Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   TR/Crypt.XPACK.Gen3 backdoor/trojan (https://www.trojaner-board.de/91146-tr-crypt-xpack-gen3-backdoor-trojan.html)

aware 26.09.2010 11:32
TR/Crypt.XPACK.Gen3 backdoor/trojan
 
Hi,

ein Freund von mir bekommt seit gestern ständig folgende Nachricht von Avira Antivir (Definitionen vom 25.9):

TR/Crypt.XPACK.Gen3 gefunden in mshtuota.dll (befindet sich in C:\Windows\).

Diese Nachricht kommt alle paar Minuten, manchmal auch gleich 20mal hintereinander.

Ich habe es zwei mal geschafft per Teamviewer remote Zugriff zu erhalten und habe ansonsten versucht es per Telefon mit ihm zu lösen. Jedoch ohne Erfolg.

Ich habe auch noch eine Malwarebytes logfile aus dem Abgesicherten Modus, wenn die weiterhilft.

Spybot S&D kann auch nicht ausgeführt werden. Wenn man es ausführen will, passiert nichts - und die Datei ist auch nicht im Taskmanager zu sehen.

Avira Antivir hat er einmal eine Systemprüfung machen lassen, und die .dll war auch in Quarantäne - sie wird aber anscheinend immer wieder neu erstellt und im normalen Modus lässt sie sich nicht löschen.

Hier ist die HijackThis Logfile (normaler modus). Ich habe sie auch nochmal angehängt.

HiJackthis Logfile:
HiJackthis Logfile:
Code:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:30:25, on 26.09.2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Programme\Antivir Avira\Avira\AntiVir Desktop\sched.exe
C:\Programme\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Programme\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\ibmtools\aptezbtn\aptezbp.exe
C:\Programme\ScanSoft\OmniPageSE\opware32.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Programme\Gemeinsame Dateien\LogiShrd\LComMgr\Communications_Helper.exe
C:\Programme\Logitech\QuickCam10\QuickCam10.exe
C:\Programme\Java\jre6\bin\jusched.exe
C:\Programme\a-squared Free\a2service.exe
C:\Programme\iTunes\iTunesHelper.exe
C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avguard.exe
C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avgnt.exe
C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programme\Gemeinsame Dateien\Nokia\MPlatform\NokiaMServer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Bonjour\mDNSResponder.exe
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Programme\Java\jre6\bin\jqs.exe
C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe
C:\Programme\RocketDock\RocketDock.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\UTSCSI.EXE
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\ibmtools\aptezbtn\rakusb.exe
C:\Programme\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe
C:\Programme\Gemeinsame Dateien\Logishrd\LQCVFX\COCIManager.exe
C:\Programme\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\System32\svchost.exe
C:\DOKUME~1\Family\LOKALE~1\Temp\TeamViewer\Version5\TeamViewer.exe
c:\dokume~1\family\lokale~1\temp\teamviewer\version5\TeamViewer_Desktop.exe
C:\Programme\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.faz.net/
O2 - BHO: Adobe PDF Reader Link Helper - {X} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {X} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {X} - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {X} - C:\Programme\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {X} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Easy-WebPrint - {X} - C:\Programme\Canon Drucker\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Adobe PDF - {X} - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [ATICCC] "C:\Programme\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [CTSysVol] C:\Programme\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AEZBProc] c:\ibmtools\aptezbtn\aptezbp.exe
O4 - HKLM\..\Run: [Omnipage] C:\Programme\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [REGSHAVE] C:\Programme\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Programme\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Programme\Gemeinsame Dateien\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Programme\Logitech\QuickCam10\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [MbWzdFPAP-EXL580] C:\WINDOWS\system32\FPAP-EXL580\PdtGuide.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime Alternative\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programme\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [NokiaMServer] C:\Programme\Gemeinsame Dateien\Nokia\MPlatform\NokiaMServer /watchfiles startup
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebyte' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [{X}] "C:\Dokumente und Einstellungen\Family\Anwendungsdaten\Haboac\ynywi.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: RocketDock.exe.lnk = C:\Programme\RocketDock\RocketDock.exe
O4 - Global Startup: Catalyst System Tray.lnk = C:\Programme\ATI Technologies\ATI.ACE\CLI.exe
O8 - Extra context menu item: Append to existing PDF - res://C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Easy-WebPrint - Drucken - res://C:\Programme\Canon Drucker\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint - Schnelldruck - res://C:\Programme\Canon Drucker\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint - Vorschau - res://C:\Programme\Canon Drucker\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint - Zu Druckliste hinzufügen - res://C:\Programme\Canon Drucker\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherchieren - {X} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {X} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {X} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {X} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {X} - C:\Programme\Messenger\msmsgs.exe
O12 - Plugin for .UVR: C:\Programme\Internet Explorer\Plugins\NPUPano.dll
O16 - DPF: {X} (CInstallLPCtrl Object) - hxxp://u3.sandisk.com/download/apps/LPInstaller.CAB
O17 - HKLM\System\CCS\Services\Tcpip\..\{X}: NameServer = 93.188.162.81,93.188.161.221
O17 - HKLM\System\CCS\Services\Tcpip\..\{X}: NameServer = 93.188.162.81,93.188.161.221
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 93.188.162.81,93.188.161.221
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 93.188.162.81,93.188.161.221
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 93.188.162.81,93.188.161.221
O18 - Protocol: skype4com - {X} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Programme\a-squared Free\a2service.exe
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Programme\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Antivir Avira\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Programme\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Programme\Gemeinsame Dateien\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: ServiceLayer - Nokia - C:\Programme\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: CLCV0 (UTSCSI) - Unknown owner - C:\WINDOWS\system32\UTSCSI.EXE

--
End of file - 11587 bytes
--- --- ---

--- --- ---




HijackThis logfile (safe mode):

HiJackthis Logfile:
Code:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:53:31, on 26.09.2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Safe mode

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: Adobe PDF Reader Link Helper - {X} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {X} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {X} - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {X} - C:\Programme\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {X} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Easy-WebPrint - {X} - C:\Programme\Canon Drucker\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Adobe PDF - {X} - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [ATICCC] "C:\Programme\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [CTSysVol] C:\Programme\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AEZBProc] c:\ibmtools\aptezbtn\aptezbp.exe
O4 - HKLM\..\Run: [Omnipage] C:\Programme\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [REGSHAVE] C:\Programme\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Programme\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Programme\Gemeinsame Dateien\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Programme\Logitech\QuickCam10\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [MbWzdFPAP-EXL580] C:\WINDOWS\system32\FPAP-EXL580\PdtGuide.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime Alternative\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programme\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [NokiaMServer] C:\Programme\Gemeinsame Dateien\Nokia\MPlatform\NokiaMServer /watchfiles startup
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Catalyst System Tray.lnk = C:\Programme\ATI Technologies\ATI.ACE\CLI.exe
O9 - Extra button: Recherchieren - {X} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {X} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {X} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {X} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {X} - C:\Programme\Messenger\msmsgs.exe
O12 - Plugin for .UVR: C:\Programme\Internet Explorer\Plugins\NPUPano.dll
O16 - DPF: {X} (CInstallLPCtrl Object) - hxxp://u3.sandisk.com/download/apps/LPInstaller.CAB
O17 - HKLM\System\CCS\Services\Tcpip\..\{X}: NameServer = 93.188.162.81,93.188.161.221
O17 - HKLM\System\CCS\Services\Tcpip\..\{X}: NameServer = 93.188.162.81,93.188.161.221
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 93.188.162.81,93.188.161.221
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 93.188.162.81,93.188.161.221
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 93.188.162.81,93.188.161.221
O18 - Protocol: skype4com - {X} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Programme\a-squared Free\a2service.exe
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Programme\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Antivir Avira\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Programme\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Programme\Gemeinsame Dateien\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: ServiceLayer - Nokia - C:\Programme\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: CLCV0 (UTSCSI) - Unknown owner - C:\WINDOWS\system32\UTSCSI.EXE

--
End of file - 7406 bytes
--- --- ---

cosinus 26.09.2010 18:35
Zitat:
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Hallo und :hallo:

Mit Updates habt Ihr es wohl nicht so? Warum fehlen zB das SP3 und der IE8? :stirn:
Poste bitte auch das Log von malwarebytes

aware 26.09.2010 19:37
Hi,

IE 6 wird nicht verwendet. Er benutzt Opera 10.x.
SP 2 - whoa, okay, das wird er wenn die Sache hier überstanden ist mal updaten :). Danke für den Hinweis.

Ich konnte jetzt via Remote Zugriff Malwarebytes ausführen (musste dafür die mbam Ausführdatei umbenennen).

Code:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4698

Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

26.09.2010 20:12:08
mbam-log-2010-09-26 (20-12-08).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|)
Durchsuchte Objekte: 265279
Laufzeit: 56 Minute(n), 29 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{cedf0066-c38d-6af7-7e21-dc8b84e4561a} (Trojan.ZbotR.Gen) -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\System Volume Information\_restore{E54C5E8B-4A92-4942-9788-26A2E6AA05E0}\RP943\A0240294.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

cosinus 26.09.2010 20:00
Der IE ist ein integraler Systembestandteil von Windows, auch bei Nichtbenutzung muss der IE immer aktuell gehalten werden!!

Systemscan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
  • Doppelklick auf die OTL.exe
  • Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
  • Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
  • Unter Extra Registry, wähle bitte Use SafeList
  • Klicke nun auf Run Scan links oben
  • Wenn der Scan beendet wurde werden 2 Logfiles erstellt
  • Poste die Logfiles hier in den Thread.

aware 26.09.2010 20:09
OTL.txt

OTL Logfile:
Code:
OTL logfile created on: 26.09.2010 20:59:13 - Run 1
OTL by OldTimer - Version 3.2.14.1    Folder = C:\Dokumente und Einstellungen\Family\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1.023,00 Mb Total Physical Memory | 263,00 Mb Available Physical Memory | 26,00% Memory free
924,00 Mb Paging File | 221,00 Mb Available in Paging File | 24,00% Paging File free
Paging file location(s):  [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 18,00 Gb Total Space | 2,01 Gb Free Space | 11,14% Space Free | Partition Type: NTFS
Drive D: | 273,24 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive E: | 131,05 Gb Total Space | 93,95 Gb Free Space | 71,69% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: PC-ONE
Current User Name: Family
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Processes (SafeList) ==========
 
PRC - C:\Dokumente und Einstellungen\Family\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Dokumente und Einstellungen\Family\Lokale Einstellungen\Temp\TeamViewer\Version5\TeamViewer.exe (TeamViewer GmbH)
PRC - c:\Dokumente und Einstellungen\Family\Lokale Einstellungen\Temp\TeamViewer\Version5\TeamViewer_Desktop.exe (TeamViewer GmbH)
PRC - C:\Programme\Gemeinsame Dateien\Nokia\MPlatform\NokiaMServer.exe (Nokia)
PRC - C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Programme\Antivir Avira\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Programme\a-squared Free\a2service.exe (Emsi Software GmbH)
PRC - C:\Programme\Lavasoft\Ad-Aware\aawservice.exe (Lavasoft)
PRC - C:\WINDOWS\system32\UTSCSI.EXE ()
PRC - C:\Programme\RocketDock\RocketDock.exe ()
PRC - C:\Programme\Logitech\QuickCam10\QuickCam10.exe ()
PRC - C:\Programme\Gemeinsame Dateien\LogiShrd\LComMgr\Communications_Helper.exe (Logitech Inc.)
PRC - C:\Programme\Gemeinsame Dateien\LogiShrd\LQCVFX\COCIManager.exe (Logitech Inc.)
PRC - C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
PRC - C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe (Logitech Inc.)
PRC - C:\Programme\ATI Technologies\ATI.ACE\CLI.exe (ATI Technologies Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Creative\SBAudigy\Surround Mixer\CTSysVol.exe (Creative Technology Ltd)
PRC - C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe (Ulead Systems, Inc.)
PRC - C:\Programme\ScanSoft\OmniPageSE\opware32.exe (ScanSoft, Inc)
PRC - C:\ibmtools\aptezbtn\aptezbp.exe (IBM Corporation)
PRC - C:\ibmtools\aptezbtn\rakusb.exe (IBM)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Dokumente und Einstellungen\Family\Desktop\OTL.exe (OldTimer Tools)
MOD - c:\Dokumente und Einstellungen\Family\Lokale Einstellungen\Temp\TeamViewer\Version5\TV.dll (TeamViewer GmbH)
MOD - C:\WINDOWS\mshtuota.dll ()
MOD - C:\Programme\RocketDock\RocketDock.dll ()
MOD - C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcInj.dll (Logitech Inc.)
MOD - C:\WINDOWS\system32\framedyn.dll (Microsoft Corporation)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2649_x-ww_aac16c8b\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)
MOD - C:\Programme\ScanSoft\OmniPageSE\ophook32.dll (ScanSoft, Inc)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (ServiceLayer) -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe (Nokia)
SRV - (AntiVirService) -- C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (Apple Mobile Device) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (AntiVirSchedulerService) -- C:\Programme\Antivir Avira\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (a2free) -- C:\Programme\a-squared Free\a2service.exe (Emsi Software GmbH)
SRV - (aawservice) -- C:\Programme\Lavasoft\Ad-Aware\aawservice.exe (Lavasoft)
SRV - (UTSCSI) -- C:\WINDOWS\system32\UTSCSI.EXE ()
SRV - (FLEXnet Licensing Service) -- C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (LVSrvLauncher) -- C:\Programme\Gemeinsame Dateien\LogiShrd\SrvLnch\SrvLnch.exe (Logitech Inc.)
SRV - (LVPrcSrv) -- C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
SRV - (LVCOMSer) -- C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe (Logitech Inc.)
SRV - (KPF4) -- C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe (Sunbelt Software)
SRV - (UleadBurningHelper) -- C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe (Ulead Systems, Inc.)
SRV - (IDriverT) -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (GMSIPCI) -- D:\INSTALL\GMSIPCI.SYS File not found
DRV - (truecrypt) -- C:\WINDOWS\system32\drivers\truecrypt.sys (TrueCrypt Foundation)
DRV - (UsbserFilt) -- C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys (Nokia)
DRV - (upperdev) -- C:\WINDOWS\system32\drivers\usbser_lowerflt.sys (Nokia)
DRV - (nmwcdc) -- C:\WINDOWS\system32\drivers\ccdcmbo.sys (Nokia)
DRV - (nmwcd) -- C:\WINDOWS\system32\drivers\ccdcmb.sys (Nokia)
DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (silabser) -- C:\WINDOWS\system32\drivers\silabser.sys (Silicon Laboratories)
DRV - (silabenm) -- C:\WINDOWS\system32\drivers\silabenm.sys (Silicon Laboratories, Inc.)
DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (WDC_SAM) -- C:\WINDOWS\system32\drivers\wdcsam.sys (Western Digital Technologies)
DRV - (avgio) -- C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (pccsmcfd) -- C:\WINDOWS\system32\drivers\pccsmcfd.sys (Nokia)
DRV - (sscdmdm) -- C:\WINDOWS\system32\drivers\sscdmdm.sys (MCCI Corporation)
DRV - (sscdmdfl) -- C:\WINDOWS\system32\drivers\sscdmdfl.sys (MCCI Corporation)
DRV - (sscdbus) SAMSUNG USB Composite Device driver (WDM) -- C:\WINDOWS\system32\drivers\sscdbus.sys (MCCI Corporation)
DRV - (AnyDVD) -- C:\WINDOWS\system32\drivers\AnyDVD.sys (SlySoft, Inc.)
DRV - (ElbyCDIO) -- C:\WINDOWS\system32\drivers\ElbyCDIO.sys (Elaborate Bytes AG)
DRV - (LVPr2Mon) -- C:\WINDOWS\system32\drivers\LVPr2Mon.sys ()
DRV - (LVMVDrv) -- C:\WINDOWS\system32\drivers\LVMVdrv.sys (Logitech Inc.)
DRV - (LVcKap) -- C:\WINDOWS\system32\drivers\Lvckap.sys ()
DRV - (MotDev) -- C:\WINDOWS\system32\drivers\motodrv.sys (Motorola Inc)
DRV - (motmodem) -- C:\WINDOWS\system32\drivers\motmodem.sys (Motorola)
DRV - (StarOpen) -- C:\WINDOWS\System32\drivers\StarOpen.sys ()
DRV - (khips) -- C:\WINDOWS\system32\drivers\khips.sys (Sunbelt Software)
DRV - (fwdrv) -- C:\WINDOWS\system32\drivers\fwdrv.sys (Sunbelt Software)
DRV - (m5288) -- C:\WINDOWS\system32\DRIVERS\m5288.sys (ULi Electronics Inc.)
DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (P17) -- C:\WINDOWS\system32\drivers\P17.sys (Creative Technology Ltd.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (ULI5261XP) -- C:\WINDOWS\system32\drivers\ULILAN51.SYS (ULi Electronics Inc.)
DRV - (AmdK8) -- C:\WINDOWS\system32\drivers\AmdK8.sys (Advanced Micro Devices)
DRV - (ossrv) -- C:\WINDOWS\system32\drivers\ctoss2k.sys (Creative Technology Ltd.)
DRV - (ctsfm2k) -- C:\WINDOWS\system32\drivers\ctsfm2k.sys (Creative Technology Ltd)
DRV - (TTLOOPHE) -- C:\WINDOWS\system32\drivers\ttloophe.sys (TechnoTrend AG)
DRV - (SAA7146n) TT DVB-PCI driver (SAA7146n) -- C:\WINDOWS\system32\drivers\saa7146n.sys (TechnoTrend AG)
DRV - (HDAudBus) -- C:\WINDOWS\system32\drivers\Hdaudbus.sys (Windows (R) Server 2003 DDK provider)
DRV - (usbaudio) USB-Audiotreiber (WDM) -- C:\WINDOWS\system32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (GVCplDrv) -- C:\WINDOWS\System32\drivers\GVCplDrv.sys ()
DRV - (AliIde) -- C:\WINDOWS\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.faz.net/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
FF - HKLM\software\mozilla\Firefox\extensions\\{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}: C:\Programme\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\ [2010.06.29 00:22:03 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}: C:\Programme\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\ [2010.06.29 00:22:04 | 000,000,000 | ---D | M]
 
[2010.09.06 13:36:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Family\Anwendungsdaten\Mozilla\Extensions
 
O1 HOSTS File: ([2010.09.26 19:13:29 | 000,396,758 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: 127.0.0.1        .supercocklol.com
O1 - Hosts: 127.0.0.1        www..webloyalty.com
O1 - Hosts: 127.0.0.1        007guard.com
O1 - Hosts: 127.0.0.1        www.007guard.com
O1 - Hosts: 127.0.0.1        008i.com
O1 - Hosts: 127.0.0.1        008k.com
O1 - Hosts: 127.0.0.1        www.008k.com
O1 - Hosts: 127.0.0.1        00hq.com
O1 - Hosts: 127.0.0.1        www.00hq.com
O1 - Hosts: 127.0.0.1        010402.com
O1 - Hosts: 127.0.0.1        032439.com
O1 - Hosts: 127.0.0.1        www.032439.com
O1 - Hosts: 127.0.0.1        www.100888290cs.com
O1 - Hosts: 127.0.0.1        100888290cs.com
O1 - Hosts: 127.0.0.1        100sexlinks.com
O1 - Hosts: 127.0.0.1        www.100sexlinks.com
O1 - Hosts: 127.0.0.1        www.10sek.com
O1 - Hosts: 127.0.0.1        10sek.com
O1 - Hosts: 127.0.0.1        123topsearch.com
O1 - Hosts: 127.0.0.1        www.123topsearch.com
O1 - Hosts: 127.0.0.1        www.132.com
O1 - Hosts: 127.0.0.1        132.com
O1 - Hosts: 127.0.0.1        136136.net
O1 - Hosts: 127.0.0.1        www.136136.net
O1 - Hosts: 13698 more lines...
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Easy-WebPrint) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programme\Canon Drucker\Easy-WebPrint\Toolband.dll ()
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\ShellBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [AEZBProc] c:\ibmtools\aptezbtn\aptezbp.exe (IBM Corporation)
O4 - HKLM..\Run: [ATICCC] C:\Programme\ATI Technologies\ATI.ACE\cli.exe (ATI Technologies Inc.)
O4 - HKLM..\Run: [avgnt] C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [CTSysVol] C:\Programme\Creative\SBAudigy\Surround Mixer\CTSysVol.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [Easy-PrintToolBox] C:\Programme\Canon\Easy-PrintToolBox\BJPSMAIN.EXE (CANON INC.)
O4 - HKLM..\Run: [LogitechCommunicationsManager] C:\Programme\Gemeinsame Dateien\LogiShrd\LComMgr\Communications_Helper.exe (Logitech Inc.)
O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Programme\Logitech\QuickCam10\QuickCam10.exe ()
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Programme\Malwarebyte' Anti-Malware\abc.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [MbWzdFPAP-EXL580] C:\WINDOWS\system32\FPAP-EXL580\PdtGuide.exe ()
O4 - HKLM..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [NokiaMServer] C:\Programme\Gemeinsame Dateien\Nokia\MPlatform\NokiaMServer.exe (Nokia)
O4 - HKLM..\Run: [Omnipage] C:\Programme\ScanSoft\OmniPageSE\opware32.exe (ScanSoft, Inc)
O4 - HKLM..\Run: [P17Helper] C:\WINDOWS\System32\P17.dll ()
O4 - HKLM..\Run: [QuickTime Task] C:\Programme\QuickTime Alternative\QTTask.exe (Apple Inc.)
O4 - HKLM..\Run: [REGSHAVE] C:\Programme\REGSHAVE\REGSHAVE.EXE (FUJI PHOTO FILM CO., LTD.)
O4 - HKCU..\Run: []  File not found
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Catalyst System Tray.lnk = C:\Programme\ATI Technologies\ATI.ACE\CLI.exe (ATI Technologies Inc.)
O4 - Startup: C:\Dokumente und Einstellungen\Family\Startmenü\Programme\Autostart\RocketDock.exe.lnk = C:\Programme\RocketDock\RocketDock.exe ()
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ClassicShell = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSaveSettings = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoThemesTab = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoViewContextMenu = 0
O8 - Extra context menu item: Append to existing PDF - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to Adobe PDF - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to existing PDF - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to Adobe PDF - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to existing PDF - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to Adobe PDF - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to existing PDF - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Easy-WebPrint - Drucken - C:\Programme\Canon Drucker\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint - Schnelldruck - C:\Programme\Canon Drucker\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint - Vorschau - C:\Programme\Canon Drucker\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint - Zu Druckliste hinzufügen - C:\Programme\Canon Drucker\Easy-WebPrint\Resource.dll ()
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O12 - Plugin for: .UVR - C:\Programme\Internet Explorer\PLUGINS\NPUPano.dll (Ulead Systems, Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {8BC53B30-32E4-4ED3-BEF9-DB761DB77453} hxxp://u3.sandisk.com/download/apps/LPInstaller.CAB (CInstallLPCtrl Object)
O16 - DPF: {CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA} hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab (Java Plug-in 1.4.2)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Family\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Family\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.08.18 00:29:25 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2007.07.30 14:05:08 | 000,000,057 | R--- | M] () - D:\autorun.bat -- [ CDFS ]
O32 - AutoRun File - [2003.02.23 00:00:00 | 000,000,045 | R--- | M] () - D:\autorun.inf -- [ CDFS ]
O32 - AutoRun File - [2004.04.30 23:00:00 | 000,000,967 | R--- | M] () - D:\autorun.pif -- [ CDFS ]
O33 - MountPoints2\{13564db2-07ae-11df-8a6b-00d05c224f6e}\Shell - "" = AutoRun
O33 - MountPoints2\{13564db2-07ae-11df-8a6b-00d05c224f6e}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{13564db2-07ae-11df-8a6b-00d05c224f6e}\Shell\AutoRun\command - "" = N:\WD SmartWare.exe -- File not found
O33 - MountPoints2\{2c6b4270-d5b4-11de-89f0-00d05c224f6e}\Shell\AutoRun\command - "" = J:\start.bat -- File not found
O33 - MountPoints2\{48e61bc8-027f-11dd-84df-00d05c224f6e}\Shell - "" = AutoRun
O33 - MountPoints2\{48e61bc8-027f-11dd-84df-00d05c224f6e}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{48e61bc8-027f-11dd-84df-00d05c224f6e}\Shell\AutoRun\command - "" = J:\PdtStart.exe -- File not found
O33 - MountPoints2\{6953400c-2042-11de-87fd-00d05c224f6e}\Shell - "" = AutoRun
O33 - MountPoints2\{6953400c-2042-11de-87fd-00d05c224f6e}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{6953400c-2042-11de-87fd-00d05c224f6e}\Shell\AutoRun\command - "" = J:\LaunchU3.exe -- File not found
O33 - MountPoints2\{6953400d-2042-11de-87fd-00d05c224f6e}\Shell\AutoRun\command - "" = K:\LaunchU3.exe -- File not found
O33 - MountPoints2\{7902d9be-37ab-11dc-8281-00d05c224f6e}\Shell\AutoRun\command - "" = J:\wd_windows_tools\setup.exe -- File not found
O33 - MountPoints2\{a4c85e91-9734-11db-811d-00d05c224f6e}\Shell\AutoRun\command - "" = J:\wd_windows_tools\setup.exe -- File not found
O33 - MountPoints2\{a9f2fc13-1654-11de-87e5-00d05c224f6e}\Shell\AutoRun\command - "" = Start.exe
O33 - MountPoints2\{ad770e30-fabc-11de-8a46-00d05c224f6e}\Shell\AutoRun\command - "" = K:\start.bat -- File not found
O33 - MountPoints2\{ad770e31-fabc-11de-8a46-00d05c224f6e}\Shell\AutoRun\command - "" = J:\start.bat -- File not found
O33 - MountPoints2\{c8420a6b-8d03-11df-8c30-00d05c224f6e}\Shell - "" = AutoRun
O33 - MountPoints2\{c8420a6b-8d03-11df-8c30-00d05c224f6e}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{c8420a6b-8d03-11df-8c30-00d05c224f6e}\Shell\AutoRun\command - "" = L:\PdtStart.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O36 - AppCertDlls: helpsass - (C:\WINDOWS\mshtuota.dll) - C:\WINDOWS\mshtuota.dll ()
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.09.26 20:57:42 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Family\Desktop\OTL.exe
[2010.09.26 19:03:46 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Family\Anwendungsdaten\Malwarebytes
[2010.09.26 11:27:53 | 000,000,000 | ---D | C] -- C:\Programme\Trend Micro
[2010.09.26 10:40:44 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010.09.26 10:40:41 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2010.09.26 10:40:38 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010.09.26 10:40:38 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebyte' Anti-Malware
[2010.09.26 10:31:37 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Family\Anwendungsdaten\TeamViewer
[2010.09.25 23:22:05 | 000,000,000 | ---D | C] -- C:\Programme\TeamViewer
[2006.08.18 12:36:24 | 000,065,536 | R--- | C] ( ) -- C:\WINDOWS\System32\A3d.dll
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2010.09.26 21:01:43 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Family\Desktop\OTL.exe
[2010.09.26 20:58:09 | 014,417,920 | ---- | M] () -- C:\Dokumente und Einstellungen\Family\NTUSER.DAT
[2010.09.26 20:12:23 | 000,054,016 | ---- | M] () -- C:\WINDOWS\System32\drivers\richmtr.sys
[2010.09.26 19:33:32 | 000,000,593 | ---- | M] () -- C:\WINDOWS\win.ini
[2010.09.26 19:33:32 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2010.09.26 19:33:32 | 000,000,211 | -HS- | M] () -- C:\boot.ini
[2010.09.26 19:13:29 | 000,396,758 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010.09.26 12:39:20 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010.09.26 12:39:10 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.09.26 11:51:06 | 000,000,330 | ---- | M] () -- C:\WINDOWS\System32\drivers\fwdrv.err
[2010.09.26 11:27:53 | 000,001,704 | ---- | M] () -- C:\Dokumente und Einstellungen\Family\Desktop\HijackThis.lnk
[2010.09.25 23:22:07 | 000,000,601 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\TeamViewer 5.lnk
[2010.09.24 14:59:25 | 000,025,713 | ---- | M] () -- C:\WINDOWS\CSTBox.INI
[2010.09.24 13:32:22 | 000,000,190 | -HS- | M] () -- C:\Dokumente und Einstellungen\Family\ntuser.ini
[2010.09.24 13:30:35 | 000,000,140 | ---- | M] () -- C:\WINDOWS\prestopm.INI
[2010.09.23 22:30:00 | 000,000,212 | ---- | M] () -- C:\WINDOWS\tasks\Backup-Anweisung.job
[2010.09.21 09:36:10 | 000,050,688 | ---- | M] () -- C:\WINDOWS\mshtuota.dll
[2010.09.10 11:52:01 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010.09.09 22:58:40 | 000,000,578 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Opera.lnk
[2010.09.07 17:16:57 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010.09.26 20:12:23 | 000,054,016 | ---- | C] () -- C:\WINDOWS\System32\drivers\richmtr.sys
[2010.09.26 11:27:53 | 000,001,704 | ---- | C] () -- C:\Dokumente und Einstellungen\Family\Desktop\HijackThis.lnk
[2010.09.25 23:22:06 | 000,000,601 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\TeamViewer 5.lnk
[2010.09.21 09:36:10 | 000,050,688 | ---- | C] () -- C:\WINDOWS\mshtuota.dll
[2009.12.31 23:49:53 | 000,000,447 | ---- | C] () -- C:\Dokumente und Einstellungen\Family\Anwendungsdaten\artresize.ini
[2009.08.19 18:12:33 | 000,000,000 | ---- | C] () -- C:\WINDOWS\pcvcdvw.INI
[2009.08.19 17:40:11 | 000,000,062 | ---- | C] () -- C:\WINDOWS\pcvcdbr.INI
[2008.07.19 16:15:36 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\LauncherAccess.dt
[2008.07.19 16:08:32 | 000,005,632 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys
[2008.07.12 17:01:18 | 000,001,359 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\QTSBandwidthCache
[2008.07.10 22:01:10 | 000,000,040 | -HS- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\.zreglib
[2008.05.07 16:15:37 | 000,000,000 | ---- | C] () -- C:\WINDOWS\iPlayer.INI
[2007.12.12 00:34:56 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2007.12.12 00:33:14 | 000,000,416 | ---- | C] () -- C:\WINDOWS\System32\dtu100.dll.manifest
[2007.12.12 00:33:14 | 000,000,416 | ---- | C] () -- C:\WINDOWS\System32\dpl100.dll.manifest
[2007.12.12 00:32:28 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\DivXWMPExtType.dll
[2007.08.29 16:16:54 | 000,001,720 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2007.05.11 17:30:16 | 000,025,888 | ---- | C] () -- C:\WINDOWS\System32\drivers\LVPr2Mon.sys
[2007.05.11 17:27:58 | 002,107,808 | ---- | C] () -- C:\WINDOWS\System32\drivers\Lvckap.sys
[2007.04.20 20:23:26 | 000,000,030 | ---- | C] () -- C:\WINDOWS\Iedit_.INI
[2006.12.30 21:34:21 | 000,000,072 | ---- | C] () -- C:\WINDOWS\Pex.INI
[2006.12.30 21:31:51 | 000,000,294 | ---- | C] () -- C:\WINDOWS\ULead32.ini
[2006.12.23 19:24:23 | 000,000,029 | ---- | C] () -- C:\WINDOWS\Battle.ini
[2006.08.25 13:10:02 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\Change.dll
[2006.08.23 22:25:04 | 000,025,713 | ---- | C] () -- C:\WINDOWS\CSTBox.INI
[2006.08.23 17:34:42 | 000,000,029 | ---- | C] () -- C:\WINDOWS\DEBUGSM.INI
[2006.08.23 15:13:59 | 000,001,267 | ---- | C] () -- C:\WINDOWS\DVB-TV.INI
[2006.08.23 11:30:51 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2006.08.23 11:30:50 | 000,089,088 | ---- | C] () -- C:\Dokumente und Einstellungen\Family\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006.08.22 22:37:31 | 000,000,036 | ---- | C] () -- C:\WINDOWS\MixBKS.INI
[2006.08.22 21:45:02 | 000,000,061 | ---- | C] () -- C:\Dokumente und Einstellungen\Family\Anwendungsdaten\sversion.ini
[2006.08.22 20:47:14 | 000,000,000 | ---- | C] () -- C:\WINDOWS\OpPrintServer.INI
[2006.08.22 20:43:29 | 000,008,704 | ---- | C] () -- C:\WINDOWS\System32\CNMVS79.DLL
[2006.08.22 20:15:04 | 000,000,140 | ---- | C] () -- C:\WINDOWS\prestopm.INI
[2006.08.22 19:53:07 | 000,011,776 | ---- | C] () -- C:\WINDOWS\System32\pmsbfn32.dll
[2006.08.22 19:52:23 | 000,000,074 | ---- | C] () -- C:\WINDOWS\PMINI.ini
[2006.08.22 19:49:38 | 000,000,509 | ---- | C] () -- C:\WINDOWS\MAXLINK.INI
[2006.08.22 18:28:08 | 000,005,632 | ---- | C] () -- C:\WINDOWS\ezbtndll.dll
[2006.08.22 18:28:08 | 000,005,120 | ---- | C] () -- C:\WINDOWS\rakdll.dll
[2006.08.18 14:56:16 | 000,000,305 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\addr_file.html
[2006.08.18 13:52:15 | 000,000,225 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2006.08.18 13:13:54 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2006.08.18 12:36:24 | 000,053,248 | R--- | C] () -- C:\WINDOWS\System32\P17CPI.dll
[2006.08.18 12:36:20 | 000,064,512 | R--- | C] () -- C:\WINDOWS\System32\P17.dll
[2006.08.18 12:16:07 | 000,000,139 | ---- | C] () -- C:\Dokumente und Einstellungen\Family\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2006.08.18 12:11:11 | 000,023,040 | R--- | C] () -- C:\WINDOWS\System32\drivers\GVCplDrv.sys
[2006.07.12 10:27:54 | 000,240,640 | ---- | C] () -- C:\WINDOWS\System32\PhotomatixLib.dll
[2006.07.12 10:03:56 | 000,107,520 | ---- | C] () -- C:\WINDOWS\System32\PhotomatixLib3.dll
[2006.05.08 12:20:08 | 000,212,992 | ---- | C] () -- C:\WINDOWS\System32\PhotomatixLib2.dll
[2006.02.05 18:23:50 | 000,205,824 | ---- | C] () -- C:\WINDOWS\System32\pmtf1.dll
[2006.02.05 16:27:16 | 000,353,280 | ---- | C] () -- C:\WINDOWS\System32\pmtf2.dll
[2005.07.13 14:09:00 | 000,216,064 | ---- | C] () -- C:\WINDOWS\System32\pmjp.dll
[2005.07.07 11:26:56 | 000,005,627 | R--- | C] () -- C:\WINDOWS\System32\Ludap17.ini
[2005.03.08 08:17:08 | 000,000,039 | R--- | C] () -- C:\WINDOWS\System32\ctzapxx.ini
[2004.12.14 14:19:34 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\pmexr.dll
[2004.08.04 00:57:22 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll
[2004.07.17 11:36:38 | 000,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys
[2004.06.04 23:22:14 | 000,782,336 | ---- | C] () -- C:\WINDOWS\System32\IlmImf.dll
[2003.11.26 12:47:24 | 000,011,776 | ---- | C] () -- C:\WINDOWS\System32\pmbm.dll
< End of report >
--- --- ---



Extras.txt

OTL Logfile:
Code:
OTL Extras logfile created on: 26.09.2010 20:59:13 - Run 1
OTL by OldTimer - Version 3.2.14.1    Folder = C:\Dokumente und Einstellungen\Family\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1.023,00 Mb Total Physical Memory | 263,00 Mb Available Physical Memory | 26,00% Memory free
924,00 Mb Paging File | 221,00 Mb Available in Paging File | 24,00% Paging File free
Paging file location(s):  [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 18,00 Gb Total Space | 2,01 Gb Free Space | 11,14% Space Free | Partition Type: NTFS
Drive D: | 273,24 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive E: | 131,05 Gb Total Space | 93,95 Gb Free Space | 71,69% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: PC-ONE
Current User Name: Family
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html [@ = Opera.HTML] -- C:\Programme\Opera\Opera.exe (Opera Software)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Programme\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Programme\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation)
http [open] -- "C:\Programme\Opera\Opera.exe" (Opera Software)
https [open] -- "C:\Programme\Opera\Opera.exe" (Opera Software)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Programme\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [bcdmcatalog] -- "C:\Programme\Broken_C_D_Manager3.94\Disk Manager.exe" /Catalog "%1" (Broken X Software)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Programme\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Programme\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Programme\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Programme\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{025C3792-E9C6-432A-92C1-661F99D021CA}" = Ulead Photo Explorer 8.6
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{089DD780-DB3F-4CDB-A0C2-111360247298}" = PC Connectivity Solution
"{11AFE21E-B193-430D-B57A-DFF7815BB962}" = Ulead PhotoImpact 12
"{1373559F-6DC6-44EA-9079-6ABDCCE8CDAD}" = OviMPlatform
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{18E65799-76BD-46EF-9E53-972FE5A40736}" = Opera 10.62
"{1B1DDAD2-C704-49F8-8FC2-18DAAD9A87C5}" = Sound Blaster Audigy
"{1B9B5B3B-28E7-4E59-A80D-D670AA984514}" = Nokia Connectivity Cable Driver
"{257D6C9F-BD8E-4739-9D03-FED55793C774}_is1" = floAt's Mobile Agent
"{26A24AE4-039D-4CA4-87B4-2F83216014FF}" = Java(TM) 6 Update 14
"{2D10FC46-1D96-44C4-8855-85F21B9B011E}" = Ovi Desktop Sync Engine
"{2E0C1913-886B-4C5C-8DAF-D1E649CE5FCC}" = Creative MediaSource
"{310E741A-84DC-11D5-AAB1-00D0B740908B}" = IBM Rapid Access Keyboard
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java(TM) 6 Update 3
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3CEA4CA8-CDD4-451C-B673-E8F17BE01B15}" = Ulead COOL 360 1.0
"{3DC5CD53-8BEE-4FD7-900E-3A5F02964251}" = WinTV Nexus
"{3EA9D975-BFDC-4E8E-B88B-0446FBC8CA66}" = ATI HydraVision
"{4A314589-8F9F-47F3-B0E5-DB1C6A8F7D2C}" = Motorola Software Update
"{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E}" = SmartSound Quicktracks Plugin
"{5490882C-6961-11D5-BAE5-00E0188E010B}" = FUJIFILM USB Driver
"{5BE42A03-E7B8-42A9-B1BB-FC48B03D58B8}" = Presto! PageManager 6.03
"{5D601655-6D54-4384-B52C-17EC5385FBBD}" = iTunes
"{6249C22D-E6A8-407B-BA8B-40298848ED94}" = OmniPage SE
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{7148F0A8-6813-11D6-A77B-00B0D0142000}" = Java 2 Runtime Environment, SE v1.4.2
"{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}" = Avanquest update
"{7AC15160-A49B-4A89-B181-D4619C025FFF}" = Samsung Samples Installer
"{7B01FD07-1790-4EE9-B5E0-149527D70C7D}" = Nokia Ovi Suite
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{8355F970-601D-442D-A79B-1D7DB4F24CAD}" = Apple Mobile Device Support
"{88F92798-59AB-474F-B40D-1EC5F782F7EE}" = Ulead VideoStudio 9.0
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8F23E496-B0E0-4DB4-B1E1-5EABF844D747}" = Silicon Laboratories CP210x VCP Drivers for Windows 2000/XP/2003 Server/Vista
"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90120000-00A4-0407-0000-0000000FF1CE}" = Microsoft Office 2003 Web Components
"{90260407-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Web Components
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9F28D8E9-9E73-49E5-88B2-988D807E7F2D}" = Manual CanoScan LiDE 80
"{A0D65C73-F2C5-432F-8788-90F8A2E99B98}" = Nokia Ovi Suite Software Updater
"{A43BF6A5-D5F0-4AAA-BF41-65995063EC44}" = MSXML 6.0 Parser
"{AC76BA86-1029-0000-7760-000000000003}" = Adobe Acrobat 8 Professional - Czech, Greek, Hungarian, Polish, Slovak
"{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B210F97A-B06D-4483-B24F-C927D4818A32}" = Samsung PC Studio 3
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{BA1BE991-D723-41BE-AD16-42EAFDA794EA}" = Ulead COOL 3D 3.5
"{BAD8CA9C-77C0-4663-B00B-A8D3B13C341B}" = Motorola Phone Tools
"{BBBC2B89-E193-4348-A83C-C8DD8210A4AC}" = Canon PhotoRecord
"{BCE46757-7674-4416-BEDB-68205A60409E}" = Canon CanoScan Toolbox 4.1
"{C4A4722E-79F9-417C-BD72-8D359A090C97}" = Samsung PC Studio 3
"{C78EAC6F-7A73-452E-8134-DBB2165C5A68}" = QuickTime
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{D050D7362D214723AD585B541FFB6C11}" = DivX Content Uploader
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D52A217A-835C-465E-B068-8B01CB12D2C5}" = ATI Catalyst Control Center
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9-Reihe
"{E659E0EE-10E6-49B7-8696-60F38D0EB174}" = Sunbelt Kerio Personal Firewall
"{EBA29752-DDD2-4B62-B2E3-9841F92A3E3A}" = Samsung PC Studio 3 USB Driver Installer
"{EFA2BBEB-CF93-493B-904B-1B970B8DFAB6}" = Logitech QuickCam
"{F00B1410-E832-4B0C-85E2-6E0F010C2A87}" = InterVideo FilterSDK for Techno Trend
"{F0312AC6-988B-11DA-9C49-000476F770CC}" = CIB pdf brewer 2.5.26
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F850707C-B6A0-4B56-8709-F89CF8F9AC6D}" = Eraser
"{FDC53DC6-137A-4541-BFA2-A9BAE4A7FE99}" = ULi Chipset Driver
"504244733D18C8F63FF584AEB290E3904E791693" = Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0)
"6194C28A8F62DD817EA1B918E6E46E806A21B452" = Windows-Treiberpaket - MobileTop (sshpmdm) Modem  (02/23/2007 2.5.0.0)
"65B6FE5418CE28F4D72543FB2D964C3CEC83F161" = Windows-Treiberpaket - MobileTop (sshpusb) USB  (02/23/2007 2.5.0.0)
"Adobe Acrobat 8 Professional - Czech, Greek, Hungarian, Polish, Slovak" = Adobe Acrobat 8 Professional - Czech, Greek, Hungarian, Polish, Slovak
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"All ATI Software" = ATI - Dienstprogramm zur Deinstallation der Software
"AnyDVD" = AnyDVD
"a-squared Free_is1" = a-squared Free 4.0
"ATI Display Driver" = ATI Display Driver
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Broken Cross Disk Manager_is1" = Broken Cross Disk Manager - Professional Version 3.94 (MBCS)
"CANONBJ_Deinstall_CNMCP79.DLL" = Canon iP5200
"Citrix Web Client" = Citrix Web Client
"DVD Decrypter" = DVD Decrypter (Remove Only)
"Easy-PhotoPrint" = Canon Utilities Easy-PhotoPrint
"Easy-PrintToolBox" = Canon Utilities Easy-PrintToolBox
"Easy-WebPrint" = Easy-WebPrint
"Free YouTube to iPod Converter_is1" = Free YouTube to iPod Converter version 3.1
"Gold Wave Editor_is1" = Gold Wave Editor v9.1
"GoldWave v5.18" = GoldWave v5.18
"HijackThis" = HijackThis 2.0.2
"IcoFX_is1" = IcoFX 1.6.4
"Icon Extractor" = Icon Extractor
"InstallShield_{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E}" = SmartSound Quicktracks Plugin
"IrfanView" = IrfanView (remove only)
"IsoBuster_is1" = IsoBuster 2.7
"Language pack for Ad-Aware SE" = Language pack for Ad-Aware SE
"MahJong Suite Graphics Pack Volume 1_is1" = MahJong Suite Graphics Pack Volume 1 - v1.8
"MahJong Suite Graphics Pack Volume 2_is1" = MahJong Suite Graphics Pack Volume 2 - v2.9
"MahJong Suite_is1" = MahJong Suite 2009 v6.1
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"MediaNavigation.CDLabelPrint" = CD-LabelPrint
"NeroMultiInstaller!UninstallKey" = Nero Suite
"Nokia Ovi Suite" = Nokia Ovi Suite
"Photomatix Pro_is1" = Photomatix Pro Version 2.2.4
"POIbase_is1" = POIbase 1.002
"Portable Backup_is1" = Portable Backup 1.0.0.2
"QcDrv" = Logitech® Camera-Treiber
"QuicktimeAlt_is1" = QuickTime Alternative 1.74
"RealPlayer 6.0" = RealPlayer
"SAMSUNG Mobile Composite Device" = SAMSUNG Mobile Composite Device Software
"SAMSUNG Mobile Modem" = SAMSUNG Mobile Modem Driver Set
"Samsung Mobile phone USB driver" = Samsung Mobile phone USB driver Software
"SAMSUNG Mobile USB Modem" = SAMSUNG Mobile USB Modem Software
"SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software
"SLABCOMM&10C4&EA60" = Silicon Laboratories CP210x USB to UART Bridge (Driver Removal)
"Spybot - Search & Destroy_is1" = Spybot - Search & Destroy 1.5.2.20
"TeamViewer 5" = TeamViewer 5
"TrueCrypt" = TrueCrypt
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VLC media player 0.9.9
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"Wdf01009" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
"Winamp" = Winamp (remove only)
"Windows Media Encoder 9" = Windows Media Encoder 9-Reihe
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 10
"WinRAR archiver" = WinRAR Archivierer
"WMFDist11" = Windows Media Format 11 runtime
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"xp-AntiSpy" = xp-AntiSpy 3.96-2
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Eraser" = Eraser
"StarOffice 7" = StarOffice 7
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 22.09.2010 16:30:27 | Computer Name = PC-ONE | Source = ESENT | ID = 490
Description = svchost (1368) Versuch, Datei "C:\WINDOWS\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb"
 für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der
 Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet
 wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
 
Error - 22.09.2010 16:30:30 | Computer Name = PC-ONE | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
 von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
 ist fehlgeschlagen mit dem Fehler: Die Serververbindung konnte nicht hergestellt
 werden.  .
 
Error - 22.09.2010 16:33:30 | Computer Name = PC-ONE | Source = PerfNet | ID = 2004
Description = Der Serverdienst konnte nicht geöffnet werden. Die Server-Leistungsinformationen
werden
 nicht zurückgegeben. Der zurückgegebene Fehlercode befindet sich in DWORD 0.
 
Error - 22.09.2010 16:34:15 | Computer Name = PC-ONE | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
 von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
 ist fehlgeschlagen mit dem Fehler: Dieser Vorgang wurde wegen Zeitüberschreitung
 zurückgegeben.  .
 
Error - 22.09.2010 17:44:17 | Computer Name = PC-ONE | Source = PerfNet | ID = 2004
Description = Der Serverdienst konnte nicht geöffnet werden. Die Server-Leistungsinformationen
werden
 nicht zurückgegeben. Der zurückgegebene Fehlercode befindet sich in DWORD 0.
 
Error - 22.09.2010 17:44:56 | Computer Name = PC-ONE | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
 von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
 ist fehlgeschlagen mit dem Fehler: Die Serververbindung konnte nicht hergestellt
 werden.  .
 
Error - 23.09.2010 15:53:44 | Computer Name = PC-ONE | Source = PerfNet | ID = 2004
Description = Der Serverdienst konnte nicht geöffnet werden. Die Server-Leistungsinformationen
werden
 nicht zurückgegeben. Der zurückgegebene Fehlercode befindet sich in DWORD 0.
 
Error - 23.09.2010 15:54:20 | Computer Name = PC-ONE | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
 von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
 ist fehlgeschlagen mit dem Fehler: Die Serververbindung konnte nicht hergestellt
 werden.  .
 
Error - 24.09.2010 07:04:09 | Computer Name = PC-ONE | Source = PerfNet | ID = 2004
Description = Der Serverdienst konnte nicht geöffnet werden. Die Server-Leistungsinformationen
werden
 nicht zurückgegeben. Der zurückgegebene Fehlercode befindet sich in DWORD 0.
 
Error - 24.09.2010 07:04:42 | Computer Name = PC-ONE | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
 von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
 ist fehlgeschlagen mit dem Fehler: Die Serververbindung konnte nicht hergestellt
 werden.  .
 
[ System Events ]
Error - 26.09.2010 05:52:56 | Computer Name = PC-ONE | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  AFD  AmdK8  avgio  avipbb  ElbyCDIO  Fips  IPSec  khips  MRxSmb  NetBIOS  NetBT  RasAcd  Rdbss  ssmdrv  StarOpen
Tcpip
truecrypt
 
Error - 26.09.2010 05:54:49 | Computer Name = PC-ONE | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "StiSvc"
 mit den Argumenten ""  gestartet wurde, um den folgenden Server zu verwenden:  {A1F4E726-8CF1-11D1-BF92-0060081ED811}
 
Error - 26.09.2010 06:36:58 | Computer Name = PC-ONE | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "StiSvc"
 mit den Argumenten ""  gestartet wurde, um den folgenden Server zu verwenden:  {A1F4E726-8CF1-11D1-BF92-0060081ED811}
 
Error - 26.09.2010 06:38:16 | Computer Name = PC-ONE | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "EventSystem"
 mit den Argumenten ""  gestartet wurde, um den folgenden Server zu verwenden:  {1BE1F766-5536-11D1-B726-00C04FB926AF}
 
Error - 26.09.2010 06:39:41 | Computer Name = PC-ONE | Source = ACPI | ID = 327685
Description = AMLI: ACPI-BIOS versucht, in eine ungültige E/A-Portadresse (0x81)
 zu schreiben, die sich in "0x81 - 0x83", einem  geschützten Adressbereich befindet.
 Dies kann zu Systeminstabilität führen. Wenden Sie sich an den Systemhersteller,
um
 technische Unterstützung zu erhalten.
 
Error - 26.09.2010 06:40:41 | Computer Name = PC-ONE | Source = Service Control Manager | ID = 7011
Description = Zeitüberschreitung (30000 ms) beim Warten auf eine Transaktionsrückmeldung
 von Dienst stisvc.
 
Error - 26.09.2010 06:40:52 | Computer Name = PC-ONE | Source = Service Control Manager | ID = 7011
Description = Zeitüberschreitung (30000 ms) beim Warten auf eine Transaktionsrückmeldung
 von Dienst stisvc.
 
Error - 26.09.2010 06:40:52 | Computer Name = PC-ONE | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  PCIIde
 
Error - 26.09.2010 06:41:22 | Computer Name = PC-ONE | Source = Service Control Manager | ID = 7011
Description = Zeitüberschreitung (30000 ms) beim Warten auf eine Transaktionsrückmeldung
 von Dienst stisvc.
 
Error - 26.09.2010 06:45:52 | Computer Name = PC-ONE | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Computerbrowser" wurde mit folgendem Fehler beendet:  %%1460
 
 
< End of report >
--- --- ---

[/code]

cosinus 27.09.2010 09:15
Beende alle Programme, starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)


Code:
:OTL
MOD - C:\WINDOWS\mshtuota.dll ()
DRV - (GMSIPCI) -- D:\INSTALL\GMSIPCI.SYS File not found
O4 - HKLM..\Run: [MbWzdFPAP-EXL580] C:\WINDOWS\system32\FPAP-EXL580\PdtGuide.exe ()
O4 - HKCU..\Run: []  File not found
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O32 - AutoRun File - [2007.07.30 14:05:08 | 000,000,057 | R--- | M] () - D:\autorun.bat -- [ CDFS ]
O32 - AutoRun File - [2003.02.23 00:00:00 | 000,000,045 | R--- | M] () - D:\autorun.inf -- [ CDFS ]
O32 - AutoRun File - [2004.04.30 23:00:00 | 000,000,967 | R--- | M] () - D:\autorun.pif -- [ CDFS ]
O33 - MountPoints2\{13564db2-07ae-11df-8a6b-00d05c224f6e}\Shell - "" = AutoRun
O33 - MountPoints2\{13564db2-07ae-11df-8a6b-00d05c224f6e}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{13564db2-07ae-11df-8a6b-00d05c224f6e}\Shell\AutoRun\command - "" = N:\WD SmartWare.exe -- File not found
O33 - MountPoints2\{2c6b4270-d5b4-11de-89f0-00d05c224f6e}\Shell\AutoRun\command - "" = J:\start.bat -- File not found
O33 - MountPoints2\{48e61bc8-027f-11dd-84df-00d05c224f6e}\Shell - "" = AutoRun
O33 - MountPoints2\{48e61bc8-027f-11dd-84df-00d05c224f6e}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{48e61bc8-027f-11dd-84df-00d05c224f6e}\Shell\AutoRun\command - "" = J:\PdtStart.exe -- File not found
O33 - MountPoints2\{6953400c-2042-11de-87fd-00d05c224f6e}\Shell - "" = AutoRun
O33 - MountPoints2\{6953400c-2042-11de-87fd-00d05c224f6e}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{6953400c-2042-11de-87fd-00d05c224f6e}\Shell\AutoRun\command - "" = J:\LaunchU3.exe -- File not found
O33 - MountPoints2\{6953400d-2042-11de-87fd-00d05c224f6e}\Shell\AutoRun\command - "" = K:\LaunchU3.exe -- File not found
O33 - MountPoints2\{7902d9be-37ab-11dc-8281-00d05c224f6e}\Shell\AutoRun\command - "" = J:\wd_windows_tools\setup.exe -- File not found
O33 - MountPoints2\{a4c85e91-9734-11db-811d-00d05c224f6e}\Shell\AutoRun\command - "" = J:\wd_windows_tools\setup.exe -- File not found
O33 - MountPoints2\{a9f2fc13-1654-11de-87e5-00d05c224f6e}\Shell\AutoRun\command - "" = Start.exe
O33 - MountPoints2\{ad770e30-fabc-11de-8a46-00d05c224f6e}\Shell\AutoRun\command - "" = K:\start.bat -- File not found
O33 - MountPoints2\{ad770e31-fabc-11de-8a46-00d05c224f6e}\Shell\AutoRun\command - "" = J:\start.bat -- File not found
O33 - MountPoints2\{c8420a6b-8d03-11df-8c30-00d05c224f6e}\Shell - "" = AutoRun
O33 - MountPoints2\{c8420a6b-8d03-11df-8c30-00d05c224f6e}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{c8420a6b-8d03-11df-8c30-00d05c224f6e}\Shell\AutoRun\command - "" = L:\PdtStart.exe -- File not found
O36 - AppCertDlls: helpsass - (C:\WINDOWS\mshtuota.dll) - C:\WINDOWS\mshtuota.dll ()
[2010.09.26 20:12:23 | 000,054,016 | ---- | M] () -- C:\WINDOWS\System32\drivers\richmtr.sys
[2010.09.26 11:51:06 | 000,000,330 | ---- | M] () -- C:\WINDOWS\System32\drivers\fwdrv.err
[2009.08.19 18:12:33 | 000,000,000 | ---- | C] () -- C:\WINDOWS\pcvcdvw.INI
[2009.08.19 17:40:11 | 000,000,062 | ---- | C] () -- C:\WINDOWS\pcvcdbr.INI
:Commands
[purity]
[resethosts]
[emptytemp]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

aware 27.09.2010 18:49
Ich habe vergessen den RocketDock (Leiste oben am Bildschirm für Programme) zu beenden und habe dann auf FIX geklickt.

Ich hatte die Leiste nicht gesehen - da ich über Remote (via Teamviewer) zugreife.

Wie lange kann es denn dauern bis der FIX fertig ist? Am Rechner hat sich seit 30 min. nichts getan.

Soll ich danach alle programme beenden und nochmal den Text den du gepostet hast reinkopieren?

aware 27.09.2010 19:36
Ich habe alles beendet, außer TeamViewer. Bei Avira Antivir konnte ich nur den Guard ausschalten, aber nicht das Programm beenden.

Hier ist der Log:


Code:
All processes killed
========== OTL ==========
Error: No service named GMSIPCI was found to stop!
Service\Driver key GMSIPCI not found.
File  D:\INSTALL\GMSIPCI.SYS File not found not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\MbWzdFPAP-EXL580 deleted successfully.
C:\WINDOWS\system32\FPAP-EXL580\PdtGuide.exe moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\SpybotSD TeaTimer deleted successfully.
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe moved successfully.
File move failed. D:\autorun.bat scheduled to be moved on reboot.
File move failed. D:\autorun.inf scheduled to be moved on reboot.
File move failed. D:\autorun.pif scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{13564db2-07ae-11df-8a6b-00d05c224f6e}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{13564db2-07ae-11df-8a6b-00d05c224f6e}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{13564db2-07ae-11df-8a6b-00d05c224f6e}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{13564db2-07ae-11df-8a6b-00d05c224f6e}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{13564db2-07ae-11df-8a6b-00d05c224f6e}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{13564db2-07ae-11df-8a6b-00d05c224f6e}\ not found.
File N:\WD SmartWare.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2c6b4270-d5b4-11de-89f0-00d05c224f6e}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2c6b4270-d5b4-11de-89f0-00d05c224f6e}\ not found.
File J:\start.bat not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{48e61bc8-027f-11dd-84df-00d05c224f6e}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{48e61bc8-027f-11dd-84df-00d05c224f6e}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{48e61bc8-027f-11dd-84df-00d05c224f6e}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{48e61bc8-027f-11dd-84df-00d05c224f6e}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{48e61bc8-027f-11dd-84df-00d05c224f6e}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{48e61bc8-027f-11dd-84df-00d05c224f6e}\ not found.
File J:\PdtStart.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6953400c-2042-11de-87fd-00d05c224f6e}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6953400c-2042-11de-87fd-00d05c224f6e}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6953400c-2042-11de-87fd-00d05c224f6e}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6953400c-2042-11de-87fd-00d05c224f6e}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6953400c-2042-11de-87fd-00d05c224f6e}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6953400c-2042-11de-87fd-00d05c224f6e}\ not found.
File J:\LaunchU3.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6953400d-2042-11de-87fd-00d05c224f6e}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6953400d-2042-11de-87fd-00d05c224f6e}\ not found.
File K:\LaunchU3.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7902d9be-37ab-11dc-8281-00d05c224f6e}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7902d9be-37ab-11dc-8281-00d05c224f6e}\ not found.
File J:\wd_windows_tools\setup.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a4c85e91-9734-11db-811d-00d05c224f6e}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a4c85e91-9734-11db-811d-00d05c224f6e}\ not found.
File J:\wd_windows_tools\setup.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a9f2fc13-1654-11de-87e5-00d05c224f6e}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a9f2fc13-1654-11de-87e5-00d05c224f6e}\ not found.
File Start.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ad770e30-fabc-11de-8a46-00d05c224f6e}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ad770e30-fabc-11de-8a46-00d05c224f6e}\ not found.
File K:\start.bat not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ad770e31-fabc-11de-8a46-00d05c224f6e}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ad770e31-fabc-11de-8a46-00d05c224f6e}\ not found.
File J:\start.bat not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c8420a6b-8d03-11df-8c30-00d05c224f6e}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c8420a6b-8d03-11df-8c30-00d05c224f6e}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c8420a6b-8d03-11df-8c30-00d05c224f6e}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c8420a6b-8d03-11df-8c30-00d05c224f6e}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c8420a6b-8d03-11df-8c30-00d05c224f6e}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c8420a6b-8d03-11df-8c30-00d05c224f6e}\ not found.
File L:\PdtStart.exe not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\\helpsass:C:\WINDOWS\mshtuota.dll deleted successfully.
C:\WINDOWS\mshtuota.dll moved successfully.
File C:\WINDOWS\System32\drivers\richmtr.sys not found.
C:\WINDOWS\system32\drivers\fwdrv.err moved successfully.
C:\WINDOWS\pcvcdvw.INI moved successfully.
C:\WINDOWS\pcvcdbr.INI moved successfully.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
[EMPTYTEMP]
 
User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
 
User: All Users
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Family
->Temp folder emptied: 49543993 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 62526153 bytes
->Opera cache emptied: 146921 bytes
->Flash cache emptied: 1561812 bytes
 
User: LocalService
->Temp folder emptied: 65984 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 405 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 364373 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 148860 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 109,00 mb
 
 
OTL by OldTimer - Version 3.2.14.1 log created on 09272010_202550

Files\Folders moved on Reboot...
File move failed. D:\autorun.bat scheduled to be moved on reboot.
File move failed. D:\autorun.inf scheduled to be moved on reboot.
File move failed. D:\autorun.pif scheduled to be moved on reboot.
C:\Dokumente und Einstellungen\Family\Lokale Einstellungen\Temp\TeamViewer\Version5\TV.dll moved successfully.
File move failed. C:\WINDOWS\SD676E5A3.tmp scheduled to be moved on reboot.

Registry entries deleted on Reboot...

cosinus 27.09.2010 22:41
Bitte folgendes machen, ich brauch den Quarantäneordner von OTL:

1.) GANZ WICHTIG!! Virenscanner deaktivieren, der darf da nicht rummurksen!
2.) Ordner C:\_OTL in eine Datei zippen
3.) Die erstellte ZIP-Datei hier hochladen => http://www.trojaner-board.de/54791-a...ner-board.html
4.) Wenns erfolgreich war Bescheid sagen
5.) Erst dann wieder den Virenscanner einschalten

aware 27.09.2010 23:34
Mein Kumpel schläft schon, kann also nicht auf seinen PC zugreifen.

Er hatte ihn nach dem Oltimer scan heruntergefahren und nicht wieder angefasst.

Morgen früh werde ich wieder draufzugreifen, aber Avira Antivir ist ja beim Systemstart an. Ich sage ihm er soll es sofort ausschalten wenn er hochgefahren ist.

Schon jetzt mal vielen Dank :).

aware 28.09.2010 14:29
Ich habe den Avira Guard ausgeschaltet (es kam auch keine Meldung) und den _OTL Ordner gezippt und hochgeladen.

cosinus 28.09.2010 15:12
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.
http://saved.im/mtm0nzyzmzd5/cofi.jpg
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

aware 28.09.2010 15:42
Ich bin jetzt dabei combofix auszuführen, und obwohl Avira Antivir Guard deaktiviert wurde, sagt comboxfix, dass es der real time scanner noch aktiv wäre.

Über den Task manager kann ich Avira Antivir nicht beenden.

Soll ich combofix dennoch weiter ausführen (ich kann eh nur OK klicken in der Dialogbox von Combofix :D)?

aware 28.09.2010 16:12
Ich habe via Remotezugriff Teamviewer ausgeführt (wurde dann rausgeschmissen aus der Session und habe den Rest per Telefon gemacht).

Combofix hat die Wiederherstellungskonsole installiert und hatte ein Rootkit gefunden. Der Rechner mußte neugestartet werden (von Combofix), wurde neugestartet.

Nach dem Neustart war keine Taskleiste zu sehen und Avira Antivir Guard kam mit einer Nachricht: Rootkit ... Gen 3... gefunden.

Das Rootkit wurde "gelöscht" von Avira Antivir.

aware 28.09.2010 16:23
Combofix Log:

Combofix Logfile:
Code:
ComboFix 10-09-27.05 - Family 28.09.2010  17:01:01.1.1 - x86
Microsoft Windows XP Professional  5.1.2600.2.1252.49.1031.18.1023.599 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\Family\Desktop\cofi.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {00000000-0000-0000-0000-000000000000}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {804FD0EC-FFA4-00DB-0D24-347CA8A3377C}
FW: Sunbelt Kerio Personal Firewall *disabled* {E659E0EE-10E6-49B7-8696-60F38D0EB174}
.

((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\settings.reg
c:\windows\system32\Data
c:\windows\system32\spool\prtprocs\w32x86\CNMPP79.DLL

Infizierte Kopie von c:\windows\system32\drivers\netbt.sys wurde gefunden und desinfiziert
Kopie von - Kitty had a snack :p wurde wiederhergestellt
.
(((((((((((((((((((((((  Dateien erstellt von 2010-08-28 bis 2010-09-28  ))))))))))))))))))))))))))))))
.

2010-09-28 14:27 . 2010-09-28 14:27        --------        d-----w-        c:\windows\system32\LogFiles
2010-09-28 14:19 . 2010-09-28 14:19        --------        d-----w-        c:\programme\CCleaner
2010-09-28 13:19 . 2010-09-28 13:20        1604575        ----a-w-        C:\_OTL.zip
2010-09-27 17:14 . 2010-09-27 17:14        --------        d-----w-        C:\_OTL
2010-09-26 17:03 . 2010-09-26 17:03        --------        d-----w-        c:\dokumente und einstellungen\Family\Anwendungsdaten\Malwarebytes
2010-09-26 09:56 . 2010-09-26 09:56        --------        d-----w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Malwarebytes
2010-09-26 09:27 . 2010-09-26 09:27        --------        d-----w-        c:\programme\Trend Micro
2010-09-26 08:40 . 2010-04-29 13:39        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-26 08:40 . 2010-09-26 08:40        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2010-09-26 08:40 . 2010-09-26 17:03        --------        d-----w-        c:\programme\Malwarebyte' Anti-Malware
2010-09-26 08:40 . 2010-04-29 13:39        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys
2010-09-26 08:31 . 2010-09-26 08:31        --------        d-----w-        c:\dokumente und einstellungen\Family\Anwendungsdaten\TeamViewer
2010-09-25 21:22 . 2010-09-25 21:22        --------        d-----w-        c:\programme\TeamViewer

.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-28 14:23 . 2006-08-18 11:45        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
2010-09-28 14:22 . 2006-08-18 12:10        --------        d-----w-        c:\programme\Winamp
2010-09-27 18:34 . 2008-07-10 19:59        0        --sh--w-        c:\windows\SD676E5A3.tmp
2010-09-27 18:25 . 2006-08-18 11:45        --------        d-----w-        c:\programme\Spybot - Search & Destroy
2010-09-25 21:49 . 2007-07-10 21:35        --------        d-----w-        c:\dokumente und einstellungen\Family\Anwendungsdaten\Skype
2010-09-25 16:49 . 2008-08-17 18:11        --------        d-----w-        c:\dokumente und einstellungen\Family\Anwendungsdaten\skypePM
2010-09-24 12:59 . 2010-04-29 21:02        --------        d-----w-        c:\dokumente und einstellungen\Family\Anwendungsdaten\Canon
2010-09-22 16:32 . 2010-01-08 17:29        --------        d-----w-        c:\programme\RocketDock
2010-09-09 20:58 . 2010-05-24 15:43        --------        d-----w-        c:\programme\Opera
2010-07-04 15:31 . 2010-07-04 15:31        223440        ----a-w-        c:\windows\system32\drivers\truecrypt.sys
2003-01-13 09:59 . 2006-12-30 19:25        278528        ------w-        c:\programme\internet explorer\plugins\PanoViewer.dll
1999-04-30 15:00 . 2006-12-30 19:25        98304        ------w-        c:\programme\internet explorer\plugins\UPjpeg.dll
.

------- Sigcheck -------

[-] 2004-08-03 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\system32\drivers\atapi.sys

[-] 2004-08-03 . 02000ABF34AF4C218C35D257024807D6 . 14336 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\asyncmac.sys
[-] 2004-08-03 . 02000ABF34AF4C218C35D257024807D6 . 14336 . . [5.1.2600.2180] . . c:\windows\system32\drivers\asyncmac.sys

[-] 2001-08-18 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\windows\system32\dllcache\beep.sys
[-] 2001-08-18 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\windows\system32\drivers\beep.sys

[-] 2004-08-03 . B128FC0A5CD83F669D5DE4B58F77C7D6 . 25216 . . [5.1.2600.2180] . . c:\windows\system32\drivers\kbdclass.sys

[-] 2004-08-03 . 558635D3AF1C7546D26067D5D9B6959E . 182912 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ndis.sys
[-] 2004-08-03 . 558635D3AF1C7546D26067D5D9B6959E . 182912 . . [5.1.2600.2180] . . c:\windows\system32\drivers\ndis.sys

[-] 2004-08-03 . B78BE402C3F63DD55521F73876951CDD . 574592 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ntfs.sys
[-] 2004-08-03 . B78BE402C3F63DD55521F73876951CDD . 574592 . . [5.1.2600.2180] . . c:\windows\system32\drivers\ntfs.sys

[-] 2001-08-18 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\windows\system32\dllcache\null.sys
[-] 2001-08-18 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\windows\system32\drivers\null.sys

[-] 2005-05-25 . 63FDFEA54EB53DE2D863EE454937CE1E . 359936 . . [5.1.2600.2685] . . c:\windows\system32\dllcache\tcpip.sys
[-] 2005-05-25 . 63FDFEA54EB53DE2D863EE454937CE1E . 359936 . . [5.1.2600.2685] . . c:\windows\system32\drivers\tcpip.sys

[-] 2004-08-03 . D8653DCD80CF2EBB333FC4FCC43A7DEF . 77312 . . [5.1.2600.2180] . . c:\windows\system32\browser.dll
[-] 2004-08-03 . D8653DCD80CF2EBB333FC4FCC43A7DEF . 77312 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\browser.dll

[-] 2004-08-03 . 183805EB05BCA5A1E4AAAED4D2BE3690 . 13312 . . [5.1.2600.2180] . . c:\windows\system32\lsass.exe
[-] 2004-08-03 . 183805EB05BCA5A1E4AAAED4D2BE3690 . 13312 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\lsass.exe

[-] 2005-08-22 . 1E5218FBE323C375B488318950E10FB4 . 197632 . . [5.1.2600.2743] . . c:\windows\system32\netman.dll
[-] 2005-08-22 . 1E5218FBE323C375B488318950E10FB4 . 197632 . . [5.1.2600.2743] . . c:\windows\system32\dllcache\netman.dll
[-] 2005-08-22 . 19D9B6B139F09A72AE71758BDF28308E . 197632 . . [5.1.2600.2743] . . c:\windows\$hf_mig$\KB905414\SP2QFE\netman.dll

[-] 2004-08-03 . 3A5E54A9AB96EF2D273B58136FB58EFE . 382464 . . [6.6.2600.2180] . . c:\windows\system32\qmgr.dll
[-] 2004-08-03 . 3A5E54A9AB96EF2D273B58136FB58EFE . 382464 . . [6.6.2600.2180] . . c:\windows\system32\dllcache\qmgr.dll

[-] 2005-07-26 . 891E3E4537C6DFCAE475073FC49CE9CB . 397824 . . [5.1.2600.2726] . . c:\windows\system32\rpcss.dll
[-] 2005-07-26 . 891E3E4537C6DFCAE475073FC49CE9CB . 397824 . . [5.1.2600.2726] . . c:\windows\system32\dllcache\rpcss.dll
[-] 2005-07-26 . DBA9F9C00A7A2B45EB8E451C2B6D10E9 . 398336 . . [5.1.2600.2726] . . c:\windows\$hf_mig$\KB902400\SP2QFE\rpcss.dll
[-] 2005-04-28 . 434A27912D53BF3FB6C1CE37BAFA5CF6 . 396288 . . [5.1.2600.2665] . . c:\windows\$hf_mig$\KB894391\SP2QFE\rpcss.dll
[-] 2005-01-14 . 64F7E6B27B790365A910ECE21134A680 . 395776 . . [5.1.2600.2595] . . c:\windows\$hf_mig$\KB873333\SP2QFE\rpcss.dll

[-] 2004-08-03 . EDB6B81761BD60F32F740BBC40AFB676 . 108544 . . [5.1.2600.2180] . . c:\windows\system32\services.exe
[-] 2004-08-03 . EDB6B81761BD60F32F740BBC40AFB676 . 108544 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\services.exe

[-] 2005-06-11 . AD3D9D191AEA7B5445FE1D82FFBB4788 . 57856 . . [5.1.2600.2696] . . c:\windows\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
[-] 2005-06-10 . DA81EC57ACD4CDC3D4C51CF3D409AF9F . 57856 . . [5.1.2600.2696] . . c:\windows\system32\spoolsv.exe
[-] 2005-06-10 . DA81EC57ACD4CDC3D4C51CF3D409AF9F . 57856 . . [5.1.2600.2696] . . c:\windows\system32\dllcache\spoolsv.exe

[-] 2004-08-03 . 2B6A0BAF33A9918F09442D873848FF72 . 507392 . . [5.1.2600.2180] . . c:\windows\system32\winlogon.exe
[-] 2004-08-03 . 2B6A0BAF33A9918F09442D873848FF72 . 507392 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\winlogon.exe

[-] 2004-08-03 . 032CA12162E89E545356525554EA12A7 . 111616 . . [5.4.3790.2180] . . c:\windows\system32\wuauclt.exe
[-] 2004-08-03 . 032CA12162E89E545356525554EA12A7 . 111616 . . [5.4.3790.2180] . . c:\windows\system32\dllcache\wuauclt.exe

[-] 2005-04-07 . 9F2604FD9111EDF4C0A042BDE44DEA2E . 617472 . . [5.82] . . c:\windows\system32\comctl32.dll
[-] 2005-04-07 . 9F2604FD9111EDF4C0A042BDE44DEA2E . 617472 . . [5.82] . . c:\windows\system32\dllcache\comctl32.dll

[-] 2004-08-03 . 1A5F9DB98DF7955B4C7CBDBF2C638238 . 60416 . . [5.1.2600.2180] . . c:\windows\system32\cryptsvc.dll
[-] 2004-08-03 . 1A5F9DB98DF7955B4C7CBDBF2C638238 . 60416 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\cryptsvc.dll

[-] 2005-07-26 04:39 . BEBC63622BDC30053A3145EBD90AF450 . 243200 . . [2001.12.4414.308] . . c:\windows\system32\es.dll
[-] 2005-07-26 04:39 . BEBC63622BDC30053A3145EBD90AF450 . 243200 . . [2001.12.4414.308] . . c:\windows\system32\dllcache\es.dll
[-] 2005-07-26 04:29 . 0D0F85237E32538F58278D673032676A . 243200 . . [2001.12.4414.308] . . c:\windows\$hf_mig$\KB902400\SP2QFE\es.dll

[-] 2004-08-03 . 94101D13A1818A9D08337EEC12ED277A . 110080 . . [5.1.2600.2180] . . c:\windows\system32\imm32.dll
[-] 2004-08-03 . 94101D13A1818A9D08337EEC12ED277A . 110080 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\imm32.dll

[-] 2004-08-03 . E6CD85D0D37416CF138F01F4BB0FC872 . 1057280 . . [5.1.2600.2180] . . c:\windows\system32\kernel32.dll
[-] 2004-08-03 . E6CD85D0D37416CF138F01F4BB0FC872 . 1057280 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\kernel32.dll

[-] 2005-09-01 . F2AFE60F01040B23207D8EB7DC26EC96 . 19968 . . [5.1.2600.2751] . . c:\windows\$hf_mig$\KB900725\SP2QFE\linkinfo.dll
[-] 2005-09-01 . 0E2B88912BF78549D5177A84A3375D52 . 19968 . . [5.1.2600.2751] . . c:\windows\system32\linkinfo.dll
[-] 2005-09-01 . 0E2B88912BF78549D5177A84A3375D52 . 19968 . . [5.1.2600.2751] . . c:\windows\system32\dllcache\linkinfo.dll

[-] 2004-08-03 . B4AD65C79F85C61D32C015B11E03CAAD . 22016 . . [5.1.2600.2180] . . c:\windows\system32\lpk.dll
[-] 2004-08-03 . B4AD65C79F85C61D32C015B11E03CAAD . 22016 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\lpk.dll

[-] 2005-11-23 . 03F9910F7958A36088B9D8CD262903AE . 3013632 . . [6.00.2900.2802] . . c:\windows\system32\mshtml.dll
[-] 2005-11-23 . 03F9910F7958A36088B9D8CD262903AE . 3013632 . . [6.00.2900.2802] . . c:\windows\system32\dllcache\mshtml.dll
[-] 2005-11-23 . 8ABDBAE6032562F17DCF962847ABB811 . 3016192 . . [6.00.2900.2802] . . c:\windows\$hf_mig$\KB905915\SP2QFE\mshtml.dll

[-] 2004-08-03 . B30BAA48E5063E71C76280E34E7E4802 . 343040 . . [7.0.2600.2180] . . c:\windows\system32\msvcrt.dll
[-] 2004-08-03 . B30BAA48E5063E71C76280E34E7E4802 . 343040 . . [7.0.2600.2180] . . c:\windows\system32\dllcache\msvcrt.dll

[-] 2004-08-03 . B36E08F680BAE4DFC5C24D00A2DFC9E7 . 247296 . . [5.1.2600.2180] . . c:\windows\system32\mswsock.dll
[-] 2004-08-03 . B36E08F680BAE4DFC5C24D00A2DFC9E7 . 247296 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\mswsock.dll

[-] 2004-08-03 . D27395EDCD3416AFD125A9370DCB585C . 407040 . . [5.1.2600.2180] . . c:\windows\system32\netlogon.dll
[-] 2004-08-03 . D27395EDCD3416AFD125A9370DCB585C . 407040 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\netlogon.dll

[-] 2005-03-02 . EB5538A452E0E99169E2B6CDB62FF9D2 . 2181888 . . [5.1.2600.2622] . . c:\windows\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe
[-] 2005-03-02 . 7189A2391ADC1F65C9AE87B0ABE0F945 . 2181632 . . [5.1.2600.2622] . . c:\windows\Driver Cache\i386\ntoskrnl.exe
[-] 2005-03-02 . 7189A2391ADC1F65C9AE87B0ABE0F945 . 2181632 . . [5.1.2600.2622] . . c:\windows\system32\ntoskrnl.exe

[-] 2004-08-03 . 5604574D490B798BD9A946B021A766AD . 17408 . . [6.00.2900.2180] . . c:\windows\system32\powrprof.dll
[-] 2004-08-03 . 5604574D490B798BD9A946B021A766AD . 17408 . . [6.00.2900.2180] . . c:\windows\system32\dllcache\powrprof.dll

[-] 2004-08-03 . 64DC26B3CF7BCCAD431CE360A4C625D5 . 186880 . . [5.1.2600.2180] . . c:\windows\system32\scecli.dll
[-] 2004-08-03 . 64DC26B3CF7BCCAD431CE360A4C625D5 . 186880 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\scecli.dll

[-] 2004-08-03 . F62934BC94299083EBFC8810242D8640 . 5120 . . [5.1.2600.2180] . . c:\windows\system32\sfc.dll
[-] 2004-08-03 . F62934BC94299083EBFC8810242D8640 . 5120 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\sfc.dll

[-] 2004-08-03 . 65A819B121EB6FDAB4400EA42BDFFE64 . 14336 . . [5.1.2600.2180] . . c:\windows\system32\svchost.exe
[-] 2004-08-03 . 65A819B121EB6FDAB4400EA42BDFFE64 . 14336 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\svchost.exe

[-] 2005-07-08 . F07061E18613F336A3120229097F7635 . 249344 . . [5.1.2600.2716] . . c:\windows\$hf_mig$\KB893756\SP2QFE\tapisrv.dll
[-] 2005-07-08 . 427D7EB3B453347082C8F4B370065D60 . 249344 . . [5.1.2600.2716] . . c:\windows\system32\tapisrv.dll
[-] 2005-07-08 . 427D7EB3B453347082C8F4B370065D60 . 249344 . . [5.1.2600.2716] . . c:\windows\system32\dllcache\tapisrv.dll

[-] 2005-03-02 . 4C90159A69A5FD3EB39C71411F28FCFF . 578560 . . [5.1.2600.2622] . . c:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll
[-] 2005-03-02 . 3751D7CF0E0A113D84414992146BCE6A . 578560 . . [5.1.2600.2622] . . c:\windows\system32\user32.dll
[-] 2005-03-02 . 3751D7CF0E0A113D84414992146BCE6A . 578560 . . [5.1.2600.2622] . . c:\windows\system32\dllcache\user32.dll

[-] 2004-08-03 . D1E53DC57143F2584B1DD53B036C0633 . 25088 . . [5.1.2600.2180] . . c:\windows\system32\userinit.exe
[-] 2004-08-03 . D1E53DC57143F2584B1DD53B036C0633 . 25088 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\userinit.exe

[-] 2005-10-21 . 19625F6F8357C2306BA4B3583C705836 . 664064 . . [6.00.2900.2781] . . c:\windows\system32\wininet.dll
[-] 2005-10-21 . 19625F6F8357C2306BA4B3583C705836 . 664064 . . [6.00.2900.2781] . . c:\windows\system32\dllcache\wininet.dll
[-] 2005-10-21 . F3118DF4ABD118B11326D1C7A0093867 . 667136 . . [6.00.2900.2781] . . c:\windows\$hf_mig$\KB905915\SP2QFE\wininet.dll

[-] 2004-08-03 . D569240A22421D5F670BB6FB6DD522B5 . 82944 . . [5.1.2600.2180] . . c:\windows\system32\ws2_32.dll
[-] 2004-08-03 . D569240A22421D5F670BB6FB6DD522B5 . 82944 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ws2_32.dll

[-] 2004-08-03 . B3ADA72D1E3E10A8F6430669DFC38ED0 . 19968 . . [5.1.2600.2180] . . c:\windows\system32\ws2help.dll
[-] 2004-08-03 . B3ADA72D1E3E10A8F6430669DFC38ED0 . 19968 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ws2help.dll

[-] 2005-04-07 . 64322E8399B205B7281FF883737A9B03 . 1035264 . . [6.00.2900.2649] . . c:\windows\explorer.exe
[-] 2005-04-07 . 64322E8399B205B7281FF883737A9B03 . 1035264 . . [6.00.2900.2649] . . c:\windows\system32\dllcache\explorer.exe

[-] 2005-07-26 . CC50261CA5DC93A47D6CF548C4223F44 . 1285120 . . [5.1.2600.2726] . . c:\windows\system32\ole32.dll
[-] 2005-07-26 . CC50261CA5DC93A47D6CF548C4223F44 . 1285120 . . [5.1.2600.2726] . . c:\windows\system32\dllcache\ole32.dll
[-] 2005-07-25 . 24EDF93FD04CA1A98D32F092DD4F9953 . 1286144 . . [5.1.2600.2726] . . c:\windows\$hf_mig$\KB902400\SP2QFE\ole32.dll
[-] 2005-04-28 . D3653209882B5645223B1EA958EEE3A6 . 1286656 . . [5.1.2600.2665] . . c:\windows\$hf_mig$\KB894391\SP2QFE\ole32.dll
[-] 2005-01-14 . 11565070406B8892149C360A4FB23731 . 1285120 . . [5.1.2600.2595] . . c:\windows\$hf_mig$\KB873333\SP2QFE\ole32.dll

[-] 2004-08-03 . 015F302C4CF961F20C3F98F3A7CA7917 . 171008 . . [5.1.2600.2180] . . c:\windows\system32\srsvc.dll
[-] 2004-08-03 . 015F302C4CF961F20C3F98F3A7CA7917 . 171008 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\srsvc.dll

[-] 2004-08-03 . 7D3E0BEB62799112F5C9FF717D72BF29 . 13824 . . [5.1.2600.2180] . . c:\windows\system32\wscntfy.exe
[-] 2004-08-03 . 7D3E0BEB62799112F5C9FF717D72BF29 . 13824 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\wscntfy.exe

[-] 2004-08-03 . 8302DE1C64618D72346DD0034DBC5D9B . 129536 . . [5.1.2600.2180] . . c:\windows\system32\xmlprov.dll
[-] 2004-08-03 . 8302DE1C64618D72346DD0034DBC5D9B . 129536 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\xmlprov.dll

[-] 2004-08-03 . B932C077D5A65B71B4512544AC404CB4 . 55808 . . [5.1.2600.2180] . . c:\windows\system32\eventlog.dll
[-] 2004-08-03 . B932C077D5A65B71B4512544AC404CB4 . 55808 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\eventlog.dll

[-] 2004-08-03 . 80F7B7198B869C07C98627AF812D68B6 . 1548288 . . [5.1.2600.2180] . . c:\windows\system32\sfcfiles.dll
[-] 2004-08-03 . 80F7B7198B869C07C98627AF812D68B6 . 1548288 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\sfcfiles.dll

[-] 2004-08-03 . 7CE20569925DF6789C31799F0C538F29 . 15360 . . [5.1.2600.2180] . . c:\windows\system32\ctfmon.exe
[-] 2004-08-03 . 7CE20569925DF6789C31799F0C538F29 . 15360 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ctfmon.exe

[-] 2004-08-03 . BAC5F7F0C2B8C1B9832594851E0F9914 . 135168 . . [6.00.2900.2180] . . c:\windows\system32\shsvcs.dll
[-] 2004-08-03 . BAC5F7F0C2B8C1B9832594851E0F9914 . 135168 . . [6.00.2900.2180] . . c:\windows\system32\dllcache\shsvcs.dll

[-] 2004-08-03 . AE81CF7D7CFA79CD03E8FB99788A7E09 . 59904 . . [5.1.2600.2180] . . c:\windows\system32\regsvc.dll
[-] 2004-08-03 . AE81CF7D7CFA79CD03E8FB99788A7E09 . 59904 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\regsvc.dll

[-] 2004-08-03 . D5E73842F38E24457C63FEF8CEFFBE19 . 192000 . . [5.1.2600.2180] . . c:\windows\system32\schedsvc.dll
[-] 2004-08-03 . D5E73842F38E24457C63FEF8CEFFBE19 . 192000 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\schedsvc.dll

[-] 2004-08-03 . 6FA03B462B2FFFE2627171B7FE73EE29 . 71680 . . [5.1.2600.2180] . . c:\windows\system32\ssdpsrv.dll
[-] 2004-08-03 . 6FA03B462B2FFFE2627171B7FE73EE29 . 71680 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ssdpsrv.dll

[-] 2004-08-03 . 1850BC10DE5DCCCEDE063FC2D0F2CEDA . 297472 . . [5.1.2600.2180] . . c:\windows\system32\termsrv.dll
[-] 2004-08-03 . 1850BC10DE5DCCCEDE063FC2D0F2CEDA . 297472 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\termsrv.dll

[-] 2004-08-03 . BECD5328E7869807D6557BE4FE60C72F . 175616 . . [5.1.2600.2180] . . c:\windows\system32\appmgmts.dll
[-] 2004-08-03 . BECD5328E7869807D6557BE4FE60C72F . 175616 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\appmgmts.dll

[-] 2001-08-18 . 9E1CA3160DAFB159CA14F83B1E317F75 . 12160 . . [5.1.2600.0] . . c:\windows\system32\drivers\acpiec.sys

[-] 2005-05-27 23:14 . 1EE7B434BA961EF845DE136224C30FEC . 142464 . . [5.1.2601.2180] . . c:\windows\Driver Cache\i386\aec.sys
[-] 2005-05-27 23:14 . 1EE7B434BA961EF845DE136224C30FEC . 142464 . . [5.1.2601.2180] . . c:\windows\system32\dllcache\aec.sys
[-] 2005-05-27 23:14 . 1EE7B434BA961EF845DE136224C30FEC . 142464 . . [5.1.2601.2180] . . c:\windows\system32\drivers\aec.sys

[-] 2004-08-03 . 4448006B6BC60E6C027932CFC38D6855 . 29056 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ip6fw.sys
[-] 2004-08-03 . 4448006B6BC60E6C027932CFC38D6855 . 29056 . . [5.1.2600.2180] . . c:\windows\system32\drivers\ip6fw.sys

[-] 2001-08-18 12:00 . 31DD27AB47F62D383505F35CA972748B . 924432 . . [4.1.6140] . . c:\windows\system32\mfc40u.dll
[-] 2001-08-18 12:00 . 31DD27AB47F62D383505F35CA972748B . 924432 . . [4.1.6140] . . c:\windows\system32\dllcache\mfc40u.dll

[-] 2004-08-03 . E5215AB942C5AC5F7EB0E54871D7A27C . 33792 . . [5.1.2600.2180] . . c:\windows\system32\msgsvc.dll
[-] 2004-08-03 . E5215AB942C5AC5F7EB0E54871D7A27C . 33792 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\msgsvc.dll

[-] 2006-10-18 19:47 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . c:\windows\system32\mspmsnsv.dll
[-] 2006-10-18 19:47 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . c:\windows\system32\dllcache\mspmsnsv.dll
[-] 2004-10-11 09:20 . C9BF4BC4D24A3A25E4A4894499FD9A6A . 25088 . . [10.0.3790.3650] . . c:\windows\$NtUninstallWMFDist11$\mspmsnsv.dll
[-] 2004-10-11 09:20 . C9BF4BC4D24A3A25E4A4894499FD9A6A . 25088 . . [10.0.3790.3650] . . c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}\MsPMSNSv.dll
[-] 2004-08-03 22:57 . D68CC4EBF7B03FD770D5962295AD814E . 52736 . . [9.0.1.56] . . c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}$BACKUP$\System\MsPMSNSv.dll

[-] 2005-03-02 . BDFF8FFA77EE7DF9758EF8C1E0DA8EFF . 2059136 . . [5.1.2600.2622] . . c:\windows\Driver Cache\i386\ntkrnlpa.exe
[-] 2005-03-02 . BDFF8FFA77EE7DF9758EF8C1E0DA8EFF . 2059136 . . [5.1.2600.2622] . . c:\windows\system32\ntkrnlpa.exe
[-] 2005-03-02 . AE8364004BBFD70461D2EF34888D3360 . 2059264 . . [5.1.2600.2622] . . c:\windows\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe

[-] 2004-08-03 22:57 . 428AA946A8D9F32DBB4260C8E6E13377 . 438272 . . [5.1.2400.2180] . . c:\windows\system32\ntmssvc.dll
[-] 2004-08-03 22:57 . 428AA946A8D9F32DBB4260C8E6E13377 . 438272 . . [5.1.2400.2180] . . c:\windows\system32\dllcache\ntmssvc.dll

[-] 2004-08-03 . 09D4A2D7C5A8ABEC227D118765FAADDF . 185856 . . [5.1.2600.2180] . . c:\windows\system32\upnphost.dll
[-] 2004-08-03 . 09D4A2D7C5A8ABEC227D118765FAADDF . 185856 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\upnphost.dll

[-] 2004-08-03 . 7DB3393F98E4211F5CE8F003DE0615CF . 367616 . . [5.3.2600.2180] . . c:\windows\system32\dsound.dll
[-] 2004-08-03 . 7DB3393F98E4211F5CE8F003DE0615CF . 367616 . . [5.3.2600.2180] . . c:\windows\system32\dllcache\dsound.dll

[-] 2004-08-03 . 20AE7889467887B869F30308EEED9A2A . 1689088 . . [5.03.2600.2180] . . c:\windows\system32\d3d9.dll
[-] 2004-08-03 . 20AE7889467887B869F30308EEED9A2A . 1689088 . . [5.03.2600.2180] . . c:\windows\system32\dllcache\d3d9.dll

[-] 2004-08-03 . CAC545A56482DE01640E6B791DE19944 . 266240 . . [5.03.2600.2180] . . c:\windows\system32\ddraw.dll
[-] 2004-08-03 . CAC545A56482DE01640E6B791DE19944 . 266240 . . [5.03.2600.2180] . . c:\windows\system32\dllcache\ddraw.dll

[-] 2004-08-03 22:57 . 1404D3DD4ED4F5E2A938B43794049A81 . 83456 . . [5.1.2600.2180] . . c:\windows\system32\olepro32.dll
[-] 2004-08-03 22:57 . 1404D3DD4ED4F5E2A938B43794049A81 . 83456 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\olepro32.dll

[-] 2004-08-03 . 007BFD01772B5202C5CE4F208A2F3F46 . 41984 . . [5.1.2600.2180] . . c:\windows\system32\perfctrs.dll
[-] 2004-08-03 . 007BFD01772B5202C5CE4F208A2F3F46 . 41984 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\perfctrs.dll

[-] 2004-08-03 . 4EF2FDC0A085C8339ED4D9C59CE8FC60 . 18944 . . [5.1.2600.2180] . . c:\windows\system32\version.dll
[-] 2004-08-03 . 4EF2FDC0A085C8339ED4D9C59CE8FC60 . 18944 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\version.dll

[-] 2004-08-03 . B39A6AF04A431E317C85BF061719E705 . 93184 . . [6.00.2900.2180] . . c:\windows\system32\dllcache\iexplore.exe
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\IconOverlay1EXL580]
@="{B4834762-CF57-45AB-819D-CABE601B3C3C}"
[HKEY_CLASSES_ROOT\CLSID\{B4834762-CF57-45AB-819D-CABE601B3C3C}]
2007-04-23 09:17        596480        ----a-w-        c:\windows\system32\FPAP-EXL580\FileptcIconOverlay.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NokiaMServer"="c:\programme\Gemeinsame Dateien\Nokia\MPlatform\NokiaMServer" [X]
"ATICCC"="c:\programme\ATI Technologies\ATI.ACE\cli.exe" [2005-08-12 45056]
"P17Helper"="P17.dll" [2005-05-03 64512]
"CTSysVol"="c:\programme\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-02-15 57344]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"AEZBProc"="c:\ibmtools\aptezbtn\aptezbp.exe" [2001-07-24 372736]
"Omnipage"="c:\programme\ScanSoft\OmniPageSE\opware32.exe" [2002-06-03 49152]
"RTHDCPL"="RTHDCPL.EXE" [2005-06-08 14565376]
"REGSHAVE"="c:\programme\REGSHAVE\REGSHAVE.EXE" [2002-02-04 53248]
"Easy-PrintToolBox"="c:\programme\Canon\Easy-PrintToolBox\BJPSMAIN.EXE" [2004-01-14 409600]
"LogitechCommunicationsManager"="c:\programme\Gemeinsame Dateien\LogiShrd\LComMgr\Communications_Helper.exe" [2007-05-17 505368]
"LogitechQuickCamRibbon"="c:\programme\Logitech\QuickCam10\QuickCam10.exe" [2007-05-17 780312]
"SunJavaUpdateSched"="c:\programme\Java\jre6\bin\jusched.exe" [2009-08-04 148888]
"QuickTime Task"="c:\programme\QuickTime Alternative\QTTask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\programme\iTunes\iTunesHelper.exe" [2009-06-05 292136]
"avgnt"="c:\programme\Antivir Avira\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]

c:\dokumente und einstellungen\Family\Startmen\Programme\Autostart\
RocketDock.exe.lnk - c:\programme\RocketDock\RocketDock.exe [2010-1-8 495616]

c:\dokumente und einstellungen\All Users\Startmen\Programme\Autostart\
Catalyst System Tray.lnk - c:\programme\ATI Technologies\ATI.ACE\CLI.exe [2005-8-12 45056]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Bonjour Service"=2 (0x2)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Creative Detector"=c:\programme\Creative\MediaSource\Detector\CTDetect.exe /R

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Alcmtr"=ALCMTR.EXE
"RemoteControl"=c:\programme\PowerDVD\PDVDServ.exe
"TkBellExe"="c:\programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe"  -osboot
"UpdReg"=c:\windows\UpdReg.EXE
"Acrobat Assistant 8.0"="c:\programme\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

R0 m5288;m5288;c:\windows\system32\drivers\m5288.sys [18.08.2006 11:59 210304]
R1 fwdrv;Firewall Driver;c:\windows\system32\drivers\fwdrv.sys [18.07.2006 12:02 284184]
R1 khips;Kerio HIPS Driver;c:\windows\system32\drivers\khips.sys [18.07.2006 12:02 91672]
R2 a2free;a-squared Free Service;c:\programme\a-squared Free\a2service.exe [29.12.2008 22:51 419448]
R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Antivir Avira\Avira\AntiVir Desktop\sched.exe [03.01.2010 00:00 108289]
R3 SAA7146n;TT DVB-PCI driver (SAA7146n);c:\windows\system32\drivers\saa7146n.sys [13.09.2004 10:13 65840]
R3 TTLOOPHE;Virtual DVB-S/-C/-T Network Adapter Driver;c:\windows\system32\drivers\ttloophe.sys [08.11.2004 18:44 39284]
R3 ULI5261XP;ULi M526X Ethernet NT Driver;c:\windows\system32\drivers\ULILAN51.SYS [18.08.2006 12:02 28672]
S3 MotDev;Motorola Inc. USB Device;c:\windows\system32\drivers\motodrv.sys [27.05.2007 23:29 40832]
S3 silabenm;Silicon Labs CP210x USB to UART Bridge Serial Port Enumerator Driver;c:\windows\system32\drivers\silabenm.sys [27.06.2010 23:09 17920]
S3 silabser;Silicon Labs CP210x USB to UART Bridge Driver;c:\windows\system32\drivers\silabser.sys [27.06.2010 23:09 63488]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [30.06.2010 14:42 11520]
.
Inhalt des "geplante Tasks" Ordners

2010-09-10 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\programme\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.faz.net/
IE: Append to existing PDF - c:\programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Easy-WebPrint - Drucken - c:\programme\Canon Drucker\Easy-WebPrint\Resource.dll/RC_Print.html
IE: Easy-WebPrint - Schnelldruck - c:\programme\Canon Drucker\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint - Vorschau - c:\programme\Canon Drucker\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: Easy-WebPrint - Zu Druckliste hinzufügen - c:\programme\Canon Drucker\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

AddRemove-Portable Backup_is1 - j:\backup4all\Portable Backup\unins000.exe
AddRemove-SLABCOMM&10C4&EA60 - c:\windows\system32\Silabs\DriverUninstaller.exe VCP CP210x Cardinal\SLABCOMM&10C4&EA60



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2010-09-28 17:07
Windows 5.1.2600 Service Pack 2 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

- - - - - - - > 'winlogon.exe'(828)
c:\windows\system32\Ati2evxx.dll
.
Zeit der Fertigstellung: 2010-09-28  17:10:45
ComboFix-quarantined-files.txt  2010-09-28 15:10

Vor Suchlauf: 2.487.291.904 Bytes frei
Nach Suchlauf: 2.501.853.184 Bytes frei

WindowsXP-KB310994-SP2-Pro-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 2870C9A5415B40B6007269D71791CFB2
--- --- ---

cosinus 28.09.2010 18:01
Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten. GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus

Anschließend den bootkit_remover herunterladen. Entpacke das Tool in einen eigenen Ordner auf dem Desktop und führe in diesem Ordner die Datei remove.exe aus.

Wenn Du Windows Vista oder Windows 7 verwendest, musst Du die remover.exe über ein Rechtsklick => als Administrator ausführen

Ein schwarzes Fenster wird sich öffnen und automatisch nach bösartigen Veränderungen im MBR suchen.
Poste dann bitte, ob es Veränderungen gibt und wenn ja in welchem device. Am besten alles posten was die remover.exe ausgibt.

aware 28.09.2010 18:11
Sorry, meine Frage hat sich erledigt, habe die Anleitung gerade gelesen.

aware 28.09.2010 20:18
Hier erstmal der GMER log, OSAM wird noch ausgeführt.


GMER Logfile:
Code:
GMER 1.0.15.15281 - hxxp://www.gmer.net
Rootkit scan 2010-09-28 20:51:00
Windows 5.1.2600 Service Pack 2
Running: i2vrgo4t.exe; Driver: C:\DOKUME~1\Family\LOKALE~1\Temp\axtdapod.sys


---- System - GMER 1.0.15 ----

SSDT            \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software)                                                  ZwClose [0xA8158110]
SSDT            \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software)                                                  ZwCreateFile [0xA8157920]
SSDT            F7CF7436                                                                                                                                ZwCreateKey
SSDT            \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software)                                                  ZwCreateProcess [0xA8156F20]
SSDT            \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software)                                                  ZwCreateProcessEx [0xA8156D90]
SSDT            F7CF742C                                                                                                                                ZwCreateThread
SSDT            \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software)                                                  ZwDeleteFile [0xA8158190]
SSDT            F7CF743B                                                                                                                                ZwDeleteKey
SSDT            F7CF7445                                                                                                                                ZwDeleteValueKey
SSDT            \SystemRoot\system32\drivers\khips.sys (Sunbelt Kerio Host Intrusion Prevention Driver/Sunbelt Software)                                ZwLoadDriver [0xA75AA9A0]
SSDT            F7CF744A                                                                                                                                ZwLoadKey
SSDT            \SystemRoot\system32\drivers\khips.sys (Sunbelt Kerio Host Intrusion Prevention Driver/Sunbelt Software)                                ZwMapViewOfSection [0xA75AAB30]
SSDT            \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software)                                                  ZwOpenFile [0xA8157BF0]
SSDT            \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software)                                                  ZwOpenKey [0xA8154140]
SSDT            F7CF7418                                                                                                                                ZwOpenProcess
SSDT            F7CF741D                                                                                                                                ZwOpenThread
SSDT            F7CF7454                                                                                                                                ZwReplaceKey
SSDT            F7CF744F                                                                                                                                ZwRestoreKey
SSDT            \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software)                                                  ZwResumeThread [0xA8157510]
SSDT            \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software)                                                  ZwSetInformationFile [0xA8157F00]
SSDT            F7CF7440                                                                                                                                ZwSetValueKey
SSDT            F7CF7427                                                                                                                                ZwTerminateProcess
SSDT            \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software)                                                  ZwWriteFile [0xA8157E50]

Code            \??\C:\DOKUME~1\Family\LOKALE~1\Temp\catchme.sys                                                                                        pIofCallDriver

---- Kernel code sections - GMER 1.0.15 ----

.text          ntkrnlpa.exe!ZwCallbackReturn + 24DC                                                                                                    805011E0 2 Bytes  [30, AB]
PAGENDSM        NDIS.sys!NdisMIndicateStatus                                                                                                            F7337A5F 6 Bytes  JMP A814BED0 \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software)
?              C:\DOKUME~1\Family\LOKALE~1\Temp\mbr.sys                                                                                                Das System kann die angegebene Datei nicht finden. !
?              C:\DOKUME~1\Family\LOKALE~1\Temp\catchme.sys                                                                                            Das System kann die angegebene Datei nicht finden. !
?              C:\WINDOWS\system32\Drivers\PROCEXP113.SYS                                                                                              Das System kann die angegebene Datei nicht finden. !

---- User code sections - GMER 1.0.15 ----

.text          C:\WINDOWS\system32\spoolsv.exe[252] kernel32.dll!VirtualProtectEx                                                                      7C801A5D 5 Bytes  JMP 000801A8
.text          C:\WINDOWS\system32\spoolsv.exe[252] kernel32.dll!VirtualProtect                                                                        7C801AD0 5 Bytes  JMP 00080090
.text          C:\WINDOWS\system32\spoolsv.exe[252] kernel32.dll!WriteProcessMemory                                                                    7C80220F 5 Bytes  JMP 00080694
.text          C:\WINDOWS\system32\spoolsv.exe[252] kernel32.dll!CreateProcessW                                                                        7C802332 5 Bytes  JMP 000802C0
.text          C:\WINDOWS\system32\spoolsv.exe[252] kernel32.dll!CreateProcessA                                                                        7C802367 5 Bytes  JMP 00080234
.text          C:\WINDOWS\system32\spoolsv.exe[252] kernel32.dll!VirtualAlloc                                                                          7C809A81 5 Bytes  JMP 00080004
.text          C:\WINDOWS\system32\spoolsv.exe[252] kernel32.dll!VirtualAllocEx                                                                        7C809AA2 5 Bytes  JMP 0008011C
.text          C:\WINDOWS\system32\spoolsv.exe[252] kernel32.dll!CreateRemoteThread                                                                    7C810626 5 Bytes  JMP 000804F0
.text          C:\WINDOWS\system32\spoolsv.exe[252] kernel32.dll!CreateThread                                                                          7C81082F 5 Bytes  JMP 0008057C
.text          C:\WINDOWS\system32\spoolsv.exe[252] kernel32.dll!CreateProcessInternalW                                                                7C8191EB 5 Bytes  JMP 000803D8
.text          C:\WINDOWS\system32\spoolsv.exe[252] kernel32.dll!CreateProcessInternalA                                                                7C81DA9E 5 Bytes  JMP 0008034C
.text          C:\WINDOWS\system32\spoolsv.exe[252] kernel32.dll!WinExec                                                                              7C86114D 5 Bytes  JMP 00080464
.text          C:\WINDOWS\system32\spoolsv.exe[252] kernel32.dll!SetThreadContext                                                                      7C862849 5 Bytes  JMP 00080608
.text          C:\WINDOWS\system32\spoolsv.exe[252] USER32.dll!SetWindowsHookExW                                                                      77D2E4AF 5 Bytes  JMP 000807AC
.text          C:\WINDOWS\system32\spoolsv.exe[252] USER32.dll!SetWindowsHookExA                                                                      77D311E9 5 Bytes  JMP 00080720
.text          C:\WINDOWS\system32\spoolsv.exe[252] WS2_32.dll!socket                                                                                  71A13B91 5 Bytes  JMP 000808C4
.text          C:\WINDOWS\system32\spoolsv.exe[252] WS2_32.dll!bind                                                                                    71A13E00 5 Bytes  JMP 00080838
.text          C:\WINDOWS\system32\spoolsv.exe[252] WS2_32.dll!connect                                                                                71A1406A 5 Bytes  JMP 00080950
.text          C:\Programme\Antivir Avira\Avira\AntiVir Desktop\sched.exe[332] kernel32.dll!VirtualProtectEx                                          7C801A5D 5 Bytes  JMP 001301A8
.text          C:\Programme\Antivir Avira\Avira\AntiVir Desktop\sched.exe[332] kernel32.dll!VirtualProtect                                            7C801AD0 5 Bytes  JMP 00130090
.text          C:\Programme\Antivir Avira\Avira\AntiVir Desktop\sched.exe[332] kernel32.dll!WriteProcessMemory                                        7C80220F 5 Bytes  JMP 00130694
.text          C:\Programme\Antivir Avira\Avira\AntiVir Desktop\sched.exe[332] kernel32.dll!CreateProcessW                                            7C802332 5 Bytes  JMP 001302C0
.text          C:\Programme\Antivir Avira\Avira\AntiVir Desktop\sched.exe[332] kernel32.dll!CreateProcessA                                            7C802367 5 Bytes  JMP 00130234
.text          C:\Programme\Antivir Avira\Avira\AntiVir Desktop\sched.exe[332] kernel32.dll!VirtualAlloc                                              7C809A81 5 Bytes  JMP 00130004
.text          C:\Programme\Antivir Avira\Avira\AntiVir Desktop\sched.exe[332] kernel32.dll!VirtualAllocEx                                            7C809AA2 5 Bytes  JMP 0013011C
.text          C:\Programme\Antivir Avira\Avira\AntiVir Desktop\sched.exe[332] kernel32.dll!CreateRemoteThread                                        7C810626 5 Bytes  JMP 001304F0
.text          C:\Programme\Antivir Avira\Avira\AntiVir Desktop\sched.exe[332] kernel32.dll!CreateThread                                              7C81082F 5 Bytes  JMP 0013057C
.text          C:\Programme\Antivir Avira\Avira\AntiVir Desktop\sched.exe[332] kernel32.dll!CreateProcessInternalW                                    7C8191EB 5 Bytes  JMP 001303D8
.text          C:\Programme\Antivir Avira\Avira\AntiVir Desktop\sched.exe[332] kernel32.dll!CreateProcessInternalA                                    7C81DA9E 5 Bytes  JMP 0013034C
.text          C:\Programme\Antivir Avira\Avira\AntiVir Desktop\sched.exe[332] kernel32.dll!WinExec                                                    7C86114D 5 Bytes  JMP 00130464
.text          C:\Programme\Antivir Avira\Avira\AntiVir Desktop\sched.exe[332] kernel32.dll!SetThreadContext                                          7C862849 5 Bytes  JMP 00130608
.text          C:\Programme\Antivir Avira\Avira\AntiVir Desktop\sched.exe[332] USER32.dll!SetWindowsHookExW                                            77D2E4AF 5 Bytes  JMP 001307AC
.text          C:\Programme\Antivir Avira\Avira\AntiVir Desktop\sched.exe[332] USER32.dll!SetWindowsHookExA                                            77D311E9 5 Bytes  JMP 00130720
.text          C:\Programme\Antivir Avira\Avira\AntiVir Desktop\sched.exe[332] WS2_32.dll!socket                                                      71A13B91 5 Bytes  JMP 001308C4
.text          C:\Programme\Antivir Avira\Avira\AntiVir Desktop\sched.exe[332] WS2_32.dll!bind                                                        71A13E00 5 Bytes  JMP 00130838
.text          C:\Programme\Antivir Avira\Avira\AntiVir Desktop\sched.exe[332] WS2_32.dll!connect                                                      71A1406A 5 Bytes  JMP 00130950
.text          C:\WINDOWS\system32\svchost.exe[360] kernel32.dll!VirtualProtectEx                                                                      7C801A5D 5 Bytes  JMP 000801A8
.text          C:\WINDOWS\system32\svchost.exe[360] kernel32.dll!VirtualProtect                                                                        7C801AD0 5 Bytes  JMP 00080090
.text          C:\WINDOWS\system32\svchost.exe[360] kernel32.dll!WriteProcessMemory                                                                    7C80220F 5 Bytes  JMP 00080694
.text          C:\WINDOWS\system32\svchost.exe[360] kernel32.dll!CreateProcessW                                                                        7C802332 5 Bytes  JMP 000802C0
.text          C:\WINDOWS\system32\svchost.exe[360] kernel32.dll!CreateProcessA                                                                        7C802367 5 Bytes  JMP 00080234
.text          C:\WINDOWS\system32\svchost.exe[360] kernel32.dll!VirtualAlloc                                                                          7C809A81 5 Bytes  JMP 00080004
.text          C:\WINDOWS\system32\svchost.exe[360] kernel32.dll!VirtualAllocEx                                                                        7C809AA2 5 Bytes  JMP 0008011C
.text          C:\WINDOWS\system32\svchost.exe[360] kernel32.dll!CreateRemoteThread                                                                    7C810626 5 Bytes  JMP 000804F0
.text          C:\WINDOWS\system32\svchost.exe[360] kernel32.dll!CreateThread                                                                          7C81082F 5 Bytes  JMP 0008057C
.text          C:\WINDOWS\system32\svchost.exe[360] kernel32.dll!CreateProcessInternalW                                                                7C8191EB 5 Bytes  JMP 000803D8
.text          C:\WINDOWS\system32\svchost.exe[360] kernel32.dll!CreateProcessInternalA                                                                7C81DA9E 5 Bytes  JMP 0008034C
.text          C:\WINDOWS\system32\svchost.exe[360] kernel32.dll!WinExec                                                                              7C86114D 5 Bytes  JMP 00080464
.text          C:\WINDOWS\system32\svchost.exe[360] kernel32.dll!SetThreadContext                                                                      7C862849 5 Bytes  JMP 00080608
.text          C:\WINDOWS\system32\svchost.exe[360] USER32.dll!SetWindowsHookExW                                                                      77D2E4AF 5 Bytes  JMP 000807AC
.text          C:\WINDOWS\system32\svchost.exe[360] USER32.dll!SetWindowsHookExA                                                                      77D311E9 5 Bytes  JMP 00080720
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[444] kernel32.dll!VirtualProtectEx                                          7C801A5D 5 Bytes  JMP 001301A8
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[444] kernel32.dll!VirtualProtect                                            7C801AD0 5 Bytes  JMP 00130090
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[444] kernel32.dll!WriteProcessMemory                                        7C80220F 5 Bytes  JMP 00130694
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[444] kernel32.dll!CreateProcessW                                            7C802332 5 Bytes  JMP 001302C0
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[444] kernel32.dll!CreateProcessA                                            7C802367 5 Bytes  JMP 00130234
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[444] kernel32.dll!VirtualAlloc                                              7C809A81 5 Bytes  JMP 00130004
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[444] kernel32.dll!VirtualAllocEx                                            7C809AA2 5 Bytes  JMP 0013011C
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[444] kernel32.dll!CreateRemoteThread                                        7C810626 5 Bytes  JMP 001304F0
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[444] kernel32.dll!CreateThread                                              7C81082F 5 Bytes  JMP 0013057C
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[444] kernel32.dll!CreateProcessInternalW                                    7C8191EB 5 Bytes  JMP 001303D8
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[444] kernel32.dll!CreateProcessInternalA                                    7C81DA9E 5 Bytes  JMP 0013034C
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[444] kernel32.dll!WinExec                                                  7C86114D 5 Bytes  JMP 00130464
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[444] kernel32.dll!SetThreadContext                                          7C862849 5 Bytes  JMP 00130608
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[444] USER32.dll!SetWindowsHookExW                                          77D2E4AF 5 Bytes  JMP 001307AC
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[444] USER32.dll!SetWindowsHookExA                                          77D311E9 5 Bytes  JMP 00130720
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[444] WS2_32.dll!socket                                                      71A13B91 5 Bytes  JMP 001308C4
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[444] WS2_32.dll!bind                                                        71A13E00 5 Bytes  JMP 00130838
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[444] WS2_32.dll!connect                                                    71A1406A 5 Bytes  JMP 00130950
.text          C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe[772] kernel32.dll!VirtualProtectEx                                      7C801A5D 5 Bytes  JMP 001301A8
.text          C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe[772] kernel32.dll!VirtualProtect                                        7C801AD0 5 Bytes  JMP 00130090
.text          C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe[772] kernel32.dll!WriteProcessMemory                                    7C80220F 5 Bytes  JMP 00130694
.text          C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe[772] kernel32.dll!CreateProcessW                                        7C802332 5 Bytes  JMP 001302C0
.text          C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe[772] kernel32.dll!CreateProcessA                                        7C802367 5 Bytes  JMP 00130234
.text          C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe[772] kernel32.dll!VirtualAlloc                                          7C809A81 5 Bytes  JMP 00130004
.text          C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe[772] kernel32.dll!VirtualAllocEx                                        7C809AA2 5 Bytes  JMP 0013011C
.text          C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe[772] kernel32.dll!CreateRemoteThread                                    7C810626 5 Bytes  JMP 001304F0
.text          C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe[772] kernel32.dll!CreateThread                                          7C81082F 5 Bytes  JMP 0013057C
.text          C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe[772] kernel32.dll!CreateProcessInternalW                                7C8191EB 5 Bytes  JMP 001303D8
.text          C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe[772] kernel32.dll!CreateProcessInternalA                                7C81DA9E 5 Bytes  JMP 0013034C
.text          C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe[772] kernel32.dll!WinExec                                                7C86114D 5 Bytes  JMP 00130464
.text          C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe[772] kernel32.dll!SetThreadContext                                      7C862849 5 Bytes  JMP 00130608
.text          C:\WINDOWS\system32\csrss.exe[800] KERNEL32.dll!VirtualProtectEx                                                                        7C801A5D 5 Bytes  JMP 001601A8
.text          C:\WINDOWS\system32\csrss.exe[800] KERNEL32.dll!VirtualProtect                                                                          7C801AD0 5 Bytes  JMP 00160090
.text          C:\WINDOWS\system32\csrss.exe[800] KERNEL32.dll!WriteProcessMemory                                                                      7C80220F 5 Bytes  JMP 00160694
.text          C:\WINDOWS\system32\csrss.exe[800] KERNEL32.dll!CreateProcessW                                                                          7C802332 5 Bytes  JMP 001602C0
.text          C:\WINDOWS\system32\csrss.exe[800] KERNEL32.dll!CreateProcessA                                                                          7C802367 5 Bytes  JMP 00160234
.text          C:\WINDOWS\system32\csrss.exe[800] KERNEL32.dll!VirtualAlloc                                                                            7C809A81 5 Bytes  JMP 00160004
.text          C:\WINDOWS\system32\csrss.exe[800] KERNEL32.dll!VirtualAllocEx                                                                          7C809AA2 5 Bytes  JMP 0016011C
.text          C:\WINDOWS\system32\csrss.exe[800] KERNEL32.dll!CreateRemoteThread                                                                      7C810626 5 Bytes  JMP 001604F0
.text          C:\WINDOWS\system32\csrss.exe[800] KERNEL32.dll!CreateThread                                                                            7C81082F 5 Bytes  JMP 0016057C
.text          C:\WINDOWS\system32\csrss.exe[800] KERNEL32.dll!CreateProcessInternalW                                                                  7C8191EB 5 Bytes  JMP 001603D8
.text          C:\WINDOWS\system32\csrss.exe[800] KERNEL32.dll!CreateProcessInternalA                                                                  7C81DA9E 5 Bytes  JMP 0016034C
.text          C:\WINDOWS\system32\csrss.exe[800] KERNEL32.dll!WinExec                                                                                7C86114D 5 Bytes  JMP 00160464
.text          C:\WINDOWS\system32\csrss.exe[800] KERNEL32.dll!SetThreadContext                                                                        7C862849 5 Bytes  JMP 00160608
.text          C:\WINDOWS\system32\csrss.exe[800] USER32.dll!SetWindowsHookExW                                                                        77D2E4AF 5 Bytes  JMP 001607AC
.text          C:\WINDOWS\system32\csrss.exe[800] USER32.dll!SetWindowsHookExA                                                                        77D311E9 5 Bytes  JMP 00160720
.text          C:\WINDOWS\system32\winlogon.exe[828] kernel32.dll!VirtualProtectEx                                                                    7C801A5D 5 Bytes  JMP 000701A8
.text          C:\WINDOWS\system32\winlogon.exe[828] kernel32.dll!VirtualProtect                                                                      7C801AD0 5 Bytes  JMP 00070090
.text          C:\WINDOWS\system32\winlogon.exe[828] kernel32.dll!WriteProcessMemory                                                                  7C80220F 5 Bytes  JMP 00070694
.text          C:\WINDOWS\system32\winlogon.exe[828] kernel32.dll!CreateProcessW                                                                      7C802332 5 Bytes  JMP 000702C0
.text          C:\WINDOWS\system32\winlogon.exe[828] kernel32.dll!CreateProcessA                                                                      7C802367 5 Bytes  JMP 00070234
.text          C:\WINDOWS\system32\winlogon.exe[828] kernel32.dll!VirtualAlloc                                                                        7C809A81 5 Bytes  JMP 00070004
.text          C:\WINDOWS\system32\winlogon.exe[828] kernel32.dll!VirtualAllocEx                                                                      7C809AA2 5 Bytes  JMP 0007011C
.text          C:\WINDOWS\system32\winlogon.exe[828] kernel32.dll!CreateRemoteThread                                                                  7C810626 5 Bytes  JMP 000704F0
.text          C:\WINDOWS\system32\winlogon.exe[828] kernel32.dll!CreateThread                                                                        7C81082F 5 Bytes  JMP 0007057C
.text          C:\WINDOWS\system32\winlogon.exe[828] kernel32.dll!CreateProcessInternalW                                                              7C8191EB 5 Bytes  JMP 000703D8
.text          C:\WINDOWS\system32\winlogon.exe[828] kernel32.dll!CreateProcessInternalA                                                              7C81DA9E 5 Bytes  JMP 0007034C
.text          C:\WINDOWS\system32\winlogon.exe[828] kernel32.dll!WinExec                                                                              7C86114D 5 Bytes  JMP 00070464
.text          C:\WINDOWS\system32\winlogon.exe[828] kernel32.dll!SetThreadContext                                                                    7C862849 5 Bytes  JMP 00070608
.text          C:\WINDOWS\system32\winlogon.exe[828] USER32.dll!SetWindowsHookExW                                                                      77D2E4AF 5 Bytes  JMP 000707AC
.text          C:\WINDOWS\system32\winlogon.exe[828] USER32.dll!SetWindowsHookExA                                                                      77D311E9 5 Bytes  JMP 00070720
.text          C:\WINDOWS\system32\winlogon.exe[828] WS2_32.dll!socket                                                                                71A13B91 5 Bytes  JMP 000708C4
.text          C:\WINDOWS\system32\winlogon.exe[828] WS2_32.dll!bind                                                                                  71A13E00 5 Bytes  JMP 00070838
.text          C:\WINDOWS\system32\winlogon.exe[828] WS2_32.dll!connect                                                                                71A1406A 5 Bytes  JMP 00070950
.text          C:\WINDOWS\system32\services.exe[872] kernel32.dll!VirtualProtectEx                                                                    7C801A5D 5 Bytes  JMP 000801A8
.text          C:\WINDOWS\system32\services.exe[872] kernel32.dll!VirtualProtect                                                                      7C801AD0 5 Bytes  JMP 00080090
.text          C:\WINDOWS\system32\services.exe[872] kernel32.dll!WriteProcessMemory                                                                  7C80220F 5 Bytes  JMP 00080694
.text          C:\WINDOWS\system32\services.exe[872] kernel32.dll!CreateProcessW                                                                      7C802332 5 Bytes  JMP 000802C0
.text          C:\WINDOWS\system32\services.exe[872] kernel32.dll!CreateProcessA                                                                      7C802367 5 Bytes  JMP 00080234
.text          C:\WINDOWS\system32\services.exe[872] kernel32.dll!VirtualAlloc                                                                        7C809A81 5 Bytes  JMP 00080004
.text          C:\WINDOWS\system32\services.exe[872] kernel32.dll!VirtualAllocEx                                                                      7C809AA2 5 Bytes  JMP 0008011C
.text          C:\WINDOWS\system32\services.exe[872] kernel32.dll!CreateRemoteThread                                                                  7C810626 5 Bytes  JMP 000804F0
.text          C:\WINDOWS\system32\services.exe[872] kernel32.dll!CreateThread                                                                        7C81082F 5 Bytes  JMP 0008057C
.text          C:\WINDOWS\system32\services.exe[872] kernel32.dll!CreateProcessInternalW                                                              7C8191EB 5 Bytes  JMP 000803D8
.text          C:\WINDOWS\system32\services.exe[872] kernel32.dll!CreateProcessInternalA                                                              7C81DA9E 5 Bytes  JMP 0008034C
.text          C:\WINDOWS\system32\services.exe[872] kernel32.dll!WinExec                                                                              7C86114D 5 Bytes  JMP 00080464
.text          C:\WINDOWS\system32\services.exe[872] kernel32.dll!SetThreadContext                                                                    7C862849 5 Bytes  JMP 00080608
.text          C:\WINDOWS\system32\services.exe[872] USER32.dll!SetWindowsHookExW                                                                      77D2E4AF 5 Bytes  JMP 000807AC
.text          C:\WINDOWS\system32\services.exe[872] USER32.dll!SetWindowsHookExA                                                                      77D311E9 5 Bytes  JMP 00080720
.text          C:\WINDOWS\system32\services.exe[872] WS2_32.dll!socket                                                                                71A13B91 5 Bytes  JMP 000808C4
.text          C:\WINDOWS\system32\services.exe[872] WS2_32.dll!bind                                                                                  71A13E00 5 Bytes  JMP 00080838
.text          C:\WINDOWS\system32\services.exe[872] WS2_32.dll!connect                                                                                71A1406A 5 Bytes  JMP 00080950
.text          C:\WINDOWS\system32\lsass.exe[884] kernel32.dll!VirtualProtectEx                                                                        7C801A5D 5 Bytes  JMP 000801A8
.text          C:\WINDOWS\system32\lsass.exe[884] kernel32.dll!VirtualProtect                                                                          7C801AD0 5 Bytes  JMP 00080090
.text          C:\WINDOWS\system32\lsass.exe[884] kernel32.dll!WriteProcessMemory                                                                      7C80220F 5 Bytes  JMP 00080694
.text          C:\WINDOWS\system32\lsass.exe[884] kernel32.dll!CreateProcessW                                                                          7C802332 5 Bytes  JMP 000802C0
.text          C:\WINDOWS\system32\lsass.exe[884] kernel32.dll!CreateProcessA                                                                          7C802367 5 Bytes  JMP 00080234
.text          C:\WINDOWS\system32\lsass.exe[884] kernel32.dll!VirtualAlloc                                                                            7C809A81 5 Bytes  JMP 00080004
.text          C:\WINDOWS\system32\lsass.exe[884] kernel32.dll!VirtualAllocEx                                                                          7C809AA2 5 Bytes  JMP 0008011C
.text          C:\WINDOWS\system32\lsass.exe[884] kernel32.dll!CreateRemoteThread                                                                      7C810626 5 Bytes  JMP 000804F0
.text          C:\WINDOWS\system32\lsass.exe[884] kernel32.dll!CreateThread                                                                            7C81082F 5 Bytes  JMP 0008057C
.text          C:\WINDOWS\system32\lsass.exe[884] kernel32.dll!CreateProcessInternalW                                                                  7C8191EB 5 Bytes  JMP 000803D8
.text          C:\WINDOWS\system32\lsass.exe[884] kernel32.dll!CreateProcessInternalA                                                                  7C81DA9E 5 Bytes  JMP 0008034C
.text          C:\WINDOWS\system32\lsass.exe[884] kernel32.dll!WinExec                                                                                7C86114D 5 Bytes  JMP 00080464
.text          C:\WINDOWS\system32\lsass.exe[884] kernel32.dll!SetThreadContext                                                                        7C862849 5 Bytes  JMP 00080608
.text          C:\WINDOWS\system32\lsass.exe[884] USER32.dll!SetWindowsHookExW                                                                        77D2E4AF 5 Bytes  JMP 000807AC
.text          C:\WINDOWS\system32\lsass.exe[884] USER32.dll!SetWindowsHookExA                                                                        77D311E9 5 Bytes  JMP 00080720
.text          C:\WINDOWS\system32\lsass.exe[884] WS2_32.dll!socket                                                                                    71A13B91 5 Bytes  JMP 000808C4
.text          C:\WINDOWS\system32\lsass.exe[884] WS2_32.dll!bind                                                                                      71A13E00 5 Bytes  JMP 00080838
.text          C:\WINDOWS\system32\lsass.exe[884] WS2_32.dll!connect                                                                                  71A1406A 5 Bytes  JMP 00080950
.text          C:\WINDOWS\system32\UTSCSI.EXE[948] kernel32.dll!VirtualProtectEx                                                                      7C801A5D 5 Bytes  JMP 001301A8
.text          C:\WINDOWS\system32\UTSCSI.EXE[948] kernel32.dll!VirtualProtect                                                                        7C801AD0 5 Bytes  JMP 00130090
.text          C:\WINDOWS\system32\UTSCSI.EXE[948] kernel32.dll!WriteProcessMemory                                                                    7C80220F 5 Bytes  JMP 00130694
.text          C:\WINDOWS\system32\UTSCSI.EXE[948] kernel32.dll!CreateProcessW                                                                        7C802332 5 Bytes  JMP 001302C0
.text          C:\WINDOWS\system32\UTSCSI.EXE[948] kernel32.dll!CreateProcessA                                                                        7C802367 5 Bytes  JMP 00130234
.text          C:\WINDOWS\system32\UTSCSI.EXE[948] kernel32.dll!VirtualAlloc                                                                          7C809A81 5 Bytes  JMP 00130004
.text          C:\WINDOWS\system32\UTSCSI.EXE[948] kernel32.dll!VirtualAllocEx                                                                        7C809AA2 5 Bytes  JMP 0013011C
.text          C:\WINDOWS\system32\UTSCSI.EXE[948] kernel32.dll!CreateRemoteThread                                                                    7C810626 5 Bytes  JMP 001304F0
.text          C:\WINDOWS\system32\UTSCSI.EXE[948] kernel32.dll!CreateThread                                                                          7C81082F 5 Bytes  JMP 0013057C
.text          C:\WINDOWS\system32\UTSCSI.EXE[948] kernel32.dll!CreateProcessInternalW                                                                7C8191EB 5 Bytes  JMP 001303D8
.text          C:\WINDOWS\system32\UTSCSI.EXE[948] kernel32.dll!CreateProcessInternalA                                                                7C81DA9E 5 Bytes  JMP 0013034C
.text          C:\WINDOWS\system32\UTSCSI.EXE[948] kernel32.dll!WinExec                                                                                7C86114D 5 Bytes  JMP 00130464
.text          C:\WINDOWS\system32\UTSCSI.EXE[948] kernel32.dll!SetThreadContext                                                                      7C862849 5 Bytes  JMP 00130608
.text          C:\WINDOWS\system32\Ati2evxx.exe[1056] kernel32.dll!VirtualProtectEx                                                                    7C801A5D 5 Bytes  JMP 001301A8
.text          C:\WINDOWS\system32\Ati2evxx.exe[1056] kernel32.dll!VirtualProtect                                                                      7C801AD0 5 Bytes  JMP 00130090
.text          C:\WINDOWS\system32\Ati2evxx.exe[1056] kernel32.dll!WriteProcessMemory                                                                  7C80220F 5 Bytes  JMP 00130694
.text          C:\WINDOWS\system32\Ati2evxx.exe[1056] kernel32.dll!CreateProcessW                                                                      7C802332 5 Bytes  JMP 001302C0
.text          C:\WINDOWS\system32\Ati2evxx.exe[1056] kernel32.dll!CreateProcessA                                                                      7C802367 5 Bytes  JMP 00130234
.text          C:\WINDOWS\system32\Ati2evxx.exe[1056] kernel32.dll!VirtualAlloc                                                                        7C809A81 5 Bytes  JMP 00130004
.text          C:\WINDOWS\system32\Ati2evxx.exe[1056] kernel32.dll!VirtualAllocEx                                                                      7C809AA2 5 Bytes  JMP 0013011C
.text          C:\WINDOWS\system32\Ati2evxx.exe[1056] kernel32.dll!CreateRemoteThread                                                                  7C810626 5 Bytes  JMP 001304F0
.text          C:\WINDOWS\system32\Ati2evxx.exe[1056] kernel32.dll!CreateThread                                                                        7C81082F 5 Bytes  JMP 0013057C
.text          C:\WINDOWS\system32\Ati2evxx.exe[1056] kernel32.dll!CreateProcessInternalW                                                              7C8191EB 5 Bytes  JMP 001303D8
.text          C:\WINDOWS\system32\Ati2evxx.exe[1056] kernel32.dll!CreateProcessInternalA                                                              7C81DA9E 5 Bytes  JMP 0013034C
.text          C:\WINDOWS\system32\Ati2evxx.exe[1056] kernel32.dll!WinExec                                                                            7C86114D 5 Bytes  JMP 00130464
.text          C:\WINDOWS\system32\Ati2evxx.exe[1056] kernel32.dll!SetThreadContext                                                                    7C862849 5 Bytes  JMP 00130608
.text          C:\WINDOWS\system32\Ati2evxx.exe[1056] USER32.dll!SetWindowsHookExW                                                                    77D2E4AF 5 Bytes  JMP 001307AC
.text          C:\WINDOWS\system32\Ati2evxx.exe[1056] USER32.dll!SetWindowsHookExA                                                                    77D311E9 5 Bytes  JMP 00130720
.text          C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!VirtualProtectEx                                                                    7C801A5D 5 Bytes  JMP 000801A8
.text          C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!VirtualProtect                                                                      7C801AD0 5 Bytes  JMP 00080090
.text          C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!WriteProcessMemory                                                                  7C80220F 5 Bytes  JMP 00080694
.text          C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!CreateProcessW                                                                      7C802332 5 Bytes  JMP 000802C0
.text          C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!CreateProcessA                                                                      7C802367 5 Bytes  JMP 00080234
.text          C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!VirtualAlloc                                                                        7C809A81 5 Bytes  JMP 00080004
.text          C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!VirtualAllocEx                                                                      7C809AA2 5 Bytes  JMP 0008011C
.text          C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!CreateRemoteThread                                                                  7C810626 5 Bytes  JMP 000804F0
.text          C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!CreateThread                                                                        7C81082F 5 Bytes  JMP 0008057C
.text          C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!CreateProcessInternalW                                                              7C8191EB 5 Bytes  JMP 000803D8
.text          C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!CreateProcessInternalA                                                              7C81DA9E 5 Bytes  JMP 0008034C
.text          C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!WinExec                                                                              7C86114D 5 Bytes  JMP 00080464
.text          C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!SetThreadContext                                                                    7C862849 5 Bytes  JMP 00080608
.text          C:\WINDOWS\system32\svchost.exe[1072] USER32.dll!SetWindowsHookExW                                                                      77D2E4AF 5 Bytes  JMP 000807AC
.text          C:\WINDOWS\system32\svchost.exe[1072] USER32.dll!SetWindowsHookExA                                                                      77D311E9 5 Bytes  JMP 00080720
.text          C:\WINDOWS\system32\svchost.exe[1072] WS2_32.dll!socket                                                                                71A13B91 5 Bytes  JMP 000808C4
.text          C:\WINDOWS\system32\svchost.exe[1072] WS2_32.dll!bind                                                                                  71A13E00 5 Bytes  JMP 00080838
.text          C:\WINDOWS\system32\svchost.exe[1072] WS2_32.dll!connect                                                                                71A1406A 5 Bytes  JMP 00080950
.text          C:\WINDOWS\system32\svchost.exe[1140] kernel32.dll!VirtualProtectEx                                                                    7C801A5D 5 Bytes  JMP 000801A8
.text          C:\WINDOWS\system32\svchost.exe[1140] kernel32.dll!VirtualProtect                                                                      7C801AD0 5 Bytes  JMP 00080090
.text          C:\WINDOWS\system32\svchost.exe[1140] kernel32.dll!WriteProcessMemory                                                                  7C80220F 5 Bytes  JMP 00080694
.text          C:\WINDOWS\system32\svchost.exe[1140] kernel32.dll!CreateProcessW                                                                      7C802332 5 Bytes  JMP 000802C0
.text          C:\WINDOWS\system32\svchost.exe[1140] kernel32.dll!CreateProcessA                                                                      7C802367 5 Bytes  JMP 00080234
.text          C:\WINDOWS\system32\svchost.exe[1140] kernel32.dll!VirtualAlloc                                                                        7C809A81 5 Bytes  JMP 00080004
.text          C:\WINDOWS\system32\svchost.exe[1140] kernel32.dll!VirtualAllocEx                                                                      7C809AA2 5 Bytes  JMP 0008011C
.text          C:\WINDOWS\system32\svchost.exe[1140] kernel32.dll!CreateRemoteThread                                                                  7C810626 5 Bytes  JMP 000804F0
.text          C:\WINDOWS\system32\svchost.exe[1140] kernel32.dll!CreateThread                                                                        7C81082F 5 Bytes  JMP 0008057C
.text          C:\WINDOWS\system32\svchost.exe[1140] kernel32.dll!CreateProcessInternalW                                                              7C8191EB 5 Bytes  JMP 000803D8
.text          C:\WINDOWS\system32\svchost.exe[1140] kernel32.dll!CreateProcessInternalA                                                              7C81DA9E 5 Bytes  JMP 0008034C
.text          C:\WINDOWS\system32\svchost.exe[1140] kernel32.dll!WinExec                                                                              7C86114D 5 Bytes  JMP 00080464
.text          C:\WINDOWS\system32\svchost.exe[1140] kernel32.dll!SetThreadContext                                                                    7C862849 5 Bytes  JMP 00080608
.text          C:\WINDOWS\system32\svchost.exe[1140] USER32.dll!SetWindowsHookExW                                                                      77D2E4AF 5 Bytes  JMP 000807AC
.text          C:\WINDOWS\system32\svchost.exe[1140] USER32.dll!SetWindowsHookExA                                                                      77D311E9 5 Bytes  JMP 00080720
.text          C:\WINDOWS\system32\svchost.exe[1140] WS2_32.dll!socket                                                                                71A13B91 5 Bytes  JMP 000808C4
.text          C:\WINDOWS\system32\svchost.exe[1140] WS2_32.dll!bind                                                                                  71A13E00 5 Bytes  JMP 00080838
.text          C:\WINDOWS\system32\svchost.exe[1140] WS2_32.dll!connect                                                                                71A1406A 5 Bytes  JMP 00080950
.text          C:\WINDOWS\System32\svchost.exe[1372] kernel32.dll!VirtualProtectEx                                                                    7C801A5D 5 Bytes  JMP 000801A8
.text          C:\WINDOWS\System32\svchost.exe[1372] kernel32.dll!VirtualProtect                                                                      7C801AD0 5 Bytes  JMP 00080090
.text          C:\WINDOWS\System32\svchost.exe[1372] kernel32.dll!WriteProcessMemory                                                                  7C80220F 5 Bytes  JMP 00080694
.text          C:\WINDOWS\System32\svchost.exe[1372] kernel32.dll!CreateProcessW                                                                      7C802332 5 Bytes  JMP 000802C0
.text          C:\WINDOWS\System32\svchost.exe[1372] kernel32.dll!CreateProcessA                                                                      7C802367 5 Bytes  JMP 00080234
.text          C:\WINDOWS\System32\svchost.exe[1372] kernel32.dll!VirtualAlloc                                                                        7C809A81 5 Bytes  JMP 00080004
.text          C:\WINDOWS\System32\svchost.exe[1372] kernel32.dll!VirtualAllocEx                                                                      7C809AA2 5 Bytes  JMP 0008011C
.text          C:\WINDOWS\System32\svchost.exe[1372] kernel32.dll!CreateRemoteThread                                                                  7C810626 5 Bytes  JMP 000804F0
.text          C:\WINDOWS\System32\svchost.exe[1372] kernel32.dll!CreateThread                                                                        7C81082F 5 Bytes  JMP 0008057C
.text          C:\WINDOWS\System32\svchost.exe[1372] kernel32.dll!CreateProcessInternalW                                                              7C8191EB 5 Bytes  JMP 000803D8
.text          C:\WINDOWS\System32\svchost.exe[1372] kernel32.dll!CreateProcessInternalA                                                              7C81DA9E 5 Bytes  JMP 0008034C
.text          C:\WINDOWS\System32\svchost.exe[1372] kernel32.dll!WinExec                                                                              7C86114D 5 Bytes  JMP 00080464
.text          C:\WINDOWS\System32\svchost.exe[1372] kernel32.dll!SetThreadContext                                                                    7C862849 5 Bytes  JMP 00080608
.text          C:\WINDOWS\System32\svchost.exe[1372] USER32.dll!SetWindowsHookExW                                                                      77D2E4AF 5 Bytes  JMP 000807AC
.text          C:\WINDOWS\System32\svchost.exe[1372] USER32.dll!SetWindowsHookExA                                                                      77D311E9 5 Bytes  JMP 00080720
.text          C:\WINDOWS\System32\svchost.exe[1372] WS2_32.dll!socket                                                                                71A13B91 5 Bytes  JMP 000808C4
.text          C:\WINDOWS\System32\svchost.exe[1372] WS2_32.dll!bind                                                                                  71A13E00 5 Bytes  JMP 00080838
.text          C:\WINDOWS\System32\svchost.exe[1372] WS2_32.dll!connect                                                                                71A1406A 5 Bytes  JMP 00080950
.text          C:\WINDOWS\System32\svchost.exe[1372] WININET.dll!InternetOpenW                                                                        7718AF65 5 Bytes  JMP 00080DB0
.text          C:\WINDOWS\System32\svchost.exe[1372] WININET.dll!InternetConnectA                                                                      771930F3 5 Bytes  JMP 00080F54
.text          C:\WINDOWS\System32\svchost.exe[1372] WININET.dll!InternetOpenA                                                                        771958EA 5 Bytes  JMP 00080D24
.text          C:\WINDOWS\System32\svchost.exe[1372] WININET.dll!InternetOpenUrlA                                                                      77195B9D 5 Bytes  JMP 00080E3C
.text          C:\WINDOWS\System32\svchost.exe[1372] WININET.dll!InternetConnectW                                                                      7719EE30 5 Bytes  JMP 00080FE0
.text          C:\WINDOWS\System32\svchost.exe[1372] WININET.dll!InternetOpenUrlW                                                                      771A5B82 5 Bytes  JMP 00080EC8
.text          C:\WINDOWS\system32\svchost.exe[1412] kernel32.dll!VirtualProtectEx                                                                    7C801A5D 5 Bytes  JMP 000801A8
.text          C:\WINDOWS\system32\svchost.exe[1412] kernel32.dll!VirtualProtect                                                                      7C801AD0 5 Bytes  JMP 00080090
.text          C:\WINDOWS\system32\svchost.exe[1412] kernel32.dll!WriteProcessMemory                                                                  7C80220F 5 Bytes  JMP 00080694
.text          C:\WINDOWS\system32\svchost.exe[1412] kernel32.dll!CreateProcessW                                                                      7C802332 5 Bytes  JMP 000802C0
.text          C:\WINDOWS\system32\svchost.exe[1412] kernel32.dll!CreateProcessA                                                                      7C802367 5 Bytes  JMP 00080234
.text          C:\WINDOWS\system32\svchost.exe[1412] kernel32.dll!VirtualAlloc                                                                        7C809A81 5 Bytes  JMP 00080004
.text          C:\WINDOWS\system32\svchost.exe[1412] kernel32.dll!VirtualAllocEx                                                                      7C809AA2 5 Bytes  JMP 0008011C
.text          C:\WINDOWS\system32\svchost.exe[1412] kernel32.dll!CreateRemoteThread                                                                  7C810626 5 Bytes  JMP 000804F0
.text          C:\WINDOWS\system32\svchost.exe[1412] kernel32.dll!CreateThread                                                                        7C81082F 5 Bytes  JMP 0008057C
.text          C:\WINDOWS\system32\svchost.exe[1412] kernel32.dll!CreateProcessInternalW                                                              7C8191EB 5 Bytes  JMP 000803D8
.text          C:\WINDOWS\system32\svchost.exe[1412] kernel32.dll!CreateProcessInternalA                                                              7C81DA9E 5 Bytes  JMP 0008034C
.text          C:\WINDOWS\system32\svchost.exe[1412] kernel32.dll!WinExec                                                                              7C86114D 5 Bytes  JMP 00080464
.text          C:\WINDOWS\system32\svchost.exe[1412] kernel32.dll!SetThreadContext                                                                    7C862849 5 Bytes  JMP 00080608
.text          C:\WINDOWS\system32\svchost.exe[1412] USER32.dll!SetWindowsHookExW                                                                      77D2E4AF 5 Bytes  JMP 000807AC
.text          C:\WINDOWS\system32\svchost.exe[1412] USER32.dll!SetWindowsHookExA                                                                      77D311E9 5 Bytes  JMP 00080720
.text          C:\WINDOWS\system32\svchost.exe[1520] kernel32.dll!VirtualProtectEx                                                                    7C801A5D 5 Bytes  JMP 000801A8
.text          C:\WINDOWS\system32\svchost.exe[1520] kernel32.dll!VirtualProtect                                                                      7C801AD0 5 Bytes  JMP 00080090
.text          C:\WINDOWS\system32\svchost.exe[1520] kernel32.dll!WriteProcessMemory                                                                  7C80220F 5 Bytes  JMP 00080694
.text          C:\WINDOWS\system32\svchost.exe[1520] kernel32.dll!CreateProcessW                                                                      7C802332 5 Bytes  JMP 000802C0
.text          C:\WINDOWS\system32\svchost.exe[1520] kernel32.dll!CreateProcessA                                                                      7C802367 5 Bytes  JMP 00080234
.text          C:\WINDOWS\system32\svchost.exe[1520] kernel32.dll!VirtualAlloc                                                                        7C809A81 5 Bytes  JMP 00080004
.text          C:\WINDOWS\system32\svchost.exe[1520] kernel32.dll!VirtualAllocEx                                                                      7C809AA2 5 Bytes  JMP 0008011C
.text          C:\WINDOWS\system32\svchost.exe[1520] kernel32.dll!CreateRemoteThread                                                                  7C810626 5 Bytes  JMP 000804F0
.text          C:\WINDOWS\system32\svchost.exe[1520] kernel32.dll!CreateThread                                                                        7C81082F 5 Bytes  JMP 0008057C
.text          C:\WINDOWS\system32\svchost.exe[1520] kernel32.dll!CreateProcessInternalW                                                              7C8191EB 5 Bytes  JMP 000803D8
.text          C:\WINDOWS\system32\svchost.exe[1520] kernel32.dll!CreateProcessInternalA                                                              7C81DA9E 5 Bytes  JMP 0008034C
.text          C:\WINDOWS\system32\svchost.exe[1520] kernel32.dll!WinExec                                                                              7C86114D 5 Bytes  JMP 00080464
.text          C:\WINDOWS\system32\svchost.exe[1520] kernel32.dll!SetThreadContext                                                                    7C862849 5 Bytes  JMP 00080608
.text          C:\WINDOWS\system32\svchost.exe[1520] USER32.dll!SetWindowsHookExW                                                                      77D2E4AF 5 Bytes  JMP 000807AC
.text          C:\WINDOWS\system32\svchost.exe[1520] USER32.dll!SetWindowsHookExA                                                                      77D311E9 5 Bytes  JMP 00080720
.text          C:\WINDOWS\system32\svchost.exe[1520] WS2_32.dll!socket                                                                                71A13B91 5 Bytes  JMP 000808C4
.text          C:\WINDOWS\system32\svchost.exe[1520] WS2_32.dll!bind                                                                                  71A13E00 5 Bytes  JMP 00080838
.text          C:\WINDOWS\system32\svchost.exe[1520] WS2_32.dll!connect                                                                                71A1406A 5 Bytes  JMP 00080950
.text          C:\Programme\a-squared Free\a2service.exe[1576] kernel32.dll!VirtualProtectEx                                                          7C801A5D 5 Bytes  JMP 001301A8
.text          C:\Programme\a-squared Free\a2service.exe[1576] kernel32.dll!VirtualProtect                                                            7C801AD0 5 Bytes  JMP 00130090
.text          C:\Programme\a-squared Free\a2service.exe[1576] kernel32.dll!WriteProcessMemory                                                        7C80220F 5 Bytes  JMP 00130694
.text          C:\Programme\a-squared Free\a2service.exe[1576] kernel32.dll!CreateProcessW                                                            7C802332 5 Bytes  JMP 001302C0
.text          C:\Programme\a-squared Free\a2service.exe[1576] kernel32.dll!CreateProcessA                                                            7C802367 5 Bytes  JMP 00130234
.text          C:\Programme\a-squared Free\a2service.exe[1576] kernel32.dll!VirtualAlloc                                                              7C809A81 5 Bytes  JMP 00130004
.text          C:\Programme\a-squared Free\a2service.exe[1576] kernel32.dll!VirtualAllocEx                                                            7C809AA2 5 Bytes  JMP 0013011C
.text          C:\Programme\a-squared Free\a2service.exe[1576] kernel32.dll!CreateRemoteThread                                                        7C810626 5 Bytes  JMP 001304F0
.text          C:\Programme\a-squared Free\a2service.exe[1576] kernel32.dll!CreateThread                                                              7C81082F 5 Bytes  JMP 0013057C
.text          C:\Programme\a-squared Free\a2service.exe[1576] kernel32.dll!CreateProcessInternalW                                                    7C8191EB 5 Bytes  JMP 001303D8
.text          C:\Programme\a-squared Free\a2service.exe[1576] kernel32.dll!CreateProcessInternalA                                                    7C81DA9E 5 Bytes  JMP 0013034C
.text          C:\Programme\a-squared Free\a2service.exe[1576] kernel32.dll!WinExec                                                                    7C86114D 5 Bytes  JMP 00130464
.text          C:\Programme\a-squared Free\a2service.exe[1576] kernel32.dll!SetThreadContext                                                          7C862849 5 Bytes  JMP 00130608
.text          C:\Programme\a-squared Free\a2service.exe[1576] USER32.dll!SetWindowsHookExW                                                            77D2E4AF 5 Bytes  JMP 001307AC
.text          C:\Programme\a-squared Free\a2service.exe[1576] USER32.dll!SetWindowsHookExA                                                            77D311E9 5 Bytes  JMP 00130720
.text          C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avguard.exe[1600] kernel32.dll!VirtualProtectEx                                        7C801A5D 5 Bytes  JMP 001301A8
.text          C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avguard.exe[1600] kernel32.dll!VirtualProtect                                          7C801AD0 5 Bytes  JMP 00130090
.text          C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avguard.exe[1600] kernel32.dll!WriteProcessMemory                                      7C80220F 5 Bytes  JMP 00130694
.text          C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avguard.exe[1600] kernel32.dll!CreateProcessW                                          7C802332 5 Bytes  JMP 001302C0
.text          C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avguard.exe[1600] kernel32.dll!CreateProcessA                                          7C802367 5 Bytes  JMP 00130234
.text          C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avguard.exe[1600] kernel32.dll!VirtualAlloc                                            7C809A81 5 Bytes  JMP 00130004
.text          C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avguard.exe[1600] kernel32.dll!VirtualAllocEx                                          7C809AA2 5 Bytes  JMP 0013011C
.text          C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avguard.exe[1600] kernel32.dll!CreateRemoteThread                                      7C810626 5 Bytes  JMP 001304F0
.text          C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avguard.exe[1600] kernel32.dll!CreateThread                                            7C81082F 5 Bytes  JMP 0013057C
.text          C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avguard.exe[1600] kernel32.dll!CreateProcessInternalW                                  7C8191EB 5 Bytes  JMP 001303D8
.text          C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avguard.exe[1600] kernel32.dll!CreateProcessInternalA                                  7C81DA9E 5 Bytes  JMP 0013034C
.text          C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avguard.exe[1600] kernel32.dll!WinExec                                                7C86114D 5 Bytes  JMP 00130464
.text          C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avguard.exe[1600] kernel32.dll!SetThreadContext                                        7C862849 5 Bytes  JMP 00130608
.text          C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avguard.exe[1600] USER32.dll!SetWindowsHookExW                                        77D2E4AF 5 Bytes  JMP 001307AC
.text          C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avguard.exe[1600] USER32.dll!SetWindowsHookExA                                        77D311E9 5 Bytes  JMP 00130720
.text          C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avguard.exe[1600] WS2_32.dll!socket                                                    71A13B91 5 Bytes  JMP 001308C4
.text          C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avguard.exe[1600] WS2_32.dll!bind                                                      71A13E00 5 Bytes  JMP 00130838
.text          C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avguard.exe[1600] WS2_32.dll!connect                                                  71A1406A 5 Bytes  JMP 00130950
.text          C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1644] kernel32.dll!VirtualProtectEx        7C801A5D 5 Bytes  JMP 001301A8
.text          C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1644] kernel32.dll!VirtualProtect          7C801AD0 5 Bytes  JMP 00130090
.text          C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1644] kernel32.dll!WriteProcessMemory      7C80220F 5 Bytes  JMP 00130694
.text          C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1644] kernel32.dll!CreateProcessW          7C802332 5 Bytes  JMP 001302C0
.text          C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1644] kernel32.dll!CreateProcessA          7C802367 5 Bytes  JMP 00130234
.text          C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1644] kernel32.dll!VirtualAlloc            7C809A81 5 Bytes  JMP 00130004
.text          C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1644] kernel32.dll!VirtualAllocEx          7C809AA2 5 Bytes  JMP 0013011C
.text          C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1644] kernel32.dll!CreateRemoteThread      7C810626 5 Bytes  JMP 001304F0
.text          C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1644] kernel32.dll!CreateThread            7C81082F 5 Bytes  JMP 0013057C
.text          C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1644] kernel32.dll!CreateProcessInternalW  7C8191EB 5 Bytes  JMP 001303D8
.text          C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1644] kernel32.dll!CreateProcessInternalA  7C81DA9E 5 Bytes  JMP 0013034C
.text          C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1644] kernel32.dll!WinExec                7C86114D 5 Bytes  JMP 00130464
.text          C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1644] kernel32.dll!SetThreadContext        7C862849 5 Bytes  JMP 00130608
.text          C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1644] WS2_32.dll!socket                    71A13B91 5 Bytes  JMP 001308C4
.text          C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1644] WS2_32.dll!bind                      71A13E00 5 Bytes  JMP 00130838
.text          C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1644] WS2_32.dll!connect                  71A1406A 5 Bytes  JMP 00130950
.text          C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1644] USER32.dll!SetWindowsHookExW        77D2E4AF 5 Bytes  JMP 001307AC
.text          C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1644] USER32.dll!SetWindowsHookExA        77D311E9 5 Bytes  JMP 00130720
.text          C:\WINDOWS\system32\CTsvcCDA.EXE[1688] kernel32.dll!VirtualProtectEx                                                                    7C801A5D 5 Bytes  JMP 001301A8
.text          C:\WINDOWS\system32\CTsvcCDA.EXE[1688] kernel32.dll!VirtualProtect                                                                      7C801AD0 5 Bytes  JMP 00130090
.text          C:\WINDOWS\system32\CTsvcCDA.EXE[1688] kernel32.dll!WriteProcessMemory                                                                  7C80220F 5 Bytes  JMP 00130694
.text          C:\WINDOWS\system32\CTsvcCDA.EXE[1688] kernel32.dll!CreateProcessW                                                                      7C802332 5 Bytes  JMP 001302C0
.text          C:\WINDOWS\system32\CTsvcCDA.EXE[1688] kernel32.dll!CreateProcessA                                                                      7C802367 5 Bytes  JMP 00130234
.text          C:\WINDOWS\system32\CTsvcCDA.EXE[1688] kernel32.dll!VirtualAlloc                                                                        7C809A81 5 Bytes  JMP 00130004
.text          C:\WINDOWS\system32\CTsvcCDA.EXE[1688] kernel32.dll!VirtualAllocEx                                                                      7C809AA2 5 Bytes  JMP 0013011C
.text          C:\WINDOWS\system32\CTsvcCDA.EXE[1688] kernel32.dll!CreateRemoteThread                                                                  7C810626 5 Bytes  JMP 001304F0
.text          C:\WINDOWS\system32\CTsvcCDA.EXE[1688] kernel32.dll!CreateThread                                                                        7C81082F 5 Bytes  JMP 0013057C
.text          C:\WINDOWS\system32\CTsvcCDA.EXE[1688] kernel32.dll!CreateProcessInternalW                                                              7C8191EB 5 Bytes  JMP 001303D8
.text          C:\WINDOWS\system32\CTsvcCDA.EXE[1688] kernel32.dll!CreateProcessInternalA                                                              7C81DA9E 5 Bytes  JMP 0013034C
.text          C:\WINDOWS\system32\CTsvcCDA.EXE[1688] kernel32.dll!WinExec                                                                            7C86114D 5 Bytes  JMP 00130464
.text          C:\WINDOWS\system32\CTsvcCDA.EXE[1688] kernel32.dll!SetThreadContext                                                                    7C862849 5 Bytes  JMP 00130608
.text          C:\WINDOWS\system32\CTsvcCDA.EXE[1688] USER32.dll!SetWindowsHookExW                                                                    77D2E4AF 5 Bytes  JMP 001307AC
.text          C:\WINDOWS\system32\CTsvcCDA.EXE[1688] USER32.dll!SetWindowsHookExA                                                                    77D311E9 5 Bytes  JMP 00130720
.text          C:\Programme\Java\jre6\bin\jqs.exe[1732] kernel32.dll!VirtualProtectEx                                                                  7C801A5D 5 Bytes  JMP 001301A8
.text          C:\Programme\Java\jre6\bin\jqs.exe[1732] kernel32.dll!VirtualProtect                                                                    7C801AD0 5 Bytes  JMP 00130090
.text          C:\Programme\Java\jre6\bin\jqs.exe[1732] kernel32.dll!WriteProcessMemory                                                                7C80220F 5 Bytes  JMP 00130694
.text          C:\Programme\Java\jre6\bin\jqs.exe[1732] kernel32.dll!CreateProcessW                                                                    7C802332 5 Bytes  JMP 001302C0
.text          C:\Programme\Java\jre6\bin\jqs.exe[1732] kernel32.dll!CreateProcessA                                                                    7C802367 5 Bytes  JMP 00130234
.text          C:\Programme\Java\jre6\bin\jqs.exe[1732] kernel32.dll!VirtualAlloc                                                                      7C809A81 5 Bytes  JMP 00130004
.text          C:\Programme\Java\jre6\bin\jqs.exe[1732] kernel32.dll!VirtualAllocEx                                                                    7C809AA2 5 Bytes  JMP 0013011C
.text          C:\Programme\Java\jre6\bin\jqs.exe[1732] kernel32.dll!CreateRemoteThread                                                                7C810626 5 Bytes  JMP 001304F0
.text          C:\Programme\Java\jre6\bin\jqs.exe[1732] kernel32.dll!CreateThread                                                                      7C81082F 5 Bytes  JMP 0013057C
.text          C:\Programme\Java\jre6\bin\jqs.exe[1732] kernel32.dll!CreateProcessInternalW                                                            7C8191EB 5 Bytes  JMP 001303D8
.text          C:\Programme\Java\jre6\bin\jqs.exe[1732] kernel32.dll!CreateProcessInternalA                                                            7C81DA9E 5 Bytes  JMP 0013034C
.text          C:\Programme\Java\jre6\bin\jqs.exe[1732] kernel32.dll!WinExec                                                                          7C86114D 5 Bytes  JMP 00130464
.text          C:\Programme\Java\jre6\bin\jqs.exe[1732] kernel32.dll!SetThreadContext                                                                  7C862849 5 Bytes  JMP 00130608
.text          C:\Programme\Java\jre6\bin\jqs.exe[1732] WS2_32.dll!socket                                                                              71A13B91 5 Bytes  JMP 001308C4
.text          C:\Programme\Java\jre6\bin\jqs.exe[1732] WS2_32.dll!bind                                                                                71A13E00 5 Bytes  JMP 00130838
.text          C:\Programme\Java\jre6\bin\jqs.exe[1732] WS2_32.dll!connect                                                                            71A1406A 5 Bytes  JMP 00130950
.text          C:\Programme\Java\jre6\bin\jqs.exe[1732] USER32.dll!SetWindowsHookExW                                                                  77D2E4AF 5 Bytes  JMP 001307AC
.text          C:\Programme\Java\jre6\bin\jqs.exe[1732] USER32.dll!SetWindowsHookExA                                                                  77D311E9 5 Bytes  JMP 00130720
.text          C:\WINDOWS\system32\svchost.exe[1768] kernel32.dll!VirtualProtectEx                                                                    7C801A5D 5 Bytes  JMP 000801A8
.text          C:\WINDOWS\system32\svchost.exe[1768] kernel32.dll!VirtualProtect                                                                      7C801AD0 5 Bytes  JMP 00080090
.text          C:\WINDOWS\system32\svchost.exe[1768] kernel32.dll!WriteProcessMemory                                                                  7C80220F 5 Bytes  JMP 00080694
.text          C:\WINDOWS\system32\svchost.exe[1768] kernel32.dll!CreateProcessW                                                                      7C802332 5 Bytes  JMP 000802C0
.text          C:\WINDOWS\system32\svchost.exe[1768] kernel32.dll!CreateProcessA                                                                      7C802367 5 Bytes  JMP 00080234
.text          C:\WINDOWS\system32\svchost.exe[1768] kernel32.dll!VirtualAlloc                                                                        7C809A81 5 Bytes  JMP 00080004
.text          C:\WINDOWS\system32\svchost.exe[1768] kernel32.dll!VirtualAllocEx                                                                      7C809AA2 5 Bytes  JMP 0008011C
.text          C:\WINDOWS\system32\svchost.exe[1768] kernel32.dll!CreateRemoteThread                                                                  7C810626 5 Bytes  JMP 000804F0
.text          C:\WINDOWS\system32\svchost.exe[1768] kernel32.dll!CreateThread                                                                        7C81082F 5 Bytes  JMP 0008057C
.text          C:\WINDOWS\system32\svchost.exe[1768] kernel32.dll!CreateProcessInternalW                                                              7C8191EB 5 Bytes  JMP 000803D8
.text          C:\WINDOWS\system32\svchost.exe[1768] kernel32.dll!CreateProcessInternalA                                                              7C81DA9E 5 Bytes  JMP 0008034C
.text          C:\WINDOWS\system32\svchost.exe[1768] kernel32.dll!WinExec                                                                              7C86114D 5 Bytes  JMP 00080464
.text          C:\WINDOWS\system32\svchost.exe[1768] kernel32.dll!SetThreadContext                                                                    7C862849 5 Bytes  JMP 00080608
.text          C:\WINDOWS\system32\svchost.exe[1768] USER32.dll!SetWindowsHookExW                                                                      77D2E4AF 5 Bytes  JMP 000807AC
.text          C:\WINDOWS\system32\svchost.exe[1768] USER32.dll!SetWindowsHookExA                                                                      77D311E9 5 Bytes  JMP 00080720
.text          C:\WINDOWS\system32\svchost.exe[1768] WS2_32.dll!socket                                                                                71A13B91 5 Bytes  JMP 000808C4
.text          C:\WINDOWS\system32\svchost.exe[1768] WS2_32.dll!bind                                                                                  71A13E00 5 Bytes  JMP 00080838
.text          C:\WINDOWS\system32\svchost.exe[1768] WS2_32.dll!connect                                                                                71A1406A 5 Bytes  JMP 00080950
.text          C:\WINDOWS\system32\svchost.exe[1768] WININET.dll!InternetOpenW                                                                        7718AF65 5 Bytes  JMP 00080DB0
.text          C:\WINDOWS\system32\svchost.exe[1768] WININET.dll!InternetConnectA                                                                      771930F3 5 Bytes  JMP 00080F54
.text          C:\WINDOWS\system32\svchost.exe[1768] WININET.dll!InternetOpenA                                                                        771958EA 5 Bytes  JMP 00080D24
.text          C:\WINDOWS\system32\svchost.exe[1768] WININET.dll!InternetOpenUrlA                                                                      77195B9D 5 Bytes  JMP 00080E3C
.text          C:\WINDOWS\system32\svchost.exe[1768] WININET.dll!InternetConnectW                                                                      7719EE30 5 Bytes  JMP 00080FE0
.text          C:\WINDOWS\system32\svchost.exe[1768] WININET.dll!InternetOpenUrlW                                                                      771A5B82 5 Bytes  JMP 00080EC8
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe[1808] kernel32.dll!VirtualProtectEx                                          7C801A5D 5 Bytes  JMP 000301A8
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe[1808] kernel32.dll!VirtualProtect                                            7C801AD0 5 Bytes  JMP 00030090
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe[1808] kernel32.dll!WriteProcessMemory                                        7C80220F 5 Bytes  JMP 00030694
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe[1808] kernel32.dll!CreateProcessW                                            7C802332 5 Bytes  JMP 000302C0
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe[1808] kernel32.dll!CreateProcessA                                            7C802367 5 Bytes  JMP 00030234
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe[1808] kernel32.dll!VirtualAlloc                                              7C809A81 5 Bytes  JMP 00030004
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe[1808] kernel32.dll!VirtualAllocEx                                            7C809AA2 5 Bytes  JMP 0003011C
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe[1808] kernel32.dll!CreateRemoteThread                                        7C810626 5 Bytes  JMP 000304F0
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe[1808] kernel32.dll!CreateThread                                              7C81082F 5 Bytes  JMP 0003057C
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe[1808] kernel32.dll!CreateProcessInternalW                                    7C8191EB 5 Bytes  JMP 000303D8
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe[1808] kernel32.dll!CreateProcessInternalA                                    7C81DA9E 5 Bytes  JMP 0003034C
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe[1808] kernel32.dll!WinExec                                                  7C86114D 5 Bytes  JMP 00030464
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe[1808] kernel32.dll!SetThreadContext                                          7C862849 5 Bytes  JMP 00030608
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe[1808] USER32.dll!SetWindowsHookExW                                          77D2E4AF 5 Bytes  JMP 000307AC
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe[1808] USER32.dll!SetWindowsHookExA                                          77D311E9 5 Bytes  JMP 00030720
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe[1808] WS2_32.dll!socket                                                      71A13B91 5 Bytes  JMP 000308C4
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe[1808] WS2_32.dll!bind                                                        71A13E00 5 Bytes  JMP 00030838
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe[1808] WS2_32.dll!connect                                                    71A1406A 5 Bytes  JMP 00030950
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe[1808] WININET.dll!InternetOpenW                                              7718AF65 5 Bytes  JMP 00030DB0
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe[1808] WININET.dll!InternetConnectA                                          771930F3 5 Bytes  JMP 00030F54
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe[1808] WININET.dll!InternetOpenA                                              771958EA 5 Bytes  JMP 00030D24
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe[1808] WININET.dll!InternetOpenUrlA                                          77195B9D 5 Bytes  JMP 00030E3C
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe[1808] WININET.dll!InternetConnectW                                          7719EE30 5 Bytes  JMP 00030FE0
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe[1808] WININET.dll!InternetOpenUrlW                                          771A5B82 5 Bytes  JMP 00030EC8
.text          C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[1848] kernel32.dll!VirtualProtectEx                                      7C801A5D 5 Bytes  JMP 001301A8
.text          C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[1848] kernel32.dll!VirtualProtect                                        7C801AD0 5 Bytes  JMP 00130090
.text          C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[1848] kernel32.dll!WriteProcessMemory                                    7C80220F 5 Bytes  JMP 00130694
.text          C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[1848] kernel32.dll!CreateProcessW                                        7C802332 5 Bytes  JMP 001302C0
.text          C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[1848] kernel32.dll!CreateProcessA                                        7C802367 5 Bytes  JMP 00130234
.text          C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[1848] kernel32.dll!VirtualAlloc                                          7C809A81 5 Bytes  JMP 00130004
.text          C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[1848] kernel32.dll!VirtualAllocEx                                        7C809AA2 5 Bytes  JMP 0013011C
.text          C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[1848] kernel32.dll!CreateRemoteThread                                    7C810626 5 Bytes  JMP 001304F0
.text          C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[1848] kernel32.dll!CreateThread                                          7C81082F 5 Bytes  JMP 0013057C
.text          C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[1848] kernel32.dll!CreateProcessInternalW                                7C8191EB 5 Bytes  JMP 001303D8
.text          C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[1848] kernel32.dll!CreateProcessInternalA                                7C81DA9E 5 Bytes  JMP 0013034C
.text          C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[1848] kernel32.dll!WinExec                                              7C86114D 5 Bytes  JMP 00130464
.text          C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[1848] kernel32.dll!SetThreadContext                                      7C862849 5 Bytes  JMP 00130608
.text          C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[1848] USER32.dll!SetWindowsHookExW                                      77D2E4AF 5 Bytes  JMP 001307AC
.text          C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[1848] USER32.dll!SetWindowsHookExA                                      77D311E9 5 Bytes  JMP 00130720
.text          C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[1848] WS2_32.dll!socket                                                  71A13B91 5 Bytes  JMP 001308C4
.text          C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[1848] WS2_32.dll!bind                                                    71A13E00 5 Bytes  JMP 00130838
.text          C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[1848] WS2_32.dll!connect                                                71A1406A 5 Bytes  JMP 00130950
.text          C:\Programme\Lavasoft\Ad-Aware\aawservice.exe[1896] kernel32.dll!VirtualProtectEx                                                      7C801A5D 5 Bytes  JMP 001301A8
.text          C:\Programme\Lavasoft\Ad-Aware\aawservice.exe[1896] kernel32.dll!VirtualProtect                                                        7C801AD0 5 Bytes  JMP 00130090
.text          C:\Programme\Lavasoft\Ad-Aware\aawservice.exe[1896] kernel32.dll!WriteProcessMemory                                                    7C80220F 5 Bytes  JMP 00130694
.text          C:\Programme\Lavasoft\Ad-Aware\aawservice.exe[1896] kernel32.dll!CreateProcessW                                                        7C802332 5 Bytes  JMP 001302C0
.text          C:\Programme\Lavasoft\Ad-Aware\aawservice.exe[1896] kernel32.dll!CreateProcessA                                                        7C802367 5 Bytes  JMP 00130234
.text          C:\Programme\Lavasoft\Ad-Aware\aawservice.exe[1896] kernel32.dll!VirtualAlloc                                                          7C809A81 5 Bytes  JMP 00130004
.text          C:\Programme\Lavasoft\Ad-Aware\aawservice.exe[1896] kernel32.dll!VirtualAllocEx                                                        7C809AA2 5 Bytes  JMP 0013011C
.text          C:\Programme\Lavasoft\Ad-Aware\aawservice.exe[1896] kernel32.dll!CreateRemoteThread                                                    7C810626 5 Bytes  JMP 001304F0
.text          C:\Programme\Lavasoft\Ad-Aware\aawservice.exe[1896] kernel32.dll!CreateThread                                                          7C81082F 5 Bytes  JMP 0013057C
.text          C:\Programme\Lavasoft\Ad-Aware\aawservice.exe[1896] kernel32.dll!CreateProcessInternalW                                                7C8191EB 5 Bytes  JMP 001303D8
.text          C:\Programme\Lavasoft\Ad-Aware\aawservice.exe[1896] kernel32.dll!CreateProcessInternalA                                                7C81DA9E 5 Bytes  JMP 0013034C
.text          C:\Programme\Lavasoft\Ad-Aware\aawservice.exe[1896] kernel32.dll!WinExec                                                                7C86114D 5 Bytes  JMP 00130464
.text          C:\Programme\Lavasoft\Ad-Aware\aawservice.exe[1896] kernel32.dll!SetThreadContext                                                      7C862849 5 Bytes  JMP 00130608
.text          C:\Programme\Lavasoft\Ad-Aware\aawservice.exe[1896] WININET.dll!InternetOpenW                                                          7718AF65 5 Bytes  JMP 00130DB0
.text          C:\Programme\Lavasoft\Ad-Aware\aawservice.exe[1896] WININET.dll!InternetConnectA                                                        771930F3 5 Bytes  JMP 00130F54
.text          C:\Programme\Lavasoft\Ad-Aware\aawservice.exe[1896] WININET.dll!InternetOpenA                                                          771958EA 5 Bytes  JMP 00130D24
.text          C:\Programme\Lavasoft\Ad-Aware\aawservice.exe[1896] WININET.dll!InternetOpenUrlA                                                        77195B9D 5 Bytes  JMP 00130E3C
.text          C:\Programme\Lavasoft\Ad-Aware\aawservice.exe[1896] WININET.dll!InternetConnectW                                                        7719EE30 5 Bytes  JMP 00130FE0
.text          C:\Programme\Lavasoft\Ad-Aware\aawservice.exe[1896] WININET.dll!InternetOpenUrlW                                                        771A5B82 5 Bytes  JMP 00130EC8
.text          C:\Programme\Lavasoft\Ad-Aware\aawservice.exe[1896] USER32.dll!SetWindowsHookExW                                                        77D2E4AF 5 Bytes  JMP 001307AC
.text          C:\Programme\Lavasoft\Ad-Aware\aawservice.exe[1896] USER32.dll!SetWindowsHookExA                                                        77D311E9 5 Bytes  JMP 00130720
.text          C:\Programme\Lavasoft\Ad-Aware\aawservice.exe[1896] WS2_32.dll!socket                                                                  71A13B91 5 Bytes  JMP 001308C4
.text          C:\Programme\Lavasoft\Ad-Aware\aawservice.exe[1896] WS2_32.dll!bind                                                                    71A13E00 5 Bytes  JMP 00130838
.text          C:\Programme\Lavasoft\Ad-Aware\aawservice.exe[1896] WS2_32.dll!connect                                                                  71A1406A 5 Bytes  JMP 00130950
.text          C:\WINDOWS\system32\Ati2evxx.exe[2000] kernel32.dll!VirtualProtectEx                                                                    7C801A5D 5 Bytes  JMP 001301A8
.text          C:\WINDOWS\system32\Ati2evxx.exe[2000] kernel32.dll!VirtualProtect                                                                      7C801AD0 5 Bytes  JMP 00130090
.text          C:\WINDOWS\system32\Ati2evxx.exe[2000] kernel32.dll!WriteProcessMemory                                                                  7C80220F 5 Bytes  JMP 00130694
.text          C:\WINDOWS\system32\Ati2evxx.exe[2000] kernel32.dll!CreateProcessW                                                                      7C802332 5 Bytes  JMP 001302C0
.text          C:\WINDOWS\system32\Ati2evxx.exe[2000] kernel32.dll!CreateProcessA                                                                      7C802367 5 Bytes  JMP 00130234
.text          C:\WINDOWS\system32\Ati2evxx.exe[2000] kernel32.dll!VirtualAlloc                                                                        7C809A81 5 Bytes  JMP 00130004
.text          C:\WINDOWS\system32\Ati2evxx.exe[2000] kernel32.dll!VirtualAllocEx                                                                      7C809AA2 5 Bytes  JMP 0013011C
.text          C:\WINDOWS\system32\Ati2evxx.exe[2000] kernel32.dll!CreateRemoteThread                                                                  7C810626 5 Bytes  JMP 001304F0
.text          C:\WINDOWS\system32\Ati2evxx.exe[2000] kernel32.dll!CreateThread                                                                        7C81082F 5 Bytes  JMP 0013057C
.text          C:\WINDOWS\system32\Ati2evxx.exe[2000] kernel32.dll!CreateProcessInternalW                                                              7C8191EB 5 Bytes  JMP 001303D8
.text          C:\WINDOWS\system32\Ati2evxx.exe[2000] kernel32.dll!CreateProcessInternalA                                                              7C81DA9E 5 Bytes  JMP 0013034C
.text          C:\WINDOWS\system32\Ati2evxx.exe[2000] kernel32.dll!WinExec                                                                            7C86114D 5 Bytes  JMP 00130464
.text          C:\WINDOWS\system32\Ati2evxx.exe[2000] kernel32.dll!SetThreadContext                                                                    7C862849 5 Bytes  JMP 00130608
.text          C:\WINDOWS\system32\Ati2evxx.exe[2000] USER32.dll!SetWindowsHookExW                                                                    77D2E4AF 5 Bytes  JMP 001307AC
.text          C:\WINDOWS\system32\Ati2evxx.exe[2000] USER32.dll!SetWindowsHookExA                                                                    77D311E9 5 Bytes  JMP 00130720
.text          C:\WINDOWS\system32\wbem\wmiapsrv.exe[2272] kernel32.dll!VirtualProtectEx                                                              7C801A5D 5 Bytes  JMP 000801A8
.text          C:\WINDOWS\system32\wbem\wmiapsrv.exe[2272] kernel32.dll!VirtualProtect                                                                7C801AD0 5 Bytes  JMP 00080090
.text          C:\WINDOWS\system32\wbem\wmiapsrv.exe[2272] kernel32.dll!WriteProcessMemory                                                            7C80220F 5 Bytes  JMP 00080694
.text          C:\WINDOWS\system32\wbem\wmiapsrv.exe[2272] kernel32.dll!CreateProcessW                                                                7C802332 5 Bytes  JMP 000802C0
.text          C:\WINDOWS\system32\wbem\wmiapsrv.exe[2272] kernel32.dll!CreateProcessA                                                                7C802367 5 Bytes  JMP 00080234
.text          C:\WINDOWS\system32\wbem\wmiapsrv.exe[2272] kernel32.dll!VirtualAlloc                                                                  7C809A81 5 Bytes  JMP 00080004
.text          C:\WINDOWS\system32\wbem\wmiapsrv.exe[2272] kernel32.dll!VirtualAllocEx                                                                7C809AA2 5 Bytes  JMP 0008011C
.text          C:\WINDOWS\system32\wbem\wmiapsrv.exe[2272] kernel32.dll!CreateRemoteThread                                                            7C810626 5 Bytes  JMP 000804F0
.text          C:\WINDOWS\system32\wbem\wmiapsrv.exe[2272] kernel32.dll!CreateThread                                                                  7C81082F 5 Bytes  JMP 0008057C
.text          C:\WINDOWS\system32\wbem\wmiapsrv.exe[2272] kernel32.dll!CreateProcessInternalW                                                        7C8191EB 5 Bytes  JMP 000803D8
.text          C:\WINDOWS\system32\wbem\wmiapsrv.exe[2272] kernel32.dll!CreateProcessInternalA                                                        7C81DA9E 5 Bytes  JMP 0008034C
.text          C:\WINDOWS\system32\wbem\wmiapsrv.exe[2272] kernel32.dll!WinExec                                                                        7C86114D 5 Bytes  JMP 00080464
.text          C:\WINDOWS\system32\wbem\wmiapsrv.exe[2272] kernel32.dll!SetThreadContext                                                              7C862849 5 Bytes  JMP 00080608
.text          C:\WINDOWS\system32\wbem\wmiapsrv.exe[2272] USER32.dll!SetWindowsHookExW                                                                77D2E4AF 5 Bytes  JMP 000807AC
.text          C:\WINDOWS\system32\wbem\wmiapsrv.exe[2272] USER32.dll!SetWindowsHookExA                                                                77D311E9 5 Bytes  JMP 00080720
.text          C:\WINDOWS\system32\wbem\wmiapsrv.exe[2272] WS2_32.dll!socket                                                                          71A13B91 5 Bytes  JMP 000808C4
.text          C:\WINDOWS\system32\wbem\wmiapsrv.exe[2272] WS2_32.dll!bind                                                                            71A13E00 5 Bytes  JMP 00080838
.text          C:\WINDOWS\system32\wbem\wmiapsrv.exe[2272] WS2_32.dll!connect                                                                          71A1406A 5 Bytes  JMP 00080950
.text          C:\WINDOWS\system32\wscntfy.exe[2388] kernel32.dll!VirtualProtectEx                                                                    7C801A5D 5 Bytes  JMP 000701A8
.text          C:\WINDOWS\system32\wscntfy.exe[2388] kernel32.dll!VirtualProtect                                                                      7C801AD0 5 Bytes  JMP 00070090
.text          C:\WINDOWS\system32\wscntfy.exe[2388] kernel32.dll!WriteProcessMemory                                                                  7C80220F 5 Bytes  JMP 00070694
.text          C:\WINDOWS\system32\wscntfy.exe[2388] kernel32.dll!CreateProcessW                                                                      7C802332 5 Bytes  JMP 000702C0
.text          C:\WINDOWS\system32\wscntfy.exe[2388] kernel32.dll!CreateProcessA                                                                      7C802367 5 Bytes  JMP 00070234
.text          C:\WINDOWS\system32\wscntfy.exe[2388] kernel32.dll!VirtualAlloc                                                                        7C809A81 5 Bytes  JMP 00070004
.text          C:\WINDOWS\system32\wscntfy.exe[2388] kernel32.dll!VirtualAllocEx                                                                      7C809AA2 5 Bytes  JMP 0007011C
.text          C:\WINDOWS\system32\wscntfy.exe[2388] kernel32.dll!CreateRemoteThread                                                                  7C810626 5 Bytes  JMP 000704F0
.text          C:\WINDOWS\system32\wscntfy.exe[2388] kernel32.dll!CreateThread                                                                        7C81082F 5 Bytes  JMP 0007057C
.text          C:\WINDOWS\system32\wscntfy.exe[2388] kernel32.dll!CreateProcessInternalW                                                              7C8191EB 5 Bytes  JMP 000703D8
.text          C:\WINDOWS\system32\wscntfy.exe[2388] kernel32.dll!CreateProcessInternalA                                                              7C81DA9E 5 Bytes  JMP 0007034C
.text          C:\WINDOWS\system32\wscntfy.exe[2388] kernel32.dll!WinExec                                                                              7C86114D 5 Bytes  JMP 00070464
.text          C:\WINDOWS\system32\wscntfy.exe[2388] kernel32.dll!SetThreadContext                                                                    7C862849 5 Bytes  JMP 00070608
.text          C:\WINDOWS\system32\wscntfy.exe[2388] USER32.dll!SetWindowsHookExW                                                                      77D2E4AF 5 Bytes  JMP 000707AC
.text          C:\WINDOWS\system32\wscntfy.exe[2388] USER32.dll!SetWindowsHookExA                                                                      77D311E9 5 Bytes  JMP 00070720
.text          C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[2404] kernel32.dll!VirtualProtectEx                                      7C801A5D 5 Bytes  JMP 001301A8
.text          C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[2404] kernel32.dll!VirtualProtect                                        7C801AD0 5 Bytes  JMP 00130090
.text          C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[2404] kernel32.dll!WriteProcessMemory                                    7C80220F 5 Bytes  JMP 00130694
.text          C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[2404] kernel32.dll!CreateProcessW                                        7C802332 5 Bytes  JMP 001302C0
.text          C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[2404] kernel32.dll!CreateProcessA                                        7C802367 5 Bytes  JMP 00130234
.text          C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[2404] kernel32.dll!VirtualAlloc                                          7C809A81 5 Bytes  JMP 00130004
.text          C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[2404] kernel32.dll!VirtualAllocEx                                        7C809AA2 5 Bytes  JMP 0013011C
.text          C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[2404] kernel32.dll!CreateRemoteThread                                    7C810626 5 Bytes  JMP 001304F0
.text          C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[2404] kernel32.dll!CreateThread                                          7C81082F 5 Bytes  JMP 0013057C
.text          C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[2404] kernel32.dll!CreateProcessInternalW                                7C8191EB 5 Bytes  JMP 001303D8
.text          C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[2404] kernel32.dll!CreateProcessInternalA                                7C81DA9E 5 Bytes  JMP 0013034C
.text          C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[2404] kernel32.dll!WinExec                                              7C86114D 5 Bytes  JMP 00130464
.text          C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[2404] kernel32.dll!SetThreadContext                                      7C862849 5 Bytes  JMP 00130608
.text          C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[2404] USER32.dll!SetWindowsHookExW                                      77D2E4AF 5 Bytes  JMP 001307AC
.text          C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[2404] USER32.dll!SetWindowsHookExA                                      77D311E9 5 Bytes  JMP 00130720
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[2540] kernel32.dll!VirtualProtectEx                                        7C801A5D 5 Bytes  JMP 001301A8
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[2540] kernel32.dll!VirtualProtect                                          7C801AD0 5 Bytes  JMP 00130090
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[2540] kernel32.dll!WriteProcessMemory                                      7C80220F 5 Bytes  JMP 00130694
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[2540] kernel32.dll!CreateProcessW                                          7C802332 5 Bytes  JMP 001302C0
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[2540] kernel32.dll!CreateProcessA                                          7C802367 5 Bytes  JMP 00130234
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[2540] kernel32.dll!VirtualAlloc                                            7C809A81 5 Bytes  JMP 00130004
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[2540] kernel32.dll!VirtualAllocEx                                          7C809AA2 5 Bytes  JMP 0013011C
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[2540] kernel32.dll!CreateRemoteThread                                      7C810626 5 Bytes  JMP 001304F0
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[2540] kernel32.dll!CreateThread                                            7C81082F 5 Bytes  JMP 0013057C
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[2540] kernel32.dll!CreateProcessInternalW                                  7C8191EB 5 Bytes  JMP 001303D8
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[2540] kernel32.dll!CreateProcessInternalA                                  7C81DA9E 5 Bytes  JMP 0013034C
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[2540] kernel32.dll!WinExec                                                  7C86114D 5 Bytes  JMP 00130464
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[2540] kernel32.dll!SetThreadContext                                        7C862849 5 Bytes  JMP 00130608
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[2540] USER32.dll!SetWindowsHookExW                                          77D2E4AF 5 Bytes  JMP 001307AC
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[2540] USER32.dll!SetWindowsHookExA                                          77D311E9 5 Bytes  JMP 00130720
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[2540] WS2_32.dll!socket                                                    71A13B91 5 Bytes  JMP 001308C4
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[2540] WS2_32.dll!bind                                                      71A13E00 5 Bytes  JMP 00130838
.text          C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[2540] WS2_32.dll!connect                                                    71A1406A 5 Bytes  JMP 00130950
.text          C:\WINDOWS\System32\svchost.exe[2808] kernel32.dll!VirtualProtectEx                                                                    7C801A5D 5 Bytes  JMP 000801A8
.text          C:\WINDOWS\System32\svchost.exe[2808] kernel32.dll!VirtualProtect                                                                      7C801AD0 5 Bytes  JMP 00080090
.text          C:\WINDOWS\System32\svchost.exe[2808] kernel32.dll!WriteProcessMemory                                                                  7C80220F 5 Bytes  JMP 00080694
.text          C:\WINDOWS\System32\svchost.exe[2808] kernel32.dll!CreateProcessW                                                                      7C802332 5 Bytes  JMP 000802C0
.text          C:\WINDOWS\System32\svchost.exe[2808] kernel32.dll!CreateProcessA                                                                      7C802367 5 Bytes  JMP 00080234
.text          C:\WINDOWS\System32\svchost.exe[2808] kernel32.dll!VirtualAlloc                                                                        7C809A81 5 Bytes  JMP 00080004
.text          C:\WINDOWS\System32\svchost.exe[2808] kernel32.dll!VirtualAllocEx                                                                      7C809AA2 5 Bytes  JMP 0008011C
.text          C:\WINDOWS\System32\svchost.exe[2808] kernel32.dll!CreateRemoteThread                                                                  7C810626 5 Bytes  JMP 000804F0
.text          C:\WINDOWS\System32\svchost.exe[2808] kernel32.dll!CreateThread                                                                        7C81082F 5 Bytes  JMP 0008057C
.text          C:\WINDOWS\System32\svchost.exe[2808] kernel32.dll!CreateProcessInternalW                                                              7C8191EB 5 Bytes  JMP 000803D8
.text          C:\WINDOWS\System32\svchost.exe[2808] kernel32.dll!CreateProcessInternalA                                                              7C81DA9E 5 Bytes  JMP 0008034C
.text          C:\WINDOWS\System32\svchost.exe[2808] kernel32.dll!WinExec                                                                              7C86114D 5 Bytes  JMP 00080464
.text          C:\WINDOWS\System32\svchost.exe[2808] kernel32.dll!SetThreadContext                                                                    7C862849 5 Bytes  JMP 00080608
.text          C:\WINDOWS\System32\svchost.exe[2808] USER32.dll!SetWindowsHookExW                                                                      77D2E4AF 5 Bytes  JMP 000807AC
.text          C:\WINDOWS\System32\svchost.exe[2808] USER32.dll!SetWindowsHookExA                                                                      77D311E9 5 Bytes  JMP 00080720
.text          C:\WINDOWS\System32\svchost.exe[2808] WS2_32.dll!socket                                                                                71A13B91 5 Bytes  JMP 000808C4
.text          C:\WINDOWS\System32\svchost.exe[2808] WS2_32.dll!bind                                                                                  71A13E00 5 Bytes  JMP 00080838
.text          C:\WINDOWS\System32\svchost.exe[2808] WS2_32.dll!connect                                                                                71A1406A 5 Bytes  JMP 00080950
.text          E:\Alex\Anti aaaa\i2vrgo4t.exe[3356] kernel32.dll!VirtualProtectEx                                                                      7C801A5D 5 Bytes  JMP 001401A8
.text          E:\Alex\Anti aaaa\i2vrgo4t.exe[3356] kernel32.dll!VirtualProtect                                                                        7C801AD0 5 Bytes  JMP 00140090
.text          E:\Alex\Anti aaaa\i2vrgo4t.exe[3356] kernel32.dll!WriteProcessMemory                                                                    7C80220F 5 Bytes  JMP 00140694
.text          E:\Alex\Anti aaaa\i2vrgo4t.exe[3356] kernel32.dll!CreateProcessW                                                                        7C802332 5 Bytes  JMP 001402C0
.text          E:\Alex\Anti aaaa\i2vrgo4t.exe[3356] kernel32.dll!CreateProcessA                                                                        7C802367 5 Bytes  JMP 00140234
.text          E:\Alex\Anti aaaa\i2vrgo4t.exe[3356] kernel32.dll!VirtualAlloc                                                                          7C809A81 5 Bytes  JMP 00140004
.text          E:\Alex\Anti aaaa\i2vrgo4t.exe[3356] kernel32.dll!VirtualAllocEx                                                                        7C809AA2 5 Bytes  JMP 0014011C
.text          E:\Alex\Anti aaaa\i2vrgo4t.exe[3356] kernel32.dll!CreateRemoteThread                                                                    7C810626 5 Bytes  JMP 001404F0
.text          E:\Alex\Anti aaaa\i2vrgo4t.exe[3356] kernel32.dll!CreateThread                                                                          7C81082F 5 Bytes  JMP 0014057C
.text          E:\Alex\Anti aaaa\i2vrgo4t.exe[3356] kernel32.dll!CreateProcessInternalW                                                                7C8191EB 5 Bytes  JMP 001403D8
.text          E:\Alex\Anti aaaa\i2vrgo4t.exe[3356] kernel32.dll!CreateProcessInternalA                                                                7C81DA9E 5 Bytes  JMP 0014034C
.text          E:\Alex\Anti aaaa\i2vrgo4t.exe[3356] kernel32.dll!WinExec                                                                              7C86114D 5 Bytes  JMP 00140464
.text          E:\Alex\Anti aaaa\i2vrgo4t.exe[3356] kernel32.dll!SetThreadContext                                                                      7C862849 5 Bytes  JMP 00140608
.text          E:\Alex\Anti aaaa\i2vrgo4t.exe[3356] USER32.dll!SetWindowsHookExW                                                                      77D2E4AF 5 Bytes  JMP 001407AC
.text          E:\Alex\Anti aaaa\i2vrgo4t.exe[3356] USER32.dll!SetWindowsHookExA                                                                      77D311E9 5 Bytes  JMP 00140720
.text          C:\WINDOWS\explorer.exe[3924] kernel32.dll!VirtualProtectEx                                                                            7C801A5D 5 Bytes  JMP 000801A8
.text          C:\WINDOWS\explorer.exe[3924] kernel32.dll!VirtualProtect                                                                              7C801AD0 5 Bytes  JMP 00080090
.text          C:\WINDOWS\explorer.exe[3924] kernel32.dll!WriteProcessMemory                                                                          7C80220F 5 Bytes  JMP 00080694
.text          C:\WINDOWS\explorer.exe[3924] kernel32.dll!CreateProcessW                                                                              7C802332 5 Bytes  JMP 000802C0
.text          C:\WINDOWS\explorer.exe[3924] kernel32.dll!CreateProcessA                                                                              7C802367 5 Bytes  JMP 00080234
.text          C:\WINDOWS\explorer.exe[3924] kernel32.dll!VirtualAlloc                                                                                7C809A81 5 Bytes  JMP 00080004
.text          C:\WINDOWS\explorer.exe[3924] kernel32.dll!VirtualAllocEx                                                                              7C809AA2 5 Bytes  JMP 0008011C
.text          C:\WINDOWS\explorer.exe[3924] kernel32.dll!CreateRemoteThread                                                                          7C810626 5 Bytes  JMP 000804F0
.text          C:\WINDOWS\explorer.exe[3924] kernel32.dll!CreateThread                                                                                7C81082F 5 Bytes  JMP 0008057C
.text          C:\WINDOWS\explorer.exe[3924] kernel32.dll!CreateProcessInternalW                                                                      7C8191EB 5 Bytes  JMP 000803D8
.text          C:\WINDOWS\explorer.exe[3924] kernel32.dll!CreateProcessInternalA                                                                      7C81DA9E 5 Bytes  JMP 0008034C
.text          C:\WINDOWS\explorer.exe[3924] kernel32.dll!WinExec                                                                                      7C86114D 5 Bytes  JMP 00080464
.text          C:\WINDOWS\explorer.exe[3924] kernel32.dll!SetThreadContext                                                                            7C862849 5 Bytes  JMP 00080608
.text          C:\WINDOWS\explorer.exe[3924] USER32.dll!SetWindowsHookExW                                                                              77D2E4AF 5 Bytes  JMP 000807AC
.text          C:\WINDOWS\explorer.exe[3924] USER32.dll!SetWindowsHookExA                                                                              77D311E9 5 Bytes  JMP 00080720
.text          C:\WINDOWS\explorer.exe[3924] WININET.dll!InternetOpenW                                                                                7718AF65 5 Bytes  JMP 00080DB0
.text          C:\WINDOWS\explorer.exe[3924] WININET.dll!InternetConnectA                                                                              771930F3 5 Bytes  JMP 00080F54
.text          C:\WINDOWS\explorer.exe[3924] WININET.dll!InternetOpenA                                                                                771958EA 5 Bytes  JMP 00080D24
.text          C:\WINDOWS\explorer.exe[3924] WININET.dll!InternetOpenUrlA                                                                              77195B9D 5 Bytes  JMP 00080E3C
.text          C:\WINDOWS\explorer.exe[3924] WININET.dll!InternetConnectW                                                                              7719EE30 5 Bytes  JMP 00080FE0
.text          C:\WINDOWS\explorer.exe[3924] WININET.dll!InternetOpenUrlW                                                                              771A5B82 5 Bytes  JMP 00080EC8
.text          C:\WINDOWS\explorer.exe[3924] WS2_32.dll!socket                                                                                        71A13B91 5 Bytes  JMP 000808C4
.text          C:\WINDOWS\explorer.exe[3924] WS2_32.dll!bind                                                                                          71A13E00 5 Bytes  JMP 00080838
.text          C:\WINDOWS\explorer.exe[3924] WS2_32.dll!connect                                                                                        71A1406A 5 Bytes  JMP 00080950

---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT            \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisCloseAdapter]                                                                      [A814BCE0] \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software)
IAT            \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisOpenAdapter]                                                                        [A814BD00] \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software)
IAT            \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisRegisterProtocol]                                                                  [A814BD90] \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software)
IAT            \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisDeregisterProtocol]                                                                [A814BDC0] \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software)
IAT            \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisRegisterProtocol]                                                                  [A814BD90] \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software)
IAT            \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisOpenAdapter]                                                                      [A814BD00] \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software)
IAT            \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisCloseAdapter]                                                                      [A814BCE0] \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software)
IAT            \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisRegisterProtocol]                                                                [A814BD90] \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software)
IAT            \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisDeregisterProtocol]                                                              [A814BDC0] \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software)
IAT            \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisCloseAdapter]                                                                    [A814BCE0] \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software)
IAT            \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisOpenAdapter]                                                                      [A814BD00] \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software)

---- Devices - GMER 1.0.15 ----

AttachedDevice  \Driver\Tcpip \Device\Ip                                                                                                                fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software)
AttachedDevice  \Driver\Tcpip \Device\Ip                                                                                                                ntkrnlpa.exe (NT-Kernel und -System/Microsoft Corporation)
AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                                                              fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software)
AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                                                              ntkrnlpa.exe (NT-Kernel und -System/Microsoft Corporation)
AttachedDevice  \Driver\Tcpip \Device\Udp                                                                                                              fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software)
AttachedDevice  \Driver\Tcpip \Device\Udp                                                                                                              ntkrnlpa.exe (NT-Kernel und -System/Microsoft Corporation)
AttachedDevice  \Driver\Tcpip \Device\RawIp                                                                                                            fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software)
AttachedDevice  \Driver\Tcpip \Device\RawIp                                                                                                            ntkrnlpa.exe (NT-Kernel und -System/Microsoft Corporation)

---- EOF - GMER 1.0.15 ----
--- --- ---

aware 28.09.2010 20:25
OSAM Log:OSAM Logfile:
Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 21:25:01 on 28.09.2010

OS: Windows XP Professional Service Pack 2 (Build 2600)
Default Browser: Microsoft Corporation Internet Explorer 6.00.2900.2180

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Boot Execute]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Session Manager )-----
"BootExecute" - "Microsoft Corporation" - C:\WINDOWS\system32\autochk.exe
"BootExecute" - ? - C:\WINDOWS\system32\lsdelete.exe  (File found, but it contains no detailed information)

[Common]
-----( %SystemRoot%\Tasks )-----
"AppleSoftwareUpdate.job" - "Apple Inc." - C:\Programme\Apple Software Update\SoftwareUpdate.exe
-----( HKLM\SOFTWARE\Microsoft\Windows Scripting Host\Locations )-----
"CScript" - "Microsoft Corporation" - C:\WINDOWS\System32\cscript.exe
"WScript" - "Microsoft Corporation" - C:\WINDOWS\System32\wscript.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"access.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\access.cpl
"ALSNDMGR.CPL" - "Realtek Semiconductor Corp." - C:\WINDOWS\system32\ALSNDMGR.CPL
"appwiz.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\appwiz.cpl
"bthprops.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\bthprops.cpl
"desk.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\desk.cpl
"firewall.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\firewall.cpl
"hdwwiz.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\hdwwiz.cpl
"inetcpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\inetcpl.cpl
"intl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\intl.cpl
"irprops.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\irprops.cpl
"javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl
"joy.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\joy.cpl
"main.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\main.cpl
"mmsys.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\mmsys.cpl
"ncpa.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\ncpa.cpl
"netsetup.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\netsetup.cpl
"nusrmgr.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\nusrmgr.cpl
"nwc.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\nwc.cpl
"odbccp32.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\odbccp32.cpl
"powercfg.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\powercfg.cpl
"RTSndMgr.CPL" - "Realtek Semiconductor Corp." - C:\WINDOWS\system32\RTSndMgr.CPL
"sysdm.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\sysdm.cpl
"telephon.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\telephon.cpl
"timedate.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\timedate.cpl
"wscui.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\wscui.cpl
"wuaucpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\wuaucpl.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"Avira AntiVir Personal - Free Antivirus " - "Avira GmbH" - C:\PROGRA~1\ANTIVI~1\Avira\ANTIVI~1\avconfig.cpl
"Avira AntiVir PersonalEdition Classic" - ? - C:\PROGRA~1\ANTIVI~1\avconfig.cpl  (File not found)
"Avira AntiVir PersonalEdition Classic Konfiguration" - ? - C:\PROGRA~1\ANTIVI~1\avconfig.cpl  (File not found)
"DeviceControl" - "Creative Technology Ltd." - C:\Programme\Creative\SBAudigy\Device Control\USBAudio.cpl
"Internet Connection Firewall" - "Microsoft Corporation" - C:\WINDOWS\system32\Firewall.cpl
"NetSetupWizard" - "Microsoft Corporation" - C:\WINDOWS\system32\NetSetup.cpl
"QuickTime" - "Apple Inc." - C:\Programme\QuickTime Alternative\QTSystem\QuickTime.cpl
"Speech" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Speech\sapi.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"AFD" (AFD) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\afd.sys
"AliIde" (AliIde) - "Acer Laboratories Inc." - C:\WINDOWS\System32\DRIVERS\aliide.sys
"AMD Processor Driver" (AmdK8) - "Advanced Micro Devices" - C:\WINDOWS\System32\DRIVERS\AmdK8.sys
"AnyDVD" (AnyDVD) - "SlySoft, Inc." - C:\WINDOWS\System32\Drivers\AnyDVD.sys
"Apple Mobile USB Driver" (USBAAPL) - "Apple, Inc." - C:\WINDOWS\System32\Drivers\usbaapl.sys
"Asynchroner RAS -Medientreiber" (AsyncMac) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\asyncmac.sys
"ati2mtag" (ati2mtag) - "ATI Technologies Inc." - C:\WINDOWS\System32\DRIVERS\ati2mtag.sys
"Audiostubtreiber" (audstub) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\audstub.sys
"avgio" (avgio) - "Avira GmbH" - C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avgio.sys
"avgntflt" (avgntflt) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avipbb.sys
"BDA Slip De-Framer" (SLIP) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\SLIP.sys
"BDA-IPSink" (streamip) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\StreamIP.sys
"Beep" (Beep) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Beep.sys
"catchme" (catchme) - ? - C:\DOKUME~1\Family\LOKALE~1\Temp\catchme.sys  (File not found)
"CD-ROM-Laufwerktreiber" (Cdrom) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\cdrom.sys
"Cdaudio" (Cdaudio) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Cdaudio.sys
"Cdfs" (Cdfs) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Cdfs.sys
"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys  (File not found)
"Creative OS Services Driver" (ossrv) - "Creative Technology Ltd." - C:\WINDOWS\System32\DRIVERS\ctoss2k.sys
"Creative SoundFont Management Device Driver" (ctsfm2k) - "Creative Technology Ltd" - C:\WINDOWS\System32\DRIVERS\ctsfm2k.sys
"Diskettencontrollertreiber" (Fdc) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\fdc.sys
"Diskettenlaufwerktreiber" (Flpydisk) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\flpydisk.sys
"dmload" (dmload) - "Microsoft Corp., Veritas Software." - C:\WINDOWS\System32\drivers\dmload.sys
"ElbyCDIO Driver" (ElbyCDIO) - "Elaborate Bytes AG" - C:\WINDOWS\System32\Drivers\ElbyCDIO.sys
"Fastfat" (Fastfat) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Fastfat.sys
"Filtertreiber für CD-Brennen" (Imapi) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\imapi.sys
"Filtertreiber für digitale CD-Audiowiedergabe" (redbook) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\redbook.sys
"Filtertreiber für IP-Verkehr" (IpFilterDriver) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\ipfltdrv.sys
"Filtertreiber für IPX-Verkehr" (NwlnkFlt) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\nwlnkflt.sys
"Filtertreiber für Systemwiederherstellung" (sr) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\sr.sys
"Fips" (Fips) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Fips.sys
"Firewall Driver" (fwdrv) - "Sunbelt Software" - C:\WINDOWS\system32\drivers\fwdrv.sys
"FltMgr" (FltMgr) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\fltMgr.sys
"Fs_Rec" (Fs_Rec) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Fs_Rec.sys
"GEAR ASPI Filter Driver" (GEARAspiWDM) - "GEAR Software Inc." - C:\WINDOWS\System32\DRIVERS\GEARAspiWDM.sys
"GVCplDrv" (GVCplDrv) - ? - C:\WINDOWS\system32\drivers\GVCplDrv.sys  (File found, but it contains no detailed information)
"HTTP" (HTTP) - "Microsoft Corporation" - C:\WINDOWS\System32\Drivers\HTTP.sys
"i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys  (File not found)
"i8042-Tastatur- und PS/2-Mausanschluss-Treiber" (i8042prt) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\i8042prt.sys
"IP/IP-Tunneltreiber" (IpInIp) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\ipinip.sys
"IPSEC-Treiber" (IPSec) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\ipsec.sys
"IPv6-Windows-Firewalltreiber" (Ip6Fw) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\Ip6Fw.sys
"IR-Enumeratordienst" (IRENUM) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\irenum.sys
"Kerio HIPS Driver" (khips) - "Sunbelt Software" - C:\WINDOWS\system32\drivers\khips.sys
"KSecDD" (KSecDD) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\KSecDD.sys
"Laufwerktreiber" (Disk) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\disk.sys
"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)
"Logitech AEC Driver" (LVcKap) - "Logitech Inc." - C:\WINDOWS\System32\DRIVERS\LVcKap.sys
"Logitech LVPr2Mon Driver" (LVPr2Mon) - "Logitech Inc." - C:\WINDOWS\System32\DRIVERS\LVPr2Mon.sys
"Logitech Machine Vision Engine Loader" (LVMVDrv) - "Logitech Inc." - C:\WINDOWS\System32\DRIVERS\LVMVDrv.sys
"m5288" (m5288) - "ULi Electronics Inc." - C:\WINDOWS\System32\DRIVERS\m5288.sys
"Maus-HID-Treiber" (mouhid) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\mouhid.sys
"Mausklassentreiber" (Mouclass) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\mouclass.sys
"Microcode Updatetreiber" (Update) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\update.sys
"Microsoft ACPI-Treiber" (ACPI) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\ACPI.sys
"Microsoft HID Class-Treiber" (hidusb) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\hidusb.sys
"Microsoft Kernel GS Wavetablesynthesizer" (swmidi) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\swmidi.sys
"Microsoft Kernel-Audiosplitter" (splitter) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\splitter.sys
"Microsoft Kernel-DLS-Synthesizer" (DMusic) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\DMusic.sys
"Microsoft Kernel-DRM-Audioentschlüsselung" (drmkaud) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\drmkaud.sys
"Microsoft Kernel-Echounterdrückung" (aec) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\aec.sys
"Microsoft Kernel-Systemaudiogerät" (sysaudio) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\sysaudio.sys
"Microsoft Kernel-Waveaudiomixer" (kmixer) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\kmixer.sys
"Microsoft Proxy für Streaming Clock" (MSPCLOCK) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\MSPCLOCK.sys
"Microsoft Proxy für Streaming Quality Manager" (MSPQM) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\MSPQM.sys
"Microsoft Standard-USB-Haupttreiber" (usbccgp) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\usbccgp.sys
"Microsoft Streaming Service Proxy" (MSKSSRV) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\MSKSSRV.sys
"Microsoft Streaming Tee/Sink-to-Sink-Konvertierung" (MSTEE) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\MSTEE.sys
"Microsoft TV-/Videoverbindung" (NdisIP) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\NdisIP.sys
"Microsoft UAA-Bustreiber für High Definition Audio" (HDAudBus) - "Windows (R) Server 2003 DDK provider" - C:\WINDOWS\System32\DRIVERS\HDAudBus.sys
"Microsoft USB-Druckerklasse" (usbprint) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\usbprint.sys
"Microsoft USB-Standardhubtreiber" (usbhub) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\usbhub.sys
"Microsoft-Systemverwaltungs-BIOS-Treiber" (mssmbios) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\mssmbios.sys
"Miniporttreiber für erweiterten Microsoft USB 2.0-Hostcontroller" (usbehci) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\usbehci.sys
"Miniporttreiber für Microsoft USB Open Host-Controller" (usbohci) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\usbohci.sys
"mnmdd" (mnmdd) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\mnmdd.sys
"Modem" (Modem) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Modem.sys
"Motorola Inc. USB Device" (MotDev) - "Motorola Inc" - C:\WINDOWS\System32\DRIVERS\motodrv.sys
"Motorola USB CDC ACM Driver" (motmodem) - "Motorola" - C:\WINDOWS\System32\DRIVERS\motmodem.sys
"MountMgr" (MountMgr) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\MountMgr.sys
"MRXSMB" (MRxSmb) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\mrxsmb.sys
"Msfs" (Msfs) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Msfs.sys
"Mup" (Mup) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Mup.sys
"NABTS/FEC VBI-Codec" (NABTSFEC) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\NABTSFEC.sys
"NDIS-Benutzermodus-E/A-Protokoll" (Ndisuio) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\ndisuio.sys
"NDIS-Systemtreiber" (NDIS) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\NDIS.sys
"NDProxy" (NDProxy) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\NDProxy.sys
"NetBios über TCP/IP" (NetBT) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\netbt.sys
"NetBIOS-Schnittstelle" (NetBIOS) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\netbios.sys
"Nokia USB Generic" (nmwcdc) - "Nokia" - C:\WINDOWS\System32\drivers\ccdcmbo.sys
"Nokia USB Phone Parent" (nmwcd) - "Nokia" - C:\WINDOWS\System32\drivers\ccdcmb.sys
"Npfs" (Npfs) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Npfs.sys
"Ntfs" (Ntfs) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Ntfs.sys
"Null" (Null) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Null.sys
"Parallelanschluss (direkt)" (Raspti) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\raspti.sys
"PartMgr" (PartMgr) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\PartMgr.sys
"ParVdm" (ParVdm) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\ParVdm.sys
"PCCS Mode Change Filter Driver" (pccsmcfd) - "Nokia" - C:\WINDOWS\System32\DRIVERS\pccsmcfd.sys
"PCI-Bus-Treiber" (PCI) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\pci.sys
"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)
"PCIIde" (PCIIde) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\pciide.sys
"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)
"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)
"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)
"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)
"PnP-ISA/EISA-Bus-Treiber" (isapnp) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\isapnp.sys
"Protokoll für ATM ARP-Client" (Atmarpc) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\atmarpc.sys
"Prozessortreiber" (Processor) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\processr.sys
"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\PxHelp20.sys
"QoS-Paketplaner" (PSched) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\psched.sys
"RAS-IP-ARP-Treiber" (Wanarp) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\wanarp.sys
"RAS-NDIS-TAPI-Treiber" (NdisTapi) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\ndistapi.sys
"RAS-NDIS-WAN-Treiber" (NdisWan) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\ndiswan.sys
"Rdbss" (Rdbss) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\rdbss.sys
"RDPCDD" (RDPCDD) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\RDPCDD.sys
"RDPWD" (RDPWD) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\RDPWD.sys
"Redirector für WebDav-Client" (MRxDAV) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\mrxdav.sys
"Remotezugriff-PPPOE-Treiber" (RasPppoe) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\raspppoe.sys
"SAMSUNG Mobile Modem Drivers" (sscdmdm) - "MCCI Corporation" - C:\WINDOWS\System32\DRIVERS\sscdmdm.sys
"SAMSUNG Mobile Modem Filter" (sscdmdfl) - "MCCI Corporation" - C:\WINDOWS\System32\DRIVERS\sscdmdfl.sys
"SAMSUNG USB Composite Device driver (WDM)" (sscdbus) - "MCCI Corporation" - C:\WINDOWS\System32\DRIVERS\sscdbus.sys
"Secdrv" (Secdrv) - ? - C:\WINDOWS\System32\DRIVERS\secdrv.sys  (File found, but it contains no detailed information)
"Serenum-Filtertreiber" (serenum) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\serenum.sys
"Service for Realtek HD Audio (WDM)" (IntcAzAudAddService) - "Realtek Semiconductor Corp." - C:\WINDOWS\System32\drivers\RtkHDAud.sys
"Sfloppy" (Sfloppy) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Sfloppy.sys
"Silicon Labs CP210x USB to UART Bridge Driver" (silabser) - "Silicon Laboratories" - C:\WINDOWS\System32\DRIVERS\silabser.sys
"Silicon Labs CP210x USB to UART Bridge Serial Port Enumerator Driver" (silabenm) - "Silicon Laboratories, Inc." - C:\WINDOWS\System32\DRIVERS\silabenm.sys
"Software-Bus-Treiber" (swenum) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\swenum.sys
"Sound Blaster Audigy" (P17) - "Creative Technology Ltd." - C:\WINDOWS\System32\drivers\P17.sys
"Srv" (Srv) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\srv.sys
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\ssmdrv.sys
"Standard-IDE/ESDI-Festplattencontroller" (atapi) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\atapi.sys
"Standardpaketklassifizierung" (Gpc) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\msgpc.sys
"StarOpen" (StarOpen) - ? - C:\WINDOWS\system32\drivers\StarOpen.sys  (File found, but it contains no detailed information)
"Tastatur-HID-Treiber" (kbdhid) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\kbdhid.sys
"Tastaturklassentreiber" (Kbdclass) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\kbdclass.sys
"TCP/IP-Protokolltreiber" (Tcpip) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\tcpip.sys
"TDPIPE" (TDPIPE) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\TDPIPE.sys
"TDTCP" (TDTCP) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\TDTCP.sys
"Terminal-Gerätetreiber" (TermDD) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\termdd.sys
"Treiber für automatische RAS-Verbindung" (RasAcd) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\rasacd.sys
"Treiber für die Verwaltung logischer Datenträger" (dmio) - "Microsoft Corp., Veritas Software" - C:\WINDOWS\System32\drivers\dmio.sys
"Treiber für direkte Parallelverbindung" (Ptilink) - "Parallel Technologies, Inc." - C:\WINDOWS\System32\DRIVERS\ptilink.sys
"Treiber für IPX-Verkehrsweiterleitung" (NwlnkFwd) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\nwlnkfwd.sys
"Treiber für Microsoft WINMM-WDM-Audiokompatibilität" (wdmaud) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\wdmaud.sys
"Treiber für parallelen Anschluss" (Parport) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\parport.sys
"Treiber für seriellen Anschluss" (Serial) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\serial.sys
"Treiber für Terminalserver-Geräteumleitung" (rdpdr) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\rdpdr.sys
"Treiber für Volume-Manager" (Ftdisk) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\ftdisk.sys
"truecrypt" (truecrypt) - "TrueCrypt Foundation" - C:\WINDOWS\System32\drivers\truecrypt.sys
"TT DVB-PCI driver (SAA7146n)" (SAA7146n) - "TechnoTrend AG" - C:\WINDOWS\System32\DRIVERS\saa7146n.sys
"ULi M526X Ethernet NT Driver" (ULI5261XP) - "ULi Electronics Inc." - C:\WINDOWS\System32\DRIVERS\ULILAN51.SYS
"Untertiteldecoder" (CCDECODE) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\CCDECODE.sys
"upperdev" (upperdev) - "Nokia" - C:\WINDOWS\System32\DRIVERS\usbser_lowerflt.sys
"USB Modem Driver" (usbser) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\usbser.sys
"USB-Audiotreiber (WDM)" (usbaudio) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\usbaudio.sys
"USB-Massenspeichertreiber" (USBSTOR) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS
"USB-Scannertreiber" (usbscan) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\usbscan.sys
"USB-Videogerät (WDM)" (usbvideo) - "Microsoft Corporation" - C:\WINDOWS\System32\Drivers\usbvideo.sys
"UsbserFilt" (UsbserFilt) - "Nokia" - C:\WINDOWS\System32\DRIVERS\usbser_lowerfltj.sys
"VgaSave" (VgaSave) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\vga.sys
"Virtual DVB-S/-C/-T Network Adapter Driver" (TTLOOPHE) - "TechnoTrend AG" - C:\WINDOWS\System32\DRIVERS\ttloophe.sys
"VolSnap" (VolSnap) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\VolSnap.sys
"WAN-Miniport (L2TP)" (Rasl2tp) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\rasl2tp.sys
"WAN-Miniport (PPTP)" (PptpMiniport) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\raspptp.sys
"WD SCSI Pass Thru driver" (WDC_SAM) - "Western Digital Technologies" - C:\WINDOWS\System32\DRIVERS\wdcsam.sys
"Wdf01000" (Wdf01000) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\Wdf01000.sys
"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)
"Windows Driver Foundation - User-mode Driver Framework Platform Driver" (WudfPf) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\WudfPf.sys
"Windows Driver Foundation - User-mode Driver Framework Reflector" (WudfRd) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\wudfrd.sys
"World Standard Teletext-Codec" (WSTCODEC) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\WSTCODEC.SYS
"WpdUsb" (WpdUsb) - "Microsoft Corporation" - C:\WINDOWS\System32\Drivers\wpdusb.sys
"Übersetzer für IP-Netzwerkadressen" (IpNat) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\ipnat.sys

[Explorer]
-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----
{7790769C-0471-11d2-AF11-00C04FA35D02} "Adressbuch 6" - "Microsoft Corporation" - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS "Browseranpassungen" - "Microsoft Corporation" - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
>{26923b43-4d38-484f-9b9e-de460746276c} "Internet Explorer" - "Microsoft Corporation" - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE
{89820200-ECBD-11cf-8B85-00AA005B4383} "Internet Explorer 6" - "Microsoft Corporation" - %SystemRoot%\system32\ie4uinit.exe
{44BBA840-CC51-11CF-AAFA-00AA00B6015C} "Microsoft Outlook Express 6" - "Microsoft Corporation" - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
>{22d6f312-b0f6-11d0-94ab-0080c74c7e95} "Microsoft Windows Media Player" - "Microsoft Corporation" - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
{6BF52A52-394A-11d3-B153-00C04F79FAA6} "Microsoft Windows Media Player" - "Microsoft Corporation" - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp10.inf,PerUserStub
{44BBA842-CC51-11CF-AAFA-00AA00B6015B} "NetMeeting 3.01" - "Microsoft Corporation" - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
>{881dd1c5-3dcf-431b-b061-f3f88e8be88a} "Outlook Express" - "Microsoft Corporation" - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
{2C7339CF-2B09-4501-B3F3-F3508C9228ED} "Themes Setup" - "Microsoft Corporation" - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
{89820200-ECBD-11cf-8B85-00AA005B4340} "Windows Desktop-Update" - "Microsoft Corporation" - regsvr32.exe /s /n /i:U shell32.dll
{5945c046-1e7d-11d1-bc44-00c04fd912be} "Windows Messenger 4.7" - "Microsoft Corporation" - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll
{0D2E74C4-3C34-11d2-A27E-00C04FC30871} "{0D2E74C4-3C34-11d2-A27E-00C04FC30871}" - "Microsoft Corporation" - C:\WINDOWS\system32\SHELL32.dll
{24F14F01-7B1C-11d1-838f-0000F80461CF} "{24F14F01-7B1C-11d1-838f-0000F80461CF}" - "Microsoft Corporation" - C:\WINDOWS\system32\SHELL32.dll
{24F14F02-7B1C-11d1-838f-0000F80461CF} "{24F14F02-7B1C-11d1-838f-0000F80461CF}" - "Microsoft Corporation" - C:\WINDOWS\system32\SHELL32.dll
{66742402-F9B9-11D1-A202-0000F81FEDEE} "{66742402-F9B9-11D1-A202-0000F81FEDEE}" - "Microsoft Corporation" - C:\WINDOWS\system32\SHELL32.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} "AP Class Install Handler filter" - "Microsoft Corporation" - C:\WINDOWS\system32\urlmon.dll
{8f6b0360-b80d-11d0-a9b3-006097942311} "AP lzdhtml encoding/decoding Filter" - "Microsoft Corporation" - C:\WINDOWS\system32\urlmon.dll
{8f6b0360-b80d-11d0-a9b3-006097942311} "AP lzdhtml encoding/decoding Filter" - "Microsoft Corporation" - C:\WINDOWS\system32\urlmon.dll
{8f6b0360-b80d-11d0-a9b3-006097942311} "AP lzdhtml encoding/decoding Filter" - "Microsoft Corporation" - C:\WINDOWS\system32\urlmon.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{807553E5-5146-11D5-A672-00B0D022E945} "text/xml" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
{733AC4CB-F1A4-11d0-B951-00A0C90312E1} "WebView MIME Filter" - "Microsoft Corporation" - C:\WINDOWS\system32\SHELL32.dll
-----( HKLM\Software\Classes\Protocols\Handler )-----
{3dd53d40-7b8b-11D0-b013-00aa0059ce02} "CDL: Asychronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\WINDOWS\system32\urlmon.dll
{32505114-5902-49B2-880A-1F7738E5A384} "Data Page Plugable Protocal mso-offdap11 Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
{3D9F03FA-7A94-11D3-BE81-0050048385D1} "Data Page Pluggable Protocol mso-offdap Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
{12D51199-0DB5-46FE-A120-47A3D7D937CC} "DVD: Pluggable Protocol" - "Microsoft Corporation" - C:\WINDOWS\system32\msvidctl.dll
{79eac9e7-baf9-11ce-8c82-00aa004ba90b} "file:, local: Asychronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\WINDOWS\system32\urlmon.dll
{79eac9e7-baf9-11ce-8c82-00aa004ba90b} "file:, local: Asychronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\WINDOWS\system32\urlmon.dll
{79eac9e3-baf9-11ce-8c82-00aa004ba90b} "ftp: Asychronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\WINDOWS\system32\urlmon.dll
{79eac9e4-baf9-11ce-8c82-00aa004ba90b} "gopher: Asychronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\WINDOWS\system32\urlmon.dll
{79eac9e2-baf9-11ce-8c82-00aa004ba90b} "http: Asychronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\WINDOWS\system32\urlmon.dll
{79eac9e5-baf9-11ce-8c82-00aa004ba90b} "https: Asychronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\WINDOWS\system32\urlmon.dll
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
{05300401-BCBC-11d0-85E3-00C04FD85AB4} "MHTML Asychronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\WINDOWS\system32\inetcomm.dll
{3050F406-98B5-11CF-BB82-00AA00BDCE0B} "Microsoft HTML About Pluggable Protocol" - "Microsoft Corporation" - C:\WINDOWS\system32\mshtml.dll
{3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} "Microsoft HTML Javascript Pluggable Protocol" - "Microsoft Corporation" - C:\WINDOWS\system32\mshtml.dll
{3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} "Microsoft HTML Javascript Pluggable Protocol" - "Microsoft Corporation" - C:\WINDOWS\system32\mshtml.dll
{3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} "Microsoft HTML Mailto Pluggable Protocol" - "Microsoft Corporation" - C:\WINDOWS\system32\mshtml.dll
{3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} "Microsoft HTML Resource Pluggable Protocol" - "Microsoft Corporation" - C:\WINDOWS\system32\mshtml.dll
{76E67A63-06E9-11D2-A840-006008059382} "Microsoft HTML Resource Pluggable Protocol" - "Microsoft Corporation" - C:\WINDOWS\system32\mshtml.dll
{9D148291-B9C8-11D0-A4CC-0000F80149F6} "Microsoft InfoTech Protocols for IE 4.0" - "Microsoft Corporation" - C:\WINDOWS\system32\itss.dll
{9D148291-B9C8-11D0-A4CC-0000F80149F6} "Microsoft InfoTech Protocols for IE 4.0" - "Microsoft Corporation" - C:\WINDOWS\system32\itss.dll
{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL
{79eac9e6-baf9-11ce-8c82-00aa004ba90b} "mk: Asychronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\WINDOWS\system32\urlmon.dll
{CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} "TV: Pluggable Protocol" - "Microsoft Corporation" - C:\WINDOWS\system32\msvidctl.dll
{13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} "WiaProtocol Class" - "Microsoft Corporation" - C:\WINDOWS\system32\wiascr.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler )-----
{438755C2-A8BA-11D1-B96B-00A0C90312E1} "Browseui preloader" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll
{8C7461EF-2B13-11d2-BE35-3078302C2030} "Component Categories cache daemon" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----
{AEB6717E-7E19-11d0-97EE-00C04FD91972} "URL Exec Hook" - "Microsoft Corporation" - C:\WINDOWS\system32\shell32.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{01E04581-4EEE-11d0-BFE9-00AA005B4383} "&Adresse" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll
{32714800-2E5F-11d0-8B85-00AA0044F941} "&Nach Personen..." - "Microsoft Corporation" - C:\Programme\Outlook Express\wabfind.dll
{7e653215-fa25-46bd-a339-34a2790f3cb7} "Accessible" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll
{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802} "Acrobat Elements Context Menu" - "Adobe Systems Inc." - C:\Programme\Adobe\Acrobat 8.0\Acrobat Elements\ContextMenu.dll
{88C6C381-2E85-11D0-94DE-444553540000} "ActiveX-Cacheordner" - "Microsoft Corporation" - C:\WINDOWS\system32\occache.dll
{A08C11D2-A228-11d0-825B-00AA005B4383} "Address EditBox" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll
{85BBD920-42A0-1069-A2E4-08002B30309D} "Aktenkoffer" - "Microsoft Corporation" - C:\WINDOWS\system32\syncui.dll
{875CB1A1-0F29-45de-A1AE-CFB4950D0B78} "Audio Media Properties Handler" - "Microsoft Corporation" - C:\WINDOWS\system32\shmedia.dll
{91EA3F8B-C99B-11d0-9815-00C04FD91972} "Augmented Shell Folder" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll
{6413BA2C-B461-11d1-A18A-080036B11A03} "Augmented Shell Folder 2" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll
{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0} "Ausführen..." - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll
{5F327514-6C5E-4d60-8F16-D07FA08A78ED} "Auto Update Property Sheet Extension" - "Microsoft Corporation" - C:\WINDOWS\system32\wuaucpl.cpl
{00E7B358-F65B-4dcf-83DF-CD026B94BFD4} "Automatische Diashowwiedergabe der Shell" - "Microsoft Corporation" - C:\WINDOWS\system32\shimgvw.dll
{87D62D94-71B3-4b9a-9489-5FE6850DC73E} "Avi Properties Handler" - "Microsoft Corporation" - C:\WINDOWS\system32\shmedia.dll
{F61FFEC1-754F-11d0-80CA-00AA005B4383} "BandProxy" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll
{7A9D77BD-5403-11d2-8785-2E0420524153} "Benutzerkonten" - "Microsoft Corporation" - C:\WINDOWS\system32\netplwiz.dll
{add36aa8-751a-4579-a266-d66f5202ccbb} "Bestellung von Abzügen über das Internet" - "Microsoft Corporation" - C:\WINDOWS\system32\netplwiz.dll
{67EA19A0-CCEF-11d0-8024-00C04FD75D13} "CDF Extension Copy Hook" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll
{f39a0dc0-9cc8-11d0-a599-00c04fd64433} "Channel" - "Microsoft Corporation" - C:\WINDOWS\system32\cdfview.dll
{f3da0dc0-9cc8-11d0-a599-00c04fd64437} "Channel Menu Handler Object" - "Microsoft Corporation" - C:\WINDOWS\system32\cdfview.dll
{f3ea0dc0-9cc8-11d0-a599-00c04fd64438} "Channel Shortcut Property Pages" - "Microsoft Corporation" - C:\WINDOWS\system32\cdfview.dll
{f3ba0dc0-9cc8-11d0-a599-00c04fd64435} "Channelhandlerobjekt" - "Microsoft Corporation" - C:\WINDOWS\system32\cdfview.dll
{f3aa0dc0-9cc8-11d0-a599-00c04fd64434} "Channelverknüpfung" - "Microsoft Corporation" - C:\WINDOWS\system32\cdfview.dll
{7D559C10-9FE9-11d0-93F7-00AA0059CE02} "Code Download Agent" - "Microsoft Corporation" - C:\WINDOWS\system32\webcheck.dll
{BD472F60-27FA-11cf-B8B4-444553540000} "Compressed (zipped) Folder Right Drag Handler" - "Microsoft Corporation" - C:\WINDOWS\system32\zipfldr.dll
{888DCA60-FC0A-11CF-8F0F-00C04FD7D062} "Compressed (zipped) Folder SendTo Target" - "Microsoft Corporation" - C:\WINDOWS\system32\zipfldr.dll
{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31} "CompressedFolder" - "Microsoft Corporation" - C:\WINDOWS\system32\zipfldr.dll
{E6CC6978-6B6E-11D0-BECA-00C04FD940BE} "ConnectionAgent" - "Microsoft Corporation" - C:\WINDOWS\system32\webcheck.dll
{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - deskpan.dll  (File not found)
{42071713-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Bildschirme" - "Microsoft Corporation" - C:\WINDOWS\system32\deskmon.dll
{42071712-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Grafikkarten" - "Microsoft Corporation" - C:\WINDOWS\system32\deskadp.dll
{7444C717-39BF-11D1-8CD9-00C04FC29D45} "CryptPKO Class" - "Microsoft Corporation" - C:\WINDOWS\system32\cryptext.dll
{7444C719-39BF-11D1-8CD9-00C04FC29D45} "CryptSig Class" - "Microsoft Corporation" - C:\WINDOWS\system32\cryptext.dll
{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A} "Custom MRU AutoCompleted List" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll
{CFCCC7A0-A282-11D1-9082-006008059382} "Darwin App Publisher" - "Microsoft Corporation" - C:\WINDOWS\system32\appwiz.cpl
{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6} "DfsShell Class" - "Microsoft Corporation" - C:\WINDOWS\system32\dfsshlex.dll
{62AE1F9A-126A-11D0-A14B-0800361B1103} "Directory Context Menu Verbs" - "Microsoft Corporation" - C:\WINDOWS\system32\dsuiext.dll
{163FDC20-2ABC-11d0-88F0-00A024AB2DBB} "Directory Object Find" - "Microsoft Corporation" - C:\WINDOWS\system32\dsquery.dll
{0D45D530-764B-11d0-A1CA-00AA00C16E65} "Directory Property UI" - "Microsoft Corporation" - C:\WINDOWS\system32\dsuiext.dll
{8A23E65E-31C2-11d0-891C-00A024AB2DBB} "Directory Query UI" - "Microsoft Corporation" - C:\WINDOWS\system32\dsquery.dll
{F020E586-5264-11d1-A532-0000F8757D7E} "Directory Start/Search Find" - "Microsoft Corporation" - C:\WINDOWS\system32\dsquery.dll
{f92e8c40-3d33-11d2-b1aa-080036a75b03} "Display TroubleShoot CPL Extension" - "Microsoft Corporation" - C:\WINDOWS\system32\deskperf.dll
{22BF0C20-6DA7-11D0-B373-00A0C9034938} "Download Status" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll
{60fd46de-f830-4894-a628-6fa81bc0190d} "Drop-Zielobjekt für den Fotodruck-Assistent" - "Microsoft Corporation" - C:\WINDOWS\system32\photowiz.dll
{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0} "E-Mail" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll
{00022613-0000-0000-C000-000000000046} "Eigenschaften für Multimediadatei" - "Microsoft Corporation" - C:\WINDOWS\system32\mmsys.cpl
{596AB062-B4D2-4215-9F74-E9109B0A8153} "Eigenschaftenseite für vorherige Versionen" - "Microsoft Corporation" - C:\WINDOWS\system32\twext.dll
{8BE13461-936F-11D1-A87D-444553540000} "Eraser Shell Extension" - "-" - C:\WINDOWS\system32\erasext.dll
{1F2E5C40-9550-11CE-99D2-00AA006E086C} "Erweiterung der Sicherheitsshell" - "Microsoft Corporation" - C:\WINDOWS\system32\rshx32.dll
{4E40F770-369C-11d0-8922-00A024AB2DBB} "Erweiterung der Sicherheitsshell" - "Microsoft Corporation" - C:\WINDOWS\system32\dssec.dll
{F37C5810-4D3F-11d0-B4BF-00AA00BBB723} "Erweiterung der Sicherheitsshell" - "Microsoft Corporation" - C:\WINDOWS\system32\rshx32.dll
{59099400-57FF-11CE-BD94-0020AF85B590} "Erweiterung für Datenträgerkopien" - "Microsoft Corporation" - C:\WINDOWS\system32\diskcopy.dll
{EFA24E64-B078-11d0-89E4-00C04FC9E26E} "Explorer-Band" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll
{692F0339-CBAA-47e6-B5B5-3B84DB604E87} "Extensions Manager Folder" - "Microsoft Corporation" - C:\WINDOWS\system32\extmgr.dll
{7A80E4A8-8005-11D2-BCF8-00C04F72C717} "ExtractIcon Class" - "Microsoft Corporation" - C:\WINDOWS\System32\mmcshext.dll
{EFA24E61-B078-11d0-89E4-00C04FC9E26E} "Favorites Band" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll
{1D2680C9-0E2A-469d-B787-065558BC7D43} "Fusion Cache" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{3F30C968-480A-4C6C-862D-EFC0897BB84B} "GDI+ Dateiminiaturansicht-Extrahierungsprogramm" - "Microsoft Corporation" - C:\WINDOWS\system32\shimgvw.dll
{D6277990-4C6A-11CF-8D87-00AA0060F5BF} "Geplante Tasks" - "Microsoft Corporation" - C:\WINDOWS\system32\mstask.dll
{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11} "Global Folder Settings" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll
{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0} "Hilfe und Support" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll
{EFA24E62-B078-11d0-89E4-00C04FC9E26E} "History Band" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll
{EAB841A0-9550-11cf-8C16-00805F1408F3} "HTML-Extrahierungsprogramm" - "Microsoft Corporation" - C:\WINDOWS\system32\shimgvw.dll
{88895560-9AA2-1069-930E-00AA0030EBC8} "HyperTerminal Icon Ext" - "Hilgraeve, Inc." - C:\WINDOWS\system32\hticons.dll
{DBCE2480-C732-101B-BE72-BA78E9AD5B27} "ICC-Profil" - "Microsoft Corporation" - C:\WINDOWS\system32\icmui.dll
{675F097E-4C4D-11D0-B6C1-0800091AA605} "ICM-Druckerverwaltung" - "Microsoft Corporation" - C:\WINDOWS\system32\icmui.dll
{5DB2625A-54DF-11D0-B6C4-0800091AA605} "ICM-Monitorverwaltung" - "Microsoft Corporation" - C:\WINDOWS\System32\icmui.dll
{176d6597-26d3-11d1-b350-080036a75b03} "ICM-Scannerverwaltung" - "Microsoft Corporation" - C:\WINDOWS\system32\icmui.dll
{3028902F-6374-48b2-8DC6-9725E775B926} "IE Microsoft AutoComplete" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll
{30D02401-6A81-11d0-8274-00C04FD5AE38} "IE Search Band" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll
{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC} "IE4 Suite-Begrüßungsbildschirm" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll
{169A0691-8DF9-11d1-A1C4-00C04FD75D13} "In-pane search" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll
{0B124F8F-91F0-11D1-B8B5-006008059382} "Installed Apps Enumerator" - "Microsoft Corporation" - C:\WINDOWS\system32\appwiz.cpl
{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0} "Internet" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll
{3DC7A020-0ACD-11CF-A9BB-00AA004AE837} "Internet" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll
{871C5380-42A0-1069-A2EA-08002B30309D} "Internet Name Space" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll
{FBF23B40-E3F0-101B-8488-00AA003E56F8} "Internetverknüpfung" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll
{131A6951-7F78-11D0-A979-00C04FD705A2} "ISFBand OC" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll
{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Programme\iTunes\iTunesMiniPlayer.dll
{0CD7A5C0-9F37-11CE-AE65-08002B2E1262} "Kabinettdatei" - "Microsoft Corporation" - C:\WINDOWS\system32\cabview.dll
{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8} "Kompatibilitätsseite" - "Microsoft Corporation" - C:\WINDOWS\system32\SlayerXP.dll
{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -  (File not found | COM-object registry key not found)
{143A62C8-C33B-11D1-84FE-00C04FA34A14} "Microsoft Agent Character Property Sheet Handler" - "Microsoft Corporation" - C:\WINDOWS\msagent\agentpsh.dll
{A5E46E3A-8849-11D1-9D8C-00C04FC99D61} "Microsoft Browser Architecture" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll
{7BA4C742-9E81-11CF-99D3-00AA004AE837} "Microsoft BrowserBand" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll
{7988B573-EC89-11cf-9C00-00AA00A14F56} "Microsoft Disk Quota UI" - "Microsoft Corporation" - C:\WINDOWS\system32\dskquoui.dll
{6A205B57-2567-4A2C-B881-F787FAB579A3} "Microsoft DocProp Inplace Calendar Control" - "Microsoft Corporation" - C:\WINDOWS\system32\docprop2.dll
{0EEA25CC-4362-4A12-850B-86EE61B0D3EB} "Microsoft DocProp Inplace Droplist Combo Control" - "Microsoft Corporation" - C:\WINDOWS\system32\docprop2.dll
{A9CF0EAE-901A-4739-A481-E35B73E47F6D} "Microsoft DocProp Inplace Edit Box Control" - "Microsoft Corporation" - C:\WINDOWS\system32\docprop2.dll
{8EE97210-FD1F-4B19-91DA-67914005F020} "Microsoft DocProp Inplace ML Edit Box Control" - "Microsoft Corporation" - C:\WINDOWS\system32\docprop2.dll
{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33} "Microsoft DocProp Inplace Time Control" - "Microsoft Corporation" - C:\WINDOWS\system32\docprop2.dll
{883373C3-BF89-11D1-BE35-080036B11A03} "Microsoft DocProp Shell Ext" - "Microsoft Corporation" - C:\WINDOWS\system32\docprop2.dll
{63da6ec0-2e98-11cf-8d82-444553540000} "Microsoft FTP Folder" - "Microsoft Corporation" - C:\WINDOWS\system32\msieftp.dll
{00BB2764-6A77-11D0-A535-00C04FD7D062} "Microsoft History AutoComplete List" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll
{5E6AB780-7743-11CF-A12B-00AA004AE837} "Microsoft Internet Toolbar" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll
{00BB2765-6A77-11D0-A535-00C04FD7D062} "Microsoft Multiple AutoComplete List Container" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Programme\Microsoft Office\OFFICE11\msohev.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll
{2206CDB2-19C1-11D1-89E0-00C04FD7A829} "Microsoft OLE DB Service Component Data Links" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\System\Ole DB\oledb32.dll
{03C036F1-A186-11D0-824A-00AA005B4383} "Microsoft Shell Folder AutoComplete List" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll
{CFBFAE00-17A6-11D0-99CB-00C04FD64497} "Microsoft Url Sucheingriff" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll
{3C374A40-BAE4-11CF-BF7D-00AA006946EE} "Microsoft URL-Verlauf-Dienst" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll
{A6FD9E45-6E44-43f9-8644-08598F5A74D9} "Midi Properties Handler" - "Microsoft Corporation" - C:\WINDOWS\system32\shmedia.dll
{6756A641-DE71-11d0-831B-00AA005B4383} "MRU AutoComplete List" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll
{ECF03A33-103D-11d2-854D-006008059367} "MyDocs Copy Hook" - "Microsoft Corporation" - C:\WINDOWS\system32\mydocs.dll
{ECF03A32-103D-11d2-854D-006008059367} "MyDocs Drop Target" - "Microsoft Corporation" - C:\WINDOWS\system32\mydocs.dll
{4a7ded0a-ad25-11d0-98a8-0800361b1103} "MyDocs menu and properties" - "Microsoft Corporation" - C:\WINDOWS\system32\mydocs.dll
{7007ACC7-3202-11D1-AAD2-00805FC1270E} "Netzwerkverbindungen" - "Microsoft Corporation" - C:\WINDOWS\system32\NETSHELL.dll
{992CFFA0-F557-101A-88EC-00DD010CCC48} "Netzwerkverbindungen" - "Microsoft Corporation" - C:\WINDOWS\system32\NETSHELL.dll
{10CFC467-4392-11d2-8DB4-00C04FA31A66} "Offline Files Folder Options" - "Microsoft Corporation" - C:\WINDOWS\System32\cscui.dll
{750fdf0e-2a26-11d1-a3ea-080036587f03} "Offline Files Menu" - "Microsoft Corporation" - C:\WINDOWS\System32\cscui.dll
{3EA48300-8CF6-101B-84FB-666CCB9BCD32} "OLE-Eigenschaftenseite für Dokumente" - "Microsoft Corporation" - C:\WINDOWS\system32\docprop.dll
{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice Property Sheet Handler" - ? - C:\Programme\StarOffice7\program\shlxthdl.dll
{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E} "Ordner 'Offlinedateien'" - "Microsoft Corporation" - C:\WINDOWS\System32\cscui.dll
{58f1f272-9240-4f51-b6d4-fd63d1618591} "Passport-Assistent" - "Microsoft Corporation" - C:\WINDOWS\system32\netplwiz.dll
{41E300E0-78B6-11ce-849B-444553540000} "PlusPack CPL-Erweiterung" - "Microsoft Corporation" - C:\WINDOWS\system32\themeui.dll
{35786D3C-B075-49b9-88DD-029876E11C01} "Portable Devices" - "Microsoft Corporation" - C:\WINDOWS\system32\wpdshext.dll
{D6791A63-E7E2-4fee-BF52-5DED8E86E9B8} "Portable Devices Menu" - "Microsoft Corporation" - C:\WINDOWS\system32\wpdshext.dll
{640167b4-59b0-47a6-b335-a6b3c0695aea} "Portable Media Devices" - "Microsoft Corporation" - C:\WINDOWS\system32\Audiodev.dll
{D8BD2030-6FC9-11D0-864F-00AA006809D9} "PostAgent" - "Microsoft Corporation" - C:\WINDOWS\system32\webcheck.dll
{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} "RealOne Player Context Menu Class" - "RealNetworks, Inc." - C:\Programme\Real\RealPlayer\rpshell.dll
{AF4F6510-F982-11d0-8595-00AA004CD6D8} "Registry Tree Options Utility" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll
{F0152790-D56E-4445-850E-4F3117DB740C} "Remote Sessions CPL Extension" - "Microsoft Corporation" - C:\WINDOWS\system32\remotepg.dll
{3F953603-1008-4f6e-A73A-04AAC7A992F1} "Scanner und Kameras" - "Microsoft Corporation" - C:\WINDOWS\system32\wiashext.dll
{83bbcbf3-b28a-4919-a5aa-73027445d672} "Scanner und Kameras" - "Microsoft Corporation" - C:\WINDOWS\system32\wiashext.dll
{905667aa-acd6-11d2-8080-00805f6596d2} "Scanner und Kameras" - "Microsoft Corporation" - C:\WINDOWS\system32\wiashext.dll
{E211B736-43FD-11D1-9EFB-0000F8757FCD} "Scanner und Kameras" - "Microsoft Corporation" - C:\WINDOWS\system32\wiashext.dll
{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD} "Scanner und Kameras" - "Microsoft Corporation" - C:\WINDOWS\system32\wiashext.dll
{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF} "Scheduling UI icon handler" - "Microsoft Corporation" - C:\WINDOWS\system32\mstask.dll
{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF} "Scheduling UI property sheet handler" - "Microsoft Corporation" - C:\WINDOWS\system32\mstask.dll
{BD84B380-8CA2-1069-AB1D-08000948F534} "Schriftarten" - "Microsoft Corporation" - C:\WINDOWS\system32\fontext.dll
{D20EA4E1-3957-11d2-A40B-0C5020524152} "Schriftarten" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll
{9461b922-3c5a-11d2-bf8b-00c04fb93661} "Search Assistant OC" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll
{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE} "Sendmail service" - "Microsoft Corporation" - C:\WINDOWS\system32\sendmail.dll
{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE} "Sendmail service" - "Microsoft Corporation" - C:\WINDOWS\system32\sendmail.dll
{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0} "Set Program Access and Defaults" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll
{352EC2B7-8B9A-11D1-B8AE-006008059382} "Shell Application Manager" - "Microsoft Corporation" - C:\WINDOWS\system32\appwiz.cpl
{0A89A860-D7B1-11CE-8350-444553540000} "Shell Automation Inproc Service" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll
{ECD4FC4E-521C-11D0-B792-00A0C90312E1} "Shell Band Site Menu" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll
{ECD4FC4C-521C-11D0-B792-00A0C90312E1} "Shell DeskBar" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll
{3CCF8A41-5C85-11d0-9796-00AA00B90ADF} "Shell DeskBarApp" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll
{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} "Shell DocObject Viewer" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Programme\Antivir Avira\Avira\AntiVir Desktop\shlext.dll
{60254CA5-953B-11CF-8C96-00AA00B8708C} "Shell Extension For Windows Script Host" - "Microsoft Corporation" - C:\WINDOWS\system32\wshext.dll
{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178} "Shell Image Data Factory" - "Microsoft Corporation" - C:\WINDOWS\system32\shimgvw.dll
{eb9b1153-3b57-4e68-959a-a3266bc3d7fe} "Shell Image Property Handler" - "Microsoft Corporation" - C:\WINDOWS\system32\shimgvw.dll
{e84fda7c-1d6a-45f6-b725-cb260c236066} "Shell Image Verbs" - "Microsoft Corporation" - C:\WINDOWS\system32\shimgvw.dll
{00BB2763-6A77-11D0-A535-00C04FD7D062} "Shell Microsoft AutoComplete" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll
{9E51E0D0-6E0F-11d2-9601-00C04FA31A86} "Shell properties for a DS object" - "Microsoft Corporation" - C:\WINDOWS\system32\dsquery.dll
{ECD4FC4D-521C-11D0-B792-00A0C90312E1} "Shell Rebar BandSite" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll
{21569614-B795-46b1-85F4-E737A8DC09AD} "Shell Search Band" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll
{56117100-C0CD-101B-81E2-00AA004AE837} "Shell-Datenauszughandler" - "Microsoft Corporation" - C:\WINDOWS\system32\shscrap.dll
{77597368-7b15-11d0-a0c2-080036af3f03} "Shellerweiterung für Webdrucker" - "Microsoft Corporation" - C:\WINDOWS\system32\printui.dll
{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -  (File not found | COM-object registry key not found)
{40dd6e20-7c17-11ce-a804-00aa003ca9f6} "Shellerweiterungen für Freigaben" - "Microsoft Corporation" - C:\WINDOWS\system32\ntshrui.dll
{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6} "Shellerweiterungen für Freigaben" - "Microsoft Corporation" - C:\WINDOWS\system32\ntshrui.dll
{59be4990-f85c-11ce-aff7-00aa003ca9f6} "Shellerweiterungen für Microsoft Windows-Netzwerkobjekte" - "Microsoft Corporation" - C:\WINDOWS\system32\ntlanui2.dll
{6b33163c-76a5-4b6c-bf21-45de9cd503a1} "Shellobjekt des Webpublishing-Assistenten" - "Microsoft Corporation" - C:\WINDOWS\system32\netplwiz.dll
{5E2121EE-0300-11D4-8D3B-444553540000} "SimpleShlExt Class" - ? - C:\Programme\ATI Technologies\ATI.ACE\atiacmxx.dll
{F5175861-2688-11d0-9C5E-00AA00A45957} "Subscription Folder" - "Microsoft Corporation" - C:\WINDOWS\system32\webcheck.dll
{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE} "Subscription Mgr" - "Microsoft Corporation" - C:\WINDOWS\system32\webcheck.dll
{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0} "Suchen" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll
{0DF44EAA-FF21-4412-828E-260A8728E7F1} "Taskleiste und Startmenü" - "Microsoft Corporation" - C:\WINDOWS\system32\shell32.dll
{7BD29E00-76C1-11CF-9DD0-00A0C9034933} "Temporary Internet Files" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll
{7BD29E01-76C1-11CF-9DD0-00A0C9034933} "Temporary Internet Files" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll
{acf35015-526e-4230-9596-becbe19f0ac9} "Track Popup Bar" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll
{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7} "TrayAgent" - "Microsoft Corporation" - C:\WINDOWS\system32\webcheck.dll
{7376D660-C583-11d0-A3A5-00C04FD706EC} "TridentImageExtractor" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll
{DD313E04-FEFF-11d1-8ECD-0000F87A470C} "User Assist" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll
{FF393560-C2A7-11CF-BFF4-444553540000} "Verlauf" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll
{D20EA4E1-3957-11d2-A40B-0C5020524153} "Verwaltung" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll
{40C3D757-D6E4-4b49-BB41-0E5BBEA28817} "Video Media Properties Handler" - "Microsoft Corporation" - C:\WINDOWS\system32\shmedia.dll
{c5a40261-cd64-4ccf-84cb-c394da41d590} "Video Thumbnail Extractor" - "Microsoft Corporation" - C:\WINDOWS\system32\shmedia.dll
{9DB7A13C-F208-4981-8353-73CC61AE2783} "Vorherige Versionen" - "Microsoft Corporation" - C:\WINDOWS\system32\twext.dll
{E4B29F9D-D390-480b-92FD-7DDB47101D71} "Wav Properties Handler" - "Microsoft Corporation" - C:\WINDOWS\system32\shmedia.dll
{07798131-AF23-11d1-9111-00A0C98BA67D} "Web Search" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll
{E6FB5E20-DE35-11CF-9C87-00AA005127ED} "WebCheck" - "Microsoft Corporation" - C:\WINDOWS\system32\webcheck.dll
{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB} "WebCheck SyncMgr Handler" - "Microsoft Corporation" - C:\WINDOWS\system32\webcheck.dll
{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB} "WebCheckChannelAgent" - "Microsoft Corporation" - C:\WINDOWS\system32\webcheck.dll
{08165EA0-E946-11CF-9C87-00AA005127ED} "WebCheckWebCrawler" - "Microsoft Corporation" - C:\WINDOWS\system32\webcheck.dll
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
{CC6EEFFB-43F6-46c5-9619-51D571967F7D} "Webpublishing-Assistent" - "Microsoft Corporation" - C:\WINDOWS\system32\netplwiz.dll
{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0} "Windows-Sicherheit" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Programme\WinRAR\rarext.dll  (File found, but it contains no detailed information)
{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD} "WMP Add To Playlist Launcher" - "Microsoft Corporation" - C:\WINDOWS\system32\wmpshell.dll
{8DD448E6-C188-4aed-AF92-44956194EB1F} "WMP Burn Audio CD Launcher" - "Microsoft Corporation" - C:\WINDOWS\system32\wmpshell.dll
{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C} "WMP Play As Playlist Launcher" - "Microsoft Corporation" - C:\WINDOWS\system32\wmpshell.dll
{9DBD2C50-62AD-11d0-B806-00C04FD706EC} "Zusammenfassungs-Miniaturansichthandler (DOCFILES)" - "Microsoft Corporation" - C:\WINDOWS\system32\shimgvw.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad )-----
{7849596a-48ea-486e-8937-a2a3009f31a9} "PostBootReminder object" - "Microsoft Corporation" - C:\WINDOWS\system32\shell32.dll
{fbeb8a05-beee-4442-804e-409d6c4515e9} "ShellFolder for CD Burning" - "Microsoft Corporation" - C:\WINDOWS\system32\SHELL32.dll
{35CEC8A3-2BE6-11D2-8773-92E220524153} "SysTray" - "Microsoft Corporation" - C:\WINDOWS\system32\stobject.dll
{E6FB5E20-DE35-11CF-9C87-00AA005127ED} "WebCheck" - "Microsoft Corporation" - C:\WINDOWS\system32\webcheck.dll
{AAA288BA-9A4C-45B0-95D7-94D524869DB5} "WPDShServiceObj Class" - "Microsoft Corporation" - C:\WINDOWS\system32\WPDShServiceObj.dll

[Internet Explorer]
-----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars )-----
{EFA24E64-B078-11D0-89E4-00C04FC9E26E} "Explorer-Band" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll
{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1} "File Search Explorer Band" - "Microsoft Corporation" - C:\WINDOWS\system32\SHELL32.dll
{21569614-B795-46B1-85F4-E737A8DC09AD} "Shell Search Band" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "&Adresse" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll
<binary data> "&Links" - "Microsoft Corporation" - C:\WINDOWS\system32\SHELL32.dll
<binary data> "Adobe PDF" - "Adobe Systems Incorporated" - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
<binary data> "ITBarLayout" - ? -  (File not found | COM-object registry key not found)
-----( HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks )-----
{CFBFAE00-17A6-11D0-99CB-00C04FD64497} "Microsoft Url Sucheingriff" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{8BC53B30-32E4-4ED3-BEF9-DB761DB77453} "CInstallLPCtrl Object" - "SanDisk Corporation" - C:\WINDOWS\Downloaded Program Files\InstallLP.dll / hxxp://u3.sandisk.com/download/apps/LPInstaller.CAB
{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA} "Java Plug-in 1.4.2" - "JavaSoft / Sun Microsystems, Inc." - C:\Programme\Java\j2re1.4.2\bin\npjpi142.dll / hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} "Java Plug-in 1.6.0_03" - "Sun Microsystems, Inc." - C:\Programme\Java\jre1.6.0_03\bin\npjpi160_03.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} "Java Plug-in 1.6.0_07" - "Sun Microsystems, Inc." - C:\Programme\Java\jre1.6.0_07\bin\npjpi160_07.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_14" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_14.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} "Java Plug-in 1.6.0_14" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_14.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_14" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_14.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\WINDOWS\system32\Macromed\Flash\Flash10a.ocx / hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{53707962-6F74-2D53-2644-206D7942484F} "ClsidExtension" - "Safer Networking Limited" - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
"Messenger" - "Microsoft Corporation" - C:\Programme\Messenger\msmsgs.exe
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Recherchieren" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Plugins\Extension )-----
"Ulead COOL 360 Viewer" - "Ulead Systems, Inc." - C:\Programme\Internet Explorer\Plugins\NPUPano.dll
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
<binary data> "Adobe PDF" - "Adobe Systems Incorporated" - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
{327C2873-E90D-4c37-AA9D-10AC9BABA46C} "Easy-WebPrint" - ? - C:\Programme\Canon Drucker\Easy-WebPrint\Toolband.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{AE7CD045-E861-484f-8273-0445EE161910} "Adobe PDF Conversion Toolbar Helper" - "Adobe Systems Incorporated" - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader Link Helper" - "Adobe Systems Incorporated" - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jp2ssv.dll
{E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
{53707962-6F74-2D53-2644-206D7942484F} "Spybot-S&D IE Protection" - "Safer Networking Limited" - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

[Known DLLs]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs )-----
"advapi32" - "Microsoft Corporation" - C:\WINDOWS\system32\advapi32.dll
"comdlg32" - "Microsoft Corporation" - C:\WINDOWS\system32\comdlg32.dll
"gdi32" - "Microsoft Corporation" - C:\WINDOWS\system32\gdi32.dll
"imagehlp" - "Microsoft Corporation" - C:\WINDOWS\system32\imagehlp.dll
"kernel32" - "Microsoft Corporation" - C:\WINDOWS\system32\kernel32.dll
"lz32" - "Microsoft Corporation" - C:\WINDOWS\system32\lz32.dll
"ole32" - "Microsoft Corporation" - C:\WINDOWS\system32\ole32.dll
"oleaut32" - "Microsoft Corporation" - C:\WINDOWS\system32\oleaut32.dll
"olecli32" - "Microsoft Corporation" - C:\WINDOWS\system32\olecli32.dll
"olecnv32" - "Microsoft Corporation" - C:\WINDOWS\system32\olecnv32.dll
"olesvr32" - "Microsoft Corporation" - C:\WINDOWS\system32\olesvr32.dll
"olethk32" - "Microsoft Corporation" - C:\WINDOWS\system32\olethk32.dll
"rpcrt4" - "Microsoft Corporation" - C:\WINDOWS\system32\rpcrt4.dll
"shell32" - "Microsoft Corporation" - C:\WINDOWS\system32\shell32.dll
"url" - "Microsoft Corporation" - C:\WINDOWS\system32\url.dll
"urlmon" - "Microsoft Corporation" - C:\WINDOWS\system32\urlmon.dll
"user32" - "Microsoft Corporation" - C:\WINDOWS\system32\user32.dll
"version" - "Microsoft Corporation" - C:\WINDOWS\system32\version.dll
"wininet" - "Microsoft Corporation" - C:\WINDOWS\system32\wininet.dll
"wldap32" - "Microsoft Corporation" - C:\WINDOWS\system32\wldap32.dll

[LSA Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Lsa )-----
"Authentication packages" - "Microsoft Corporation" - C:\WINDOWS\system32\msv1_0.dll
"Notification packages" - "Microsoft Corporation" - C:\WINDOWS\system32\scecli.dll
"Security Packages" - "Microsoft Corporation" - C:\WINDOWS\system32\kerberos.dll
"Security Packages" - "Microsoft Corporation" - C:\WINDOWS\system32\msv1_0.dll
"Security Packages" - "Microsoft Corporation" - C:\WINDOWS\system32\schannel.dll
"Security Packages" - "Microsoft Corporation" - C:\WINDOWS\system32\wdigest.dll
-----( HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders )-----
"SecurityProviders" - "Microsoft Corporation" - C:\WINDOWS\system32\msapsspc.dll
"SecurityProviders" - "Microsoft Corporation" - C:\WINDOWS\system32\schannel.dll
"SecurityProviders" - "Microsoft Corporation" - C:\WINDOWS\system32\digest.dll
"SecurityProviders" - "Microsoft Corporation" - C:\WINDOWS\system32\msnsspc.dll

[Logon]
-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----
"Catalyst System Tray.lnk" - "ATI Technologies Inc." - C:\Programme\ATI Technologies\ATI.ACE\CLI.exe  (Shortcut exists | File exists)
"desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini
-----( %UserProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\Family\Startmenü\Programme\Autostart\desktop.ini
"RocketDock.exe.lnk" - ? - C:\Programme\RocketDock\RocketDock.exe  (Shortcut exists | File found, but it contains no detailed information | File exists)
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon )-----
"Shell" - "Microsoft Corporation" - C:\WINDOWS\Explorer.exe
"Userinit" - "Microsoft Corporation" - C:\WINDOWS\system32\userinit.exe
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - "Microsoft Corporation" - C:\WINDOWS\system32\rdpclip.exe
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"AEZBProc" - "IBM Corporation" - c:\ibmtools\aptezbtn\aptezbp.exe
"ATICCC" - "ATI Technologies Inc." - "C:\Programme\ATI Technologies\ATI.ACE\cli.exe" runtime
"avgnt" - "Avira GmbH" - "C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avgnt.exe" /min
"CTSysVol" - "Creative Technology Ltd" - C:\Programme\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
"Easy-PrintToolBox" - "CANON INC." - C:\Programme\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
"iTunesHelper" - "Apple Inc." - "C:\Programme\iTunes\iTunesHelper.exe"
"LogitechCommunicationsManager" - "Logitech Inc." - "C:\Programme\Gemeinsame Dateien\LogiShrd\LComMgr\Communications_Helper.exe"
"LogitechQuickCamRibbon" - "Logitech Inc." - "C:\Programme\Logitech\QuickCam10\QuickCam10.exe" /hide
"NeroFilterCheck" - "Ahead Software Gmbh" - C:\WINDOWS\system32\NeroCheck.exe
"NokiaMServer" - "Nokia" - C:\Programme\Gemeinsame Dateien\Nokia\MPlatform\NokiaMServer /watchfiles startup
"Omnipage" - "ScanSoft, Inc" - C:\Programme\ScanSoft\OmniPageSE\opware32.exe
"P17Helper" - ? - Rundll32 P17.dll,P17Helper
"QuickTime Task" - "Apple Inc." - "C:\Programme\QuickTime Alternative\QTTask.exe" -atboottime
"REGSHAVE" - "FUJI PHOTO FILM CO., LTD." - C:\Programme\REGSHAVE\REGSHAVE.EXE /AUTORUN
"RTHDCPL" - "Realtek Semiconductor Corp." - RTHDCPL.EXE
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Programme\Java\jre6\bin\jusched.exe"
"UserFaultCheck" - "Microsoft Corporation" - %systemroot%\system32\dumprep 0 -u

[Network Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order )-----
"Microsoft Windows-Netzwerk" - "Microsoft Corporation" - C:\WINDOWS\System32\ntlanman.dll
"Microsoft-Terminaldienste" - "Microsoft Corporation" - C:\WINDOWS\System32\drprov.dll
"Web Client Network" - "Microsoft Corporation" - C:\WINDOWS\System32\davclnt.dll

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"Adobe PDF Port" - "Adobe Systems Incorporated." - C:\WINDOWS\system32\AdobePDF.dll
"BJ Language Monitor" - "Microsoft Corporation" - C:\WINDOWS\system32\cnbjmon.dll
"Canon BJ Language Monitor iP5200" - "CANON INC." - C:\WINDOWS\system32\CNMLM79.DLL
"Local Port" - "Microsoft Corporation" - C:\WINDOWS\system32\localspl.dll
"Microsoft Document Imaging Writer Monitor" - "Microsoft Corporation" - C:\WINDOWS\system32\mdimon.dll
"PJL Language Monitor" - "Microsoft Corporation" - C:\WINDOWS\system32\pjlmon.dll
"Standard TCP/IP Port" - "Microsoft Corporation" - C:\WINDOWS\system32\tcpmon.dll
"USB Monitor" - "Microsoft Corporation" - C:\WINDOWS\system32\usbmon.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"a-squared Free Service" (a2free) - "Emsi Software GmbH" - C:\Programme\a-squared Free\a2service.exe
"Ablagemappe" (ClipSrv) - "Microsoft Corporation" - C:\WINDOWS\system32\clipsrv.exe
"Anmeldedienst" (Netlogon) - "Microsoft Corporation" - C:\WINDOWS\system32\lsass.exe
"Anwendungsverwaltung" (AppMgmt) - "Microsoft Corporation" - C:\WINDOWS\System32\appmgmts.dll
"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
"Arbeitsstationsdienst" (lanmanworkstation) - "Microsoft Corporation" - C:\WINDOWS\System32\wkssvc.dll
"ASP.NET State Service" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe
"Ati HotKey Poller" (Ati HotKey Poller) - "ATI Technologies Inc." - C:\WINDOWS\system32\Ati2evxx.exe
"ATI Smart" (ATI Smart) - ? - C:\WINDOWS\system32\ati2sgag.exe
"Automatische Updates" (wuauserv) - "Microsoft Corporation" - C:\WINDOWS\system32\wuauserv.dll
"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avguard.exe
"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Programme\Antivir Avira\Avira\AntiVir Desktop\sched.exe
"CLCV0" (UTSCSI) - ? - C:\WINDOWS\system32\UTSCSI.EXE
"COM+-Ereignissystem" (EventSystem) - "Microsoft Corporation" - C:\WINDOWS\system32\es.dll
"COM+-Systemanwendung" (COMSysApp) - "Microsoft Corporation" - C:\WINDOWS\system32\dllhost.exe
"Computerbrowser" (Browser) - "Microsoft Corporation" - C:\WINDOWS\System32\browser.dll
"Creative Service for CDROM Access" (Creative Service for CDROM Access) - "Creative Technology Ltd" - C:\WINDOWS\system32\CTsvcCDA.EXE
"CryptSvc" (CryptSvc) - "Microsoft Corporation" - C:\WINDOWS\System32\cryptsvc.dll
"DCOM-Server-Prozessstart" (DcomLaunch) - "Microsoft Corporation" - C:\WINDOWS\system32\rpcss.dll
"Designs" (Themes) - "Microsoft Corporation" - C:\WINDOWS\System32\shsvcs.dll
"DHCP-Client" (Dhcp) - "Microsoft Corporation" - C:\WINDOWS\System32\dhcpcsvc.dll
"Dienst für Seriennummern der tragbaren Medien" (WmdmPmSN) - "Microsoft Corporation" - C:\WINDOWS\system32\MsPMSNSv.dll
"Distributed Transaction Coordinator" (MSDTC) - "Microsoft Corporation" - C:\WINDOWS\system32\msdtc.exe
"DNS-Client" (Dnscache) - "Microsoft Corporation" - C:\WINDOWS\System32\dnsrslvr.dll
"Druckwarteschlange" (Spooler) - "Microsoft Corporation" - C:\WINDOWS\system32\spoolsv.exe
"Ereignisprotokoll" (Eventlog) - "Microsoft Corporation" - C:\WINDOWS\system32\services.exe
"Fehlerberichterstattungsdienst" (ERSvc) - "Microsoft Corporation" - C:\WINDOWS\System32\ersvc.dll
"FLEXnet Licensing Service" (FLEXnet Licensing Service) - "Macrovision Europe Ltd." - C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
"Gatewaydienst auf Anwendungsebene" (ALG) - "Microsoft Corporation" - C:\WINDOWS\System32\alg.exe
"Geschützter Speicher" (ProtectedStorage) - "Microsoft Corporation" - C:\WINDOWS\system32\lsass.exe
"HID Input Service" (HidServ) - ? -  C:\WINDOWS\System32\hidserv.dll  (File not found)
"Hilfe und Support" (helpsvc) - "Microsoft Corporation" - C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
"HTTP-SSL" (HTTPFilter) - "Microsoft Corporation" - C:\WINDOWS\System32\w3ssl.dll
"IMAPI-CD-Brenn-COM-Dienste" (ImapiService) - "Microsoft Corporation" - C:\WINDOWS\system32\imapi.exe
"Indexdienst" (CiSvc) - "Microsoft Corporation" - C:\WINDOWS\system32\cisvc.exe
"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe
"Intelligenter Hintergrundübertragungsdienst" (BITS) - "Microsoft Corporation" - C:\WINDOWS\system32\qmgr.dll
"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Programme\iPod\bin\iPodService.exe
"IPSEC-Dienste" (PolicyAgent) - "Microsoft Corporation" - C:\WINDOWS\system32\lsass.exe
"Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jqs.exe
"Kompatibilität für schnelle Benutzerumschaltung" (FastUserSwitchingCompatibility) - "Microsoft Corporation" - C:\WINDOWS\System32\shsvcs.dll
"Konfigurationsfreie drahtlose Verbindung" (WZCSVC) - "Microsoft Corporation" - C:\WINDOWS\System32\wzcsvc.dll
"Lavasoft Ad-Aware Service" (aawservice) - "Lavasoft" - C:\Programme\Lavasoft\Ad-Aware\aawservice.exe
"Leistungsdatenprotokolle und Warnungen" (SysmonLog) - "Microsoft Corporation" - C:\WINDOWS\system32\smlogsvc.exe
"LVCOMSer" (LVCOMSer) - "Logitech Inc." - C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe
"LVSrvLauncher" (LVSrvLauncher) - "Logitech Inc." - C:\Programme\Gemeinsame Dateien\LogiShrd\SrvLnch\SrvLnch.exe
"MS Software Shadow Copy Provider" (SwPrv) - "Microsoft Corporation" - C:\WINDOWS\system32\dllhost.exe
"NetMeeting-Remotedesktop-Freigabe" (mnmsrvc) - "Microsoft Corporation" - C:\WINDOWS\system32\mnmsrvc.exe
"Netzwerkverbindungen" (Netman) - "Microsoft Corporation" - C:\WINDOWS\System32\netman.dll
"Netzwerkversorgungsdienst" (xmlprov) - "Microsoft Corporation" - C:\WINDOWS\System32\xmlprov.dll
"NLA (Network Location Awareness)" (Nla) - "Microsoft Corporation" - C:\WINDOWS\System32\mswsock.dll
"NT-LM-Sicherheitsdienst" (NtLmSsp) - "Microsoft Corporation" - C:\WINDOWS\system32\lsass.exe
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE
"Plug & Play" (PlugPlay) - "Microsoft Corporation" - C:\WINDOWS\system32\services.exe
"Process Monitor" (LVPrcSrv) - "Logitech Inc." - C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe
"QoS-RSVP" (RSVP) - "Microsoft Corporation" - C:\WINDOWS\system32\rsvp.exe
"RAS-Verbindungsverwaltung" (RasMan) - "Microsoft Corporation" - C:\WINDOWS\System32\rasmans.dll
"Remote-Registrierung" (RemoteRegistry) - "Microsoft Corporation" - C:\WINDOWS\system32\regsvc.dll
"Remoteprozeduraufruf (RPC)" (RpcSs) - "Microsoft Corporation" - C:\WINDOWS\System32\rpcss.dll
"RPC-Locator" (RpcLocator) - "Microsoft Corporation" - C:\WINDOWS\system32\locator.exe
"Secondary Logon" (seclogon) - "Microsoft Corporation" - C:\WINDOWS\System32\seclogon.dll
"Server" (lanmanserver) - "Microsoft Corporation" - C:\WINDOWS\System32\srvsvc.dll
"ServiceLayer" (ServiceLayer) - "Nokia" - C:\Programme\PC Connectivity Solution\ServiceLayer.exe
"Shellhardwareerkennung" (ShellHWDetection) - "Microsoft Corporation" - C:\WINDOWS\System32\shsvcs.dll
"Sicherheitscenter" (wscsvc) - "Microsoft Corporation" - C:\WINDOWS\system32\wscsvc.dll
"Sicherheitskontenverwaltung" (SamSs) - "Microsoft Corporation" - C:\WINDOWS\system32\lsass.exe
"Sitzungs-Manager für Remotedesktophilfe" (RDSessMgr) - "Microsoft Corporation" - C:\WINDOWS\system32\sessmgr.exe
"Smartcard" (SCardSvr) - "Microsoft Corporation" - C:\WINDOWS\System32\SCardSvr.exe
"SSDP-Suchdienst" (SSDPSRV) - "Microsoft Corporation" - C:\WINDOWS\System32\ssdpsrv.dll
"Sunbelt Kerio Personal Firewall 4" (KPF4) - "Sunbelt Software" - C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe
"Systemereignisbenachrichtigung" (SENS) - "Microsoft Corporation" - C:\WINDOWS\system32\sens.dll
"Systemwiederherstellungsdienst" (srservice) - "Microsoft Corporation" - C:\WINDOWS\system32\srsvc.dll
"Taskplaner" (Schedule) - "Microsoft Corporation" - C:\WINDOWS\system32\schedsvc.dll
"TCP/IP-NetBIOS-Hilfsprogramm" (LmHosts) - "Microsoft Corporation" - C:\WINDOWS\System32\lmhsvc.dll
"Telefonie" (TapiSrv) - "Microsoft Corporation" - C:\WINDOWS\System32\tapisrv.dll
"Telnet" (TlntSvr) - "Microsoft Corporation" - C:\WINDOWS\system32\tlntsvr.exe
"Terminaldienste" (TermService) - "Microsoft Corporation" - C:\WINDOWS\System32\termsrv.dll
"Treibererweiterungen für Windows-Verwaltungsinstrumentation" (Wmi) - "Microsoft Corporation" - C:\WINDOWS\System32\advapi32.dll
"Ulead Burning Helper" (UleadBurningHelper) - "Ulead Systems, Inc." - C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe
"Universeller Plug & Play-Gerätehost" (upnphost) - "Microsoft Corporation" - C:\WINDOWS\System32\upnphost.dll
"Unterbrechungsfreie Stromversorgung" (UPS) - "Microsoft Corporation" - C:\WINDOWS\System32\ups.exe
"Verwaltung für automatische RAS-Verbindung" (RasAuto) - "Microsoft Corporation" - C:\WINDOWS\System32\rasauto.dll
"Verwaltung logischer Datenträger" (dmserver) - "Microsoft Corp." - C:\WINDOWS\System32\dmserver.dll
"Verwaltungsdienst für die Verwaltung logischer Datenträger" (dmadmin) - "Microsoft Corp., Veritas Software" - C:\WINDOWS\System32\dmadmin.exe
"Volumeschattenkopie" (VSS) - "Microsoft Corporation" - C:\WINDOWS\System32\vssvc.exe
"Webclient" (WebClient) - "Microsoft Corporation" - C:\WINDOWS\System32\webclnt.dll
"Wechselmedien" (NtmsSvc) - "Microsoft Corporation" - C:\WINDOWS\system32\ntmssvc.dll
"Windows Audio" (AudioSrv) - "Microsoft Corporation" - C:\WINDOWS\System32\audiosrv.dll
"Windows Driver Foundation - User-mode Driver Framework" (WudfSvc) - "Microsoft Corporation" - C:\WINDOWS\System32\WUDFSvc.dll
"Windows Installer" (MSIServer) - "Microsoft Corporation" - C:\WINDOWS\system32\msiexec.exe
"Windows-Bilderfassung (WIA)" (stisvc) - "Microsoft Corporation" - C:\WINDOWS\system32\wiaservc.dll
"Windows-Firewall/Gemeinsame Nutzung der Internetverbindung" (SharedAccess) - "Microsoft Corporation" - C:\WINDOWS\System32\ipnathlp.dll
"Windows-Verwaltungsinstrumentation" (winmgmt) - "Microsoft Corporation" - C:\WINDOWS\system32\wbem\WMIsvc.dll
"WMI-Leistungsadapter" (WmiApSrv) - "Microsoft Corporation" - C:\WINDOWS\system32\wbem\wmiapsrv.exe
"Überwachung verteilter Verknüpfungen (Client)" (TrkWks) - "Microsoft Corporation" - C:\WINDOWS\system32\trkwks.dll

[Winlogon]
-----( HKCU\Control Panel\IOProcs )-----
"MVB" - ? - mvfs32.dll  (File not found)
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon )-----
"UIHost" - "Microsoft Corporation" - C:\WINDOWS\system32\logonui.exe
"VmApplet" - "Microsoft Corporation" - C:\WINDOWS\system32\sysdm.cpl
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions )-----
{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63} "Drahtlos" - "Microsoft Corporation" - C:\WINDOWS\system32\gptext.dll
{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A} "EFS recovery" - "Microsoft Corporation" - C:\WINDOWS\system32\scecli.dll
{25537BA6-77A8-11D2-9B6C-0000F8080861} "Folder Redirection" - "Microsoft Corporation" - C:\WINDOWS\system32\fdeploy.dll
{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B} "Internet Explorer-Branding" - "Microsoft Corporation" - C:\WINDOWS\system32\iedkcs32.dll
{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3} "Internet Explorer-Zonenzuordnung" - "Microsoft Corporation" - C:\WINDOWS\system32\iedkcs32.dll
{e437bc1c-aa7d-11d2-a382-00c04f991e27} "IP-Sicherheit" - "Microsoft Corporation" - C:\WINDOWS\system32\gptext.dll
{C631DF4C-088F-4156-B058-4375F0853CD8} "Microsoft Offline Files" - "Microsoft Corporation" - C:\WINDOWS\System32\cscui.dll
{3610eda5-77ef-11d2-8dc5-00c04fa31a66} "Microsoft-Datenträgerkontingent" - "Microsoft Corporation" - C:\WINDOWS\system32\dskquota.dll
{426031c0-0b47-4852-b0ca-ac3d37bfcb39} "QoS-Paketplaner" - "Microsoft Corporation" - C:\WINDOWS\system32\gptext.dll
{827D319E-6EAC-11D2-A4EA-00C04F79F83A} "Security" - "Microsoft Corporation" - C:\WINDOWS\system32\scecli.dll
{42B5FAAE-6536-11d2-AE5A-0000F87571E3} "Skripts" - "Microsoft Corporation" - C:\WINDOWS\system32\gptext.dll
{c6dc5466-785a-11d2-84d0-00c04fb169f7} "Softwareinstallation" - "Microsoft Corporation" - C:\WINDOWS\system32\appmgmts.dll
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----
"AtiExtEvent" - "ATI Technologies Inc." - C:\WINDOWS\system32\Ati2evxx.dll
"crypt32chain" - "Microsoft Corporation" - C:\WINDOWS\system32\crypt32.dll
"cryptnet" - "Microsoft Corporation" - C:\WINDOWS\system32\cryptnet.dll
"cscdll" - "Microsoft Corporation" - C:\WINDOWS\system32\cscdll.dll
"ScCertProp" - "Microsoft Corporation" - C:\WINDOWS\system32\wlnotify.dll
"Schedule" - "Microsoft Corporation" - C:\WINDOWS\system32\wlnotify.dll
"sclgntfy" - "Microsoft Corporation" - C:\WINDOWS\system32\sclgntfy.dll
"SensLogn" - "Microsoft Corporation" - C:\WINDOWS\system32\WlNotify.dll
"termsrv" - "Microsoft Corporation" - C:\WINDOWS\system32\wlnotify.dll
"wlballoon" - "Microsoft Corporation" - C:\WINDOWS\system32\wlnotify.dll

[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----
"mdnsNSP" - "Apple Inc." - C:\Programme\Bonjour\mdnsNSP.dll
"NLA-Namespace" - "Microsoft Corporation" - C:\WINDOWS\System32\mswsock.dll
"NTDS" - "Microsoft Corporation" - C:\WINDOWS\System32\winrnr.dll
"TCP/IP" - "Microsoft Corporation" - C:\WINDOWS\System32\mswsock.dll
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries )-----
"MSAFD NetBIOS [\Device\NetBT_Tcpip_{38720C4D-3B78-4976-802B-DBB578E25317}] DATAGRAM 2" - "Microsoft Corporation" - C:\WINDOWS\system32\mswsock.dll
"MSAFD NetBIOS [\Device\NetBT_Tcpip_{38720C4D-3B78-4976-802B-DBB578E25317}] SEQPACKET 2" - "Microsoft Corporation" - C:\WINDOWS\system32\mswsock.dll
"MSAFD NetBIOS [\Device\NetBT_Tcpip_{4A6A7E60-D124-4E64-94DE-22D605A8A5C3}] DATAGRAM 4" - "Microsoft Corporation" - C:\WINDOWS\system32\mswsock.dll
"MSAFD NetBIOS [\Device\NetBT_Tcpip_{4A6A7E60-D124-4E64-94DE-22D605A8A5C3}] SEQPACKET 4" - "Microsoft Corporation" - C:\WINDOWS\system32\mswsock.dll
"MSAFD NetBIOS [\Device\NetBT_Tcpip_{4B12BFD7-BC30-41C2-9F29-B78B0468BDF9}] DATAGRAM 3" - "Microsoft Corporation" - C:\WINDOWS\system32\mswsock.dll
"MSAFD NetBIOS [\Device\NetBT_Tcpip_{4B12BFD7-BC30-41C2-9F29-B78B0468BDF9}] SEQPACKET 3" - "Microsoft Corporation" - C:\WINDOWS\system32\mswsock.dll
"MSAFD NetBIOS [\Device\NetBT_Tcpip_{4E4822C3-AFF7-4CE3-8355-763F4C00A93B}] DATAGRAM 0" - "Microsoft Corporation" - C:\WINDOWS\system32\mswsock.dll
"MSAFD NetBIOS [\Device\NetBT_Tcpip_{4E4822C3-AFF7-4CE3-8355-763F4C00A93B}] SEQPACKET 0" - "Microsoft Corporation" - C:\WINDOWS\system32\mswsock.dll
"MSAFD NetBIOS [\Device\NetBT_Tcpip_{D5DE6FA2-CC4E-4123-B4C0-992C4BD742C7}] DATAGRAM 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mswsock.dll
"MSAFD NetBIOS [\Device\NetBT_Tcpip_{D5DE6FA2-CC4E-4123-B4C0-992C4BD742C7}] SEQPACKET 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mswsock.dll
"MSAFD Tcpip [RAW/IP]" - "Microsoft Corporation" - C:\WINDOWS\system32\mswsock.dll
"MSAFD Tcpip [TCP/IP]" - "Microsoft Corporation" - C:\WINDOWS\system32\mswsock.dll
"MSAFD Tcpip [UDP/IP]" - "Microsoft Corporation" - C:\WINDOWS\system32\mswsock.dll
"RSVP TCP Service Provider" - "Microsoft Corporation" - C:\WINDOWS\system32\rsvpsp.dll
"RSVP UDP Service Provider" - "Microsoft Corporation" - C:\WINDOWS\system32\rsvpsp.dll

===[ Logfile end ]=========================================[ Logfile end ]===
--- --- ---
If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

aware 28.09.2010 20:36
Bootkit Remover output:

(c) 2009 eSage Lab
esage lab - main

Program version: 1.2.0.0
OS Version: Microsoft Windows XP Professional Service Pack 2 (build

System volume is \\.\C:
\\.\C: -> \\.\PhysicalDrive0 at offset 0x00000000`00007e00
ATA_Read(): DeviceIoControl() ERROR 1
Boot sector MD5 is: 5ddc20efcc4d1dab37c348c7db7289cf

Size Device Name MBR Status
--------------------------------------------
149 GB \\.\PhysicalDrive0 Unknown boot code

Unknown boot code has been found on some of your physical disks.
To inspect the boot code manually, dump the master boot sector:
remover.exe dump <device_name> [output_file]
To disinfect the master boot sector, use the following command:
remover.exe fix <device_name>


Done;
Press any key to quit...

cosinus 28.09.2010 20:55
Downloade Dir bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.
  • Doppelklick auf die MBRCheck.exe.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Das Tool braucht nur eine Sekunde.
  • Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.
Poste mir bitte den Inhalt des .txt Dokumentes

aware 28.09.2010 20:59
MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Professional
Windows Information: Service Pack 2 (build 2600)
Logical Drives Mask: 0x000001fd

Kernel Drivers (total 138):
0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
0x806CE000 \WINDOWS\system32\hal.dll
0xF7B1C000 \WINDOWS\system32\KDCOM.DLL
0xF7A2C000 \WINDOWS\system32\BOOTVID.dll
0xF74EC000 ACPI.sys
0xF7B1E000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xF74DB000 pci.sys
0xF761C000 isapnp.sys
0xF7BE4000 pciide.sys
0xF789C000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xF7B20000 aliide.sys
0xF762C000 MountMgr.sys
0xF74BC000 ftdisk.sys
0xF7B22000 dmload.sys
0xF7496000 dmio.sys
0xF78A4000 PartMgr.sys
0xF763C000 VolSnap.sys
0xF747E000 atapi.sys
0xF744A000 m5288.sys
0xF7432000 \WINDOWS\system32\DRIVERS\SCSIPORT.SYS
0xF764C000 disk.sys
0xF765C000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xF7413000 fltMgr.sys
0xF7401000 sr.sys
0xF766C000 PxHelp20.sys
0xF73EA000 KSecDD.sys
0xF73D7000 WudfPf.sys
0xF734A000 Ntfs.sys
0xF731D000 NDIS.sys
0xF7303000 Mup.sys
0xF76AC000 \SystemRoot\system32\DRIVERS\AmdK8.sys
0xF6738000 \SystemRoot\system32\DRIVERS\ati2mtag.sys
0xF6724000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xF65D0000 \SystemRoot\system32\drivers\P17.sys
0xF65AE000 \SystemRoot\system32\drivers\portcls.sys
0xF76BC000 \SystemRoot\system32\drivers\drmk.sys
0xF658B000 \SystemRoot\system32\drivers\ks.sys
0xF655B000 \SystemRoot\system32\DRIVERS\ctoss2k.sys
0xF6535000 \SystemRoot\system32\DRIVERS\ctsfm2k.sys
0xF76CC000 \SystemRoot\system32\DRIVERS\saa7146n.sys
0xF79BC000 \SystemRoot\system32\DRIVERS\ULILAN51.SYS
0xF79C4000 \SystemRoot\system32\DRIVERS\usbohci.sys
0xF6512000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xF79CC000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xF6501000 \SystemRoot\system32\DRIVERS\serial.sys
0xF72C3000 \SystemRoot\system32\DRIVERS\serenum.sys
0xF79D4000 \SystemRoot\system32\DRIVERS\fdc.sys
0xF64ED000 \SystemRoot\system32\DRIVERS\parport.sys
0xF76DC000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0xF79DC000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xF76EC000 \SystemRoot\system32\DRIVERS\imapi.sys
0xF64D7000 \SystemRoot\System32\Drivers\AnyDVD.sys
0xF76FC000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xF770C000 \SystemRoot\system32\DRIVERS\redbook.sys
0xF771C000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0xF7C87000 \SystemRoot\system32\DRIVERS\audstub.sys
0xF772C000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xF72BB000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xF64C0000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF773C000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF774C000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF79E4000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xF64AF000 \SystemRoot\system32\DRIVERS\psched.sys
0xF775C000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xF79EC000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF79F4000 \SystemRoot\system32\DRIVERS\raspti.sys
0xF79FC000 \SystemRoot\system32\DRIVERS\ttloophe.sys
0xF647E000 \SystemRoot\system32\DRIVERS\rdpdr.sys
0xF776C000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF7A04000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF7B64000 \SystemRoot\system32\DRIVERS\swenum.sys
0xF644A000 \SystemRoot\system32\DRIVERS\update.sys
0xF7ABC000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xF68E0000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF5D48000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xF7BA0000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xA9635000 \SystemRoot\system32\DRIVERS\flpydisk.sys
0xF7BAE000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF7C8D000 \SystemRoot\System32\Drivers\Null.SYS
0xF7BB0000 \SystemRoot\System32\Drivers\Beep.SYS
0xA9625000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xA961D000 \SystemRoot\System32\drivers\vga.sys
0xF7BB4000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF7BB6000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xA7CA8000 \SystemRoot\system32\drivers\fwdrv.sys
0xA9605000 \SystemRoot\System32\Drivers\Msfs.SYS
0xA95FD000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF5E1C000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xA7C95000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xA7C3D000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xA7C0B000 \SystemRoot\system32\DRIVERS\netbt.sys
0xA7BE9000 \SystemRoot\System32\drivers\afd.sys
0xA9596000 \SystemRoot\system32\DRIVERS\netbios.sys
0xA95F5000 \SystemRoot\System32\Drivers\StarOpen.SYS
0xA7BB4000 \SystemRoot\System32\drivers\truecrypt.sys
0xA95ED000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
0xA7B7F000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xA7AE8000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xA7AC9000 \SystemRoot\system32\drivers\khips.sys
0xA37CE000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xA6866000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xA6856000 \SystemRoot\System32\Drivers\Fips.SYS
0xA6E9F000 \SystemRoot\system32\DRIVERS\usbprint.sys
0xA6E97000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0xF72DF000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xF68D0000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xF7AF4000 \SystemRoot\system32\DRIVERS\usbscan.sys
0xF79AC000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
0xA0061000 \SystemRoot\system32\DRIVERS\LVMVDrv.sys
0xA0017000 \SystemRoot\System32\Drivers\usbvideo.sys
0xA942C000 \SystemRoot\system32\drivers\usbaudio.sys
0x9FDD4000 \SystemRoot\system32\DRIVERS\LVcKap.sys
0xA7EAB000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x9DEC9000 \SystemRoot\System32\Drivers\ElbyCDIO.sys
0x9D4E5000 \SystemRoot\system32\DRIVERS\avipbb.sys
0xA760E000 \??\C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avgio.sys
0xBF800000 \SystemRoot\System32\win32k.sys
0x9D686000 \SystemRoot\System32\drivers\Dxapi.sys
0x9DEB9000 \SystemRoot\System32\watchdog.sys
0xBF9C2000 \SystemRoot\System32\drivers\dxg.sys
0xA3A62000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF9D4000 \SystemRoot\System32\ati2dvag.dll
0xBFA13000 \SystemRoot\System32\ati2cqag.dll
0xBFA4C000 \SystemRoot\System32\atikvmag.dll
0xBFA81000 \SystemRoot\System32\ati3duag.dll
0xBFCD4000 \SystemRoot\System32\ativvaxx.dll
0x9B4D1000 \SystemRoot\system32\DRIVERS\avgntflt.sys
0x9DF4D000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x9B486000 \SystemRoot\System32\Drivers\Fastfat.SYS
0xF68B0000 \SystemRoot\System32\Drivers\Cdfs.SYS
0x9B3F9000 \SystemRoot\system32\drivers\wdmaud.sys
0x9DB24000 \SystemRoot\system32\drivers\sysaudio.sys
0x9B3A4000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0x9D6A4000 \SystemRoot\System32\Drivers\ParVdm.SYS
0x9B0AA000 \SystemRoot\system32\DRIVERS\srv.sys
0xF78EC000 \SystemRoot\system32\DRIVERS\LVPr2Mon.sys
0x9A991000 \SystemRoot\System32\Drivers\HTTP.sys
0x7C910000 \WINDOWS\system32\ntdll.dll

Processes (total 57):
0 System Idle Process
4 System
732 C:\WINDOWS\system32\smss.exe
804 csrss.exe
832 C:\WINDOWS\system32\winlogon.exe
876 C:\WINDOWS\system32\services.exe
888 C:\WINDOWS\system32\lsass.exe
1056 C:\WINDOWS\system32\ati2evxx.exe
1072 C:\WINDOWS\system32\svchost.exe
1140 svchost.exe
1340 C:\WINDOWS\system32\svchost.exe
1452 C:\WINDOWS\system32\svchost.exe
1560 C:\WINDOWS\system32\ati2evxx.exe
1620 C:\WINDOWS\explorer.exe
1716 svchost.exe
1972 svchost.exe
220 C:\Programme\Lavasoft\Ad-Aware\aawservice.exe
416 C:\WINDOWS\system32\spoolsv.exe
460 C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe
476 C:\Programme\Antivir Avira\Avira\AntiVir Desktop\sched.exe
628 C:\Programme\ATI Technologies\ATI.ACE\CLI.exe
636 C:\WINDOWS\system32\rundll32.exe
652 C:\Programme\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
680 C:\ibmtools\aptezbtn\aptezbp.exe
712 C:\Programme\ScanSoft\OmniPageSE\opware32.exe
748 C:\WINDOWS\RTHDCPL.EXE
776 C:\Programme\Gemeinsame Dateien\LogiShrd\LComMgr\Communications_Helper.exe
780 C:\Programme\Logitech\QuickCam10\QuickCam10.exe
800 C:\Programme\Java\jre6\bin\jusched.exe
808 C:\Programme\iTunes\iTunesHelper.exe
952 C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avgnt.exe
960 C:\Programme\Gemeinsame Dateien\Nokia\MPlatform\NokiaMServer.exe
1192 C:\Programme\RocketDock\RocketDock.exe
1712 C:\ibmtools\aptezbtn\rakusb.exe
1864 C:\Programme\a-squared Free\a2service.exe
1880 C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avguard.exe
1920 C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
1956 C:\WINDOWS\system32\CTSVCCDA.EXE
188 C:\Programme\Java\jre6\bin\jqs.exe
244 C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe
260 C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe
1348 C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe
1184 C:\WINDOWS\system32\svchost.exe
2092 C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe
2152 C:\WINDOWS\system32\UTSCSI.EXE
2648 C:\Programme\iPod\bin\iPodService.exe
2728 C:\WINDOWS\system32\wscntfy.exe
2916 C:\WINDOWS\system32\wbem\wmiapsrv.exe
3112 C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe
3216 alg.exe
1540 C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe
1500 C:\Programme\Gemeinsame Dateien\LogiShrd\LQCVFX\COCIManager.exe
2464 C:\Programme\ATI Technologies\ATI.ACE\CLI.exe
1844 C:\WINDOWS\system32\svchost.exe
2684 C:\DOKUME~1\Family\LOKALE~1\temp\TeamViewer\Version5\TeamViewer.exe
3236 C:\DOKUME~1\Family\LOKALE~1\temp\TeamViewer\Version5\TeamViewer_Desktop.exe
3904 C:\Dokumente und Einstellungen\Family\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
\\.\E: --> \\.\PhysicalDrive0 at offset 0x00000004`801f5c00 (NTFS)

PhysicalDrive0 Model Number: SAMSUNGHD160JJ, Rev: ZM100-41

Size Device Name MBR Status
--------------------------------------------
149 GB \\.\PhysicalDrive0 RE: Windows XP MBR code detected
SHA1: ADFE55CD0C6ED2E00B22375835E4C2736CE9AD11


Done!

cosinus 28.09.2010 21:28
Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

aware 28.09.2010 22:14
Während ich gerade malwarebytes ausführe kam folgende meldung von Antivir:

C:\System Volume Information\...\A0241324.dll

ist das trojanische Pferd TR/Crypt.XPACK.Gen3


Löschen? Oder Quarantäne?

aware 28.09.2010 22:56
Das Rootkit was vorher gefunden wurde, kam auch wieder, ich habe auf Löschen geklickt (leider zu schnell bevor ich gemerkt hatte, dass es das Rootkit war und habe somit nicht gesehen welches Verzeichnis angegeben war) - auch wieder Antivir.

Weitere Nachricht von Antivir:

C:\_OTL\MovedFiles\09272010_202550\C_WINDOWS\mshuota.dll
ist das trojanische Pferd TR/Crypt.XPACK.Gen3


Da der Scan sonst nicht weiter ausgeführt wird, habe ich immer "Löschen" gewählt.

aware 28.09.2010 23:12
Malwarebytes:

Code:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4712

Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

29.09.2010 00:03:18
mbam-log-2010-09-29 (00-03-18).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|)
Durchsuchte Objekte: 262051
Laufzeit: 1 Stunde(n), 35 Minute(n), 46 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

BTW, nur weil ich es in einem anderen Thread von Dir gelesen habe: Kann es sein, dass der Trojaner + Rootkit in der System Volume wieder auftaucht, weil System Restore noch eingeschaltet ist?

aware 29.09.2010 08:32
SASW:

SUPERAntiSpyware Scann-Protokoll
hxxp://www.superantispyware.com

Generiert 09/29/2010 bei 01:32 AM

Version der Applikation : 4.43.1000

Version der Kern-Datenbank : 5598
Version der Spur-Datenbank : 3410

Scan Art : kompletter Scann
Totale Scann-Zeit : 01:17:53

Gescannte Speicherelemente : 748
Erfasste Speicher-Bedrohungen : 0
Gescannte Register-Elemente : 7146
Erfasste Register-Bedrohungen : 0
Gescannte Datei-Elemente : 112417
Erfasste Datei-Elemente : 0

aware 29.09.2010 09:30
Habe jetzt nochmal mit Malwarebytes gescannt:

Wieder kam eine Meldung von Antivir, dass in der System Volume Information der TR/Crypt.XPACK.Gen3 trojan wäre.

Code:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4715

Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

29.09.2010 10:23:01
mbam-log-2010-09-29 (10-23-01).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|)
Durchsuchte Objekte: 262636
Laufzeit: 52 Minute(n), 7 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\System Volume Information\_restore{E54C5E8B-4A92-4942-9788-26A2E6AA05E0}\RP945\A0244538.dll (Trojan.Agent) -> No action taken.

cosinus 29.09.2010 10:20
Deaktiviere die Systemwiederherstellung, im Verlauf der Infektion wurden auch Malwaredateien in Wiederherstellungspunkten mitgesichert - die sind alle nun unbrauchbar, da ein Zurücksetzen des Systems durch einen Wiederherstellungspunkt wahrscheinlich wieder eine Infektion nach sich ziehen würde.

Zitat:
Weitere Nachricht von Antivir:

C:\_OTL\MovedFiles\09272010_202550\C_WINDOWS\mshuota.dll
ist das trojanische Pferd TR/Crypt.XPACK.Gen3
Schau Dir mal den Pfad an. Mit OTL haben wir das gelöscht, es hat die Datei in seinen Quarantäneordner C:\_OTL verschoben. Dasmacht OTL immer. Da liegend sind die Datei isoliert und harmlos.

aware 29.09.2010 10:24
Die Systemwiederherstellung habe ich deaktiviert.


Das mit dem _OTL habe ich mir schon so gedacht, aber warum sollte ich die infizierte Datei behalten wollen?

cosinus 29.09.2010 10:38
Zitat:
aber warum sollte ich die infizierte Datei behalten wollen?
Damit man eine Sicherheitskopie davon behält!
Es kann ja auch versehentlich was Legitimes gelöscht werden.

aware 29.09.2010 10:44
Hm, okay, verstehe.

Ich hatte die dll vorher u.a. gegoogelt und nichts gefunden und ging in der Annahme, dass sie von dem Trojaner erstellt wurde.

Was soll ich als nächstes machen?

cosinus 29.09.2010 10:51
Da wurden nur Überreste gefunden.
Noch Probleme oder weitere Funde in der Zwischenzeit?

aware 29.09.2010 10:53
Bisher ist mir nichts aufgefallen.

Also jetzt am besten etwas dran arbeiten und sehen ob alles wieder i.O. ist?
(natürlich nicht beim email account oder so einloggen; wahrscheinlich sollten da später auch die PWs geändert werden, oder?).

Sollte die Systemwiederherstellung später wieder eingeschaltet werden - also wenn in ein paar Tagen noch immer alles ok ist?

cosinus 29.09.2010 13:10
Wir sind dann durch! :abklatsch:

Die SWH kannst Du bei Bedarf wieder einschalten.

Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update



PDF-Reader aktualisieren
Dein Adobe Reader ist nicht aktuell, was ein großes Sicherheitsrisiko darstellt. Du solltest daher besser die alte Version über Systemsteuerung => Software deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst.

Ich empfehle einen alternativen PDF-Reader wie SumatraPDF oder Foxit PDF Reader, beide sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers, hier der direkte Downloadlink => http://filepony.de/?q=Flash+Player


Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

aware 29.09.2010 14:06
Vielen, vielen Dank Arne. :dankeschoen:

Die Spende ist unterwegs.

Kann Ich Dir sonst noch irgendwie danken?


Alle Zeitangaben in WEZ +1. Es ist jetzt 09:47 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131