Trojaner-Board - Google verlinkt auf falsche Seite

Hallo Chris,

die Umleitung ist immer noch aktiv.

Die Zeile 17:

Zitat:

O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 93.188.163.68,93.188.166.7

hatte ich bei meinem "Alleingang" vorgestern Nacht mit Hijack gefixt. Hatte ich vergessen mitzuteilen.

avenger.txt

Code:

Logfile of The Avenger Version 2.0, (c) by Swandog46

hxxp://swandog46.geekstogo.com
 

Platform:  Windows XP
 

*******************
 

Script file opened successfully.

Script file read successfully.
 

Backups directory opened successfully at C:\Avenger
 

*******************
 

Beginning to process script file:
 

Rootkit scan active.

No rootkits found!
 
 

Error:  file "C:\WINDOWS\TEMP\b.exe" not found!

Deletion of file "C:\WINDOWS\TEMP\b.exe" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

  --> the object does not exist
 

Folder "C:\WINDOWS\TEMP" deleted successfully.
 

Completed script processing.
 

*******************
 

Finished!  Terminate.

Wie ich gerade gestgestellt habe, lässt sich Spybot bei mir überhaupt nicht mehr ausführen. Auch nach uninstall und neuer Installation nicht!

Weiter im Text: HiJack nach Avenger

Code:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 13:46:50, on 01.10.2010

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16850)

Boot mode: Normal
 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe

C:\Programme\Avira\AntiVir Desktop\sched.exe

C:\Programme\Avira\AntiVir Desktop\avguard.exe

C:\Programme\ICQ6Toolbar\ICQ Service.exe

C:\Programme\Avira\AntiVir Desktop\avshadow.exe

C:\Programme\Java\jre6\bin\jqs.exe

C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe

C:\Programme\CDBurnerXP\NMSAccessU.exe

C:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\WINDOWS\system32\svchost.exe

C:\Programme\Viewpoint\Common\ViewpointService.exe

C:\Programme\Avira\AntiVir Desktop\avmailc.exe

C:\Programme\Avira\AntiVir Desktop\AVWEBGRD.EXE

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\WINDOWS\Explorer.EXE

C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\WINDOWS\system32\pctspk.exe

C:\Programme\Avira\AntiVir Desktop\avgnt.exe

C:\Programme\HP\hpcoretech\hpcmpmgr.exe

C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programme\Adobe\Acrobat 7.0\Reader\AcroRd32.exe

C:\Programme\Trend Micro\HijackThis\HijackThis.exe
 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://de.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*hxxp://de.search.yahoo.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://de.yahoo.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://de.rd.yahoo.com/customize/ie/defaults/su/msgr9/*hxxp://de.search.yahoo.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://de.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*hxxp://de.search.yahoo.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.yahoo.com

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = hxxp://de.rd.yahoo.com/customize/ie/defaults/su/msgr9/*hxxp://de.search.yahoo.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=localhost:4001;http=localhost:4001;https=localhost:4001

R3 - URLSearchHook: (no name) -  - (no file)

R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: Burn4Free Toolbar Helper - {60BF5EE3-0105-4858-AD98-17C19F86B042} - C:\Programme\Burn4Free Toolbar\v3.2.0.0\Burn4Free_Toolbar.dll

O2 - BHO: Search Helper - {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - C:\Programme\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll

O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll

O2 - BHO: Windows Live Toolbar Helper - {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - C:\Programme\Windows Live\Toolbar\wltcore.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: Burn4Free Toolbar - {55FAF0F2-44D4-425F-B5F5-6B275B621EAB} - C:\Programme\Burn4Free Toolbar\v3.2.0.0\Burn4Free_Toolbar.dll

O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll

O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programme\Windows Live\Toolbar\wltcore.dll

O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)

O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe

O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe

O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe

O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKLM\..\Run: [HP Component Manager] "C:\Programme\HP\hpcoretech\hpcmpmgr.exe"

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\RunServices: [xdgg] C:\WINDOWS\TEMP\2A3.tmp

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: In Blog veröffentlichen - {219c3416-8cb2-491a-a3c7-d9fcddc9d600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: In Windows Live Writer in Blog veröffentliche&n - {219c3416-8cb2-491a-a3c7-d9fcddc9d600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Programme\PokerStars\PokerStarsUpdate.exe

O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O15 - Trusted Zone: www.safer-networking.org

O16 - DPF: {792E349D-4844-4F53-A660-3F1E00234138} (CVXChatControl Object) - hxxp://www.visit-x.de/downloads/applet/90/9,0,0,5/cP-Client-90.cab

O16 - DPF: {A9F8D9EC-3D0A-4A60-BD82-FBD64BAD370D} (DDRevision Class) - hxxp://h20264.www2.hp.com/ediags/dd/install/HPDriverDiagnosticsxp2k.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} (Java Plug-in 1.6.0_17) - 

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - hxxp://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab

O18 - Protocol: haufereader - {39198710-62F7-42CD-9458-069843FA5D32} - C:\Programme\Haufe\HaufeReader\HRInstmon.dll

O23 - Service: Avira AntiVir MailGuard (AntiVirMailService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avmailc.exe

O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe

O23 - Service: Avira AntiVir WebGuard (AntiVirWebService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\AVWEBGRD.EXE

O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: Intelligenter Hintergrundübertragungsdienst (BITS) - Unknown owner - C:\WINDOWS\

O23 - Service: Google Software Updater (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: ICQ Service - Unknown owner - C:\Programme\ICQ6Toolbar\ICQ Service.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe

O23 - Service: LVCOMSer - Logitech Inc. - C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe

O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe

O23 - Service: NMSAccessU - Unknown owner - C:\Programme\CDBurnerXP\NMSAccessU.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: Viewpoint Manager Service (viewpoint manager service) - Viewpoint Corporation - C:\Programme\Viewpoint\Common\ViewpointService.exe

O23 - Service: Automatische Updates (wuauserv) - Unknown owner - C:\WINDOWS\
 

--

End of file - 9573 bytes

Malwarebytes Antimalware lässt sich installieren, Programm lässt sich jedoch nicht ausführen!!

OTL.TXT:

Code:

OTL logfile created on: 01.10.2010 14:00:07 - Run 1

OTL by OldTimer - Version 3.2.14.1     Folder = C:\Dokumente und Einstellungen\user\Desktop\MFTools

Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 7.0.5730.13)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

511,00 Mb Total Physical Memory | 66,00 Mb Available Physical Memory | 13,00% Memory free

1,00 Gb Paging File | 1,00 Gb Available in Paging File | 66,00% Paging File free

Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme

Drive C: | 74,52 Gb Total Space | 12,89 Gb Free Space | 17,30% Space Free | Partition Type: NTFS

D: Drive not present or media not loaded

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

 

Computer Name: PRIVAT-C65EE05C

Current User Name: user

Logged in as Administrator.

 

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Minimal

 
 ========== Processes (SafeList) ==========

 

PRC - C:\Dokumente und Einstellungen\user\Desktop\MFTools\OTL.exe (OldTimer Tools)

PRC - C:\Programme\Mozilla Firefox\plugin-container.exe (Mozilla Corporation)

PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)

PRC - C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)

PRC - C:\Programme\Avira\AntiVir Desktop\avwebgrd.exe (Avira GmbH)

PRC - C:\Programme\Avira\AntiVir Desktop\avmailc.exe (Avira GmbH)

PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)

PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)

PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)

PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

PRC - C:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corp.)

PRC - C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)

PRC - C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe (Logitech Inc.)

PRC - C:\Programme\CDBurnerXP\NMSAccessU.exe ()

PRC - C:\Programme\ICQ6Toolbar\ICQ Service.exe ()

PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

PRC - C:\Programme\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)

PRC - C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)

PRC - C:\WINDOWS\system32\pctspk.exe ()

 

 
 ========== Modules (SafeList) ==========

 

MOD - C:\Dokumente und Einstellungen\user\Desktop\MFTools\OTL.exe (OldTimer Tools)

MOD - C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Logitech Inc.)

MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - (AppMgmt) -- C:\WINDOWS\System32\appmgmts.dll File not found

SRV - (AntiVirWebService) -- C:\Programme\Avira\AntiVir Desktop\AVWEBGRD.EXE (Avira GmbH)

SRV - (AntiVirMailService) -- C:\Programme\Avira\AntiVir Desktop\avmailc.exe (Avira GmbH)

SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)

SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)

SRV - (fsssvc) -- C:\Programme\Windows Live\Family Safety\fsssvc.exe (Microsoft Corporation)

SRV - (seaport) -- C:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corp.)

SRV - (LVPrcSrv) -- C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)

SRV - (LVCOMSer) -- C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe (Logitech Inc.)

SRV - (NMSAccessU) -- C:\Programme\CDBurnerXP\NMSAccessU.exe ()

SRV - (ICQ Service) -- C:\Programme\ICQ6Toolbar\ICQ Service.exe ()

SRV - (viewpoint manager service) -- C:\Programme\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)

SRV - (Pml Driver HPZ12) -- C:\WINDOWS\system32\HPZipm12.exe (HP)

SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - (ZTEusbser6k) -- C:\WINDOWS\System32\DRIVERS\ZTEusbser6k.sys File not found

DRV - (ZTEusbnmea) -- C:\WINDOWS\System32\DRIVERS\ZTEusbnmea.sys File not found

DRV - (ZTEusbmdm6k) -- C:\WINDOWS\System32\DRIVERS\ZTEusbmdm6k.sys File not found

DRV - (massfilter) -- C:\WINDOWS\System32\drivers\massfilter.sys File not found

DRV - (LVMVDrv) -- C:\WINDOWS\System32\DRIVERS\LVMVDrv.sys File not found

DRV - (LVcKap) -- C:\WINDOWS\System32\DRIVERS\LVcKap.sys File not found

DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)

DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)

DRV - (fssfltr) -- C:\WINDOWS\system32\drivers\fssfltr_tdi.sys (Microsoft Corporation)

DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)

DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)

DRV - (FilterService) -- C:\WINDOWS\system32\drivers\lvuvcflt.sys (Logitech Inc.)

DRV - (LVUVC) Logitech QuickCam Pro 5000(UVC) -- C:\WINDOWS\system32\drivers\lvuvc.sys (Logitech Inc.)

DRV - (LVUSBSta) -- C:\WINDOWS\system32\drivers\LVUSBSta.sys (Logitech Inc.)

DRV - (LVRS) -- C:\WINDOWS\system32\drivers\lvrs.sys (Logitech Inc.)

DRV - (lvpopflt) -- C:\WINDOWS\system32\drivers\lvpopflt.sys (Logitech Inc.)

DRV - (LVPr2Mon) -- C:\WINDOWS\system32\drivers\LVPr2Mon.sys ()

DRV - (Tcpip6) -- C:\WINDOWS\system32\drivers\tcpip6.sys (Microsoft Corporation)

DRV - (usbaudio) USB-Audiotreiber (WDM) -- C:\WINDOWS\system32\drivers\usbaudio.sys (Microsoft Corporation)

DRV - (w29n51) Intel(R) -- C:\WINDOWS\system32\drivers\w29n51.sys (Intel® Corporation)

DRV - (k750mdm) -- C:\WINDOWS\system32\drivers\k750mdm.sys (MCCI)

DRV - (k750mgmt) -- C:\WINDOWS\system32\drivers\k750mgmt.sys (MCCI)

DRV - (k750mdfl) -- C:\WINDOWS\system32\drivers\k750mdfl.sys (MCCI)

DRV - (AFS2K) -- C:\WINDOWS\System32\drivers\AFS2K.SYS (Oak Technology Inc.)

DRV - (k750bus) Sony Ericsson 750 driver (WDM) -- C:\WINDOWS\system32\drivers\k750bus.sys (MCCI)

DRV - (k750obex) -- C:\WINDOWS\system32\drivers\k750obex.sys (MCCI)

DRV - (rtl8139) NT-Treiber für Realtek RTL8139(A/B/C) -- C:\WINDOWS\system32\drivers\RTL8139.sys (Realtek Semiconductor Corporation)

DRV - (G3GCUMDM) -- C:\WINDOWS\system32\drivers\g3gcumdm.sys (Vodafone)

DRV - (G3GCUSER) -- C:\WINDOWS\system32\drivers\g3gcuser.sys (Vodafone)

DRV - (w22n51) Intel(R) -- C:\WINDOWS\system32\drivers\w22n51.sys (Intel® Corporation)

DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)

DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)

DRV - (EMCR) -- C:\WINDOWS\system32\drivers\EMCR7SK.sys (ENE Technology Inc.)

DRV - (RTL8023) -- C:\WINDOWS\system32\drivers\Rtlnic51.sys (Realtek Semiconductor Corporation                           )

DRV - (ALCXSENS) -- C:\WINDOWS\system32\drivers\ALCXSENS.SYS (Sensaura Ltd)

DRV - (Vpctcom) -- C:\WINDOWS\system32\drivers\vpctcom.sys (PCtel, Inc.)

DRV - (Vvoice) -- C:\WINDOWS\system32\drivers\vvoice.sys (PCtel, Inc.)

DRV - (Vmodem) -- C:\WINDOWS\system32\drivers\vmodem.sys (PCTEL, INC.)

DRV - (Ptserial) -- C:\WINDOWS\system32\drivers\ptserial.sys (PCTEL, INC.)

DRV - (MODEMCSA) -- C:\WINDOWS\system32\drivers\MODEMCSA.sys (Microsoft Corporation)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://de.yahoo.com

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://de.rd.yahoo.com/customize/ie/defaults/su/msgr9/*hxxp://de.search.yahoo.com

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://de.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*hxxp://de.search.yahoo.com

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.yahoo.com

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://de.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*hxxp://de.search.yahoo.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Live Search

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

IE - HKCU\..\URLSearchHook:  - Reg Error: Key error. File not found

IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = ftp=localhost:4001;http=localhost:4001;https=localhost:4001

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultenginename: "ICQ Search"

FF - prefs.js..browser.search.defaulturl: "hxxp://de.search.yahoo.com/search?fr=ffsp1&p="

FF - prefs.js..browser.search.selectedEngine: "ICQ Search"

FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"

FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0

FF - prefs.js..extensions.enabledItems: firefox@tvunetworks.com:2

FF - prefs.js..extensions.enabledItems: 5

FF - prefs.js..extensions.enabledItems: 2

FF - prefs.js..extensions.enabledItems: 2

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21

FF - prefs.js..extensions.enabledItems: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065}:2.7.1.3

FF - prefs.js..keyword.URL: "hxxp://de.search.yahoo.com/search?fr=ffds1&p="

FF - prefs.js..network.proxy.http: "localhost"

FF - prefs.js..network.proxy.http_port: 4001

 

 

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.09.29 23:59:48 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.09.29 23:59:48 | 000,000,000 | ---D | M]

 

[2009.08.25 02:33:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Mozilla\Extensions

[2010.09.30 22:17:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Mozilla\Firefox\Profiles\c026nnbb.default\extensions

[2009.12.20 18:36:43 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Mozilla\Firefox\Profiles\c026nnbb.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}

[2008.03.05 18:39:28 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Mozilla\Firefox\Profiles\c026nnbb.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}(2)

[2010.09.24 07:32:53 | 000,000,000 | ---D | M] (softonic-de3 Toolbar) -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Mozilla\Firefox\Profiles\c026nnbb.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}

[2010.04.20 20:54:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Mozilla\Firefox\Profiles\c026nnbb.default\extensions\firefox@tvunetworks.com

[2010.09.29 14:07:20 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Mozilla\Firefox\Profiles\c026nnbb.default\searchplugins\icqplugin-1.xml

[2009.08.25 02:57:15 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Mozilla\Firefox\Profiles\c026nnbb.default\searchplugins\icqplugin-2.xml

[2009.09.04 14:13:39 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Mozilla\Firefox\Profiles\c026nnbb.default\searchplugins\icqplugin-3.xml

[2009.09.19 16:49:38 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Mozilla\Firefox\Profiles\c026nnbb.default\searchplugins\icqplugin-4.xml

[2008.11.18 14:56:02 | 000,000,944 | ---- | M] () -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Mozilla\Firefox\Profiles\c026nnbb.default\searchplugins\icqplugin.xml

[2010.09.30 22:17:39 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions

[2006.09.22 16:41:42 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Programme\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}

[2010.05.02 02:32:45 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

[2010.08.02 00:31:32 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

[2010.07.17 05:00:04 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll

[2007.04.16 19:07:12 | 000,180,293 | ---- | M] () -- C:\Programme\Mozilla Firefox\plugins\npViewpoint.dll

[2010.08.22 15:26:27 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml

[2010.08.22 15:26:27 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml

[2010.08.22 15:26:28 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml

[2010.08.22 15:26:28 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml

[2010.08.22 15:26:28 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2010.09.30 02:30:34 | 000,000,023 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1  localhost 

O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)

O2 - BHO: (Burn4Free Toolbar Helper) - {60BF5EE3-0105-4858-AD98-17C19F86B042} - C:\Programme\Burn4Free Toolbar\v3.2.0.0\Burn4Free_Toolbar.dll ()

O2 - BHO: (Search Helper) - {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - C:\Programme\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll (Microsoft Corp.)

O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

O2 - BHO: (Windows Live Toolbar Helper) - {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)

O3 - HKLM\..\Toolbar: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)

O3 - HKLM\..\Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - No CLSID value found.

O3 - HKLM\..\Toolbar: (Burn4Free Toolbar) - {55FAF0F2-44D4-425F-B5F5-6B275B621EAB} - C:\Programme\Burn4Free Toolbar\v3.2.0.0\Burn4Free_Toolbar.dll ()

O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)

O3 - HKCU\..\Toolbar\ShellBrowser: (Burn4Free Toolbar) - {55FAF0F2-44D4-425F-B5F5-6B275B621EAB} - C:\Programme\Burn4Free Toolbar\v3.2.0.0\Burn4Free_Toolbar.dll ()

O3 - HKCU\..\Toolbar\WebBrowser: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)

O3 - HKCU\..\Toolbar\WebBrowser: (Burn4Free Toolbar) - {55FAF0F2-44D4-425F-B5F5-6B275B621EAB} - C:\Programme\Burn4Free Toolbar\v3.2.0.0\Burn4Free_Toolbar.dll ()

O4 - HKLM..\Run: []  File not found

O4 - HKLM..\Run: [ATIModeChange] C:\WINDOWS\System32\Ati2mdxx.exe (ATI Technologies, Inc.)

O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [NWEReboot]  File not found

O4 - HKLM..\Run: [PCTVOICE] C:\WINDOWS\System32\pctspk.exe ()

O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)

O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)

O4 - HKLM..\RunServices: [xdgg] C:\WINDOWS\TEMP\2A3.tmp File not found

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\control panel present

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\restrictions present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O9 - Extra Button: In Blog veröffentlichen - {219c3416-8cb2-491a-a3c7-d9fcddc9d600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219c3416-8cb2-491a-a3c7-d9fcddc9d600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)

O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Programme\PokerStars\PokerStarsUpdate.exe (PokerStars)

O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)

O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)

O10 - Protocol_Catalog9\Catalog_Entries\000000000035 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)

O15 - HKCU\..Trusted Domains: safer-networking.org ([www] * in Vertrauenswürdige Sites)

O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} hxxp://www.apple.com/qtactivex/qtplugin.cab (QuickTime Object)

O16 - DPF: {792E349D-4844-4F53-A660-3F1E00234138} hxxp://www.visit-x.de/downloads/applet/90/9,0,0,5/cP-Client-90.cab (CVXChatControl Object)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)

O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)

O16 - DPF: {A9F8D9EC-3D0A-4A60-BD82-FBD64BAD370D} hxxp://h20264.www2.hp.com/ediags/dd/install/HPDriverDiagnosticsxp2k.cab (DDRevision Class)

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)

O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Reg Error: Key error.)

O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Reg Error: Key error.)

O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Reg Error: Key error.)

O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)

O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} hxxp://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab (Minesweeper Flags Class)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1

O18 - Protocol\Handler\cetihpz {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Programme\HP\hpcoretech\comp\hpuiprot.dll (Hewlett-Packard Company)

O18 - Protocol\Handler\haufereader {39198710-62F7-42CD-9458-069843FA5D32} - C:\Programme\Haufe\HaufeReader\HRInstmon.dll (Haufe Mediengruppe)

O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)

O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home

O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp

O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.08.29 13:20:59 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O33 - MountPoints2\{c45cb630-b055-11df-bedf-0040d05f5da2}\Shell - "" = AutoRun

O33 - MountPoints2\{c45cb630-b055-11df-bedf-0040d05f5da2}\Shell\AutoRun - "" = Auto&Play

O34 - HKLM BootExecute: (autocheck autochk *) -  File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKCU\...exe [@ = exefile] -- Reg Error: Key error. File not found

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2010.10.01 12:33:44 | 000,000,000 | ---D | C] -- C:\WINDOWS\TEMP

[2010.10.01 12:30:32 | 000,000,000 | ---D | C] -- C:\Avenger

[2010.10.01 06:12:29 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT

[2010.10.01 06:08:39 | 000,000,000 | ---D | C] -- C:\Programme\ERUNT

[2010.10.01 05:55:07 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys

[2010.10.01 05:55:02 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes

[2010.10.01 05:55:00 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys

[2010.10.01 05:55:00 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware

[2010.10.01 05:54:08 | 000,000,000 | ---D | C] -- C:\Programme\7-Zip

[2010.10.01 05:53:01 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\user\Desktop\MFTools

[2010.09.30 03:30:38 | 000,000,000 | ---D | C] -- C:\WINDOWS\VDLL.DLL

[2010.09.30 03:30:37 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\runouce.exe

[2010.09.30 03:30:37 | 000,000,000 | ---D | C] -- C:\WINDOWS\rundll16.exe

[2010.09.30 03:30:37 | 000,000,000 | ---D | C] -- C:\WINDOWS\RUNDL132.EXE

[2010.09.30 03:30:37 | 000,000,000 | ---D | C] -- C:\WINDOWS\logo1_.exe

[2010.09.30 03:30:37 | 000,000,000 | ---D | C] -- C:\WINDOWS\logo_1.exe

[2010.09.30 03:20:22 | 000,632,064 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msvcr80.dll

[2010.09.30 03:20:21 | 000,554,240 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msvcp80.dll

[2010.09.30 03:20:20 | 000,034,048 | ---- | C] (MicroWorld Technologies Inc.) -- C:\WINDOWS\System32\eEmpty.exe

[2010.09.30 03:19:57 | 000,140,800 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\T.COM

[2010.09.30 03:19:56 | 000,153,600 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\R.COM

[2010.09.30 03:19:56 | 000,140,800 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\TASKMGR.COM

[2010.09.30 03:19:55 | 000,153,600 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\REGEDIT.COM

[2010.09.30 03:19:53 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\MicroWorld

[2010.09.30 03:19:40 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MicroWorld

[2010.09.30 02:20:25 | 000,000,000 | ---D | C] -- C:\Fix_wareout

[2010.09.26 15:54:09 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\user\Desktop\Nicht verwendete Desktopverknüpfungen

[2010.09.25 10:49:58 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Uniblue

[2010.09.25 10:14:54 | 000,000,000 | ---D | C] -- C:\fixwareout

[2010.09.24 18:29:53 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\STOPzilla!

[2010.09.24 15:06:43 | 000,000,000 | ---D | C] -- C:\Programme\Safer Networking

[2010.09.24 14:42:08 | 000,000,000 | ---D | C] -- C:\Programme\Spybot - Search & Destroy

[2010.09.24 13:37:22 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\JonDo

[2010.09.24 13:36:19 | 000,000,000 | ---D | C] -- C:\Programme\JAP

[2010.09.24 10:45:56 | 016,409,960 | ---- | C] (Safer Networking Limited                                    ) -- C:\Dokumente und Einstellungen\user\Desktop\spybotsd162.exe

[2010.09.24 10:27:29 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\user\Recent

[2010.09.24 07:32:54 | 000,000,000 | ---D | C] -- C:\Programme\Conduit

[2010.09.24 06:55:23 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\PriceGong

[2010.09.24 06:52:50 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\user\Lokale Einstellungen\Anwendungsdaten\Conduit

[2009.10.06 14:08:41 | 003,534,855 | ---- | C] (McAfee Inc.) -- C:\Programme\stinger1001546.exe

 
 ========== Files - Modified Within 30 Days ==========

 

[2010.10.01 13:51:09 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2010.10.01 13:49:25 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT

[2010.10.01 13:49:18 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2010.10.01 13:47:32 | 011,010,048 | ---- | M] () -- C:\Dokumente und Einstellungen\user\ntuser.dat

[2010.10.01 13:47:32 | 000,000,300 | -HS- | M] () -- C:\Dokumente und Einstellungen\user\ntuser.ini

[2010.10.01 13:33:18 | 000,000,905 | ---- | M] () -- C:\Dokumente und Einstellungen\user\Desktop\Spybot - Search & Destroy.lnk

[2010.10.01 13:31:33 | 016,409,960 | ---- | M] (Safer Networking Limited                                    ) -- C:\Dokumente und Einstellungen\user\Desktop\spybotsd162.exe

[2010.10.01 12:27:14 | 000,731,136 | ---- | M] () -- C:\Dokumente und Einstellungen\user\Desktop\avenger.exe

[2010.10.01 12:06:09 | 000,463,886 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat

[2010.10.01 12:06:09 | 000,443,378 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat

[2010.10.01 12:06:09 | 000,073,650 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat

[2010.10.01 12:06:08 | 000,088,362 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat

[2010.10.01 12:06:03 | 001,081,894 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI

[2010.10.01 06:20:21 | 000,000,676 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk

[2010.10.01 06:08:41 | 000,000,591 | ---- | M] () -- C:\Dokumente und Einstellungen\user\Desktop\NTREGOPT.lnk

[2010.10.01 06:08:41 | 000,000,572 | ---- | M] () -- C:\Dokumente und Einstellungen\user\Desktop\ERUNT.lnk

[2010.10.01 05:53:59 | 000,284,915 | ---- | M] () -- C:\Dokumente und Einstellungen\user\Desktop\Gmer.zip

[2010.09.30 08:18:02 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job

[2010.09.30 03:30:37 | 000,000,054 | ---- | M] () -- C:\WINDOWS\Lic.xxx

[2010.09.30 03:20:21 | 000,632,064 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\msvcr80.dll

[2010.09.30 03:20:20 | 000,554,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\msvcp80.dll

[2010.09.30 03:20:19 | 000,034,048 | ---- | M] (MicroWorld Technologies Inc.) -- C:\WINDOWS\System32\eEmpty.exe

[2010.09.30 01:04:05 | 000,000,245 | -HS- | M] () -- C:\boot.ini

[2010.09.30 00:57:35 | 000,010,284 | ---- | M] () -- C:\Dokumente und Einstellungen\user\Desktop\cc_20100930_005613.reg

[2010.09.28 11:58:44 | 002,557,964 | -H-- | M] () -- C:\Dokumente und Einstellungen\user\Lokale Einstellungen\Anwendungsdaten\IconCache.db

[2010.09.27 16:17:51 | 000,031,889 | ---- | M] () -- C:\Dokumente und Einstellungen\user\Desktop\AKD-7367861301[1].pdf

[2010.09.27 16:16:39 | 000,031,889 | ---- | M] () -- C:\Dokumente und Einstellungen\user\Eigene Dateien\AKD-7367861301[1].pdf

[2010.09.25 14:17:09 | 000,000,704 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\PowerSuite.lnk

[2010.09.25 12:01:01 | 000,141,016 | ---- | M] () -- C:\WINDOWS\System32\ALSNDMGR.WAV

[2010.09.24 19:37:39 | 000,000,000 | ---- | M] () -- C:\WINDOWS\System32\drivers\lvuvc.hs

[2010.09.24 19:37:35 | 000,000,000 | ---- | M] () -- C:\WINDOWS\System32\drivers\logiflt.iad

[2010.09.24 19:30:45 | 000,083,966 | ---- | M] () -- C:\Dokumente und Einstellungen\user\Desktop\cc_20100924_192830.reg

[2010.09.24 18:44:06 | 000,000,464 | ---- | M] () -- C:\WINDOWS\System32\drivers\kgpcpy.cfg

[2010.09.24 13:03:22 | 000,172,280 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2010.09.24 10:49:06 | 000,035,424 | ---- | M] () -- C:\Dokumente und Einstellungen\user\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT

[2010.09.24 08:18:01 | 000,163,174 | ---- | M] () -- C:\Dokumente und Einstellungen\user\Eigene Dateien\cc_20100924_081444.reg

[2010.09.23 15:10:41 | 000,018,432 | ---- | M] () -- C:\Dokumente und Einstellungen\user\Desktop\Fahrtstrecken Frau Herrmann.xls

 
 ========== Files Created - No Company Name ==========

 

[2010.10.01 13:33:18 | 000,000,905 | ---- | C] () -- C:\Dokumente und Einstellungen\user\Desktop\Spybot - Search & Destroy.lnk

[2010.10.01 12:27:12 | 000,731,136 | ---- | C] () -- C:\Dokumente und Einstellungen\user\Desktop\avenger.exe

[2010.10.01 06:08:41 | 000,000,591 | ---- | C] () -- C:\Dokumente und Einstellungen\user\Desktop\NTREGOPT.lnk

[2010.10.01 06:08:41 | 000,000,572 | ---- | C] () -- C:\Dokumente und Einstellungen\user\Desktop\ERUNT.lnk

[2010.10.01 05:55:13 | 000,000,676 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk

[2010.10.01 05:53:22 | 000,284,915 | ---- | C] () -- C:\Dokumente und Einstellungen\user\Desktop\Gmer.zip

[2010.09.30 03:21:10 | 000,000,054 | ---- | C] () -- C:\WINDOWS\Lic.xxx

[2010.09.30 03:20:20 | 000,000,522 | ---- | C] () -- C:\WINDOWS\System32\Microsoft.VC80.CRT.manifest

[2010.09.30 00:56:23 | 000,010,284 | ---- | C] () -- C:\Dokumente und Einstellungen\user\Desktop\cc_20100930_005613.reg

[2010.09.29 17:38:08 | 011,010,048 | ---- | C] () -- C:\Dokumente und Einstellungen\user\ntuser.dat

[2010.09.27 16:17:51 | 000,031,889 | ---- | C] () -- C:\Dokumente und Einstellungen\user\Desktop\AKD-7367861301[1].pdf

[2010.09.27 16:16:39 | 000,031,889 | ---- | C] () -- C:\Dokumente und Einstellungen\user\Eigene Dateien\AKD-7367861301[1].pdf

[2010.09.25 14:17:09 | 000,000,704 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\PowerSuite.lnk

[2010.09.24 19:28:50 | 000,083,966 | ---- | C] () -- C:\Dokumente und Einstellungen\user\Desktop\cc_20100924_192830.reg

[2010.09.24 18:43:19 | 000,000,464 | ---- | C] () -- C:\WINDOWS\System32\drivers\kgpcpy.cfg

[2010.09.24 08:15:11 | 000,163,174 | ---- | C] () -- C:\Dokumente und Einstellungen\user\Eigene Dateien\cc_20100924_081444.reg

[2010.09.23 15:10:41 | 000,018,432 | ---- | C] () -- C:\Dokumente und Einstellungen\user\Desktop\Fahrtstrecken Frau Herrmann.xls

[2010.08.24 17:06:38 | 000,299,008 | ---- | C] () -- C:\WINDOWS\System32\midas.dll

[2009.10.06 17:05:09 | 000,000,017 | ---- | C] () -- C:\Programme\stinger1001546.opt

[2009.10.06 14:08:41 | 001,981,200 | ---- | C] () -- C:\Programme\TeamViewer_Setup_de.exe

[2009.10.05 21:20:15 | 000,017,762 | ---- | C] () -- C:\WINDOWS\System32\uacinit.dll

[2008.10.24 14:55:34 | 000,002,828 | -HS- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\KGyGaAvL.sys

[2008.10.24 14:55:34 | 000,000,008 | RHS- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\5FED2826CD.sys

[2008.08.04 12:50:23 | 000,000,441 | ---- | C] () -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Hewlett-Packardhp officejet 5500 series1215435203_PROTOCOL.log

[2008.08.04 12:50:23 | 000,000,366 | ---- | C] () -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Hewlett-Packardhp officejet 5500 series1215435203_UI.log

[2008.08.04 12:50:23 | 000,000,221 | ---- | C] () -- C:\WINDOWS\NCLogConfig.ini

[2008.08.04 12:50:23 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Hewlett-Packardhp officejet 5500 series1215435203_API.log

[2008.07.26 09:25:02 | 000,025,624 | ---- | C] () -- C:\WINDOWS\System32\drivers\LVPr2Mon.sys

[2008.07.05 18:56:36 | 000,002,272 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat

[2008.06.10 02:59:11 | 000,000,082 | ---- | C] () -- C:\WINDOWS\asciiart.ini

[2008.02.22 20:54:56 | 000,001,755 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\QTSBandwidthCache

[2007.02.21 20:11:23 | 000,066,482 | ---- | C] () -- C:\WINDOWS\System32\lvcoinst.ini

[2006.11.13 23:44:02 | 000,000,081 | ---- | C] () -- C:\WINDOWS\ktel.ini

[2006.11.07 21:43:02 | 000,000,137 | ---- | C] () -- C:\Dokumente und Einstellungen\user\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat

[2006.11.07 21:12:24 | 000,041,064 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\hpzinstall.log

[2006.10.30 16:18:44 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\redmonnt.dll

[2006.10.22 21:10:35 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI

[2006.10.06 21:54:41 | 000,000,990 | ---- | C] () -- C:\WINDOWS\wincmd.ini

[2006.09.22 16:31:11 | 000,082,432 | ---- | C] () -- C:\Dokumente und Einstellungen\user\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2006.09.20 18:12:54 | 000,000,305 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\addr_file.html

[2006.08.29 13:32:25 | 000,155,648 | ---- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll

[2006.08.29 13:32:19 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\ati2evxx.dll

[2006.08.29 13:24:13 | 000,001,082 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI

[2006.08.11 19:35:34 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll

[2006.08.11 19:31:28 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\DivXWMPExtType.dll

[2005.04.08 09:51:08 | 000,565,248 | R--- | C] () -- C:\WINDOWS\System32\hpotscl.dll

[2003.02.20 17:53:42 | 000,005,702 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI

[2001.07.06 16:30:00 | 000,003,254 | ---- | C] () -- C:\WINDOWS\System32\HPTCPMON.INI

< End of report >

Extras.txt:

Code:

OTL Extras logfile created on: 01.10.2010 14:00:07 - Run 1

OTL by OldTimer - Version 3.2.14.1     Folder = C:\Dokumente und Einstellungen\user\Desktop\MFTools

Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 7.0.5730.13)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

511,00 Mb Total Physical Memory | 66,00 Mb Available Physical Memory | 13,00% Memory free

1,00 Gb Paging File | 1,00 Gb Available in Paging File | 66,00% Paging File free

Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme

Drive C: | 74,52 Gb Total Space | 12,89 Gb Free Space | 17,30% Space Free | Partition Type: NTFS

D: Drive not present or media not loaded

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

 

Computer Name: PRIVAT-C65EE05C

Current User Name: user

Logged in as Administrator.

 

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Minimal

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.exe [@ = exefile] -- Reg Error: Key error. File not found

 
 ========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

htmlfile [edit] -- "C:\Programme\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)

htmlfile [print] -- "C:\Programme\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation)

http [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)

https [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"FirstRunDisabled" = 1

"AntiVirusDisableNotify" = 0

"FirewallDisableNotify" = 0

"UpdatesDisableNotify" = 0

"AntiVirusOverride" = 0

"FirewallOverride" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

 
 ========== System Restore Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]

"DisableSR" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]

"Start" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]

"Start" = 2

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

"DoNotAllowExceptions" = 0

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007

"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

 
 ========== Authorized Applications List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

"C:\Programme\MSN Messenger\msncall.exe" = C:\Programme\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone) -- File not found

"C:\Programme\MSN Messenger\livecall.exe" = C:\Programme\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone) -- File not found

"C:\Programme\Windows Live\Messenger\wlcsdk.exe" = C:\Programme\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation)

"C:\Programme\Windows Live\Sync\WindowsLiveSync.exe" = C:\Programme\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync -- (Microsoft Corporation)

"E:\SpybotSDPortable\App\SpybotSD\SpybotSD.exe" = E:\SpybotSDPortable\App\SpybotSD\SpybotSD.exe:*:Enabled:SpybotSD -- File not found

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"C:\Programme\PuTTY\putty.exe" = C:\Programme\PuTTY\putty.exe:*:Enabled:putty -- File not found

"C:\Programme\Yahoo!\Messenger\YahooMessenger.exe" = C:\Programme\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger -- File not found

"C:\Programme\Yahoo!\Messenger\YServer.exe" = C:\Programme\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server -- File not found

"C:\WINDOWS\system32\dpvsetup.exe" = C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test -- (Microsoft Corporation)

"C:\Programme\eMule\emule.exe" = C:\Programme\eMule\emule.exe:*:Disabled:eMule -- File not found

"C:\Programme\HP\Digital Imaging\bin\hpofxm08.exe" = C:\Programme\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe -- (Hewlett-Packard Co.)

"C:\Programme\HP\Digital Imaging\bin\hposfx08.exe" = C:\Programme\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe -- (Hewlett-Packard Co.)

"C:\Programme\HP\Digital Imaging\bin\hposid01.exe" = C:\Programme\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe -- (Hewlett-Packard Co.)

"C:\Programme\HP\Digital Imaging\bin\hpqCopy.exe" = C:\Programme\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe -- File not found

"C:\Programme\HP\Digital Imaging\bin\hpfccopy.exe" = C:\Programme\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe -- (Hewlett-Packard)

"C:\Programme\HP\Digital Imaging\bin\hpzwiz01.exe" = C:\Programme\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe -- File not found

"C:\Programme\HP\Digital Imaging\Unload\HpqPhUnl.exe" = C:\Programme\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe -- ()

"C:\Programme\HP\Digital Imaging\bin\hpoews01.exe" = C:\Programme\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe -- File not found

"C:\Programme\MSN Messenger\livecall.exe" = C:\Programme\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone) -- File not found

"C:\Programme\Windows Media Player\wmplayer.exe" = C:\Programme\Windows Media Player\wmplayer.exe:*:Disabled:Windows Media Player -- (Microsoft Corporation)

"C:\Programme\Windows Live\Messenger\wlcsdk.exe" = C:\Programme\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation)

"C:\Programme\Windows Live\Sync\WindowsLiveSync.exe" = C:\Programme\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync -- (Microsoft Corporation)

"E:\SpybotSDPortable\App\SpybotSD\SpybotSD.exe" = E:\SpybotSDPortable\App\SpybotSD\SpybotSD.exe:*:Enabled:SpybotSD -- File not found

"C:\Programme\SopCast\adv\SopAdver.exe" = C:\Programme\SopCast\adv\SopAdver.exe:*:Enabled:SopCast Adver -- (www.sopcast.com)

 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{0611BD4E-4FE4-4a62-B0C0-18A4CC463428}" = CP_Package_Variety1

"{09984AEC-6B9F-4ca7-B78D-CB44D4771DA3}" = Destinations

"{0BEDBD4E-2D34-47B5-9973-57E62B29307C}" = ATI Control Panel

"{0FABD3D7-3036-4e78-B29D-58957ADB0A12}" = HP PSC & OfficeJet 3.5

"{15EE79F4-4ED1-4267-9B0F-351009325D7D}" = HP Software Update

"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer

"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate

"{1C139D7D-9FEA-468d-A9C8-2A6E3BDE564A}" = CP_Package_Variety3

"{205c6bdd-7b73-42de-8505-9a093f35a238}" = Windows Live-Uploadtool

"{218761F6-CBF6-4973-B910-A33E6563A1EA}" = Windows Live Toolbar-Erweiterung (Windows Live Toolbar)

"{22b775e7-6c42-4fc5-8e10-9a5e3257bd94}" = MSVCRT

"{24C8FBF7-26C6-48ca-834B-A4E5C09E362F}" = AiO_Scan

"{257EC58E-03FD-472B-A9B6-93F23A3C4CB0}" = Scan

"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 21

"{29B50D30-EAFC-4cea-9F76-3A0E3729E9B0}" = SkinsHP1

"{2ba722d1-48d1-406e-9123-8ae5431d63ef}" = Windows Live Fotogalerie

"{2CADCEAB-D5DA-44D6-B5FC-7DEE87AB3C0C}" = Unload

"{2CCBABCB-6427-4A55-B091-49864623C43F}" = Google Toolbar for Firefox

"{2DD6C198-FA9A-40B4-8DE5-CE5206E3EB34}" = Smart Menus (Windows Live Toolbar)

"{2E132061-C78A-48D4-A899-1D13B9D189FA}" = Memories Disc Creator 2.0

"{300D9EF4-2721-4cb4-A6C3-FB2337CFEA2D}" = AIOMinimal

"{30C19FF2-7FBA-4d09-B9DE-1659977F64F6}" = TrayApp

"{3248F0A8-6813-11D6-A77B-00B0D0150000}" = J2SE Runtime Environment 5.0

"{3248F0A8-6813-11D6-A77B-00B0D0150050}" = J2SE Runtime Environment 5.0 Update 5

"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java(TM) 6 Update 3

"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java(TM) 6 Update 5

"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7

"{3353CA25-78CC-4321-B67C-16F2933DC94B}" = Browsen mit Registerkarten (Windows Live Toolbar)

"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP

"{3AF8FCCD-F51A-4014-9002-F195E1CBC876}" = Logitech QuickCam

"{3b4e636e-9d65-4d67-ba61-189800823f52}" = Windows Live Communications Platform

"{3CF78481-FB7B-4B51-99A2-D5E0CD0B3AAF}" = HPSystemDiagnostics

"{41e654a9-26d0-4eac-854b-0fa824fffabb}" = Windows Live Messenger

"{48242276-DB89-42e8-9678-BD4280D7B99A}" = Copy

"{48380D07-AFB8-42F6-8BD1-C68BC61D1117}" = klickTel Frühjahr 2006

"{491DD792-AD81-429C-9EB4-86DD3D22E333}" = Windows Communication Foundation

"{498A4E3D-562E-4129-8722-6DCAB12384AE}" = Windows Communication Foundation Language Pack - DEU

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{4BDFD2CE-6329-42E4-9801-9B3D1F10D79B}" = Adobe® Photoshop® Album Starter Edition 3.0

"{4CCC7F68-A437-4559-A840-F5E010934951}" = HP Driver Diagnostics

"{52b97218-98cb-4b8b-9283-d213c85e1aa4}" = Windows Live Anmelde-Assistent

"{53735ECE-E461-4FD0-B742-23A352436D3A}" = Logitech Updater

"{56F8AFC3-FA98-4ff1-9673-8A026CBF85BE}" = WebReg

"{57C7C46A-D35D-492d-A328-4F8C9B5B4B52}" = PrintScreen

"{57f0ed40-8f11-41aa-b926-4a66d0d1a9cc}" = Microsoft Office Live Add-in 1.3

"{5E863175-E85D-44A6-8968-82507D34AE7F}" = QuickTime

"{5fc68772-6d56-41c6-9df1-24e868198ae6}" = Windows Live Call

"{62F79C52-E264-44ab-ABC2-7BEA2962C70D}" = 5500Trb

"{63F2408D-A675-4d97-A256-70EACB6B9B4A}" = AiOSoftware

"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder

"{6BB6627C-694F-4FDC-A3E5-C7F4BED4C724}" = DocProc

"{6D4E56A1-22EE-44d8-BD14-7B9FB7F80D1B}" = 5500_Help

"{70b7a167-0b88-445d-a3ea-97c73aa88cac}" = Windows Live Toolbar

"{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}" = Microsoft .NET Framework 2.0

"{7228FD8C-3B9E-4204-AE36-8A466107685B}" = Windows Workflow Foundation DE Language Pack

"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable

"{73C23496-A105-4b6f-B8F0-22523DFE4E4E}" = 5500

"{745A92AF-53B4-41A7-91C3-9B026B1D5897}" = InstantShare

"{76618402-179d-4699-a66b-d351c59436bc}" = Windows Live Sync

"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec

"{7D1B85BD-AA07-48B8-808D-67A4067FC6BD}" = Windows Workflow Foundation

"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP

"{8777AC6D-89F9-4793-8266-DE406F343E89}" = QFolder

"{8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38}" = Microsoft .NET Framework 2.0 Language Pack - DEU

"{89f4137d-6c26-4a84-bdb8-2e5a4bb71e00}" = Microsoft Silverlight

"{8a74e887-8f0f-4017-af53-cba42211aaa5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)

"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player

"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003

"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System

"{92DF2F1B-F63C-4D9A-B3E1-B2D11AE29790}" = Windows Presentation Foundation Language Pack (DEU)

"{95120000-00b9-0409-0000-0000000ff1ce}" = Microsoft Application Error Reporting

"{95120000-0122-0407-0000-0000000ff1ce}" = Microsoft Office Outlook Connector

"{95140000-00AF-0407-0000-0000000FF1CE}" = Microsoft PowerPoint Viewer

"{994223f3-a99b-4ddd-9e1d-0190a17c6860}" = Windows Live Family Safety

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9B03C535-3AEA-4ef2-B326-0A01A2207034}" = CreativeProjects

"{9c9ceb9d-53fd-49a7-85d2-fe674f72f24e}" = Microsoft Search Enhancement Pack

"{9DE9E293-5D7B-4312-88C2-BDFAEC5310AE}" = Microsoft .NET Framework 3.0

"{A195B13E-A5E3-4BAF-A995-7F70F445CD06}" = ScannerCopy

"{a1f66fc9-11ee-4f2f-98c9-16f8d1e69fb7}" = Segoe UI

"{A2500497-FD32-493e-B8E5-28D6728DBEF5}" = Readme

"{A260B422-70E1-41E2-957D-F76FA21266D5}" = Apple Software Update

"{A30B27FF-8C79-424A-89B4-43AD712A41ED}" = Steuer 2005

"{A5181519-9F3D-4372-ABC6-C333C2F3A816}_is1" = RunAlyzer

"{A9E5EDA7-2E6C-49E7-924B-A32B89C24A04}" = T-Mobile Internet Manager 03

"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder

"{AC76BA86-7AD7-1031-7B44-A70800000002}" = Adobe Reader 7.0.8 - Deutsch

"{AF226123-1A6F-4ec1-8DEF-E35E7A0D0127}" = Fax

"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter

"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy

"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player

"{B824B5C9-849F-4b9e-9EA7-6FD8CD8116DA}" = CP_Package_Variety2

"{B996AE66-10DB-4ac5-B151-E8B4BFBC42FC}" = BufferChm

"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation

"{BC339BFD-F550-471a-8D26-4D08126C62F7}" = SkinsHP2

"{bd64af4a-8c80-4152-ad77-fcddf05208ab}" = Microsoft Sync Framework Services Native v1.0 (x86)

"{c4124e95-5061-4776-8d5d-e3d931c778e1}" = Microsoft VC9 runtime libraries

"{c4d738f7-996a-4c81-b8fa-c4e26d767e41}" = Windows Live Mail

"{C5ADA65A-7828-4D85-B071-ECC52B51F794}" = Sony Ericsson PC Suite 1.20.173

"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1

"{CBE3E0AF-73BB-4c21-8B96-B09E003EDE7F}" = QuickProjects

"{CDBFDD5B-50E0-4021-94AF-516B80509ABE}" = 5500Tour

"{D186329B-1B4D-408D-ABEC-EA5CE1F182C9}" = Overland

"{e0a4805d-280a-4dd7-9e74-3a5f85e302a1}" = Windows Live Writer

"{e2dfe069-083e-4631-9b6c-43c48e991de5}" = Junk Mail filter update

"{E3F90083-80D4-4b5a-87C7-E97E12F5516D}" = HPProductAssistant

"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack

"{E8BFBD0A-8002-4dc9-869C-E495FA9DCE7A}" = PhotoGallery

"{EA103B64-C0E4-4C0E-A506-751590E1653D}" = SolutionCenter

"{EBA672FF-F80E-48B1-8FC4-616825318810}" = Feederkennung (Windows Live Toolbar)

"{EDDDC607-91D9-4758-9F57-265FDCD8A772}" = Microsoft Works 7.0 

"{f0b430d1-b6aa-473d-9b06-aa3dd01fd0b8}" = Microsoft SQL Server 2005 Compact Edition [ENU]

"{f0e12bba-ad66-4022-a453-a1c8a0c4d570}" = Microsoft Choice Guard

"{F2A7F421-1679-48D5-B918-96999014ED53}" = Microsoft .NET Framework 3.0 German Language Pack

"{F4C2E5F5-2970-45f4-ABD3-C180C4D961C4}" = Status

"{f8ff18ee-264a-43fd-b2f6-5ead40798c2f}" = Windows Live Essentials

"{FE64AE29-0883-4C70-8388-DC026019C900}" = HP Image Zone Express

"{FF102450-55AA-4AE1-ACE4-E271E2470C83}" = hpmdtab

"7-Zip" = 7-Zip 4.65

"AC3Filter" = AC3Filter (remove only)

"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin

"All ATI Software" = ATI - Dienstprogramm zur Deinstallation der Software

"ATI Display Driver" = ATI Display Driver

"Avira AntiVir Desktop" = Avira AntiVir Premium

"AXIS Media Control Embedded" = AXIS Media Control Embedded

"Burn4Free" = Burn4Free CD and DVD

"Burn4Free Toolbar" = Burn4Free Toolbar

"CCleaner" = CCleaner (remove only)

"DivX Content Uploader" = DivX Content Uploader

"ERUNT_is1" = ERUNT 1.1j

"FreePDF_XP" = FreePDF XP (Remove only)

"GPL Ghostscript 8.15" = GPL Ghostscript 8.15

"GPL Ghostscript Fonts" = GPL Ghostscript Fonts

"HaufeReader" = HaufeReader

"HijackThis" = HijackThis 2.0.2

"HP Imaging Device Functions" = HP Imaging Device Functions 5.3

"hp officejet 5500 series_Driver" = hp officejet 5500 series

"HP Photo & Imaging" = HP Image Zone 3.5

"HP Solution Center & Imaging Support Tools" = HP Solution Center & Imaging Support Tools 5.3

"ICQToolbar" = ICQ Toolbar

"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs

"ie7" = Windows Internet Explorer 7

"Installing HSP56 MicroModem Drivers" = HSP56 Modem Drivers

"JAP" = JAP

"legacyqcam_10.50" = Logitech Legacy USB Camera-Treiberpaket

"lvdrivers_11.80" = Logitech QuickCam-Treiberpaket

"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware

"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1

"Microsoft .NET Framework 2.0" = Microsoft .NET Framework 2.0

"Microsoft .NET Framework 2.0 Language Pack - DEU" = Microsoft .NET Framework 2.0 Language Pack - DEU

"Microsoft .NET Framework 3.0" = Microsoft .NET Framework 3.0

"Microsoft .NET Framework 3.0 German Language Pack" = Microsoft .NET Framework 3.0 German Language Pack

"Mozilla Firefox (3.6.10)" = Mozilla Firefox (3.6.10)

"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP

"MSNINST" = MSN

"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs

"PokerStars" = PokerStars

"RealPlayer 6.0" = RealPlayer

"Redirection Port Monitor" = RedMon - Redirection Port Monitor

"SopCast" = SopCast 3.2.9

"Totalcmd" = Total Commander (Remove or Repair)

"Veetle TV" = Veetle TV 0.9.17

"viewpointmediaplayer" = Viewpoint Media Player

"WIC" = Windows Imaging Component

"Windows Media Format Runtime" = Windows Media Format 11 runtime

"Windows Media Player" = Windows Media Player 11

"Windows XP Service Pack" = Windows XP Service Pack 3

"winlivesuite_wave3" = Windows Live Essentials

"WinRAR archiver" = WinRAR Archivierer

"WMFDist11" = Windows Media Format 11 runtime

"wmp11" = Windows Media Player 11

"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0

"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0

 
 ========== HKEY_CURRENT_USER Uninstall List ==========

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"Move Networks Player - IE" = Move Networks Media Player for Internet Explorer

 
 ========== Last 10 Event Log Errors ==========

 

[ Application Events ]

Error - 29.09.2010 17:57:00 | Computer Name = PRIVAT-C65EE05C | Source = Application Error | ID = 1000

Description = Fehlgeschlagene Anwendung iexplore.exe, Version 7.0.6000.16850, fehlgeschlagenes

 Modul ntdll.dll, Version 5.1.2600.5755, Fehleradresse 0x000251bc.

 

Error - 29.09.2010 17:58:02 | Computer Name = PRIVAT-C65EE05C | Source = Application Error | ID = 1000

Description = Fehlgeschlagene Anwendung iexplore.exe, Version 7.0.6000.16850, fehlgeschlagenes

 Modul ntdll.dll, Version 5.1.2600.5755, Fehleradresse 0x000251bc.

 

Error - 30.09.2010 16:06:59 | Computer Name = PRIVAT-C65EE05C | Source = Application Error | ID = 1000

Description = Fehlgeschlagene Anwendung iexplore.exe, Version 7.0.6000.16850, fehlgeschlagenes

 Modul ntdll.dll, Version 5.1.2600.5755, Fehleradresse 0x00025672.

 

Error - 30.09.2010 23:56:14 | Computer Name = PRIVAT-C65EE05C | Source = LoadPerf | ID = 3001

Description = Der Wert für die Namenszeichenfolge im Leistungsindikator in der Registrierung

ist

 falsch formatiert. Die ungültige Zeichenfolge ist 4576 und der ungültige  Indexwert

 ist das erste DWORD im Datenbereich, während die letzten gültigen  Indexwerte die

 zweiten und dritten DWORD im Datenbereich sind.

 

Error - 30.09.2010 23:56:14 | Computer Name = PRIVAT-C65EE05C | Source = LoadPerf | ID = 3001

Description = Der Wert für die Namenszeichenfolge im Leistungsindikator in der Registrierung

ist

 falsch formatiert. Die ungültige Zeichenfolge ist 4576 und der ungültige  Indexwert

 ist das erste DWORD im Datenbereich, während die letzten gültigen  Indexwerte die

 zweiten und dritten DWORD im Datenbereich sind.

 

Error - 30.09.2010 23:56:14 | Computer Name = PRIVAT-C65EE05C | Source = LoadPerf | ID = 3011

Description = Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren

 für  Dienst WmiApRpl (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

 

Error - 30.09.2010 23:56:17 | Computer Name = PRIVAT-C65EE05C | Source = LoadPerf | ID = 3001

Description = Der Wert für die Namenszeichenfolge im Leistungsindikator in der Registrierung

ist

 falsch formatiert. Die ungültige Zeichenfolge ist 4576 und der ungültige  Indexwert

 ist das erste DWORD im Datenbereich, während die letzten gültigen  Indexwerte die

 zweiten und dritten DWORD im Datenbereich sind.

 

Error - 01.10.2010 06:03:52 | Computer Name = PRIVAT-C65EE05C | Source = WmiAdapter | ID = 4099

Description = Dienst konnte nicht geöffnet werden.

 

Error - 01.10.2010 06:33:36 | Computer Name = PRIVAT-C65EE05C | Source = crypt32 | ID = 131083

Description = Die Extrahierung der Drittanbieterstammlisten aus der automatischen

 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>

 ist fehlgeschlagen mit dem Fehler: Der Verzeichnisname ist ungültig.  .

 

Error - 01.10.2010 06:33:38 | Computer Name = PRIVAT-C65EE05C | Source = crypt32 | ID = 131083

Description = Die Extrahierung der Drittanbieterstammlisten aus der automatischen

 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>

 ist fehlgeschlagen mit dem Fehler: Der Verzeichnisname ist ungültig.  .

 

[ System Events ]

Error - 01.10.2010 06:33:22 | Computer Name = PRIVAT-C65EE05C | Source = Service Control Manager | ID = 7022

Description = Der Dienst "IPv6-Hilfsdienst" wurde nicht ordnungsgemäß gestartet.

 

Error - 01.10.2010 06:33:22 | Computer Name = PRIVAT-C65EE05C | Source = Service Control Manager | ID = 7026

Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:

   IntelIde

 

Error - 01.10.2010 07:19:37 | Computer Name = PRIVAT-C65EE05C | Source = Service Control Manager | ID = 7000

Description = Der Dienst "Intelligenter Hintergrundübertragungsdienst" wurde aufgrund

 folgenden Fehlers nicht gestartet:   %%2

 

Error - 01.10.2010 07:19:37 | Computer Name = PRIVAT-C65EE05C | Source = Service Control Manager | ID = 7000

Description = Der Dienst "Automatische Updates" wurde aufgrund folgenden Fehlers

 nicht gestartet:   %%2

 

Error - 01.10.2010 07:19:48 | Computer Name = PRIVAT-C65EE05C | Source = Ftdisk | ID = 262189

Description = Das System konnte den Treiber für das Speicherabbild nicht laden.

 

Error - 01.10.2010 07:19:48 | Computer Name = PRIVAT-C65EE05C | Source = Ftdisk | ID = 262193

Description = Die Konfiguration der Auslagerungsdatei für das Speicherabbild ist

 fehlgeschlagen. Stellen  Sie sicher, dass eine Auslagerungsdatei auf der Startpartition

 vorhanden ist und dass diese  groß genug ist, um den gesamten physikalischen Speicher

 abbilden zu können.

 

Error - 01.10.2010 07:49:32 | Computer Name = PRIVAT-C65EE05C | Source = Service Control Manager | ID = 7000

Description = Der Dienst "Intelligenter Hintergrundübertragungsdienst" wurde aufgrund

 folgenden Fehlers nicht gestartet:   %%2

 

Error - 01.10.2010 07:49:32 | Computer Name = PRIVAT-C65EE05C | Source = Service Control Manager | ID = 7000

Description = Der Dienst "Automatische Updates" wurde aufgrund folgenden Fehlers

 nicht gestartet:   %%2

 

Error - 01.10.2010 07:49:43 | Computer Name = PRIVAT-C65EE05C | Source = Ftdisk | ID = 262189

Description = Das System konnte den Treiber für das Speicherabbild nicht laden.

 

Error - 01.10.2010 07:49:43 | Computer Name = PRIVAT-C65EE05C | Source = Ftdisk | ID = 262193

Description = Die Konfiguration der Auslagerungsdatei für das Speicherabbild ist

 fehlgeschlagen. Stellen  Sie sicher, dass eine Auslagerungsdatei auf der Startpartition

 vorhanden ist und dass diese  groß genug ist, um den gesamten physikalischen Speicher

 abbilden zu können.

 

 

< End of report >

TDDS:

Code:

2010/10/01 14:39:09.0534    TDSS rootkit removing tool 2.4.3.0 Sep 27 2010 15:28:54

2010/10/01 14:39:09.0534    ================================================================================

2010/10/01 14:39:09.0534    SystemInfo:

2010/10/01 14:39:09.0534    

2010/10/01 14:39:09.0534    OS Version: 5.1.2600 ServicePack: 3.0

2010/10/01 14:39:09.0534    Product type: Workstation

2010/10/01 14:39:09.0534    ComputerName: PRIVAT-C65EE05C

2010/10/01 14:39:09.0534    UserName: user

2010/10/01 14:39:09.0534    Windows directory: C:\WINDOWS

2010/10/01 14:39:09.0534    System windows directory: C:\WINDOWS

2010/10/01 14:39:09.0534    Processor architecture: Intel x86

2010/10/01 14:39:09.0534    Number of processors: 1

2010/10/01 14:39:09.0534    Page size: 0x1000

2010/10/01 14:39:09.0534    Boot type: Normal boot

2010/10/01 14:39:09.0534    ================================================================================

2010/10/01 14:39:09.0864    Initialize success

2010/10/01 14:39:20.0700    ================================================================================

2010/10/01 14:39:20.0700    Scan started

2010/10/01 14:39:20.0700    Mode: Manual;

2010/10/01 14:39:20.0700    ================================================================================

2010/10/01 14:39:23.0974    ACPI            (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys

2010/10/01 14:39:24.0205    ACPIEC          (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys

2010/10/01 14:39:24.0395    aec             (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys

2010/10/01 14:39:24.0625    AFD             (7e775010ef291da96ad17ca4b17137d7) C:\WINDOWS\System32\drivers\afd.sys

2010/10/01 14:39:24.0756    AFS2K           (c719341a1cf6afd4fa0808ae3d23d6a3) C:\WINDOWS\system32\drivers\AFS2K.sys

2010/10/01 14:39:24.0906    agp440          (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys

2010/10/01 14:39:25.0457    ALCXSENS        (fbbcb95f677cbaa924140b6ea2d9a97b) C:\WINDOWS\system32\drivers\ALCXSENS.SYS

2010/10/01 14:39:25.0727    ALCXWDM         (bc5c55b49c4bd1fdfaaa128fe21f9fea) C:\WINDOWS\system32\drivers\ALCXWDM.SYS

2010/10/01 14:39:26.0178    Arp1394         (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys

2010/10/01 14:39:26.0769    AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys

2010/10/01 14:39:26.0889    atapi           (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys

2010/10/01 14:39:27.0279    ati2mtag        (8303b347a02ed4bbf94e5682a6d22619) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys

2010/10/01 14:39:27.0429    Atmarpc         (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys

2010/10/01 14:39:27.0570    audstub         (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys

2010/10/01 14:39:27.0700    avgio           (6a646c46b9415e13095aa9b352040a7a) C:\Programme\Avira\AntiVir Desktop\avgio.sys

2010/10/01 14:39:27.0910    avgntflt        (a88d29d928ad2b830e87b53e3f9bc182) C:\WINDOWS\system32\DRIVERS\avgntflt.sys

2010/10/01 14:39:28.0130    avipbb          (6eeeab115f45993af480cc6c9188e8a4) C:\WINDOWS\system32\DRIVERS\avipbb.sys

2010/10/01 14:39:28.0301    Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys

2010/10/01 14:39:28.0461    cbidf2k         (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys

2010/10/01 14:39:28.0681    CCDECODE        (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys

2010/10/01 14:39:28.0882    Cdaudio         (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys

2010/10/01 14:39:29.0092    Cdfs            (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys

2010/10/01 14:39:29.0192    Cdrom           (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys

2010/10/01 14:39:29.0482    CmBatt          (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys

2010/10/01 14:39:29.0713    Compbatt        (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys

2010/10/01 14:39:30.0244    Disk            (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys

2010/10/01 14:39:30.0454    dmboot          (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys

2010/10/01 14:39:30.0674    dmio            (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys

2010/10/01 14:39:30.0854    dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys

2010/10/01 14:39:30.0975    DMusic          (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys

2010/10/01 14:39:31.0285    drmkaud         (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys

2010/10/01 14:39:31.0425    EMCR            (624535d92df138fd37a0f0737c8ad20e) C:\WINDOWS\system32\DRIVERS\EMCR7SK.sys

2010/10/01 14:39:31.0575    Fastfat         (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys

2010/10/01 14:39:31.0756    Fdc             (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys

2010/10/01 14:39:31.0876    FilterService   (50104c5f1ee1e295781caf9521ca2e56) C:\WINDOWS\system32\DRIVERS\lvuvcflt.sys

2010/10/01 14:39:32.0206    Fips            (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys

2010/10/01 14:39:32.0306    Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys

2010/10/01 14:39:32.0407    FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys

2010/10/01 14:39:32.0587    fssfltr         (c6ee3a87fe609d3e1db9dbd072a248de) C:\WINDOWS\system32\DRIVERS\fssfltr_tdi.sys

2010/10/01 14:39:32.0737    Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys

2010/10/01 14:39:32.0837    Ftdisk          (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys

2010/10/01 14:39:33.0048    G3GCUMDM        (dab887fa8518ac06f0c32ca337b61e5a) C:\WINDOWS\system32\DRIVERS\g3gcumdm.sys

2010/10/01 14:39:33.0148    G3GCUSER        (1949f10df07bb15f92d2cf6e6abce497) C:\WINDOWS\system32\DRIVERS\g3gcuser.sys

2010/10/01 14:39:33.0248    Gpc             (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys

2010/10/01 14:39:33.0428    HidUsb          (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys

2010/10/01 14:39:33.0678    HPZid412        (9f1d80908658eb7f1bf70809e0b51470) C:\WINDOWS\system32\DRIVERS\HPZid412.sys

2010/10/01 14:39:33.0829    HPZipr12        (f7e3e9d50f9cd3de28085a8fdaa0a1c3) C:\WINDOWS\system32\DRIVERS\HPZipr12.sys

2010/10/01 14:39:33.0939    HPZius12        (cf1b7951b4ec8d13f3c93b74bb2b461b) C:\WINDOWS\system32\DRIVERS\HPZius12.sys

2010/10/01 14:39:34.0179    HTTP            (f6aacf5bce2893e0c1754afeb672e5c9) C:\WINDOWS\system32\Drivers\HTTP.sys

2010/10/01 14:39:34.0660    i8042prt        (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys

2010/10/01 14:39:34.0730    Imapi           (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys

2010/10/01 14:39:34.0970    IntelIde        (69c4e3c9e67a1f103b94e14fdd5f3213) C:\WINDOWS\system32\DRIVERS\intelide.sys

2010/10/01 14:39:35.0141    intelppm        (4c7d2750158ed6e7ad642d97bffae351) C:\WINDOWS\system32\DRIVERS\intelppm.sys

2010/10/01 14:39:35.0231    Ip6Fw           (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys

2010/10/01 14:39:35.0361    IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys

2010/10/01 14:39:35.0481    IpInIp          (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys

2010/10/01 14:39:35.0641    IpNat           (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys

2010/10/01 14:39:35.0761    IPSec           (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys

2010/10/01 14:39:35.0892    IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys

2010/10/01 14:39:36.0072    isapnp          (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys

2010/10/01 14:39:36.0242    k750bus         (fe8300320281d658a7854d5cfc02a63f) C:\WINDOWS\system32\DRIVERS\k750bus.sys

2010/10/01 14:39:36.0372    k750mdfl        (f44521f63c0c00364fa3d59db980de6a) C:\WINDOWS\system32\DRIVERS\k750mdfl.sys

2010/10/01 14:39:36.0492    k750mdm         (e93323c3ed5e8923a177740a973c27b2) C:\WINDOWS\system32\DRIVERS\k750mdm.sys

2010/10/01 14:39:36.0683    k750mgmt        (9d5f5a70ca0b7c428efcd73db50e6ac7) C:\WINDOWS\system32\DRIVERS\k750mgmt.sys

2010/10/01 14:39:36.0803    k750obex        (81ca2d57b2c14f76f4ba80846784bb3d) C:\WINDOWS\system32\DRIVERS\k750obex.sys

2010/10/01 14:39:36.0993    Kbdclass        (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys

2010/10/01 14:39:37.0214    kmixer          (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys

2010/10/01 14:39:37.0334    KSecDD          (1705745d900dabf2d89f90ebaddc7517) C:\WINDOWS\system32\drivers\KSecDD.sys

2010/10/01 14:39:37.0884    lvpopflt        (6d994fa3d541b63eaccf4f2b3f42b2e1) C:\WINDOWS\system32\DRIVERS\lvpopflt.sys

2010/10/01 14:39:38.0165    LVPr2Mon        (a6919138f29ae45e90e99fa94737e04c) C:\WINDOWS\system32\Drivers\LVPr2Mon.sys

2010/10/01 14:39:38.0325    LVRS            (b895839b8743e400d7c7dae156f74e7e) C:\WINDOWS\system32\DRIVERS\lvrs.sys

2010/10/01 14:39:38.0505    LVUSBSta        (23f8ef78bb9553e465a476f3cee5ca18) C:\WINDOWS\system32\drivers\LVUSBSta.sys

2010/10/01 14:39:39.0046    LVUVC           (8bc0d5f6e3898f465a94c6d03afb5a20) C:\WINDOWS\system32\DRIVERS\lvuvc.sys

2010/10/01 14:39:39.0567    mnmdd           (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys

2010/10/01 14:39:39.0717    Modem           (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys

2010/10/01 14:39:39.0897    MODEMCSA        (1992e0d143b09653ab0f9c5e04b0fd65) C:\WINDOWS\system32\drivers\MODEMCSA.sys

2010/10/01 14:39:40.0058    Mouclass        (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys

2010/10/01 14:39:40.0188    mouhid          (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys

2010/10/01 14:39:40.0348    MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys

2010/10/01 14:39:40.0578    MRxDAV          (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys

2010/10/01 14:39:40.0769    MRxSmb          (60ae98742484e7ab80c3c1450e708148) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys

2010/10/01 14:39:40.0929    Msfs            (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys

2010/10/01 14:39:41.0109    MSKSSRV         (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys

2010/10/01 14:39:41.0229    MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys

2010/10/01 14:39:41.0370    MSPQM           (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys

2010/10/01 14:39:41.0480    mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys

2010/10/01 14:39:41.0640    MSTEE           (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys

2010/10/01 14:39:41.0810    Mup             (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys

2010/10/01 14:39:41.0930    NABTSFEC        (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys

2010/10/01 14:39:42.0271    NDIS            (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys

2010/10/01 14:39:42.0451    NdisIP          (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys

2010/10/01 14:39:42.0591    NdisTapi        (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys

2010/10/01 14:39:42.0731    Ndisuio         (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys

2010/10/01 14:39:42.0872    NdisWan         (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys

2010/10/01 14:39:43.0062    NDProxy         (6215023940cfd3702b46abc304e1d45a) C:\WINDOWS\system32\drivers\NDProxy.sys

2010/10/01 14:39:43.0182    NetBIOS         (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys

2010/10/01 14:39:43.0332    NetBT           (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys

2010/10/01 14:39:43.0523    NIC1394         (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys

2010/10/01 14:39:43.0773    Npfs            (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys

2010/10/01 14:39:43.0893    Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys

2010/10/01 14:39:44.0184    Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys

2010/10/01 14:39:44.0354    NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys

2010/10/01 14:39:44.0464    NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys

2010/10/01 14:39:44.0584    ohci1394        (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys

2010/10/01 14:39:44.0774    Parport         (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\drivers\Parport.sys

2010/10/01 14:39:44.0865    PartMgr         (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys

2010/10/01 14:39:44.0975    ParVdm          (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys

2010/10/01 14:39:45.0205    PCI             (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys

2010/10/01 14:39:45.0395    PCIIde          (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\DRIVERS\pciide.sys

2010/10/01 14:39:45.0576    Pcmcia          (845939021e2821e74e88e2a452360585) C:\WINDOWS\system32\DRIVERS\pcmcia.sys

2010/10/01 14:39:45.0576    Suspicious file (Forged): C:\WINDOWS\system32\DRIVERS\pcmcia.sys. Real md5: 845939021e2821e74e88e2a452360585, Fake md5: a2a966b77d61847d61a3051df87c8c97

2010/10/01 14:39:45.0586    Pcmcia - detected Rootkit.Win32.TDSS.tdl3 (0)

2010/10/01 14:39:46.0327    PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys

2010/10/01 14:39:46.0427    PSched          (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys

2010/10/01 14:39:46.0557    Ptilink         (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys

2010/10/01 14:39:46.0727    Ptserial        (155151cf423dbc12650c7346a23b90e7) C:\WINDOWS\system32\DRIVERS\ptserial.sys

2010/10/01 14:39:46.0867    PxHelp20        (86724469cd077901706854974cd13c3e) C:\WINDOWS\system32\Drivers\PxHelp20.sys

2010/10/01 14:39:47.0578    RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys

2010/10/01 14:39:47.0739    Rasl2tp         (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys

2010/10/01 14:39:47.0899    RasPppoe        (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys

2010/10/01 14:39:48.0079    Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys

2010/10/01 14:39:48.0209    Rdbss           (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys

2010/10/01 14:39:48.0360    RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys

2010/10/01 14:39:48.0510    RDPWD           (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys

2010/10/01 14:39:48.0730    redbook         (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys

2010/10/01 14:39:48.0900    RTL8023         (265e3427e74cf322126c83e12c7869ec) C:\WINDOWS\system32\DRIVERS\Rtlnic51.sys

2010/10/01 14:39:49.0121    rtl8139         (d507c1400284176573224903819ffda3) C:\WINDOWS\system32\DRIVERS\RTL8139.SYS

2010/10/01 14:39:49.0331    Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys

2010/10/01 14:39:49.0481    Serial          (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\drivers\Serial.sys

2010/10/01 14:39:49.0952    Sfloppy         (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys

2010/10/01 14:39:50.0593    SLIP            (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys

2010/10/01 14:39:51.0194    splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys

2010/10/01 14:39:51.0584    sr              (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys

2010/10/01 14:39:52.0155    Srv             (3bb03f2ba89d2be417206c373d2af17c) C:\WINDOWS\system32\DRIVERS\srv.sys

2010/10/01 14:39:52.0796    ssmdrv          (654dfea96bc82b4acda4f37e5e4a3bbf) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys

2010/10/01 14:39:53.0507    streamip        (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys

2010/10/01 14:39:54.0158    swenum          (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys

2010/10/01 14:39:54.0979    swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys

2010/10/01 14:39:56.0101    sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys

2010/10/01 14:39:56.0281    Tcpip           (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys

2010/10/01 14:39:56.0411    Tcpip6          (fb9f32acc1d3ad523f7ec900b66fc1bb) C:\WINDOWS\system32\DRIVERS\tcpip6.sys

2010/10/01 14:39:56.0521    TDPIPE          (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys

2010/10/01 14:39:56.0702    TDTCP           (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys

2010/10/01 14:39:56.0792    TermDD          (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys

2010/10/01 14:39:57.0142    tunmp           (8f861eda21c05857eb8197300a92501c) C:\WINDOWS\system32\DRIVERS\tunmp.sys

2010/10/01 14:39:57.0242    Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys

2010/10/01 14:39:57.0693    Update          (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys

2010/10/01 14:39:57.0873    usbaudio        (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys

2010/10/01 14:39:58.0053    usbccgp         (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys

2010/10/01 14:39:58.0194    usbehci         (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys

2010/10/01 14:39:58.0314    usbhub          (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys

2010/10/01 14:39:58.0444    usbohci         (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys

2010/10/01 14:39:58.0574    usbprint        (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys

2010/10/01 14:39:58.0765    usbscan         (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys

2010/10/01 14:39:58.0895    USBSTOR         (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

2010/10/01 14:39:59.0085    usbuhci         (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys

2010/10/01 14:39:59.0225    VgaSave         (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys

2010/10/01 14:39:59.0506    Vmodem          (4a21e872548678c2f6a2183c72cb9434) C:\WINDOWS\system32\DRIVERS\vmodem.sys

2010/10/01 14:39:59.0786    VolSnap         (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys

2010/10/01 14:39:59.0916    Vpctcom         (0d85a686e4ed428c1df4b27b4a2d59b4) C:\WINDOWS\system32\DRIVERS\vpctcom.sys

2010/10/01 14:40:00.0187    Vvoice          (bc0d1e9c88e4d5e87b043b81055e4322) C:\WINDOWS\system32\DRIVERS\vvoice.sys

2010/10/01 14:40:00.0417    w22n51          (b6cb2cce557ce57c72c3d31e701e6e39) C:\WINDOWS\system32\DRIVERS\w22n51.sys

2010/10/01 14:40:00.0827    w29n51          (f0608f3b5b6d16f4870e867f9d069b6b) C:\WINDOWS\system32\DRIVERS\w29n51.sys

2010/10/01 14:40:01.0078    Wanarp          (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys

2010/10/01 14:40:01.0268    wdmaud          (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys

2010/10/01 14:40:01.0468    wpdusb          (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys

2010/10/01 14:40:01.0649    WS2IFSL         (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys

2010/10/01 14:40:01.0769    WSTCODEC        (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS

2010/10/01 14:40:01.0929    WudfPf          (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys

2010/10/01 14:40:02.0139    WudfRd          (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys

2010/10/01 14:40:02.0740    ================================================================================

2010/10/01 14:40:02.0740    Scan finished

2010/10/01 14:40:02.0740    ================================================================================

2010/10/01 14:40:02.0780    Detected object count: 1

2010/10/01 14:40:40.0014    Pcmcia          (845939021e2821e74e88e2a452360585) C:\WINDOWS\system32\DRIVERS\pcmcia.sys

2010/10/01 14:40:40.0124    Suspicious file (Forged): C:\WINDOWS\system32\DRIVERS\pcmcia.sys. Real md5: 845939021e2821e74e88e2a452360585, Fake md5: a2a966b77d61847d61a3051df87c8c97

2010/10/01 14:40:43.0619    Backup copy found, using it..

2010/10/01 14:40:44.0060    C:\WINDOWS\system32\DRIVERS\pcmcia.sys - will be cured after reboot

2010/10/01 14:40:44.0060    Rootkit.Win32.TDSS.tdl3(Pcmcia) - User select action: Cure

So ich hoffe alles soweit richtig erledigt.
Is there any hope?
Danke für Deine Hilfe!!!
Gruss
Andreas

Guten Morgen Chris,

hat sich einiges getan. Habe Deine Anweisungen ausgeführt und denke, dass sich doch einiges vebessert haben sollte. Amüsant war dass XP nach dem Combofix und MAM insgesamt 87 updates aufspielen durfte:lach:

Nachfolgend die Logfiles:

Combofix:

Code:

ComboFix 10-10-01.07 - user 03.10.2010   0:48.1.1 - x86

Microsoft Windows XP Home Edition  5.1.2600.3.1252.49.1031.18.511.271 [GMT 2:00]

ausgeführt von:: c:\dokumente und einstellungen\user\Desktop\ComboFix.exe

AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated) {806ED0B3-FFA4-00FF-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {00000000-0000-0000-0000-000000000000}

AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {806ED0B3-FFA4-00DA-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {806ED0B3-FFA4-00EB-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {806ED0B3-FFA4-00EE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {806ED0B3-FFA4-00FC-0D24-347CA8A3377C}

.
 

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.
 

c:\dokumente und einstellungen\user\Anwendungsdaten\PriceGong

c:\dokumente und einstellungen\user\Anwendungsdaten\PriceGong\Data\1.xml

c:\dokumente und einstellungen\user\Anwendungsdaten\PriceGong\Data\a.xml

c:\dokumente und einstellungen\user\Anwendungsdaten\PriceGong\Data\b.xml

c:\dokumente und einstellungen\user\Anwendungsdaten\PriceGong\Data\c.xml

c:\dokumente und einstellungen\user\Anwendungsdaten\PriceGong\Data\d.xml

c:\dokumente und einstellungen\user\Anwendungsdaten\PriceGong\Data\e.xml

c:\dokumente und einstellungen\user\Anwendungsdaten\PriceGong\Data\f.xml

c:\dokumente und einstellungen\user\Anwendungsdaten\PriceGong\Data\g.xml

c:\dokumente und einstellungen\user\Anwendungsdaten\PriceGong\Data\h.xml

c:\dokumente und einstellungen\user\Anwendungsdaten\PriceGong\Data\i.xml

c:\dokumente und einstellungen\user\Anwendungsdaten\PriceGong\Data\J.xml

c:\dokumente und einstellungen\user\Anwendungsdaten\PriceGong\Data\k.xml

c:\dokumente und einstellungen\user\Anwendungsdaten\PriceGong\Data\l.xml

c:\dokumente und einstellungen\user\Anwendungsdaten\PriceGong\Data\m.xml

c:\dokumente und einstellungen\user\Anwendungsdaten\PriceGong\Data\n.xml

c:\dokumente und einstellungen\user\Anwendungsdaten\PriceGong\Data\o.xml

c:\dokumente und einstellungen\user\Anwendungsdaten\PriceGong\Data\p.xml

c:\dokumente und einstellungen\user\Anwendungsdaten\PriceGong\Data\q.xml

c:\dokumente und einstellungen\user\Anwendungsdaten\PriceGong\Data\r.xml

c:\dokumente und einstellungen\user\Anwendungsdaten\PriceGong\Data\s.xml

c:\dokumente und einstellungen\user\Anwendungsdaten\PriceGong\Data\t.xml

c:\dokumente und einstellungen\user\Anwendungsdaten\PriceGong\Data\u.xml

c:\dokumente und einstellungen\user\Anwendungsdaten\PriceGong\Data\v.xml

c:\dokumente und einstellungen\user\Anwendungsdaten\PriceGong\Data\w.xml

c:\dokumente und einstellungen\user\Anwendungsdaten\PriceGong\Data\x.xml

c:\dokumente und einstellungen\user\Anwendungsdaten\PriceGong\Data\y.xml

c:\dokumente und einstellungen\user\Anwendungsdaten\PriceGong\Data\z.xml

c:\dokumente und einstellungen\user\Eigene Dateien\DPE.DUS

c:\windows\regedit.com

c:\windows\system32\taskmgr.com

c:\windows\system32\uacinit.dll

c:\windows\system32\uactmp.db

c:\windows\system32\UACwsxujpsmko.db

c:\windows\TEMP\logishrd\LVPrcInj01.dll
 

.

(((((((((((((((((((((((   Dateien erstellt von 2010-09-02 bis 2010-10-02  ))))))))))))))))))))))))))))))

.
 

2010-10-01 12:37 . 2010-10-01 12:38        --------        d-----w-        C:\TDDS

2010-10-01 04:08 . 2010-10-01 04:12        --------        d-----w-        c:\programme\ERUNT

2010-10-01 03:55 . 2010-04-29 10:19        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys

2010-10-01 03:55 . 2010-10-01 03:55        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes

2010-10-01 03:55 . 2010-10-01 10:59        --------        d-----w-        c:\programme\Malwarebytes' Anti-Malware

2010-10-01 03:55 . 2010-04-29 10:19        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys

2010-10-01 03:54 . 2010-10-01 03:54        --------        d-----w-        c:\programme\7-Zip

2010-09-30 01:30 . 2010-09-30 01:30        --------        d---a-w-        c:\windows\VDLL.DLL

2010-09-30 01:30 . 2010-09-30 01:30        --------        d---a-w-        c:\windows\system32\runouce.exe

2010-09-30 01:30 . 2010-09-30 01:30        --------        d---a-w-        c:\windows\rundll16.exe

2010-09-30 01:30 . 2010-09-30 01:30        --------        d---a-w-        c:\windows\RUNDL132.EXE

2010-09-30 01:30 . 2010-09-30 01:30        --------        d---a-w-        c:\windows\logo1_.exe

2010-09-30 01:30 . 2010-09-30 01:30        --------        d---a-w-        c:\windows\logo_1.exe

2010-09-30 01:20 . 2010-09-30 01:20        632064        ----a-w-        c:\windows\system32\msvcr80.dll

2010-09-30 01:20 . 2010-09-30 01:20        554240        ----a-w-        c:\windows\system32\msvcp80.dll

2010-09-30 01:20 . 2010-09-30 01:20        34048        ----a-w-        c:\windows\system32\eEmpty.exe

2010-09-30 01:19 . 2008-04-14 02:23        140800        ----a-w-        c:\windows\system32\T.COM

2010-09-30 01:19 . 2008-04-14 02:22        153600        ----a-w-        c:\windows\R.COM

2010-09-30 01:19 . 2010-09-30 01:19        --------        d-----w-        c:\programme\Gemeinsame Dateien\MicroWorld

2010-09-30 01:19 . 2010-09-30 01:19        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\MicroWorld

2010-09-30 00:20 . 2010-09-30 00:21        --------        d-----w-        C:\Fix_wareout

2010-09-29 21:14 . 2010-09-29 21:14        --------        d-----w-        c:\windows\system32\wbem\Repository

2010-09-25 08:49 . 2010-09-25 09:30        --------        d-----w-        c:\dokumente und einstellungen\user\Anwendungsdaten\Uniblue

2010-09-25 08:14 . 2010-10-02 12:19        --------        d-----w-        C:\fixwareout

2010-09-24 16:57 . 2010-09-24 16:49        1129120        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\STOPzilla!\vdb\vbcorent.dll

2010-09-24 16:29 . 2010-09-24 17:20        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\STOPzilla!

2010-09-24 13:06 . 2010-09-24 13:06        --------        d-----w-        c:\programme\Safer Networking

2010-09-24 12:42 . 2010-10-01 11:35        --------        d-----w-        c:\programme\Spybot - Search & Destroy

2010-09-24 11:37 . 2010-09-24 11:46        --------        d-----w-        c:\dokumente und einstellungen\user\Anwendungsdaten\JonDo

2010-09-24 11:36 . 2010-09-24 11:36        --------        d-----w-        c:\programme\JAP

2010-09-24 05:32 . 2010-09-24 05:32        --------        d-----w-        c:\programme\Conduit

2010-09-24 04:52 . 2010-09-24 04:55        --------        d-----w-        c:\dokumente und einstellungen\user\Lokale Einstellungen\Anwendungsdaten\Conduit

2010-09-24 04:52 . 2010-06-08 09:29        52224        ----a-w-        c:\dokumente und einstellungen\user\Anwendungsdaten\Mozilla\Firefox\Profiles\c026nnbb.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\components\FFExternalAlert.dll

2010-09-24 04:52 . 2010-06-08 09:29        101376        ----a-w-        c:\dokumente und einstellungen\user\Anwendungsdaten\Mozilla\Firefox\Profiles\c026nnbb.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\components\RadioWMPCore.dll
 

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-10-02 22:25 . 2009-10-06 17:36        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Avira

2010-10-01 20:47 . 2004-08-04 12:00        120576        ----a-w-        c:\windows\system32\drivers\pcmcia.sys

2010-10-01 11:34 . 2009-10-05 21:33        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy

2010-10-01 10:06 . 2004-08-04 12:00        463886        ----a-w-        c:\windows\system32\perfh007.dat

2010-10-01 10:06 . 2004-08-04 12:00        88362        ----a-w-        c:\windows\system32\perfc007.dat

2010-09-27 22:06 . 2007-01-24 23:55        --------        d-----w-        c:\programme\PokerStars

2010-09-24 18:14 . 2006-08-29 11:32        --------        d--h--w-        c:\programme\InstallShield Installation Information

2010-09-24 17:37 . 2007-02-21 18:14        0        ----a-w-        c:\windows\system32\drivers\lvuvc.hs

2010-09-24 17:37 . 2008-12-08 12:56        0        ----a-w-        c:\windows\system32\drivers\logiflt.iad

2010-09-24 16:44 . 2010-09-24 16:43        464        ----a-w-        c:\windows\system32\drivers\kgpcpy.cfg

2010-09-24 08:49 . 2006-08-30 15:44        35424        ----a-w-        c:\dokumente und einstellungen\user\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT

2010-09-13 22:59 . 2010-08-08 16:14        456200        ----a-w-        c:\dokumente und einstellungen\user\Anwendungsdaten\Real\Update\setup3.12\setup.exe

2010-08-25 14:36 . 2010-08-25 14:36        --------        d-----w-        c:\dokumente und einstellungen\user\Anwendungsdaten\Programme

2010-08-09 10:01 . 2010-07-26 10:14        --------        d-----w-        c:\programme\MSECache

2010-08-08 18:22 . 2010-08-08 18:22        61440        ----a-w-        c:\dokumente und einstellungen\user\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-7bbe689a-n\decora-sse.dll

2010-08-08 18:22 . 2010-08-08 18:22        503808        ----a-w-        c:\dokumente und einstellungen\user\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-29798c6e-n\msvcp71.dll

2010-08-08 18:22 . 2010-08-08 18:22        499712        ----a-w-        c:\dokumente und einstellungen\user\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-29798c6e-n\jmc.dll

2010-08-08 18:22 . 2010-08-08 18:22        348160        ----a-w-        c:\dokumente und einstellungen\user\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-29798c6e-n\msvcr71.dll

2010-08-08 18:22 . 2010-08-08 18:22        12800        ----a-w-        c:\dokumente und einstellungen\user\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-7bbe689a-n\decora-d3d.dll

2010-08-08 17:37 . 2006-09-22 00:53        --------        d-----w-        c:\programme\eMule

2010-07-28 13:30 . 2010-07-28 13:30        503808        ----a-w-        c:\dokumente und einstellungen\Hoerm\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-2a4c1f5f-n\msvcp71.dll

2010-07-28 13:30 . 2010-07-28 13:30        499712        ----a-w-        c:\dokumente und einstellungen\Hoerm\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-2a4c1f5f-n\jmc.dll

2010-07-28 13:30 . 2010-07-28 13:30        348160        ----a-w-        c:\dokumente und einstellungen\Hoerm\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-2a4c1f5f-n\msvcr71.dll

2010-07-28 13:30 . 2010-07-28 13:30        12800        ----a-w-        c:\dokumente und einstellungen\Hoerm\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-27171684-n\decora-d3d.dll

2010-07-28 13:30 . 2010-07-28 13:30        61440        ----a-w-        c:\dokumente und einstellungen\Hoerm\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-27171684-n\decora-sse.dll

2010-07-17 03:00 . 2010-05-02 00:32        423656        ----a-w-        c:\windows\system32\deployJava1.dll

2009-10-06 15:05 . 2009-10-06 15:05        17        ----a-w-        c:\programme\stinger1001546.opt

2009-10-06 11:57 . 2009-10-06 12:08        3534855        ----a-w-        c:\programme\stinger1001546.exe

2009-09-28 08:33 . 2009-10-06 12:08        1981200        ----a-w-        c:\programme\TeamViewer_Setup_de.exe

.
 

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ATIModeChange"="Ati2mdxx.exe" [2001-09-04 28672]

"ATIPTA"="c:\programme\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-01-27 335872]

"SoundMan"="SOUNDMAN.EXE" [2004-01-09 65536]

"PCTVOICE"="pctspk.exe" [2003-11-07 180224]

"HP Component Manager"="c:\programme\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 241664]

"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2010-05-14 248552]

"QuickTime Task"="c:\programme\QuickTime\qttask.exe" [2007-02-16 282624]
 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]

2008-04-14 02:22        15360        ----a-w-        c:\windows\system32\ctfmon.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FreePDF Assistant]

2005-05-27 10:24        310272        ----a-w-        c:\programme\FreePDF_XP\fpassist.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechCommunicationsManager]

2008-08-14 16:11        565008        ----a-w-        c:\programme\Gemeinsame Dateien\LogiShrd\LComMgr\Communications_Helper.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]

2008-08-14 16:15        2407184        ----a-w-        c:\programme\Logitech\QuickCam\Quickcam.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2007-02-16 08:54        282624        ----a-w-        c:\programme\QuickTime\qttask.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]

2008-04-12 17:00        68856        ----a-w-        c:\programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]

2006-12-14 16:47        185896        ----a-w-        c:\programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]

2006-03-30 14:45        313472        ----a-r-        c:\programme\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"Adobe Photo Downloader"="c:\programme\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Programme\\Messenger\\msmsgs.exe"=

"c:\\WINDOWS\\system32\\dpvsetup.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Programme\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Programme\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=

"c:\\Programme\\HP\\Digital Imaging\\bin\\hposfx08.exe"=

"c:\\Programme\\HP\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Programme\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=

"c:\\Programme\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Programme\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=

"c:\\Programme\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

"c:\\Programme\\Windows Media Player\\wmplayer.exe"=

"c:\\Programme\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Programme\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Programme\\Windows Live\\Sync\\WindowsLiveSync.exe"=

"c:\\Programme\\SopCast\\adv\\SopAdver.exe"=
 

R2 ICQ Service;ICQ Service;c:\programme\ICQ6Toolbar\ICQ Service.exe [10.12.2008 23:30 222456]

R2 viewpoint manager service;Viewpoint Manager Service;c:\programme\Viewpoint\Common\ViewpointService.exe [08.09.2009 15:23 24652]

R3 EMCR;EMCR;c:\windows\system32\drivers\EMCR7SK.sys [29.08.2006 13:32 72064]

S3 G3GCUMDM;G3G C USB Modem;c:\windows\system32\drivers\g3gcumdm.sys [30.08.2006 16:40 21376]

S3 G3GCUSER;G3G C USB Serial;c:\windows\system32\drivers\g3gcuser.sys [30.08.2006 16:40 19072]

S3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys --> c:\windows\system32\drivers\massfilter.sys [?]

.

Inhalt des "geplante Tasks" Ordners
 

2010-09-30 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\programme\Apple Software Update\SoftwareUpdate.exe [2007-01-10 13:42]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.google.de/

uSearchMigratedDefaultURL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}

mStart Page = hxxp://de.yahoo.com

uInternet Settings,ProxyServer = ftp=localhost:4001;http=localhost:4001;https=localhost:4001

uSearchURL,(Default) = hxxp://de.rd.yahoo.com/customize/ie/defaults/su/msgr9/*hxxp://de.search.yahoo.com

IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

Trusted Zone: safer-networking.org\www

Handler: haufereader - {39198710-62F7-42CD-9458-069843FA5D32} - c:\programme\Haufe\HaufeReader\HRInstmon.dll

DPF: {792E349D-4844-4F53-A660-3F1E00234138} - hxxp://www.visit-x.de/downloads/applet/90/9,0,0,5/cP-Client-90.cab

DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

FF - ProfilePath - c:\dokumente und einstellungen\user\Anwendungsdaten\Mozilla\Firefox\Profiles\c026nnbb.default\

FF - prefs.js: browser.search.defaulturl - hxxp://de.search.yahoo.com/search?fr=ffsp1&p=

FF - prefs.js: browser.search.selectedEngine - ICQ Search

FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/

FF - prefs.js: keyword.URL - hxxp://de.search.yahoo.com/search?fr=ffds1&p=

FF - component: c:\dokumente und einstellungen\user\Anwendungsdaten\Mozilla\Firefox\Profiles\c026nnbb.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\components\FFExternalAlert.dll

FF - component: c:\dokumente und einstellungen\user\Anwendungsdaten\Mozilla\Firefox\Profiles\c026nnbb.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\components\RadioWMPCore.dll

FF - plugin: c:\dokumente und einstellungen\user\Anwendungsdaten\Mozilla\Firefox\Profiles\c026nnbb.default\extensions\firefox@tvunetworks.com\plugins\npTVUAx.dll

FF - plugin: c:\progra~1\Yahoo!\Common\npyaxmpb.dll

FF - plugin: c:\programme\Java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\programme\Microsoft\Office Live\npOLW.dll

FF - plugin: c:\programme\Veetle\Player\npvlc.dll

FF - plugin: c:\programme\Veetle\plugins\npVeetle.dll

FF - plugin: c:\programme\Veetle\VLCBroadcast\npvbp.dll

FF - plugin: c:\programme\Viewpoint\Viewpoint Media Player\npViewpoint.dll

FF - plugin: c:\programme\Windows Live\Photo Gallery\NPWLPG.dll

FF - plugin: c:\windows\system32\TVUAx\npTVUAx.dll
 

---- FIREFOX Richtlinien ----

FF - user.js: yahoo.homepage.dontask - truec:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true); 

c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true); 

c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -
 

HKLM-Run-NWEReboot - (no file)

SafeBoot-klmdb.sys

MSConfigStartUp-avgnt - c:\programme\Avira\AntiVir Desktop\avgnt.exe

MSConfigStartUp-UIExec - c:\programme\T-Mobile Internet Manager 03\UIExec.exe

ActiveSetup-{8flt29fn-v40h-ow4a-gow4-ajrx5cjqy6cj} - c:\windows\TEMP\2A3.tmp
 
 
 

**************************************************************************
 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2010-10-03 01:02

Windows 5.1.2600 Service Pack 3 NTFS
 

Scanne versteckte Prozesse... 
 

Scanne versteckte Autostarteinträge... 
 

Scanne versteckte Dateien... 
 

Scan erfolgreich abgeschlossen

versteckte Dateien: 0
 

**************************************************************************

.

--------------------- Gesperrte Registrierungsschluessel ---------------------
 

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•6~*]

"7040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
 

- - - - - - - > 'explorer.exe'(6652)

c:\windows\TEMP\logishrd\LVPrcInj01.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\windows\system32\Ati2evxx.exe

c:\programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe

c:\programme\Java\jre6\bin\jqs.exe

c:\programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe

c:\programme\CDBurnerXP\NMSAccessU.exe

c:\programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

c:\programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe

c:\windows\system32\wbem\wmiapsrv.exe

c:\windows\SOUNDMAN.EXE

c:\windows\system32\pctspk.exe

c:\programme\HP\hpcoretech\comp\hptskmgr.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2010-10-03  01:13:18 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2010-10-02 23:13
 

Vor Suchlauf: 16 Verzeichnis(se), 13.909.893.120 Bytes frei

Nach Suchlauf: 17 Verzeichnis(se), 13.903.208.448 Bytes frei
 

WindowsXP-KB310994-SP2-Home-BootDisk-DEU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

[spybotsd]

timeout.old=30
 

Current=4 Default=4 Failed=2 LastKnownGood=3 Sets=1,2,3,4

- - End Of File - - 27AB71E825D533B8554F6BF41861FA8A

MAM:

Code:

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org
 

Datenbank Version: 4734
 

Windows 5.1.2600 Service Pack 3

Internet Explorer 7.0.5730.13
 

03.10.2010 03:12:02

mbam-log-2010-10-03 (03-12-02).txt
 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)

Durchsuchte Objekte: 227321

Laufzeit: 1 Stunde(n), 45 Minute(n), 24 Sekunde(n)
 

Infizierte Speicherprozesse: 0

Infizierte Speichermodule: 0

Infizierte Registrierungsschlüssel: 4

Infizierte Registrierungswerte: 0

Infizierte Dateiobjekte der Registrierung: 0

Infizierte Verzeichnisse: 0

Infizierte Dateien: 1
 

Infizierte Speicherprozesse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel:

HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully.

HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.

HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully.

HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.
 

Infizierte Registrierungswerte:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung:

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien:

C:\System Volume Information\_restore{27F464A5-B031-4748-80A2-E73BDF64906F}\RP1235\A0147953.exe (Trojan.Zapchast) -> Quarantined and deleted successfully.

OTL.txt:

Code:

OTL logfile created on: 03.10.2010 04:55:54 - Run 2

OTL by OldTimer - Version 3.2.14.1     Folder = C:\Dokumente und Einstellungen\user\Desktop\MFTools

Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

511,00 Mb Total Physical Memory | 223,00 Mb Available Physical Memory | 44,00% Memory free

1,00 Gb Paging File | 1,00 Gb Available in Paging File | 80,00% Paging File free

Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme

Drive C: | 74,52 Gb Total Space | 11,19 Gb Free Space | 15,01% Space Free | Partition Type: NTFS

D: Drive not present or media not loaded

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

 

Computer Name: PRIVAT-C65EE05C

Current User Name: user

Logged in as Administrator.

 

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Minimal

 
 ========== Processes (SafeList) ==========

 

PRC - C:\Dokumente und Einstellungen\user\Desktop\MFTools\OTL.exe (OldTimer Tools)

PRC - C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)

PRC - C:\Programme\Windows Live\Toolbar\wltuser.exe (Microsoft Corporation)

PRC - C:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corp.)

PRC - C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)

PRC - C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe (Logitech Inc.)

PRC - C:\Programme\CDBurnerXP\NMSAccessU.exe ()

PRC - C:\Programme\ICQ6Toolbar\ICQ Service.exe ()

PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

PRC - C:\Programme\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)

PRC - C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)

PRC - C:\WINDOWS\system32\pctspk.exe ()

 

 
 ========== Modules (SafeList) ==========

 

MOD - C:\Dokumente und Einstellungen\user\Desktop\MFTools\OTL.exe (OldTimer Tools)

MOD - C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Logitech Inc.)

MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - (AppMgmt) -- C:\WINDOWS\System32\appmgmts.dll File not found

SRV - (fsssvc) -- C:\Programme\Windows Live\Family Safety\fsssvc.exe (Microsoft Corporation)

SRV - (seaport) -- C:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corp.)

SRV - (LVPrcSrv) -- C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)

SRV - (LVCOMSer) -- C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe (Logitech Inc.)

SRV - (NMSAccessU) -- C:\Programme\CDBurnerXP\NMSAccessU.exe ()

SRV - (ICQ Service) -- C:\Programme\ICQ6Toolbar\ICQ Service.exe ()

SRV - (viewpoint manager service) -- C:\Programme\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)

SRV - (Pml Driver HPZ12) -- C:\WINDOWS\system32\HPZipm12.exe (HP)

SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - (ZTEusbser6k) -- C:\WINDOWS\System32\DRIVERS\ZTEusbser6k.sys File not found

DRV - (ZTEusbnmea) -- C:\WINDOWS\System32\DRIVERS\ZTEusbnmea.sys File not found

DRV - (ZTEusbmdm6k) -- C:\WINDOWS\System32\DRIVERS\ZTEusbmdm6k.sys File not found

DRV - (massfilter) -- C:\WINDOWS\System32\drivers\massfilter.sys File not found

DRV - (LVMVDrv) -- C:\WINDOWS\System32\DRIVERS\LVMVDrv.sys File not found

DRV - (LVcKap) -- C:\WINDOWS\System32\DRIVERS\LVcKap.sys File not found

DRV - (catchme) -- C:\DOKUME~1\user\LOKALE~1\Temp\catchme.sys File not found

DRV - (Tcpip6) -- C:\WINDOWS\system32\drivers\tcpip6.sys (Microsoft Corporation)

DRV - (fssfltr) -- C:\WINDOWS\system32\drivers\fssfltr_tdi.sys (Microsoft Corporation)

DRV - (FilterService) -- C:\WINDOWS\system32\drivers\lvuvcflt.sys (Logitech Inc.)

DRV - (LVUVC) Logitech QuickCam Pro 5000(UVC) -- C:\WINDOWS\system32\drivers\lvuvc.sys (Logitech Inc.)

DRV - (LVUSBSta) -- C:\WINDOWS\system32\drivers\LVUSBSta.sys (Logitech Inc.)

DRV - (LVRS) -- C:\WINDOWS\system32\drivers\lvrs.sys (Logitech Inc.)

DRV - (lvpopflt) -- C:\WINDOWS\system32\drivers\lvpopflt.sys (Logitech Inc.)

DRV - (LVPr2Mon) -- C:\WINDOWS\system32\drivers\LVPr2Mon.sys ()

DRV - (usbaudio) USB-Audiotreiber (WDM) -- C:\WINDOWS\system32\drivers\usbaudio.sys (Microsoft Corporation)

DRV - (w29n51) Intel(R) -- C:\WINDOWS\system32\drivers\w29n51.sys (Intel® Corporation)

DRV - (k750mdm) -- C:\WINDOWS\system32\drivers\k750mdm.sys (MCCI)

DRV - (k750mgmt) -- C:\WINDOWS\system32\drivers\k750mgmt.sys (MCCI)

DRV - (k750mdfl) -- C:\WINDOWS\system32\drivers\k750mdfl.sys (MCCI)

DRV - (AFS2K) -- C:\WINDOWS\System32\drivers\AFS2K.SYS (Oak Technology Inc.)

DRV - (k750bus) Sony Ericsson 750 driver (WDM) -- C:\WINDOWS\system32\drivers\k750bus.sys (MCCI)

DRV - (k750obex) -- C:\WINDOWS\system32\drivers\k750obex.sys (MCCI)

DRV - (rtl8139) NT-Treiber für Realtek RTL8139(A/B/C) -- C:\WINDOWS\system32\drivers\RTL8139.sys (Realtek Semiconductor Corporation)

DRV - (G3GCUMDM) -- C:\WINDOWS\system32\drivers\g3gcumdm.sys (Vodafone)

DRV - (G3GCUSER) -- C:\WINDOWS\system32\drivers\g3gcuser.sys (Vodafone)

DRV - (w22n51) Intel(R) -- C:\WINDOWS\system32\drivers\w22n51.sys (Intel® Corporation)

DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)

DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)

DRV - (EMCR) -- C:\WINDOWS\system32\drivers\EMCR7SK.sys (ENE Technology Inc.)

DRV - (RTL8023) -- C:\WINDOWS\system32\drivers\Rtlnic51.sys (Realtek Semiconductor Corporation                           )

DRV - (ALCXSENS) -- C:\WINDOWS\system32\drivers\ALCXSENS.SYS (Sensaura Ltd)

DRV - (Vpctcom) -- C:\WINDOWS\system32\drivers\vpctcom.sys (PCtel, Inc.)

DRV - (Vvoice) -- C:\WINDOWS\system32\drivers\vvoice.sys (PCtel, Inc.)

DRV - (Vmodem) -- C:\WINDOWS\system32\drivers\vmodem.sys (PCTEL, INC.)

DRV - (Ptserial) -- C:\WINDOWS\system32\drivers\ptserial.sys (PCTEL, INC.)

DRV - (MODEMCSA) -- C:\WINDOWS\system32\drivers\MODEMCSA.sys (Microsoft Corporation)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Live Search

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

IE - HKCU\..\URLSearchHook:  - Reg Error: Key error. File not found

IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = ftp=localhost:4001;http=localhost:4001;https=localhost:4001

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultenginename: "ICQ Search"

FF - prefs.js..browser.search.defaulturl: "hxxp://de.search.yahoo.com/search?fr=ffsp1&p="

FF - prefs.js..browser.search.selectedEngine: "ICQ Search"

FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"

FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0

FF - prefs.js..extensions.enabledItems: firefox@tvunetworks.com:2

FF - prefs.js..extensions.enabledItems: 5

FF - prefs.js..extensions.enabledItems: 2

FF - prefs.js..extensions.enabledItems: 2

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21

FF - prefs.js..extensions.enabledItems: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065}:2.7.1.3

FF - prefs.js..keyword.URL: "hxxp://de.search.yahoo.com/search?fr=ffds1&p="

FF - prefs.js..network.proxy.http: "localhost"

FF - prefs.js..network.proxy.http_port: 4001

 

 

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.10.02 11:28:46 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.09.29 23:59:48 | 000,000,000 | ---D | M]

 

[2009.08.25 02:33:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Mozilla\Extensions

[2010.10.02 23:03:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Mozilla\Firefox\Profiles\c026nnbb.default\extensions

[2009.12.20 18:36:43 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Mozilla\Firefox\Profiles\c026nnbb.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}

[2008.03.05 18:39:28 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Mozilla\Firefox\Profiles\c026nnbb.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}(2)

[2010.09.24 07:32:53 | 000,000,000 | ---D | M] (softonic-de3 Toolbar) -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Mozilla\Firefox\Profiles\c026nnbb.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}

[2010.04.20 20:54:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Mozilla\Firefox\Profiles\c026nnbb.default\extensions\firefox@tvunetworks.com

[2010.09.29 14:07:20 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Mozilla\Firefox\Profiles\c026nnbb.default\searchplugins\icqplugin-1.xml

[2009.08.25 02:57:15 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Mozilla\Firefox\Profiles\c026nnbb.default\searchplugins\icqplugin-2.xml

[2009.09.04 14:13:39 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Mozilla\Firefox\Profiles\c026nnbb.default\searchplugins\icqplugin-3.xml

[2009.09.19 16:49:38 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Mozilla\Firefox\Profiles\c026nnbb.default\searchplugins\icqplugin-4.xml

[2008.11.18 14:56:02 | 000,000,944 | ---- | M] () -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Mozilla\Firefox\Profiles\c026nnbb.default\searchplugins\icqplugin.xml

[2010.10.02 23:03:35 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions

[2006.09.22 16:41:42 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Programme\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}

[2010.05.02 02:32:45 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

[2010.08.02 00:31:32 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

[2010.07.17 05:00:04 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll

[2007.04.16 19:07:12 | 000,180,293 | ---- | M] () -- C:\Programme\Mozilla Firefox\plugins\npViewpoint.dll

[2010.08.22 15:26:27 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml

[2010.08.22 15:26:27 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml

[2010.08.22 15:26:28 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml

[2010.08.22 15:26:28 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml

[2010.08.22 15:26:28 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2010.10.03 01:01:43 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)

O2 - BHO: (Burn4Free Toolbar Helper) - {60BF5EE3-0105-4858-AD98-17C19F86B042} - C:\Programme\Burn4Free Toolbar\v3.2.0.0\Burn4Free_Toolbar.dll ()

O2 - BHO: (Search Helper) - {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - C:\Programme\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll (Microsoft Corp.)

O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

O2 - BHO: (Windows Live Toolbar Helper) - {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)

O3 - HKLM\..\Toolbar: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)

O3 - HKLM\..\Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - No CLSID value found.

O3 - HKLM\..\Toolbar: (Burn4Free Toolbar) - {55FAF0F2-44D4-425F-B5F5-6B275B621EAB} - C:\Programme\Burn4Free Toolbar\v3.2.0.0\Burn4Free_Toolbar.dll ()

O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)

O3 - HKCU\..\Toolbar\ShellBrowser: (Burn4Free Toolbar) - {55FAF0F2-44D4-425F-B5F5-6B275B621EAB} - C:\Programme\Burn4Free Toolbar\v3.2.0.0\Burn4Free_Toolbar.dll ()

O3 - HKCU\..\Toolbar\WebBrowser: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)

O3 - HKCU\..\Toolbar\WebBrowser: (Burn4Free Toolbar) - {55FAF0F2-44D4-425F-B5F5-6B275B621EAB} - C:\Programme\Burn4Free Toolbar\v3.2.0.0\Burn4Free_Toolbar.dll ()

O4 - HKLM..\Run: [ATIModeChange] C:\WINDOWS\System32\Ati2mdxx.exe (ATI Technologies, Inc.)

O4 - HKLM..\Run: [PCTVOICE] C:\WINDOWS\System32\pctspk.exe ()

O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)

O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)

O4 - HKCU..\Run: [BrowserChoice] C:\WINDOWS\System32\browserchoice.exe (Microsoft Corporation)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\control panel present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O9 - Extra Button: In Blog veröffentlichen - {219c3416-8cb2-491a-a3c7-d9fcddc9d600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219c3416-8cb2-491a-a3c7-d9fcddc9d600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)

O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Programme\PokerStars\PokerStarsUpdate.exe (PokerStars)

O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)

O15 - HKCU\..Trusted Domains: safer-networking.org ([www] * in Trusted sites)

O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} hxxp://www.apple.com/qtactivex/qtplugin.cab (QuickTime Object)

O16 - DPF: {792E349D-4844-4F53-A660-3F1E00234138} hxxp://www.visit-x.de/downloads/applet/90/9,0,0,5/cP-Client-90.cab (CVXChatControl Object)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)

O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)

O16 - DPF: {A9F8D9EC-3D0A-4A60-BD82-FBD64BAD370D} hxxp://h20264.www2.hp.com/ediags/dd/install/HPDriverDiagnosticsxp2k.cab (DDRevision Class)

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)

O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Reg Error: Key error.)

O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Reg Error: Key error.)

O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Reg Error: Key error.)

O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)

O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} hxxp://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab (Minesweeper Flags Class)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1

O18 - Protocol\Handler\cetihpz {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Programme\HP\hpcoretech\comp\hpuiprot.dll (Hewlett-Packard Company)

O18 - Protocol\Handler\haufereader {39198710-62F7-42CD-9458-069843FA5D32} - C:\Programme\Haufe\HaufeReader\HRInstmon.dll (Haufe Mediengruppe)

O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)

O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home

O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp

O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.08.29 13:20:59 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *) -  File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKCU\...exe [@ = exefile] -- Reg Error: Key error. File not found

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2010.10.03 04:30:54 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\user\IECompatCache

[2010.10.03 04:27:11 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\user\PrivacIE

[2010.10.03 04:25:11 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\user\IETldCache

[2010.10.03 04:19:31 | 000,000,000 | ---D | C] -- C:\WINDOWS\ie8updates

[2010.10.03 04:16:50 | 000,743,424 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iedvtool.dll

[2010.10.03 04:12:52 | 000,000,000 | -H-D | C] -- C:\WINDOWS\ie8

[2010.10.03 01:56:53 | 000,471,552 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\aclayers.dll

[2010.10.03 01:55:22 | 000,744,448 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\helpsvc.exe

[2010.10.03 01:54:01 | 000,119,808 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\t2embed.dll

[2010.10.03 01:54:01 | 000,081,920 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fontsub.dll

[2010.10.03 01:45:45 | 000,293,376 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\browserchoice.exe

[2010.10.03 01:42:02 | 003,558,912 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\moviemk.exe

[2010.10.03 01:16:41 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Malwarebytes

[2010.10.03 00:46:38 | 000,000,000 | RHSD | C] -- C:\cmdcons

[2010.10.03 00:42:27 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe

[2010.10.03 00:42:27 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe

[2010.10.03 00:42:27 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe

[2010.10.03 00:42:27 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe

[2010.10.03 00:08:27 | 000,000,000 | ---D | C] -- C:\Qoobox

[2010.10.01 14:37:45 | 000,000,000 | ---D | C] -- C:\TDDS

[2010.10.01 12:33:44 | 000,000,000 | ---D | C] -- C:\WINDOWS\TEMP

[2010.10.01 06:12:29 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT

[2010.10.01 06:08:39 | 000,000,000 | ---D | C] -- C:\Programme\ERUNT

[2010.10.01 05:55:07 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys

[2010.10.01 05:55:02 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes

[2010.10.01 05:55:00 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys

[2010.10.01 05:55:00 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware

[2010.10.01 05:54:08 | 000,000,000 | ---D | C] -- C:\Programme\7-Zip

[2010.10.01 05:53:01 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\user\Desktop\MFTools

[2010.09.30 03:30:38 | 000,000,000 | ---D | C] -- C:\WINDOWS\VDLL.DLL

[2010.09.30 03:30:37 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\runouce.exe

[2010.09.30 03:30:37 | 000,000,000 | ---D | C] -- C:\WINDOWS\rundll16.exe

[2010.09.30 03:30:37 | 000,000,000 | ---D | C] -- C:\WINDOWS\RUNDL132.EXE

[2010.09.30 03:30:37 | 000,000,000 | ---D | C] -- C:\WINDOWS\logo1_.exe

[2010.09.30 03:30:37 | 000,000,000 | ---D | C] -- C:\WINDOWS\logo_1.exe

[2010.09.30 03:20:22 | 000,632,064 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msvcr80.dll

[2010.09.30 03:20:21 | 000,554,240 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msvcp80.dll

[2010.09.30 03:20:20 | 000,034,048 | ---- | C] (MicroWorld Technologies Inc.) -- C:\WINDOWS\System32\eEmpty.exe

[2010.09.30 03:19:57 | 000,140,800 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\T.COM

[2010.09.30 03:19:56 | 000,153,600 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\R.COM

[2010.09.30 03:19:53 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\MicroWorld

[2010.09.30 03:19:40 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MicroWorld

[2010.09.30 02:20:25 | 000,000,000 | ---D | C] -- C:\Fix_wareout

[2010.09.26 15:54:09 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\user\Desktop\Nicht verwendete Desktopverknüpfungen

[2010.09.25 10:49:58 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Uniblue

[2010.09.25 10:14:54 | 000,000,000 | ---D | C] -- C:\fixwareout

[2010.09.24 18:29:53 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\STOPzilla!

[2010.09.24 15:06:43 | 000,000,000 | ---D | C] -- C:\Programme\Safer Networking

[2010.09.24 14:42:08 | 000,000,000 | ---D | C] -- C:\Programme\Spybot - Search & Destroy

[2010.09.24 13:37:22 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\JonDo

[2010.09.24 13:36:19 | 000,000,000 | ---D | C] -- C:\Programme\JAP

[2010.09.24 10:45:56 | 016,409,960 | ---- | C] (Safer Networking Limited                                    ) -- C:\Dokumente und Einstellungen\user\Desktop\spybotsd162.exe

[2010.09.24 10:27:29 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\user\Recent

[2010.09.24 07:32:54 | 000,000,000 | ---D | C] -- C:\Programme\Conduit

[2010.09.24 06:52:50 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\user\Lokale Einstellungen\Anwendungsdaten\Conduit

[2009.10.06 14:08:41 | 003,534,855 | ---- | C] (McAfee Inc.) -- C:\Programme\stinger1001546.exe

 
 ========== Files - Modified Within 30 Days ==========

 

[2010.10.03 04:25:22 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2010.10.03 04:25:00 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT

[2010.10.03 04:24:51 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2010.10.03 04:23:02 | 011,272,192 | ---- | M] () -- C:\Dokumente und Einstellungen\user\ntuser.dat

[2010.10.03 04:23:02 | 000,000,300 | -HS- | M] () -- C:\Dokumente und Einstellungen\user\ntuser.ini

[2010.10.03 04:21:18 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK

[2010.10.03 03:56:15 | 000,001,503 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Browserwahl.lnk

[2010.10.03 03:55:24 | 000,172,280 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2010.10.03 03:52:46 | 000,000,716 | ---- | M] () -- C:\WINDOWS\win.ini

[2010.10.03 01:02:26 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini

[2010.10.03 01:01:43 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts

[2010.10.03 00:46:46 | 000,000,355 | RHS- | M] () -- C:\boot.ini

[2010.10.03 00:34:50 | 000,006,958 | ---- | M] () -- C:\Dokumente und Einstellungen\user\Desktop\cc_20101003_003436.reg

[2010.10.02 23:49:56 | 003,859,570 | R--- | M] () -- C:\Dokumente und Einstellungen\user\Desktop\ComboFix.exe

[2010.10.02 10:17:18 | 000,174,172 | ---- | M] () -- C:\Dokumente und Einstellungen\user\Desktop\Ordneroptionen.JPG

[2010.10.01 13:33:18 | 000,000,905 | ---- | M] () -- C:\Dokumente und Einstellungen\user\Desktop\Spybot - Search & Destroy.lnk

[2010.10.01 13:31:33 | 016,409,960 | ---- | M] (Safer Networking Limited                                    ) -- C:\Dokumente und Einstellungen\user\Desktop\spybotsd162.exe

[2010.10.01 12:27:14 | 000,731,136 | ---- | M] () -- C:\Dokumente und Einstellungen\user\Desktop\avenger.exe

[2010.10.01 12:06:09 | 000,463,886 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat

[2010.10.01 12:06:09 | 000,443,378 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat

[2010.10.01 12:06:09 | 000,073,650 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat

[2010.10.01 12:06:08 | 000,088,362 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat

[2010.10.01 12:06:03 | 001,081,894 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI

[2010.10.01 06:20:21 | 000,000,676 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk

[2010.10.01 06:08:41 | 000,000,591 | ---- | M] () -- C:\Dokumente und Einstellungen\user\Desktop\NTREGOPT.lnk

[2010.10.01 06:08:41 | 000,000,572 | ---- | M] () -- C:\Dokumente und Einstellungen\user\Desktop\ERUNT.lnk

[2010.10.01 05:53:59 | 000,284,915 | ---- | M] () -- C:\Dokumente und Einstellungen\user\Desktop\Gmer.zip

[2010.09.30 08:18:02 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job

[2010.09.30 03:30:37 | 000,000,054 | ---- | M] () -- C:\WINDOWS\Lic.xxx

[2010.09.30 03:20:21 | 000,632,064 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\msvcr80.dll

[2010.09.30 03:20:20 | 000,554,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\msvcp80.dll

[2010.09.30 03:20:19 | 000,034,048 | ---- | M] (MicroWorld Technologies Inc.) -- C:\WINDOWS\System32\eEmpty.exe

[2010.09.30 01:04:05 | 000,000,245 | ---- | M] () -- C:\Boot.bak

[2010.09.30 00:57:35 | 000,010,284 | ---- | M] () -- C:\Dokumente und Einstellungen\user\Desktop\cc_20100930_005613.reg

[2010.09.28 11:58:44 | 002,557,964 | -H-- | M] () -- C:\Dokumente und Einstellungen\user\Lokale Einstellungen\Anwendungsdaten\IconCache.db

[2010.09.27 16:17:51 | 000,031,889 | ---- | M] () -- C:\Dokumente und Einstellungen\user\Desktop\AKD-7367861301[1].pdf

[2010.09.27 16:16:39 | 000,031,889 | ---- | M] () -- C:\Dokumente und Einstellungen\user\Eigene Dateien\AKD-7367861301[1].pdf

[2010.09.25 14:17:09 | 000,000,704 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\PowerSuite.lnk

[2010.09.25 12:01:01 | 000,141,016 | ---- | M] () -- C:\WINDOWS\System32\ALSNDMGR.WAV

[2010.09.24 19:37:39 | 000,000,000 | ---- | M] () -- C:\WINDOWS\System32\drivers\lvuvc.hs

[2010.09.24 19:37:35 | 000,000,000 | ---- | M] () -- C:\WINDOWS\System32\drivers\logiflt.iad

[2010.09.24 19:30:45 | 000,083,966 | ---- | M] () -- C:\Dokumente und Einstellungen\user\Desktop\cc_20100924_192830.reg

[2010.09.24 18:44:06 | 000,000,464 | ---- | M] () -- C:\WINDOWS\System32\drivers\kgpcpy.cfg

[2010.09.24 10:49:06 | 000,035,424 | ---- | M] () -- C:\Dokumente und Einstellungen\user\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT

[2010.09.24 08:18:01 | 000,163,174 | ---- | M] () -- C:\Dokumente und Einstellungen\user\Eigene Dateien\cc_20100924_081444.reg

[2010.09.23 15:10:41 | 000,018,432 | ---- | M] () -- C:\Dokumente und Einstellungen\user\Desktop\Fahrtstrecken Frau Herrmann.xls

 
 ========== Files Created - No Company Name ==========

 

[2010.10.03 03:56:15 | 000,001,503 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Browserwahl.lnk

[2010.10.03 00:46:46 | 000,000,245 | ---- | C] () -- C:\Boot.bak

[2010.10.03 00:46:41 | 000,262,448 | RHS- | C] () -- C:\cmldr

[2010.10.03 00:42:27 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe

[2010.10.03 00:42:27 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe

[2010.10.03 00:42:27 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe

[2010.10.03 00:42:27 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe

[2010.10.03 00:42:27 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe

[2010.10.03 00:34:42 | 000,006,958 | ---- | C] () -- C:\Dokumente und Einstellungen\user\Desktop\cc_20101003_003436.reg

[2010.10.02 23:49:30 | 003,859,570 | R--- | C] () -- C:\Dokumente und Einstellungen\user\Desktop\ComboFix.exe

[2010.10.02 10:17:17 | 000,174,172 | ---- | C] () -- C:\Dokumente und Einstellungen\user\Desktop\Ordneroptionen.JPG

[2010.10.01 13:33:18 | 000,000,905 | ---- | C] () -- C:\Dokumente und Einstellungen\user\Desktop\Spybot - Search & Destroy.lnk

[2010.10.01 12:27:12 | 000,731,136 | ---- | C] () -- C:\Dokumente und Einstellungen\user\Desktop\avenger.exe

[2010.10.01 06:08:41 | 000,000,591 | ---- | C] () -- C:\Dokumente und Einstellungen\user\Desktop\NTREGOPT.lnk

[2010.10.01 06:08:41 | 000,000,572 | ---- | C] () -- C:\Dokumente und Einstellungen\user\Desktop\ERUNT.lnk

[2010.10.01 05:55:13 | 000,000,676 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk

[2010.10.01 05:53:22 | 000,284,915 | ---- | C] () -- C:\Dokumente und Einstellungen\user\Desktop\Gmer.zip

[2010.09.30 03:21:10 | 000,000,054 | ---- | C] () -- C:\WINDOWS\Lic.xxx

[2010.09.30 03:20:20 | 000,000,522 | ---- | C] () -- C:\WINDOWS\System32\Microsoft.VC80.CRT.manifest

[2010.09.30 00:56:23 | 000,010,284 | ---- | C] () -- C:\Dokumente und Einstellungen\user\Desktop\cc_20100930_005613.reg

[2010.09.29 22:42:25 | 000,001,374 | ---- | C] () -- C:\WINDOWS\imsins.BAK

[2010.09.29 17:38:08 | 011,272,192 | ---- | C] () -- C:\Dokumente und Einstellungen\user\ntuser.dat

[2010.09.27 16:17:51 | 000,031,889 | ---- | C] () -- C:\Dokumente und Einstellungen\user\Desktop\AKD-7367861301[1].pdf

[2010.09.27 16:16:39 | 000,031,889 | ---- | C] () -- C:\Dokumente und Einstellungen\user\Eigene Dateien\AKD-7367861301[1].pdf

[2010.09.25 14:17:09 | 000,000,704 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\PowerSuite.lnk

[2010.09.24 19:28:50 | 000,083,966 | ---- | C] () -- C:\Dokumente und Einstellungen\user\Desktop\cc_20100924_192830.reg

[2010.09.24 18:43:19 | 000,000,464 | ---- | C] () -- C:\WINDOWS\System32\drivers\kgpcpy.cfg

[2010.09.24 08:15:11 | 000,163,174 | ---- | C] () -- C:\Dokumente und Einstellungen\user\Eigene Dateien\cc_20100924_081444.reg

[2010.09.23 15:10:41 | 000,018,432 | ---- | C] () -- C:\Dokumente und Einstellungen\user\Desktop\Fahrtstrecken Frau Herrmann.xls

[2010.08.24 17:06:38 | 000,299,008 | ---- | C] () -- C:\WINDOWS\System32\midas.dll

[2009.10.06 17:05:09 | 000,000,017 | ---- | C] () -- C:\Programme\stinger1001546.opt

[2009.10.06 14:08:41 | 001,981,200 | ---- | C] () -- C:\Programme\TeamViewer_Setup_de.exe

[2008.10.24 14:55:34 | 000,002,828 | -HS- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\KGyGaAvL.sys

[2008.10.24 14:55:34 | 000,000,008 | RHS- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\5FED2826CD.sys

[2008.08.04 12:50:23 | 000,000,441 | ---- | C] () -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Hewlett-Packardhp officejet 5500 series1215435203_PROTOCOL.log

[2008.08.04 12:50:23 | 000,000,366 | ---- | C] () -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Hewlett-Packardhp officejet 5500 series1215435203_UI.log

[2008.08.04 12:50:23 | 000,000,221 | ---- | C] () -- C:\WINDOWS\NCLogConfig.ini

[2008.08.04 12:50:23 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Hewlett-Packardhp officejet 5500 series1215435203_API.log

[2008.07.26 09:25:02 | 000,025,624 | ---- | C] () -- C:\WINDOWS\System32\drivers\LVPr2Mon.sys

[2008.07.05 18:56:36 | 000,002,272 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat

[2008.06.10 02:59:11 | 000,000,082 | ---- | C] () -- C:\WINDOWS\asciiart.ini

[2008.02.22 20:54:56 | 000,001,755 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\QTSBandwidthCache

[2007.02.21 20:11:23 | 000,066,482 | ---- | C] () -- C:\WINDOWS\System32\lvcoinst.ini

[2006.11.13 23:44:02 | 000,000,081 | ---- | C] () -- C:\WINDOWS\ktel.ini

[2006.11.07 21:43:02 | 000,000,137 | ---- | C] () -- C:\Dokumente und Einstellungen\user\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat

[2006.11.07 21:12:24 | 000,041,064 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\hpzinstall.log

[2006.10.30 16:18:44 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\redmonnt.dll

[2006.10.22 21:10:35 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI

[2006.10.06 21:54:41 | 000,000,990 | ---- | C] () -- C:\WINDOWS\wincmd.ini

[2006.09.22 16:31:11 | 000,082,432 | ---- | C] () -- C:\Dokumente und Einstellungen\user\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2006.09.20 18:12:54 | 000,000,305 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\addr_file.html

[2006.08.29 13:32:25 | 000,155,648 | ---- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll

[2006.08.29 13:32:19 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\ati2evxx.dll

[2006.08.29 13:24:13 | 000,001,082 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI

[2006.08.11 19:35:34 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll

[2006.08.11 19:31:28 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\DivXWMPExtType.dll

[2005.04.08 09:51:08 | 000,565,248 | R--- | C] () -- C:\WINDOWS\System32\hpotscl.dll

[2003.02.20 17:53:42 | 000,005,702 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI

[2001.07.06 16:30:00 | 000,003,254 | ---- | C] () -- C:\WINDOWS\System32\HPTCPMON.INI

< End of report >

Extra.txt:

Code:

OTL Extras logfile created on: 03.10.2010 04:55:54 - Run 2

OTL by OldTimer - Version 3.2.14.1     Folder = C:\Dokumente und Einstellungen\user\Desktop\MFTools

Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

511,00 Mb Total Physical Memory | 223,00 Mb Available Physical Memory | 44,00% Memory free

1,00 Gb Paging File | 1,00 Gb Available in Paging File | 80,00% Paging File free

Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme

Drive C: | 74,52 Gb Total Space | 11,19 Gb Free Space | 15,01% Space Free | Partition Type: NTFS

D: Drive not present or media not loaded

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

 

Computer Name: PRIVAT-C65EE05C

Current User Name: user

Logged in as Administrator.

 

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Minimal

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.exe [@ = exefile] -- Reg Error: Key error. File not found

 
 ========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

htmlfile [edit] -- "C:\Programme\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"FirstRunDisabled" = 1

"AntiVirusDisableNotify" = 0

"FirewallDisableNotify" = 0

"UpdatesDisableNotify" = 0

"AntiVirusOverride" = 0

"FirewallOverride" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

 
 ========== System Restore Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]

"DisableSR" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]

"Start" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]

"Start" = 2

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

"DoNotAllowExceptions" = 0

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007

"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

 
 ========== Authorized Applications List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

"C:\Programme\MSN Messenger\msncall.exe" = C:\Programme\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone) -- File not found

"C:\Programme\MSN Messenger\livecall.exe" = C:\Programme\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone) -- File not found

"C:\Programme\Windows Live\Messenger\wlcsdk.exe" = C:\Programme\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation)

"C:\Programme\Windows Live\Sync\WindowsLiveSync.exe" = C:\Programme\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync -- (Microsoft Corporation)

"E:\SpybotSDPortable\App\SpybotSD\SpybotSD.exe" = E:\SpybotSDPortable\App\SpybotSD\SpybotSD.exe:*:Enabled:SpybotSD -- File not found

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"C:\WINDOWS\system32\dpvsetup.exe" = C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test -- (Microsoft Corporation)

"C:\Programme\HP\Digital Imaging\bin\hpofxm08.exe" = C:\Programme\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe -- (Hewlett-Packard Co.)

"C:\Programme\HP\Digital Imaging\bin\hposfx08.exe" = C:\Programme\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe -- (Hewlett-Packard Co.)

"C:\Programme\HP\Digital Imaging\bin\hposid01.exe" = C:\Programme\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe -- (Hewlett-Packard Co.)

"C:\Programme\HP\Digital Imaging\bin\hpfccopy.exe" = C:\Programme\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe -- (Hewlett-Packard)

"C:\Programme\HP\Digital Imaging\Unload\HpqPhUnl.exe" = C:\Programme\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe -- ()

"C:\Programme\Windows Media Player\wmplayer.exe" = C:\Programme\Windows Media Player\wmplayer.exe:*:Disabled:Windows Media Player -- (Microsoft Corporation)

"C:\Programme\Windows Live\Messenger\wlcsdk.exe" = C:\Programme\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation)

"C:\Programme\Windows Live\Sync\WindowsLiveSync.exe" = C:\Programme\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync -- (Microsoft Corporation)

"C:\Programme\SopCast\adv\SopAdver.exe" = C:\Programme\SopCast\adv\SopAdver.exe:*:Enabled:SopCast Adver -- (www.sopcast.com)

 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148

"{0611BD4E-4FE4-4a62-B0C0-18A4CC463428}" = CP_Package_Variety1

"{09984AEC-6B9F-4ca7-B78D-CB44D4771DA3}" = Destinations

"{0BEDBD4E-2D34-47B5-9973-57E62B29307C}" = ATI Control Panel

"{0FABD3D7-3036-4e78-B29D-58957ADB0A12}" = HP PSC & OfficeJet 3.5

"{15EE79F4-4ED1-4267-9B0F-351009325D7D}" = HP Software Update

"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer

"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate

"{1C139D7D-9FEA-468d-A9C8-2A6E3BDE564A}" = CP_Package_Variety3

"{205c6bdd-7b73-42de-8505-9a093f35a238}" = Windows Live-Uploadtool

"{218761F6-CBF6-4973-B910-A33E6563A1EA}" = Windows Live Toolbar-Erweiterung (Windows Live Toolbar)

"{22b775e7-6c42-4fc5-8e10-9a5e3257bd94}" = MSVCRT

"{24C8FBF7-26C6-48ca-834B-A4E5C09E362F}" = AiO_Scan

"{257EC58E-03FD-472B-A9B6-93F23A3C4CB0}" = Scan

"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 21

"{29B50D30-EAFC-4cea-9F76-3A0E3729E9B0}" = SkinsHP1

"{2ba722d1-48d1-406e-9123-8ae5431d63ef}" = Windows Live Fotogalerie

"{2CADCEAB-D5DA-44D6-B5FC-7DEE87AB3C0C}" = Unload

"{2CCBABCB-6427-4A55-B091-49864623C43F}" = Google Toolbar for Firefox

"{2DD6C198-FA9A-40B4-8DE5-CE5206E3EB34}" = Smart Menus (Windows Live Toolbar)

"{2E132061-C78A-48D4-A899-1D13B9D189FA}" = Memories Disc Creator 2.0

"{300D9EF4-2721-4cb4-A6C3-FB2337CFEA2D}" = AIOMinimal

"{30C19FF2-7FBA-4d09-B9DE-1659977F64F6}" = TrayApp

"{3248F0A8-6813-11D6-A77B-00B0D0150000}" = J2SE Runtime Environment 5.0

"{3248F0A8-6813-11D6-A77B-00B0D0150050}" = J2SE Runtime Environment 5.0 Update 5

"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java(TM) 6 Update 3

"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java(TM) 6 Update 5

"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7

"{3353CA25-78CC-4321-B67C-16F2933DC94B}" = Browsen mit Registerkarten (Windows Live Toolbar)

"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP

"{3AF8FCCD-F51A-4014-9002-F195E1CBC876}" = Logitech QuickCam

"{3b4e636e-9d65-4d67-ba61-189800823f52}" = Windows Live Communications Platform

"{3CF78481-FB7B-4B51-99A2-D5E0CD0B3AAF}" = HPSystemDiagnostics

"{41e654a9-26d0-4eac-854b-0fa824fffabb}" = Windows Live Messenger

"{48242276-DB89-42e8-9678-BD4280D7B99A}" = Copy

"{48380D07-AFB8-42F6-8BD1-C68BC61D1117}" = klickTel Frühjahr 2006

"{491DD792-AD81-429C-9EB4-86DD3D22E333}" = Windows Communication Foundation

"{498A4E3D-562E-4129-8722-6DCAB12384AE}" = Windows Communication Foundation Language Pack - DEU

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{4BDFD2CE-6329-42E4-9801-9B3D1F10D79B}" = Adobe® Photoshop® Album Starter Edition 3.0

"{4CCC7F68-A437-4559-A840-F5E010934951}" = HP Driver Diagnostics

"{52b97218-98cb-4b8b-9283-d213c85e1aa4}" = Windows Live Anmelde-Assistent

"{53735ECE-E461-4FD0-B742-23A352436D3A}" = Logitech Updater

"{56F8AFC3-FA98-4ff1-9673-8A026CBF85BE}" = WebReg

"{57C7C46A-D35D-492d-A328-4F8C9B5B4B52}" = PrintScreen

"{57f0ed40-8f11-41aa-b926-4a66d0d1a9cc}" = Microsoft Office Live Add-in 1.3

"{5E863175-E85D-44A6-8968-82507D34AE7F}" = QuickTime

"{5fc68772-6d56-41c6-9df1-24e868198ae6}" = Windows Live Call

"{62F79C52-E264-44ab-ABC2-7BEA2962C70D}" = 5500Trb

"{63F2408D-A675-4d97-A256-70EACB6B9B4A}" = AiOSoftware

"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder

"{6BB6627C-694F-4FDC-A3E5-C7F4BED4C724}" = DocProc

"{6D4E56A1-22EE-44d8-BD14-7B9FB7F80D1B}" = 5500_Help

"{70b7a167-0b88-445d-a3ea-97c73aa88cac}" = Windows Live Toolbar

"{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}" = Microsoft .NET Framework 2.0

"{7228FD8C-3B9E-4204-AE36-8A466107685B}" = Windows Workflow Foundation DE Language Pack

"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable

"{73C23496-A105-4b6f-B8F0-22523DFE4E4E}" = 5500

"{745A92AF-53B4-41A7-91C3-9B026B1D5897}" = InstantShare

"{76618402-179d-4699-a66b-d351c59436bc}" = Windows Live Sync

"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec

"{7D1B85BD-AA07-48B8-808D-67A4067FC6BD}" = Windows Workflow Foundation

"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP

"{8777AC6D-89F9-4793-8266-DE406F343E89}" = QFolder

"{8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38}" = Microsoft .NET Framework 2.0 Language Pack - DEU

"{89f4137d-6c26-4a84-bdb8-2e5a4bb71e00}" = Microsoft Silverlight

"{8a74e887-8f0f-4017-af53-cba42211aaa5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)

"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player

"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003

"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System

"{92DF2F1B-F63C-4D9A-B3E1-B2D11AE29790}" = Windows Presentation Foundation Language Pack (DEU)

"{95120000-00b9-0409-0000-0000000ff1ce}" = Microsoft Application Error Reporting

"{95120000-0122-0407-0000-0000000ff1ce}" = Microsoft Office Outlook Connector

"{95140000-00AF-0407-0000-0000000FF1CE}" = Microsoft PowerPoint Viewer

"{994223f3-a99b-4ddd-9e1d-0190a17c6860}" = Windows Live Family Safety

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9B03C535-3AEA-4ef2-B326-0A01A2207034}" = CreativeProjects

"{9c9ceb9d-53fd-49a7-85d2-fe674f72f24e}" = Microsoft Search Enhancement Pack

"{9DE9E293-5D7B-4312-88C2-BDFAEC5310AE}" = Microsoft .NET Framework 3.0

"{A195B13E-A5E3-4BAF-A995-7F70F445CD06}" = ScannerCopy

"{a1f66fc9-11ee-4f2f-98c9-16f8d1e69fb7}" = Segoe UI

"{A2500497-FD32-493e-B8E5-28D6728DBEF5}" = Readme

"{A260B422-70E1-41E2-957D-F76FA21266D5}" = Apple Software Update

"{A30B27FF-8C79-424A-89B4-43AD712A41ED}" = Steuer 2005

"{A5181519-9F3D-4372-ABC6-C333C2F3A816}_is1" = RunAlyzer

"{A9E5EDA7-2E6C-49E7-924B-A32B89C24A04}" = T-Mobile Internet Manager 03

"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder

"{AC76BA86-7AD7-1031-7B44-A70800000002}" = Adobe Reader 7.0.8 - Deutsch

"{AF226123-1A6F-4ec1-8DEF-E35E7A0D0127}" = Fax

"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter

"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy

"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player

"{B824B5C9-849F-4b9e-9EA7-6FD8CD8116DA}" = CP_Package_Variety2

"{B996AE66-10DB-4ac5-B151-E8B4BFBC42FC}" = BufferChm

"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation

"{BC339BFD-F550-471a-8D26-4D08126C62F7}" = SkinsHP2

"{bd64af4a-8c80-4152-ad77-fcddf05208ab}" = Microsoft Sync Framework Services Native v1.0 (x86)

"{c4124e95-5061-4776-8d5d-e3d931c778e1}" = Microsoft VC9 runtime libraries

"{c4d738f7-996a-4c81-b8fa-c4e26d767e41}" = Windows Live Mail

"{C5ADA65A-7828-4D85-B071-ECC52B51F794}" = Sony Ericsson PC Suite 1.20.173

"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1

"{CBE3E0AF-73BB-4c21-8B96-B09E003EDE7F}" = QuickProjects

"{CDBFDD5B-50E0-4021-94AF-516B80509ABE}" = 5500Tour

"{D186329B-1B4D-408D-ABEC-EA5CE1F182C9}" = Overland

"{e0a4805d-280a-4dd7-9e74-3a5f85e302a1}" = Windows Live Writer

"{e2dfe069-083e-4631-9b6c-43c48e991de5}" = Junk Mail filter update

"{E3F90083-80D4-4b5a-87C7-E97E12F5516D}" = HPProductAssistant

"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack

"{E8BFBD0A-8002-4dc9-869C-E495FA9DCE7A}" = PhotoGallery

"{EA103B64-C0E4-4C0E-A506-751590E1653D}" = SolutionCenter

"{EBA672FF-F80E-48B1-8FC4-616825318810}" = Feederkennung (Windows Live Toolbar)

"{EDDDC607-91D9-4758-9F57-265FDCD8A772}" = Microsoft Works 7.0 

"{f0b430d1-b6aa-473d-9b06-aa3dd01fd0b8}" = Microsoft SQL Server 2005 Compact Edition [ENU]

"{f0e12bba-ad66-4022-a453-a1c8a0c4d570}" = Microsoft Choice Guard

"{F2A7F421-1679-48D5-B918-96999014ED53}" = Microsoft .NET Framework 3.0 German Language Pack

"{F4C2E5F5-2970-45f4-ABD3-C180C4D961C4}" = Status

"{f8ff18ee-264a-43fd-b2f6-5ead40798c2f}" = Windows Live Essentials

"{FE64AE29-0883-4C70-8388-DC026019C900}" = HP Image Zone Express

"{FF102450-55AA-4AE1-ACE4-E271E2470C83}" = hpmdtab

"7-Zip" = 7-Zip 4.65

"AC3Filter" = AC3Filter (remove only)

"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin

"All ATI Software" = ATI - Dienstprogramm zur Deinstallation der Software

"ATI Display Driver" = ATI Display Driver

"AXIS Media Control Embedded" = AXIS Media Control Embedded

"Burn4Free" = Burn4Free CD and DVD

"Burn4Free Toolbar" = Burn4Free Toolbar

"CCleaner" = CCleaner (remove only)

"DivX Content Uploader" = DivX Content Uploader

"ERUNT_is1" = ERUNT 1.1j

"FreePDF_XP" = FreePDF XP (Remove only)

"GPL Ghostscript 8.15" = GPL Ghostscript 8.15

"GPL Ghostscript Fonts" = GPL Ghostscript Fonts

"HaufeReader" = HaufeReader

"HijackThis" = HijackThis 2.0.2

"HP Imaging Device Functions" = HP Imaging Device Functions 5.3

"hp officejet 5500 series_Driver" = hp officejet 5500 series

"HP Photo & Imaging" = HP Image Zone 3.5

"HP Solution Center & Imaging Support Tools" = HP Solution Center & Imaging Support Tools 5.3

"ICQToolbar" = ICQ Toolbar

"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs

"ie7" = Windows Internet Explorer 7

"ie8" = Windows Internet Explorer 8

"Installing HSP56 MicroModem Drivers" = HSP56 Modem Drivers

"JAP" = JAP

"legacyqcam_10.50" = Logitech Legacy USB Camera-Treiberpaket

"lvdrivers_11.80" = Logitech QuickCam-Treiberpaket

"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware

"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1

"Microsoft .NET Framework 2.0" = Microsoft .NET Framework 2.0

"Microsoft .NET Framework 2.0 Language Pack - DEU" = Microsoft .NET Framework 2.0 Language Pack - DEU

"Microsoft .NET Framework 3.0" = Microsoft .NET Framework 3.0

"Microsoft .NET Framework 3.0 German Language Pack" = Microsoft .NET Framework 3.0 German Language Pack

"Mozilla Firefox (3.6.10)" = Mozilla Firefox (3.6.10)

"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP

"MSNINST" = MSN

"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs

"PokerStars" = PokerStars

"RealPlayer 6.0" = RealPlayer

"Redirection Port Monitor" = RedMon - Redirection Port Monitor

"SopCast" = SopCast 3.2.9

"Totalcmd" = Total Commander (Remove or Repair)

"Veetle TV" = Veetle TV 0.9.17

"viewpointmediaplayer" = Viewpoint Media Player

"WIC" = Windows Imaging Component

"Windows Media Format Runtime" = Windows Media Format 11 runtime

"Windows Media Player" = Windows Media Player 11

"Windows XP Service Pack" = Windows XP Service Pack 3

"winlivesuite_wave3" = Windows Live Essentials

"WinRAR archiver" = WinRAR Archivierer

"WMFDist11" = Windows Media Format 11 runtime

"wmp11" = Windows Media Player 11

"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0

"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0

 
 ========== HKEY_CURRENT_USER Uninstall List ==========

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"Move Networks Player - IE" = Move Networks Media Player for Internet Explorer

 
 ========== Last 10 Event Log Errors ==========

 

[ Application Events ]

Error - 29.09.2010 17:58:02 | Computer Name = PRIVAT-C65EE05C | Source = Application Error | ID = 1000

Description = Fehlgeschlagene Anwendung iexplore.exe, Version 7.0.6000.16850, fehlgeschlagenes

 Modul ntdll.dll, Version 5.1.2600.5755, Fehleradresse 0x000251bc.

 

Error - 30.09.2010 16:06:59 | Computer Name = PRIVAT-C65EE05C | Source = Application Error | ID = 1000

Description = Fehlgeschlagene Anwendung iexplore.exe, Version 7.0.6000.16850, fehlgeschlagenes

 Modul ntdll.dll, Version 5.1.2600.5755, Fehleradresse 0x00025672.

 

Error - 30.09.2010 23:56:14 | Computer Name = PRIVAT-C65EE05C | Source = LoadPerf | ID = 3001

Description = Der Wert für die Namenszeichenfolge im Leistungsindikator in der Registrierung

ist

 falsch formatiert. Die ungültige Zeichenfolge ist 4576 und der ungültige  Indexwert

 ist das erste DWORD im Datenbereich, während die letzten gültigen  Indexwerte die

 zweiten und dritten DWORD im Datenbereich sind.

 

Error - 30.09.2010 23:56:14 | Computer Name = PRIVAT-C65EE05C | Source = LoadPerf | ID = 3001

Description = Der Wert für die Namenszeichenfolge im Leistungsindikator in der Registrierung

ist

 falsch formatiert. Die ungültige Zeichenfolge ist 4576 und der ungültige  Indexwert

 ist das erste DWORD im Datenbereich, während die letzten gültigen  Indexwerte die

 zweiten und dritten DWORD im Datenbereich sind.

 

Error - 30.09.2010 23:56:14 | Computer Name = PRIVAT-C65EE05C | Source = LoadPerf | ID = 3011

Description = Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren

 für  Dienst WmiApRpl (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

 

Error - 30.09.2010 23:56:17 | Computer Name = PRIVAT-C65EE05C | Source = LoadPerf | ID = 3001

Description = Der Wert für die Namenszeichenfolge im Leistungsindikator in der Registrierung

ist

 falsch formatiert. Die ungültige Zeichenfolge ist 4576 und der ungültige  Indexwert

 ist das erste DWORD im Datenbereich, während die letzten gültigen  Indexwerte die

 zweiten und dritten DWORD im Datenbereich sind.

 

Error - 01.10.2010 06:03:52 | Computer Name = PRIVAT-C65EE05C | Source = WmiAdapter | ID = 4099

Description = Dienst konnte nicht geöffnet werden.

 

Error - 01.10.2010 06:33:36 | Computer Name = PRIVAT-C65EE05C | Source = crypt32 | ID = 131083

Description = Die Extrahierung der Drittanbieterstammlisten aus der automatischen

 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>

 ist fehlgeschlagen mit dem Fehler: Der Verzeichnisname ist ungültig.  .

 

Error - 01.10.2010 06:33:38 | Computer Name = PRIVAT-C65EE05C | Source = crypt32 | ID = 131083

Description = Die Extrahierung der Drittanbieterstammlisten aus der automatischen

 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>

 ist fehlgeschlagen mit dem Fehler: Der Verzeichnisname ist ungültig.  .

 

Error - 01.10.2010 16:41:26 | Computer Name = PRIVAT-C65EE05C | Source = Application Error | ID = 1000

Description = Fehlgeschlagene Anwendung svchost.exe, Version 5.1.2600.5512, fehlgeschlagenes

 Modul unknown, Version 0.0.0.0, Fehleradresse 0x001a6e6f.

 

[ System Events ]

Error - 02.10.2010 18:28:42 | Computer Name = PRIVAT-C65EE05C | Source = Service Control Manager | ID = 7000

Description = Der Dienst "Automatische Updates" wurde aufgrund folgenden Fehlers

 nicht gestartet:   %%2

 

Error - 02.10.2010 18:29:59 | Computer Name = PRIVAT-C65EE05C | Source = Service Control Manager | ID = 7022

Description = Der Dienst "IPv6-Hilfsdienst" wurde nicht ordnungsgemäß gestartet.

 

Error - 02.10.2010 18:31:20 | Computer Name = PRIVAT-C65EE05C | Source = Service Control Manager | ID = 7034

Description = Dienst "Process Monitor" wurde unerwartet beendet. Dies ist bereits

 1 Mal passiert.

 

Error - 02.10.2010 18:36:27 | Computer Name = PRIVAT-C65EE05C | Source = Service Control Manager | ID = 7000

Description = Der Dienst "Intelligenter Hintergrundübertragungsdienst" wurde aufgrund

 folgenden Fehlers nicht gestartet:   %%2

 

Error - 02.10.2010 18:36:27 | Computer Name = PRIVAT-C65EE05C | Source = Service Control Manager | ID = 7000

Description = Der Dienst "Automatische Updates" wurde aufgrund folgenden Fehlers

 nicht gestartet:   %%2

 

Error - 02.10.2010 18:37:48 | Computer Name = PRIVAT-C65EE05C | Source = Service Control Manager | ID = 7022

Description = Der Dienst "IPv6-Hilfsdienst" wurde nicht ordnungsgemäß gestartet.

 

Error - 02.10.2010 18:39:07 | Computer Name = PRIVAT-C65EE05C | Source = Service Control Manager | ID = 7034

Description = Dienst "Process Monitor" wurde unerwartet beendet. Dies ist bereits

 1 Mal passiert.

 

Error - 02.10.2010 19:01:19 | Computer Name = PRIVAT-C65EE05C | Source = Service Control Manager | ID = 7023

Description = Der Dienst "HID Input Service" wurde mit folgendem Fehler beendet:

   %%126

 

Error - 02.10.2010 21:55:44 | Computer Name = PRIVAT-C65EE05C | Source = Service Control Manager | ID = 7023

Description = Der Dienst "HID Input Service" wurde mit folgendem Fehler beendet:

   %%126

 

Error - 02.10.2010 22:25:03 | Computer Name = PRIVAT-C65EE05C | Source = Service Control Manager | ID = 7023

Description = Der Dienst "HID Input Service" wurde mit folgendem Fehler beendet:

   %%126

 

 

< End of report >

Ich habe nach dem OTL-Scan bereinigt, hoffe das war kein Fehler? Die OTL-Logs sind vor dem bereinigen.

Aktuell habe ich keinen Virenscanner mehr aktiv. AntiVir läuft in 3 Tagen aus bei mir. Was würdest Du mir denn empfehlen?

Gruss und schönen Sonntag
BESTE GRÜSSE!!
Andreas