Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   tr/kazy.mekml.1 leider hats mich auch betroffen (https://www.trojaner-board.de/98014-tr-kazy-mekml-1-leider-hats-mich-betroffen.html)

Oemmel 24.04.2011 11:45
tr/kazy.mekml.1 leider hats mich auch betroffen
 
Hallo zusammen!

Habe auch das Problem mit dem Trojaner TR/Kazy.mekml.1
Könnt ihr mir eventuell weiter helfen?
Alle Ordner sind weg, kann nicht mehr auf die Festplatte zugreifen.
Danke schonmal vorweg!!

Ich habe schonmal im vorweg OTL drüberlaufen lassen. Folgendes kam beiweg:

OTL.txtOTL Logfile:
Code:
OTL logfile created on: 24.04.2011 13:04:14 - Run 1
OTL by OldTimer - Version 3.2.22.3    Folder = E:\
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 75,00% Memory free
5,00 Gb Paging File | 4,00 Gb Available in Paging File | 83,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 298,09 Gb Total Space | 148,00 Gb Free Space | 49,65% Space Free | Partition Type: NTFS
Drive E: | 1,97 Gb Total Space | 1,96 Gb Free Space | 99,61% Space Free | Partition Type: FAT
 
Computer Name: TECRA | User Name: M.Schattke | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - E:\OTL.exe (OldTimer Tools)
PRC - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\YnnAflICEeXU.exe (WinTrust)
PRC - C:\Programme\Danfoss Drives\VLT Motion Control Tool\MCT 10 Set-up Software\MCTServ.exe ()
PRC - C:\Programme\Gemeinsame Dateien\Siemens\S7IEPG\s7oiehsx.exe (SIEMENS AG)
PRC - C:\Programme\Gemeinsame Dateien\Siemens\Automation\TraceEngine\bin\S7TraceServiceX.exe (SIEMENS AG)
PRC - C:\Programme\Gemeinsame Dateien\Siemens\S7UBTOOX\S7ubTstx.exe (SIEMENS AG)
PRC - C:\Programme\Siemens\Step7\S7BIN\s7asysvx.exe (SIEMENS AG)
PRC - C:\Programme\Nokia\Nokia PC Suite 7\PCSuite.exe (Nokia)
PRC - C:\Programme\Gemeinsame Dateien\Siemens\SWS\almsrv\almsrvx.exe (SIEMENS AG)
PRC - C:\Programme\Siemens\Automation\Portal V10\Bin\Siemens.Automation.ObjectFrame.FileStorage.Server.exe (Siemens AG)
PRC - C:\FSP_5000_RPS\RAMV\Tools\TransferToolNet.exe (Bosch)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programme\Samsung\Samsung New PC Studio\NPSAgent.exe (Samsung Electronics Co., Ltd.)
PRC - C:\WINDOWS\system32\FsUsbExService.Exe (Teruten)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\FSP_5000_RPS\RAMV\Tools\TransferTool.exe (Bosch)
PRC - C:\Programme\TrueSuite Access Manager\CssSvr.exe (Arachnoid Biometrics Identification Group Corp.)
PRC - C:\Programme\TrueSuite Access Manager\PwdBank.exe (Arachnoid Biometrics Identification Group)
PRC - C:\Programme\TrueSuite Access Manager\FpNotifier.exe (AuthenTec, Inc)
PRC - C:\WINDOWS\system32\TAMSvr.exe (AuthenTec Inc.)
PRC - C:\Programme\Gemeinsame Dateien\Siemens\ALMPanelPlugin\ALMPanelPlugin.exe (Siemens AG)
PRC - C:\Programme\TrueSuite Access Manager\usbnotify.exe ()
PRC - C:\Programme\Toshiba\3GUty\tw3gsvc.exe (TOSHIBA CORPORATION)
PRC - C:\Programme\Toshiba\3GUty\tw3gctrl.exe (TOSHIBA CORPORATION)
PRC - C:\WINDOWS\system32\TFNF5.exe (TOSHIBA Corp.)
PRC - C:\Programme\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe (TOSHIBA Corporation)
PRC - C:\Programme\Toshiba\TPHM\TPCHSrv.exe (TOSHIBA Corporation)
PRC - C:\Programme\Toshiba\TME3\TMERzCtl.exe (TOSHIBA)
PRC - C:\WINDOWS\system32\ThpSrv.exe (TOSHIBA Corporation)
PRC - C:\Programme\Gemeinsame Dateien\Intel\Privacy Icon\UNS\UNS.exe (Intel Corporation)
PRC - C:\Programme\Gemeinsame Dateien\Intel\Privacy Icon\PrivacyIconClient.exe (Intel Corporation)
PRC - C:\Programme\Intel\AMT\LMS.exe (Intel Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\attrib.exe (Microsoft Corporation)
PRC - c:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (TOSHIBA CORPORATION)
PRC - C:\WINDOWS\system32\TODDSrv.exe (TOSHIBA Corporation)
PRC - C:\WINDOWS\system32\TPSMain.exe (TOSHIBA Corporation)
PRC - C:\WINDOWS\system32\TPSBattM.exe (TOSHIBA Corporation)
PRC - C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe (TOSHIBA CORPORATION)
PRC - C:\Programme\Toshiba\Bluetooth Toshiba Stack\ItSecMng.exe ( TOSHIBA CORPORATION)
PRC - C:\Programme\Gemeinsame Dateien\Siemens\SQLANY\dbsrv9.exe (iAnywhere Solutions, Inc.)
PRC - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Macrovision\FLEXnet Connect\6\ISUSPM.exe (Macrovision Corporation)
PRC - C:\WINDOWS\system32\agrsmsvc.exe (Agere Systems)
PRC - C:\WINDOWS\system32\00THotkey.exe (TOSHIBA Corporation)
PRC - C:\Programme\Toshiba\TAudEffect\TAudEff.exe (TOSHIBA)
PRC - C:\Programme\Toshiba\ConfigFree\NDSTray.exe (TOSHIBA CORPORATION)
PRC - C:\Programme\Toshiba\TME3\TMESRV31.exe (TOSHIBA)
PRC - C:\Programme\Toshiba\TOSHIBA Controls\TFncKy.exe (TOSHIBA Corporation)
PRC - C:\Programme\Toshiba\DualPointUtility\TEDTray.exe (TOSHIBA)
PRC - C:\Programme\Toshiba\TOSCDSPD\TOSCDSPD.exe (TOSHIBA)
PRC - C:\Programme\Toshiba\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
PRC - C:\Programme\Toshiba\TME3\TMEEJME.exe (TOSHIBA)
 
 
========== Modules (SafeList) ==========
 
MOD - E:\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\nview.dll ()
MOD - C:\WINDOWS\system32\nvwrsde.dll (NVIDIA Corporation)
MOD - C:\WINDOWS\system32\nvwddi.dll (NVIDIA Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (MCT10 Service) -- C:\Programme\Danfoss Drives\VLT Motion Control Tool\MCT 10 Set-up Software\MCTServ.exe ()
SRV - (ServiceLayer) -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe (Nokia)
SRV - (s7oiehsx) -- C:\Programme\Gemeinsame Dateien\Siemens\S7IEPG\s7oiehsx.exe (SIEMENS AG)
SRV - (S7TraceServiceX) -- C:\Programme\Gemeinsame Dateien\Siemens\Automation\TraceEngine\bin\S7TraceServiceX.exe (SIEMENS AG)
SRV - (s7asysvx) -- C:\Programme\Siemens\Step7\S7BIN\s7asysvx.exe (SIEMENS AG)
SRV - (almservice) -- C:\Programme\Gemeinsame Dateien\Siemens\sws\almsrv\almsrvx.exe (SIEMENS AG)
SRV - (Microsoft SharePoint Workspace Audit Service) -- C:\Programme\Microsoft Office\Office14\GROOVE.EXE (Microsoft Corporation)
SRV - (McComponentHostService) -- C:\Programme\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.)
SRV - (osppsvc) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation)
SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (TransferToolNet) -- C:\FSP_5000_RPS\RAMV\Tools\TransferToolNet.exe (Bosch)
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (FsUsbExService) -- C:\WINDOWS\system32\FsUsbExService.Exe (Teruten)
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (TransferTool) -- C:\FSP_5000_RPS\RAMV\Tools\TransferTool.exe (Bosch)
SRV - (FingerprintServer) -- C:\WINDOWS\system32\FpLogonServ.exe (AuthenTec,Inc)
SRV - (Authentec memory manager) -- C:\WINDOWS\system32\TAMSvr.exe (AuthenTec Inc.)
SRV - (TW3GSVC) -- C:\Programme\Toshiba\3GUty\tw3gsvc.exe (TOSHIBA CORPORATION)
SRV - (TNaviSrv) -- C:\Programme\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe (TOSHIBA Corporation)
SRV - (TPCHSrv) -- C:\Programme\TOSHIBA\TPHM\TPCHSrv.exe (TOSHIBA Corporation)
SRV - (Thpsrv) -- C:\WINDOWS\system32\ThpSrv.exe (TOSHIBA Corporation)
SRV - (UNS) Intel(R) -- C:\Programme\Gemeinsame Dateien\Intel\Privacy Icon\UNS\UNS.exe (Intel Corporation)
SRV - (LMS) Intel(R) -- C:\Programme\Intel\AMT\LMS.exe (Intel Corporation)
SRV - (TOSHIBA Bluetooth Service) -- c:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (TOSHIBA CORPORATION)
SRV - (TODDSrv) -- C:\WINDOWS\system32\TODDSrv.exe (TOSHIBA Corporation)
SRV - (OpcEnum) -- C:\WINDOWS\system32\OpcEnum.exe (OPC Foundation)
SRV - (AgereModemAudio) -- C:\WINDOWS\system32\agrsmsvc.exe (Agere Systems)
SRV - (Tmesrv) -- C:\Programme\TOSHIBA\TME3\Tmesrv31.exe (TOSHIBA)
SRV - (IDriverT) -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (CFSvcs) -- C:\Programme\Toshiba\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (s7otsadx) -- C:\WINDOWS\System32\Drivers\s7otsadx.sys (SIEMENS AG)
DRV - (s7otranx) -- C:\WINDOWS\System32\Drivers\s7otranx.sys (SIEMENS AG)
DRV - (s7osmcax) -- C:\WINDOWS\System32\Drivers\s7osmcax.sys (SIEMENS AG)
DRV - (S7opcsrtx) PROFINET IO RT-Protocol (LLDP) -- C:\WINDOWS\system32\drivers\s7opcsrtx.sys (SIEMENS AG)
DRV - (s7odpx2x) -- C:\WINDOWS\System32\Drivers\S7odpx2x.sys (SIEMENS AG)
DRV - (Peakcan) -- C:\WINDOWS\system32\drivers\PEAKCAN.SYS (PEAK-System Technik GmbH, Darmstadt, Germany)
DRV - (S7OUPC2X) -- C:\WINDOWS\system32\drivers\s7oupc2x.sys (SIEMENS AG)
DRV - (UsbserFilt) -- C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys (Nokia)
DRV - (upperdev) -- C:\WINDOWS\system32\drivers\usbser_lowerflt.sys (Nokia)
DRV - (nmwcdc) -- C:\WINDOWS\system32\drivers\ccdcmbo.sys (Nokia)
DRV - (nmwcd) -- C:\WINDOWS\system32\drivers\ccdcmb.sys (Nokia)
DRV - (nmwcdnsu) -- C:\WINDOWS\system32\drivers\nmwcdnsu.sys (Nokia)
DRV - (nmwcdnsuc) -- C:\WINDOWS\system32\drivers\nmwcdnsuc.sys (Nokia)
DRV - (SNTIE) SIMATIC Industrial Ethernet (ISO) -- C:\WINDOWS\system32\drivers\SNTIE.SYS (SIEMENS AG)
DRV - (Dpmtrcdd) -- C:\WINDOWS\system32\drivers\dpmtrcdd.sys (SIEMENS AG)
DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (FTDIBUS) -- C:\WINDOWS\system32\drivers\ftdibus.sys (FTDI Ltd.)
DRV - (FTSER2K) -- C:\WINDOWS\system32\drivers\ftser2k.sys (FTDI Ltd.)
DRV - (FsUsbExDisk) -- C:\WINDOWS\system32\FsUsbExDisk.Sys ()
DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (fwkbdrtm) -- C:\WINDOWS\System32\drivers\fwkbdrtm.sys (Siemens AG)
DRV - (s7snsrtx) -- C:\WINDOWS\system32\drivers\s7snsrtx.sys (SIEMENS AG)
DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (hwdatacard) -- C:\WINDOWS\system32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV - (USBModem) -- C:\WINDOWS\system32\drivers\lgusbmodem.sys (LG Electronics Inc.)
DRV - (UsbDiag) -- C:\WINDOWS\system32\drivers\lgusbdiag.sys (LG Electronics Inc.)
DRV - (usbbus) -- C:\WINDOWS\system32\drivers\lgusbbus.sys (LG Electronics Inc.)
DRV - (pccsmcfd) -- C:\WINDOWS\system32\drivers\pccsmcfd.sys (Nokia)
DRV - (ATSWPDRV) AuthenTec TruePrint USB Driver (SwipeSensor) -- C:\WINDOWS\system32\drivers\atswpdrv.sys (AuthenTec, Inc.)
DRV - (AlfaFF) -- C:\WINDOWS\system32\Drivers\AlfaFF.sys (Alfa Corporation)
DRV - (toshgps) -- C:\WINDOWS\system32\drivers\toshgps.sys (Ericsson AB)
DRV - (toshunic) Toshiba F3507g Mobile Broadband Network Adapter (WDM) -- C:\WINDOWS\system32\drivers\toshunic.sys (MCCI Corporation)
DRV - (toshmdm2) -- C:\WINDOWS\system32\drivers\toshmdm2.sys (MCCI Corporation)
DRV - (toshmdm) -- C:\WINDOWS\system32\drivers\toshmdm.sys (MCCI Corporation)
DRV - (toshcard) -- C:\WINDOWS\system32\drivers\toshcard.sys (MCCI Corporation)
DRV - (toshbus) Toshiba F3507g Mobile Broadband Device driver (WDM) -- C:\WINDOWS\system32\drivers\toshbus.sys (MCCI Corporation)
DRV - (toshnd5) Toshiba F3507g Mobile Broadband Network Adapter (NDIS) -- C:\WINDOWS\system32\drivers\toshnd5.sys (MCCI Corporation)
DRV - (toshmdfl2) -- C:\WINDOWS\system32\drivers\toshmdfl2.sys (MCCI Corporation)
DRV - (toshmdfl) -- C:\WINDOWS\system32\drivers\toshmdfl.sys (MCCI Corporation)
DRV - (Sony_EricssonWWSC) -- C:\WINDOWS\system32\drivers\toshscard.sys (Sony Ericsson)
DRV - (tos_sps32) -- C:\WINDOWS\system32\DRIVERS\tos_sps32.sys (TOSHIBA Corporation)
DRV - (TVALZFL) -- C:\WINDOWS\system32\drivers\TVALZFL.sys (TOSHIBA Corporation)
DRV - (NETw5x32) Intel(R) -- C:\WINDOWS\system32\drivers\NETw5x32.sys (Intel Corporation)
DRV - (tosrfbd) -- C:\WINDOWS\system32\drivers\tosrfbd.sys (TOSHIBA CORPORATION)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (e1yexpress) Intel(R) -- C:\WINDOWS\system32\drivers\e1y5132.sys (Intel Corporation)
DRV - (HECI) Intel(R) -- C:\WINDOWS\system32\drivers\HECI.sys (Intel Corporation)
DRV - (tosporte) -- C:\WINDOWS\system32\drivers\tosporte.sys (TOSHIBA Corporation)
DRV - (Tosrfhid) -- C:\WINDOWS\system32\drivers\Tosrfhid.sys (TOSHIBA Corporation.)
DRV - (rimmptsk) -- C:\WINDOWS\system32\drivers\rimmptsk.sys (REDC)
DRV - (TosRfSnd) -- C:\WINDOWS\system32\drivers\TosRfSnd.sys (TOSHIBA Corporation)
DRV - (Thpdrv) -- C:\WINDOWS\system32\DRIVERS\thpdrv.sys (TOSHIBA Corporation)
DRV - (guardian2) -- C:\WINDOWS\system32\drivers\oz776.sys (O2Micro)
DRV - (usbmp) -- C:\WINDOWS\system32\drivers\usbmp.sys (Bosch GmbH, Germany)
DRV - (UVCFTR) -- C:\WINDOWS\system32\drivers\UVCFTR_S.SYS (Chicony Electronics Co., Ltd.)
DRV - (tosrfbnp) -- C:\WINDOWS\system32\drivers\tosrfbnp.sys (TOSHIBA Corporation)
DRV - (Tosrfusb) -- C:\WINDOWS\system32\drivers\tosrfusb.sys (TOSHIBA CORPORATION)
DRV - (Tosrfcom) -- C:\WINDOWS\system32\drivers\tosrfcom.sys (TOSHIBA Corporation)
DRV - (Thpevm) -- C:\WINDOWS\system32\DRIVERS\Thpevm.SYS (TOSHIBA Corporation)
DRV - (rismxdp) -- C:\WINDOWS\system32\drivers\rixdptsk.sys (REDC)
DRV - (rimsptsk) -- C:\WINDOWS\system32\drivers\rimsptsk.sys (REDC)
DRV - (IFXTPM) -- C:\WINDOWS\system32\drivers\ifxtpm.sys (Infineon Technologies AG)
DRV - (sscdmdm) -- C:\WINDOWS\system32\drivers\sscdmdm.sys (MCCI Corporation)
DRV - (sscdmdfl) -- C:\WINDOWS\system32\drivers\sscdmdfl.sys (MCCI Corporation)
DRV - (sscdbus) SAMSUNG USB Composite Device driver (WDM) -- C:\WINDOWS\system32\drivers\sscdbus.sys (MCCI Corporation)
DRV - (tdudf) -- C:\WINDOWS\system32\drivers\tdudf.sys (TOSHIBA Corporation)
DRV - (tdcmdpst) -- C:\WINDOWS\system32\drivers\tdcmdpst.sys (TOSHIBA Corporation.)
DRV - (TEchoCan) -- C:\WINDOWS\system32\drivers\TEchoCan.sys (TOSHIBA Corporation)
DRV - (trudf) -- C:\WINDOWS\system32\drivers\trudf.sys (TOSHIBA Corporation)
DRV - (TVALZ) -- C:\WINDOWS\system32\DRIVERS\TVALZ.SYS (TOSHIBA Corporation)
DRV - (AgereSoftModem) -- C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)
DRV - (tosrfec) -- C:\WINDOWS\system32\drivers\tosrfec.sys (TOSHIBA Corporation)
DRV - (toshidpt) -- C:\WINDOWS\system32\drivers\Toshidpt.sys (TOSHIBA Corporation.)
DRV - (dpmcslv) -- C:\WINDOWS\System32\drivers\dpmcslv.sys (Siemens AG)
DRV - (S7OUTS2X) -- C:\WINDOWS\system32\drivers\s7outs2x.sys (SIEMENS AG)
DRV - (tosrfnds) -- C:\WINDOWS\system32\drivers\tosrfnds.sys (TOSHIBA Corporation.)
DRV - (Sentinel) -- C:\WINDOWS\System32\Drivers\SENTINEL.SYS (Rainbow Technologies, Inc.)
DRV - (TMEI3E) -- C:\WINDOWS\system32\drivers\TMEI3E.sys (Toshiba Corporation)
DRV - (ApfiltrService) -- C:\WINDOWS\system32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (Netdevio) -- C:\WINDOWS\system32\drivers\Netdevio.sys (TOSHIBA Corporation.)
DRV - (s7oefs_x) -- C:\WINDOWS\System32\drivers\s7oefs_x.sys (SIEMENS AG)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-1851379012-1242461590-2316183665-1122\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2269050
IE - HKU\S-1-5-21-1851379012-1242461590-2316183665-1122\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVD1.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-1851379012-1242461590-2316183665-1122\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultthis.engineName: "Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.selectedEngine: "Search"
FF - prefs.js..browser.startup.homepage: "www.google.de"
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:2.7.0.14
FF - prefs.js..extensions.enabledItems: bkmrksync@nokia.com:1.0.0.733
 
FF - HKLM\software\mozilla\Firefox\Extensions\\bkmrksync@nokia.com: C:\Programme\Nokia\Nokia PC Suite 7\bkmrksync\ [2010.10.10 14:35:10 | 000,000,000 | -H-D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.18\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011.04.01 15:50:47 | 000,000,000 | -H-D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.18\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011.04.01 15:50:47 | 000,000,000 | -H-D | M]
 
[2010.01.19 17:13:07 | 000,000,000 | -H-D | M] (No name found) -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\Mozilla\Extensions
[2011.04.22 12:17:40 | 000,000,000 | -H-D | M] (No name found) -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\Mozilla\Firefox\Profiles\qwv8mqoi.default\extensions
[2010.07.06 11:11:34 | 000,000,000 | -H-D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\Mozilla\Firefox\Profiles\qwv8mqoi.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.08.05 08:53:32 | 000,000,000 | -H-D | M] (DVDVideoSoftTB Toolbar) -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\Mozilla\Firefox\Profiles\qwv8mqoi.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
[2010.07.06 12:03:36 | 000,000,000 | -H-D | M] ("DVDVideoSoft Menu") -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\Mozilla\Firefox\Profiles\qwv8mqoi.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2010.08.05 10:05:17 | 000,000,881 | -H-- | M] () -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\Mozilla\Firefox\Profiles\qwv8mqoi.default\searchplugins\conduit.xml
[2010.01.19 17:12:51 | 000,000,000 | -H-D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2010.10.10 14:35:10 | 000,000,000 | -H-D | M] (PC Sync 2 Synchronisation Extension) -- C:\PROGRAMME\NOKIA\NOKIA PC SUITE 7\BKMRKSYNC
[2009.12.22 05:57:54 | 000,001,392 | -H-- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2009.12.22 05:57:54 | 000,002,344 | -H-- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2009.12.22 05:57:54 | 000,006,805 | -H-- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2009.12.22 05:57:54 | 000,001,178 | -H-- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2009.12.22 05:57:54 | 000,000,801 | -H-- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2008.04.14 14:00:00 | 000,000,820 | -H-- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_06\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVD1.dll (Conduit Ltd.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVD1.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-1851379012-1242461590-2316183665-1122\..\Toolbar\WebBrowser: (DVDVideoSoftTB Toolbar) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - C:\Programme\DVDVideoSoftTB\tbDVD1.dll (Conduit Ltd.)
O4 - HKLM..\Run: [000StTHK] C:\WINDOWS\System32\000StTHK.exe ()
O4 - HKLM..\Run: [00THotkey] C:\WINDOWS\system32\00THotkey.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [BCSSync] C:\Programme\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)
O4 - HKLM..\Run: [DpUtil] C:\Programme\Toshiba\DualPointUtility\TEDTray.exe (TOSHIBA)
O4 - HKLM..\Run: [FingerPrintNotifer] C:\Programme\TrueSuite Access Manager\FpNotifier.exe (AuthenTec, Inc)
O4 - HKLM..\Run: [ITSecMng] C:\Programme\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe ( TOSHIBA CORPORATION)
O4 - HKLM..\Run: [NDSTray.exe]  File not found
O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [NPSStartup]  File not found
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NVRotateSysTray] C:\WINDOWS\System32\nvsysrot.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NWEReboot]  File not found
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [picon] C:\Programme\Gemeinsame Dateien\Intel\Privacy Icon\PrivacyIconClient.exe (Intel Corporation)
O4 - HKLM..\Run: [PwdBank] C:\Programme\TrueSuite Access Manager\PwdBank.exe (Arachnoid Biometrics Identification Group)
O4 - HKLM..\Run: [S7UB Start] C:\Programme\Gemeinsame Dateien\Siemens\S7ubtoox\s7ubtstx.exe (SIEMENS AG)
O4 - HKLM..\Run: [SiemensAutomationFileStorage]  File not found
O4 - HKLM..\Run: [TAudEffect] C:\Programme\TOSHIBA\TAudEffect\TAudEff.exe (TOSHIBA)
O4 - HKLM..\Run: [TFncKy]  File not found
O4 - HKLM..\Run: [TFNF5] C:\WINDOWS\System32\TFNF5.exe (TOSHIBA Corp.)
O4 - HKLM..\Run: [ThpSrv] C:\WINDOWS\System32\thpsrv.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TMERzCtl.EXE] C:\Programme\TOSHIBA\TME3\TMERzCtl.EXE (TOSHIBA)
O4 - HKLM..\Run: [TMESRV.EXE] C:\Programme\TOSHIBA\TME3\TMESRV31.EXE (TOSHIBA)
O4 - HKLM..\Run: [TOSDCR] C:\WINDOWS\System32\TOSDCR.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TOSHIBA_3G_UTY] C:\Programme\Toshiba\3GUty\tw3gctrl.exe (TOSHIBA CORPORATION)
O4 - HKLM..\Run: [TosHKCW.exe] C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe (TOSHIBA CORPORATION)
O4 - HKLM..\Run: [TPSMain] C:\WINDOWS\System32\TPSMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TPSODDCtl] C:\WINDOWS\System32\TPSODDCtl.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [UsbMonitor] C:\Programme\TrueSuite Access Manager\usbnotify.exe ()
O4 - HKU\S-1-5-21-1851379012-1242461590-2316183665-1122..\Run: [AutoStartNPSAgent] C:\Programme\Samsung\Samsung New PC Studio\NPSAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKU\S-1-5-21-1851379012-1242461590-2316183665-1122..\Run: [ISUSPM] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Macrovision\FLEXnet Connect\6\ISUSPM.exe (Macrovision Corporation)
O4 - HKU\S-1-5-21-1851379012-1242461590-2316183665-1122..\Run: [PC Suite Tray] C:\Programme\Nokia\Nokia PC Suite 7\PCSuite.exe (Nokia)
O4 - HKU\S-1-5-21-1851379012-1242461590-2316183665-1122..\Run: [TOSCDSPD] C:\Programme\Toshiba\TOSCDSPD\TOSCDSPD.exe (TOSHIBA)
O4 - HKU\S-1-5-21-1851379012-1242461590-2316183665-1122..\Run: [YnnAflICEeXU] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\YnnAflICEeXU.exe (WinTrust)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Bluetooth Manager.lnk = C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe (TOSHIBA CORPORATION.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\McAfee Security Scan Plus.lnk = C:\Programme\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1851379012-1242461590-2316183665-1122\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1851379012-1242461590-2316183665-1122\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O8 - Extra context menu item: An OneNote s&enden - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O8 - Extra context menu item: Free YouTube Download - C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\DVDVideoSoftIEHelpers\youtubedownload.htm ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_06\bin\npjpi160_06.dll (Sun Microsystems, Inc.)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab (Java Plug-in 1.6.0_06)
O16 - DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab (Java Plug-in 1.6.0_06)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab (Java Plug-in 1.6.0_06)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = PUS.local
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\ATFUS: DllName - C:\WINDOWS\system32\FpWinLogonNp.dll - C:\WINDOWS\system32\FpWinlogonNp.dll (AuthenTec,Inc)
O20 - Winlogon\Notify\TosBtNP: DllName - TosBtNP.dll - C:\WINDOWS\System32\TosBtNP.dll (TOSHIBA CORPORATION)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008.07.21 14:21:57 | 000,000,000 | -H-- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{19a13668-a840-11de-8fa6-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{19a13668-a840-11de-8fa6-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{19a13668-a840-11de-8fa6-00037a7397ad}\Shell\AutoRun\command - "" = E:\StartVMCLite.exe
O33 - MountPoints2\{19a13669-a840-11de-8fa6-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{19a13669-a840-11de-8fa6-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{19a13669-a840-11de-8fa6-00037a7397ad}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{20b335c2-01a6-11df-8fec-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{20b335c2-01a6-11df-8fec-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{20b335c2-01a6-11df-8fec-00037a7397ad}\Shell\AutoRun\command - "" = E:\StartVMCLite.exe
O33 - MountPoints2\{722742e4-b106-11df-90f5-028037ec0200}\Shell - "" = AutoRun
O33 - MountPoints2\{722742e4-b106-11df-90f5-028037ec0200}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{722742e4-b106-11df-90f5-028037ec0200}\Shell\AutoRun\command - "" = G:\USBAutoRun.exe
O33 - MountPoints2\{ab86bb8a-1fd5-11e0-9188-00037a7397ad}\Shell\AutoRun\command - "" = E:\Launcher.exe
O33 - MountPoints2\{dd4d35da-b895-11de-8fb4-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{dd4d35da-b895-11de-8fb4-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{dd4d35da-b895-11de-8fb4-00037a7397ad}\Shell\AutoRun\command - "" = E:\StartVMCLite.exe
O33 - MountPoints2\{dd4d35db-b895-11de-8fb4-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{dd4d35db-b895-11de-8fb4-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{dd4d35db-b895-11de-8fb4-00037a7397ad}\Shell\AutoRun\command - "" = E:\StartVMCLite.exe
O33 - MountPoints2\{e6e44c34-b181-11de-8fac-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{e6e44c34-b181-11de-8fac-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{e6e44c34-b181-11de-8fac-00037a7397ad}\Shell\AutoRun\command - "" = E:\StartVMCLite.exe
O33 - MountPoints2\{e6e44c35-b181-11de-8fac-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{e6e44c35-b181-11de-8fac-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{e6e44c35-b181-11de-8fac-00037a7397ad}\Shell\AutoRun\command - "" = E:\StartVMCLite.exe
O33 - MountPoints2\{e71ea992-a761-11de-8fa4-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{e71ea992-a761-11de-8fa4-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{e71ea992-a761-11de-8fa4-00037a7397ad}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe
O33 - MountPoints2\{e98294cd-0213-11df-8fef-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{e98294cd-0213-11df-8fef-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{e98294cd-0213-11df-8fef-00037a7397ad}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{ec75db12-a827-11de-8fa5-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{ec75db12-a827-11de-8fa5-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{ec75db12-a827-11de-8fa5-00037a7397ad}\Shell\AutoRun\command - "" = E:\VMC_PBStarter.exe
O33 - MountPoints2\{ec75db13-a827-11de-8fa5-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{ec75db13-a827-11de-8fa5-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{ec75db13-a827-11de-8fa5-00037a7397ad}\Shell\AutoRun\command - "" = E:\VMC_PBStarter.exe
O33 - MountPoints2\{ec75db15-a827-11de-8fa5-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{ec75db15-a827-11de-8fa5-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{ec75db15-a827-11de-8fa5-00037a7397ad}\Shell\AutoRun\command - "" = E:\StartVMCLite.exe
O33 - MountPoints2\{fb98f666-01b3-11df-8fed-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{fb98f666-01b3-11df-8fed-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{fb98f666-01b3-11df-8fed-00037a7397ad}\Shell\AutoRun\command - "" = E:\StartVMCLite.exe
O33 - MountPoints2\{fb98f667-01b3-11df-8fed-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{fb98f667-01b3-11df-8fed-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{fb98f667-01b3-11df-8fed-00037a7397ad}\Shell\AutoRun\command - "" = E:\StartVMCLite.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: 6to4 -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: Irmon -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: WmdmPmSp -  File not found
 
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Bluetooth Manager.lnk - C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe - (TOSHIBA CORPORATION.)
MsConfig - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - c:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: Camera Assistant Software - hkey= - key= - C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe (Chicony)
MsConfig - StartUpReg: DDWMon - hkey= - key= - C:\Programme\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe ()
MsConfig - StartUpReg: SmoothView - hkey= - key= - C:\Programme\Toshiba\TOSHIBA Zoom-Dienstprogramm\SmoothView.exe (TOSHIBA Corporation)
MsConfig - StartUpReg: topi - hkey= - key= - C:\Programme\TOSHIBA\Toshiba Online Product Information\topi.exe (TOSHIBA)
MsConfig - StartUpReg: TPCHWMsg - hkey= - key= -  File not found
MsConfig - StartUpReg: WinCC flexible Smart Start - hkey= - key= - C:\Programme\Siemens\SIMATIC WinCC flexible\WinCC flexible 2008\HmiSmartStart.exe (SIEMENS AG)
MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 0
MsConfig - State: "services" - 0
MsConfig - State: "startup" - 2
 
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {0E8AF1C0-D275-11d2-B803-0000F81E8383} - Windows Script Version 5.0
ActiveX: {0E8AF1C1-D275-11d2-B803-0000F81E8383} - Windows Script Version 5.0
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)
ActiveX: {10ABA7E0-3236-11d2-B7B0-0000F81E8383} - Windows Script Version 5.0
ActiveX: {10ABA7E1-3236-11d2-B7B0-0000F81E8383} - Windows Script Version 5.0
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {2F6EFCE6-10DF-49F9-9E64-9AE3775B2588} - Microsoft .NET Framework 1.1 Security Update (KB2416447)
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.8
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {73fa19d0-2d75-11d2-995d-00c04f98bbc9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {ACC563BC-4266-43f0-B6ED-9D38C4202C7E} -
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E78BFA60-5393-4C38-82AB-E8019E464EB4} - .NET Framework
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
 
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Unable to start service SrService!
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.04.24 13:05:24 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Recent
[2011.04.22 19:08:20 | 000,004,224 | -H-- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\beep.sys
[2011.04.22 19:06:24 | 000,569,344 | -H-- | C] (WinTrust) -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\YnnAflICEeXU.exe
[2011.04.13 16:43:19 | 000,000,000 | -H-D | C] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Eigene Dateien\Subsoil DVD
[2009.06.15 14:48:43 | 000,570,128 | -H-- | C] (Microsoft Corporation) -- C:\Programme\Gemeinsame Dateien\dao350.dll
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.04.24 12:54:59 | 000,001,158 | -H-- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011.04.24 12:52:03 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011.04.24 12:51:53 | 3216,216,064 | -HS- | M] () -- C:\hiberfil.sys
[2011.04.24 11:09:03 | 000,910,664 | -H-- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2011.04.24 11:09:03 | 000,794,382 | -H-- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011.04.24 11:09:03 | 000,316,468 | -H-- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2011.04.24 11:09:03 | 000,277,142 | -H-- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011.04.24 11:03:48 | 000,189,645 | -H-- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2011.04.22 19:06:24 | 000,569,344 | -H-- | M] (WinTrust) -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\YnnAflICEeXU.exe
[2011.04.21 22:52:46 | 000,000,116 | -H-- | M] () -- C:\WINDOWS\NeroDigital.ini
[2011.04.14 10:42:58 | 000,325,112 | -H-- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011.04.13 22:00:18 | 000,001,374 | -H-- | M] () -- C:\WINDOWS\imsins.BAK
[2011.04.09 17:43:18 | 000,034,816 | -H-- | M] () -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.04.09 07:34:40 | 009,452,962 | -H-- | M] () -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Desktop\073_Kirche_MatzeSabrina_poest.rar
[2011.04.01 16:11:57 | 000,000,906 | -H-- | M] () -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Desktop\DVDVideoSoft Free Studio.lnk
[2011.04.01 16:11:43 | 000,001,023 | -H-- | M] () -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Desktop\Free YouTube to MP3 Converter.lnk
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.04.24 12:24:36 | 3216,216,064 | -HS- | C] () -- C:\hiberfil.sys
[2011.04.09 07:34:37 | 009,452,962 | -H-- | C] () -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Desktop\073_Kirche_MatzeSabrina_poest.rar
[2011.04.01 16:11:51 | 000,000,906 | -H-- | C] () -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Desktop\DVDVideoSoft Free Studio.lnk
[2011.04.01 16:11:43 | 000,001,023 | -H-- | C] () -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Desktop\Free YouTube to MP3 Converter.lnk
[2011.03.10 15:50:10 | 000,000,077 | -H-- | C] () -- C:\WINDOWS\HmiSRT.ini
[2011.01.21 14:06:58 | 000,028,672 | -H-- | C] () -- C:\WINDOWS\System32\nnr.dll
[2011.01.03 18:26:15 | 000,000,008 | -H-- | C] () -- C:\WINDOWS\System32\nvModes.dat
[2010.11.07 12:58:06 | 000,000,123 | -H-- | C] () -- C:\WINDOWS\fsp5000rps.sys
[2010.06.24 17:38:49 | 000,110,592 | -H-- | C] () -- C:\WINDOWS\System32\FsUsbExDevice.Dll
[2010.06.24 17:38:49 | 000,036,608 | -H-- | C] () -- C:\WINDOWS\System32\FsUsbExDisk.Sys
[2010.06.24 17:38:39 | 000,002,528 | -H-- | C] () -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\$_hpcst$.hpc
[2010.05.19 19:33:38 | 000,626,636 | -H-- | C] () -- C:\WINDOWS\System32\drivers\fw_5711.bin
[2010.03.08 20:17:34 | 000,417,792 | -H-- | C] () -- C:\WINDOWS\System32\sn_regbase.dll
[2010.02.25 15:06:00 | 000,010,764 | -H-- | C] () -- C:\Programme\Dlist.lst
[2010.02.25 15:04:17 | 000,086,016 | -H-- | C] () -- C:\Programme\wkstn.mdb
[2010.01.19 17:13:00 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\nsreg.dat
[2010.01.18 19:58:28 | 000,000,151 | -H-- | C] () -- C:\WINDOWS\PhotoSnapViewer.INI
[2009.11.19 14:27:34 | 000,018,432 | -H-- | C] () -- C:\WINDOWS\System32\ep5711k.dll
[2009.11.19 14:27:26 | 000,021,504 | -H-- | C] () -- C:\WINDOWS\System32\ep5711j.dll
[2009.10.13 15:24:28 | 000,152,624 | -H-- | C] () -- C:\WINDOWS\System32\WIN2PDFS.DLL
[2009.10.13 15:24:28 | 000,015,360 | -H-- | C] () -- C:\WINDOWS\System32\WIN2PDFM.DLL
[2009.10.13 15:24:28 | 000,000,993 | -H-- | C] () -- C:\WINDOWS\1way.ini
[2009.09.14 12:09:29 | 000,034,816 | -H-- | C] () -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.09.10 15:42:05 | 000,000,116 | -H-- | C] () -- C:\WINDOWS\NeroDigital.ini
[2009.09.04 11:33:03 | 000,000,092 | -H-- | C] () -- C:\WINDOWS\System32\ftdiun2k.ini
[2009.09.04 10:58:29 | 000,000,400 | -H-- | C] () -- C:\WINDOWS\ODBC.INI
[2009.09.02 11:47:46 | 000,000,147 | -H-- | C] () -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2009.09.02 10:55:17 | 000,000,027 | -H-- | C] () -- C:\WINDOWS\Pcan.ini
[2009.09.02 10:50:20 | 000,016,451 | -H-- | C] () -- C:\WINDOWS\System32\OPCmessages.dll
[2009.09.02 10:50:12 | 000,000,027 | -H-- | C] () -- C:\WINDOWS\System32\pcan.ini
[2009.09.02 10:50:05 | 000,075,264 | -H-- | C] () -- C:\WINDOWS\System32\callrproxy.dll
[2009.06.15 13:46:26 | 000,062,976 | -H-- | C] () -- C:\WINDOWS\System32\scpw32a.dll
[2009.06.15 13:46:26 | 000,060,928 | -H-- | C] () -- C:\WINDOWS\System32\scpbw32a.dll
[2009.06.15 13:46:16 | 000,032,256 | -H-- | C] () -- C:\WINDOWS\System32\_UNODBC.dll
[2009.06.12 09:36:20 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\tosOBEX.INI
[2009.02.25 05:44:36 | 000,036,624 | -H-- | C] () -- C:\WINDOWS\System32\s7200L2.dll
[2008.12.15 10:11:14 | 000,979,785 | -H-- | C] () -- C:\WINDOWS\System32\drivers\fpga5711.bin
[2008.08.19 05:22:09 | 001,630,208 | -H-- | C] () -- C:\WINDOWS\System32\nwiz.exe
[2008.08.19 05:22:05 | 001,703,936 | -H-- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2008.08.19 05:22:05 | 001,019,904 | -H-- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2008.08.19 05:21:58 | 000,466,944 | -H-- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2008.08.19 05:21:50 | 001,486,848 | -H-- | C] () -- C:\WINDOWS\System32\nview.dll
[2008.08.19 05:21:46 | 001,339,392 | -H-- | C] () -- C:\WINDOWS\System32\nvdspsch.exe
[2008.08.19 05:21:32 | 000,442,368 | -H-- | C] () -- C:\WINDOWS\System32\nvappbar.exe
[2008.08.19 05:21:26 | 000,425,984 | -H-- | C] () -- C:\WINDOWS\System32\keystone.exe
[2008.07.21 15:48:27 | 000,000,061 | -H-- | C] () -- C:\WINDOWS\smscfg.ini
[2008.07.21 15:36:15 | 000,000,562 | -H-- | C] () -- C:\WINDOWS\TBTdetect.ini
[2008.07.21 15:18:31 | 000,004,161 | -H-- | C] () -- C:\WINDOWS\ODBCINST.INI
[2008.07.21 15:18:01 | 000,325,112 | -H-- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2008.07.21 15:01:49 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\NDSTray.INI
[2008.07.21 14:51:13 | 000,128,113 | -H-- | C] () -- C:\WINDOWS\System32\csellang.ini
[2008.07.21 14:51:13 | 000,045,056 | -H-- | C] () -- C:\WINDOWS\System32\csellang.dll
[2008.07.21 14:51:13 | 000,010,146 | -H-- | C] () -- C:\WINDOWS\System32\tosmreg.ini
[2008.07.21 14:51:13 | 000,007,671 | -H-- | C] () -- C:\WINDOWS\System32\cseltbl.ini
[2008.07.21 14:47:56 | 000,024,576 | -H-- | C] () -- C:\WINDOWS\System32\000StTHK.exe
[2008.07.21 14:47:48 | 000,049,152 | -H-- | C] () -- C:\WINDOWS\System32\ChCfg.exe
[2008.07.21 14:47:35 | 000,007,104 | -H-- | C] () -- C:\WINDOWS\System32\drivers\HDACfg.dat
[2008.07.21 14:37:47 | 000,028,672 | -H-- | C] () -- C:\WINDOWS\System32\ToshBIOS.dll
[2008.07.21 14:36:10 | 000,000,849 | -H-- | C] () -- C:\WINDOWS\orun32.ini
[2008.07.21 14:35:46 | 000,159,744 | -H-- | C] () -- C:\WINDOWS\MakeMrk.exe
[2008.07.21 14:35:46 | 000,000,083 | -H-- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2008.07.21 14:23:10 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2008.07.21 14:20:40 | 000,021,740 | -H-- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2008.07.21 14:14:43 | 000,910,664 | -H-- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2008.07.21 14:14:43 | 000,316,468 | -H-- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2008.07.21 14:14:43 | 000,269,480 | -H-- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2008.07.21 14:14:43 | 000,034,478 | -H-- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2008.07.21 14:14:41 | 000,794,382 | -H-- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2008.07.21 14:14:41 | 000,277,142 | -H-- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2008.07.21 14:14:41 | 000,272,128 | -H-- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2008.07.21 14:14:41 | 000,028,626 | -H-- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2008.07.21 14:14:41 | 000,004,569 | -H-- | C] () -- C:\WINDOWS\System32\secupd.dat
[2008.07.21 14:14:40 | 013,107,200 | -H-- | C] () -- C:\WINDOWS\System32\oembios.bin
[2008.07.21 14:14:40 | 000,004,598 | -H-- | C] () -- C:\WINDOWS\System32\oembios.dat
[2008.07.21 14:14:40 | 000,000,741 | -H-- | C] () -- C:\WINDOWS\System32\noise.dat
[2008.07.21 14:14:38 | 000,673,088 | -H-- | C] () -- C:\WINDOWS\System32\mlang.dat
[2008.07.21 14:14:38 | 000,046,258 | -H-- | C] () -- C:\WINDOWS\System32\mib.bin
[2008.07.21 14:14:35 | 000,218,003 | -H-- | C] () -- C:\WINDOWS\System32\dssec.dat
[2008.07.21 14:14:35 | 000,001,804 | -H-- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2007.12.21 16:46:32 | 000,118,784 | -H-- | C] () -- C:\WINDOWS\System32\TosBtAcc.dll
[2007.10.25 17:26:10 | 000,005,632 | -H-- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys
[2005.07.22 21:30:18 | 000,065,536 | -H-- | C] () -- C:\WINDOWS\System32\TosCommAPI.dll
[2005.06.10 08:46:52 | 000,049,152 | RH-- | C] () -- C:\WINDOWS\System32\FDT100.dll
[2005.04.21 10:02:28 | 000,029,184 | -H-- | C] () -- C:\WINDOWS\System32\SP32W.DLL
[2000.03.13 14:12:54 | 000,128,512 | -H-- | C] () -- C:\WINDOWS\System32\IBSUBC32.dll
[1999.11.08 14:55:46 | 000,057,344 | -H-- | C] () -- C:\WINDOWS\System32\S7oformx.dll
[1999.11.08 14:55:34 | 000,032,768 | -H-- | C] () -- C:\WINDOWS\System32\s7oformx.exe
[1999.07.16 13:37:56 | 000,136,704 | -H-- | C] () -- C:\WINDOWS\System32\TDCTRL.dll
[1996.12.19 14:37:38 | 000,103,360 | -H-- | C] () -- C:\WINDOWS\System32\S7OSC16X.DLL
[1996.12.19 14:36:48 | 000,014,848 | -H-- | C] () -- C:\WINDOWS\System32\S7OSC32X.DLL
 
========== LOP Check ==========
 
[2009.06.12 17:27:16 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\toshiba
[2009.06.12 17:27:16 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Administrator.PUS\Anwendungsdaten\toshiba
[2011.03.09 12:49:25 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Danfoss Drives
[2010.10.10 14:32:56 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Installations
[2010.06.24 17:40:21 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Suite
[2009.09.09 15:03:42 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PKWARE
[2011.01.14 13:04:33 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SEW
[2009.06.15 09:57:08 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Siemens
[2009.06.15 09:56:17 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Siemens AG
[2009.06.12 08:54:25 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TOSHIBA
[2009.06.12 17:27:17 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}
[2009.06.12 17:27:16 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Default User\Anwendungsdaten\toshiba
[2009.06.15 10:02:38 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke\Anwendungsdaten\SIEMENS AG
[2009.06.12 17:27:16 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke\Anwendungsdaten\toshiba
[2010.07.06 14:14:10 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\DVDVideoSoftIEHelpers
[2010.10.11 08:13:49 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\Nokia
[2010.10.10 14:36:34 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\PC Suite
[2009.09.09 15:03:42 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\PKWARE
[2011.04.24 13:02:24 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\PriceGong
[2010.06.24 17:38:38 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\Samsung
[2011.03.09 16:19:39 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\Siemens
[2009.10.20 12:55:21 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\SIEMENS AG
[2009.12.05 21:50:28 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\toshiba
[2009.06.12 08:52:29 | 000,000,258 | -H-- | M] () -- C:\WINDOWS\Tasks\Registrierungserinnerung 1.job
[2009.06.12 08:52:29 | 000,000,258 | -H-- | M] () -- C:\WINDOWS\Tasks\Registrierungserinnerung 2.job
[2009.06.12 08:52:29 | 000,000,258 | -H-- | M] () -- C:\WINDOWS\Tasks\Registrierungserinnerung 3.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2009.09.10 15:35:18 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\Adobe
[2010.08.29 21:04:35 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\Ahead
[2010.11.21 18:31:58 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\dvdcss
[2010.07.06 14:14:10 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\DVDVideoSoftIEHelpers
[2009.10.19 10:50:35 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\Help
[2009.06.12 17:27:10 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\Identities
[2009.06.12 17:27:10 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\InstallShield
[2009.09.10 15:36:17 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\Macromedia
[2009.09.24 08:05:29 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\Macrovision
[2010.09.29 21:55:44 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\Microsoft
[2010.01.19 17:13:07 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\Mozilla
[2010.10.11 08:13:49 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\Nokia
[2010.10.10 14:36:34 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\PC Suite
[2009.09.09 15:03:42 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\PKWARE
[2011.04.24 13:02:24 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\PriceGong
[2010.06.24 17:38:38 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\Samsung
[2011.03.09 16:19:39 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\Siemens
[2009.10.20 12:55:21 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\SIEMENS AG
[2009.06.12 17:27:10 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\Sun
[2009.12.05 21:50:28 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\toshiba
[2011.04.22 19:08:54 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\vlc
[2010.05.11 16:17:34 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\WinRAR
 
< %APPDATA%\*.exe /s >
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2008.04.14 14:00:00 | 020,108,202 | -H-- | M] () .cab file -- C:\I386\sp3.cab:AGP440.sys
[2008.04.14 14:00:00 | 020,108,202 | -H-- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2008.04.14 14:00:00 | 020,108,202 | -H-- | M] () .cab file -- C:\I386\sp3.cab:atapi.sys
[2008.04.14 14:00:00 | 020,108,202 | -H-- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008.04.14 14:00:00 | 000,096,512 | -H-- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
 
< MD5 for: EVENTLOG.DLL  >
[2008.04.14 14:00:00 | 000,056,320 | -H-- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll
 
< MD5 for: EXPLORER.EXE  >
[2008.04.14 14:00:00 | 001,036,800 | -H-- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\explorer.exe
 
< MD5 for: IASTOR.SYS  >
[2008.04.15 17:54:16 | 000,388,120 | -H-- | M] (Intel Corporation) MD5=8D58627FEF3F8767665D9F4DC91CBD97 -- C:\Programme\Intel\Intel Matrix Storage Manager\driver64\IaStor.sys
[2008.04.15 17:53:44 | 000,312,344 | -H-- | M] (Intel Corporation) MD5=DB0CC620B27A928D968C1A1E9CD9CB87 -- C:\Programme\Intel\Intel Matrix Storage Manager\driver\IaStor.sys
[2008.04.15 17:53:44 | 000,312,344 | -H-- | M] (Intel Corporation) MD5=DB0CC620B27A928D968C1A1E9CD9CB87 -- C:\WINDOWS\OemDir\iaStor.sys
[2008.04.15 17:53:44 | 000,312,344 | -H-- | M] (Intel Corporation) MD5=DB0CC620B27A928D968C1A1E9CD9CB87 -- C:\WINDOWS\system32\drivers\iaStor.sys
[2008.04.15 17:53:44 | 000,312,344 | -H-- | M] (Intel Corporation) MD5=DB0CC620B27A928D968C1A1E9CD9CB87 -- C:\WINDOWS\system32\DRVSTORE\iaAHCI_E7EB69FF3449D216602D0D37A1D73969621673A9\iaStor.sys
[2008.04.15 17:53:44 | 000,312,344 | -H-- | M] (Intel Corporation) MD5=DB0CC620B27A928D968C1A1E9CD9CB87 -- C:\WINDOWS\system32\ReinstallBackups\0013\DriverFiles\iaStor.sys
 
< MD5 for: NETLOGON.DLL  >
[2008.04.14 14:00:00 | 000,407,040 | -H-- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll
 
< MD5 for: SCECLI.DLL  >
[2008.04.14 14:00:00 | 000,187,904 | -H-- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll
 
< MD5 for: USER32.DLL  >
[2008.04.14 14:00:00 | 000,580,096 | -H-- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.04.14 14:00:00 | 000,026,624 | -H-- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2008.04.14 14:00:00 | 000,513,024 | -H-- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2008.04.14 14:00:00 | 000,012,032 | -H-- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2008.07.21 16:17:28 | 000,094,208 | -H-- | M] () -- C:\WINDOWS\system32\config\default.sav
[2008.07.21 16:17:28 | 001,093,632 | -H-- | M] () -- C:\WINDOWS\system32\config\software.sav
[2008.07.21 16:17:28 | 000,471,040 | -H-- | M] () -- C:\WINDOWS\system32\config\system.sav
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2009.03.08 05:31:44 | 000,348,160 | -H-- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\dxtmsft.dll
[2009.03.08 05:31:38 | 000,216,064 | -H-- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\dxtrans.dll
[3 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]
 
< End of report >
--- --- ---

Extras.txtOTL Logfile:
Code:
OTL Extras logfile created on: 24.04.2011 13:04:25 - Run 1
OTL by OldTimer - Version 3.2.22.3    Folder = E:\
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 75,00% Memory free
5,00 Gb Paging File | 4,00 Gb Available in Paging File | 83,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 298,09 Gb Total Space | 148,00 Gb Free Space | 49,65% Space Free | Partition Type: NTFS
Drive E: | 1,97 Gb Total Space | 1,96 Gb Free Space | 99,61% Space Free | Partition Type: FAT
 
Computer Name: TECRA | User Name: M.Schattke | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
 
[HKEY_USERS\S-1-5-21-1851379012-1242461590-2316183665-1122\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Programme\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Programme\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"4410:TCP" = 4410:TCP:LocalSubNet:Enabled:Automation License Management
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"4410:TCP" = 4410:TCP:LocalSubNet:Enabled:Automation License Management
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Programme\Siemens\SIMATIC WinCC flexible\WinCC flexible 2008\TraceServer.exe" = C:\Programme\Siemens\SIMATIC WinCC flexible\WinCC flexible 2008\TraceServer.exe:*:Enabled:WinCC flexible  - Trace Server -- (SIEMENS AG)
"C:\Programme\Gemeinsame Dateien\Siemens\SQLANY\dbsrv9.exe" = C:\Programme\Gemeinsame Dateien\Siemens\SQLANY\dbsrv9.exe:*:Enabled:Adaptive Server Anywhere Network Server -- (iAnywhere Solutions, Inc.)
"C:\Programme\Gemeinsame Dateien\Siemens\SQLANY\dbeng9.exe" = C:\Programme\Gemeinsame Dateien\Siemens\SQLANY\dbeng9.exe:*:Enabled:Adaptive Server Anywhere Database Engine -- (iAnywhere Solutions, Inc.)
"C:\WINDOWS\system32\s7otbxsx.exe" = C:\WINDOWS\system32\s7otbxsx.exe:*:Enabled:SIEMENS STEP7 Block Administration -- (SIEMENS AG)
"C:\Programme\Siemens\Step7\S7INF\S7usiapx.exe" = C:\Programme\Siemens\Step7\S7INF\S7usiapx.exe:*:Enabled:SIEMENS STEP7 S7InfoBox -- (SIEMENS AG)
"C:\Programme\Siemens\Step7\S7BIN\S7tgtopx.exe" = C:\Programme\Siemens\Step7\S7BIN\S7tgtopx.exe:*:Enabled:SIEMENS STEP7 SIMATIC Manager -- (SIEMENS AG)
"C:\Programme\Microsoft Office\Office14\GROOVE.EXE" = C:\Programme\Microsoft Office\Office14\GROOVE.EXE:*:Enabled:Microsoft SharePoint Workspace -- (Microsoft Corporation)
"C:\Programme\Microsoft Office\Office14\ONENOTE.EXE" = C:\Programme\Microsoft Office\Office14\ONENOTE.EXE:*:Enabled:Microsoft OneNote -- (Microsoft Corporation)
"C:\Programme\Microsoft Office\Office14\OUTLOOK.EXE" = C:\Programme\Microsoft Office\Office14\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook -- (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\Gemeinsame Dateien\Siemens\SQLANY\dbsrv9.exe" = C:\Programme\Gemeinsame Dateien\Siemens\SQLANY\dbsrv9.exe:*:Enabled:Adaptive Server Anywhere Network Server -- (iAnywhere Solutions, Inc.)
"C:\Programme\Siemens\Step7\S7BIN\S7tgtopx.exe" = C:\Programme\Siemens\Step7\S7BIN\S7tgtopx.exe:*:Enabled:SIEMENS STEP7 SIMATIC Manager -- (SIEMENS AG)
"C:\Programme\Siemens\Step7\S7INF\S7usiapx.exe" = C:\Programme\Siemens\Step7\S7INF\S7usiapx.exe:*:Enabled:SIEMENS STEP7 S7InfoBox -- (SIEMENS AG)
"C:\WINDOWS\system32\s7otbxsx.exe" = C:\WINDOWS\system32\s7otbxsx.exe:*:Enabled:SIEMENS STEP7 Block Administration -- (SIEMENS AG)
"C:\Programme\Siemens\SIMATIC WinCC flexible\WinCC flexible 2008\HmiES.exe" = C:\Programme\Siemens\SIMATIC WinCC flexible\WinCC flexible 2008\HmiES.exe:*:Enabled:SIMATIC WinCC flexible 2008 Application -- (SIEMENS AG)
"C:\Programme\Siemens\SIMATIC WinCC flexible\WinCC flexible 2008\TraceServer.exe" = C:\Programme\Siemens\SIMATIC WinCC flexible\WinCC flexible 2008\TraceServer.exe:*:Enabled:SIMATIC WinCC flexible 2008 Trace Server -- (SIEMENS AG)
"C:\Programme\Siemens\SIMATIC WinCC flexible\WinCC flexible 2008 Runtime\MiniWeb.exe" = C:\Programme\Siemens\SIMATIC WinCC flexible\WinCC flexible 2008 Runtime\MiniWeb.exe:*:Disabled:WinCC flexible RT Module MiniWeb -- (Siemens AG)
"C:\Programme\Siemens\SIMATIC WinCC flexible\WinCC flexible 2008 Runtime\SmartServer.exe" = C:\Programme\Siemens\SIMATIC WinCC flexible\WinCC flexible 2008 Runtime\SmartServer.exe:*:Disabled:WinCC flexible RT Module SmartServer -- (Siemens AG)
"C:\Programme\Siemens\SIMATIC WinCC flexible\WinCC flexible 2008 Runtime\HmiLoad.exe" = C:\Programme\Siemens\SIMATIC WinCC flexible\WinCC flexible 2008 Runtime\HmiLoad.exe:*:Enabled:WinCC flexible RT Module HmiLoad -- (Siemens AG)
"C:\Programme\Samsung\Samsung New PC Studio\npsasvr.exe" = C:\Programme\Samsung\Samsung New PC Studio\npsasvr.exe:*:Enabled:KTF MUSIC AoD Server -- (PeeringPortal)
"C:\Programme\Samsung\Samsung New PC Studio\npsvsvr.exe" = C:\Programme\Samsung\Samsung New PC Studio\npsvsvr.exe:*:Enabled:KTF MUSIC VoD Server -- (PeeringPortal)
"C:\Programme\RAMV\Tools\TrafoShell.exe" = C:\Programme\RAMV\Tools\TrafoShell.exe:*:Enabled:Configuration Transformer Shell for Magic Panel
"C:\FSP_5000_RPS\RAMV\Tools\TrafoShell.exe" = C:\FSP_5000_RPS\RAMV\Tools\TrafoShell.exe:*:Enabled:Configuration Transformer Shell for Magic Panel -- (BOSCH Security Systems GmbH)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{047BC977-015A-4339-B571-44CA33901F63}" = TIA Portal Single SetupPackage - HWConfig Single SetupPackage  V10.5 + SP2
"{0577A2AA-DEA0-4D40-8372-4211102D43E4}" = TOSHIBA Mic Effect
"{068B2432-7CF2-449C-97A6-95E16E7F4880}" = OZ776 SCR Driver V1.1.4.202
"{06960058-76A9-405D-8833-6D38BFC66979}" = OPC .NET API 2.00 Redistributables
"{089DD780-DB3F-4CDB-A0C2-111360247298}" = PC Connectivity Solution
"{0934A6DC-CFEF-45B3-89D7-D5F69008C4D2}" = MotionStudio 5.60
"{0D61D68B-DF5E-4635-82C7-B0C53F0A581B}" = Microsoft SQL Server 2005 Backward compatibility
"{12B3A009-A080-4619-9A2A-C6DB151D8D67}" = TOSHIBA Assist
"{13153F10-CAE7-4C15-A0B0-C51B9BA3CAAA}_is1" = fit zur schriftlichen Jägerprüfung
"{134A51EB-1BBB-4249-BAF5-494C3D186A06}" = PKZIP Server for Windows 12.40.0008
"{1ADAC261-0A9B-4672-A048-A423F5ACA4D2}" = MCT 10 Set-up Software
"{1B9B5B3B-28E7-4E59-A80D-D670AA984514}" = Nokia Connectivity Cable Driver
"{1C971EE3-B4C4-4367-9676-57549919C6CE}" = TOSHIBA Benutzerhandbücher
"{1E63ACB5-D45E-4856-8FC9-78F4B0D7BB80}" = TOSHIBA Sicherheits-Assistent
"{1E8250AD-CC1B-43A4-9E75-321806D6F256}" = WinCC flexible Graphics
"{225DB4AA-3CFF-47E8-B3C8-6DAD713E986E}" = Nokia PC Suite
"{2290A680-4083-410A-ADCC-7092C67FC052}" = Toshiba Online Product Information
"{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}" = Microsoft SQL Server 2005 Express Edition (WINCCFLEXEXPRESS)
"{2C38F661-26B7-445D-B87D-B53FE2D3BD42}" = TOSHIBA PC Diagnostic Tool
"{310358D8-48D1-4B35-A984-7DE3E88B6469}" = SEW-Communication-Server
"{31C1839C-7967-469C-921D-0BEB49AC0652}" = Totally Integrated Automation Portal V10 -  TIA Portal Single SetupPackage  V10.5 + SP2
"{3248F0A8-6813-11D6-A77B-00B0D0160060}" = Java(TM) 6 Update 6
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{37C866E4-AA67-4725-9E95-A39968DD7960}" = Camera Assistant Software for Toshiba
"{37F822E3-B56D-4131-8E3D-0A6753DFB8A5}" = TIA Portal Single SetupPackage - S7BASUCL  V10.5 + SP12
"{3A52E924-A331-4020-9E70-0270B37E8899}" = TOSHIBA F3507g Mobile Broadband Device
"{3B8D9FA4-745C-47C9-962D-4ABE6ACE136B}" = TOSHIBA Mobile Extension3
"{3EABECB0-B86C-4206-9EAC-D1A230270A30}" = Presto! BizCard5 SE
"{3EB30640-F847-4F59-AF74-837D0FD02B73}" = TIA Portal Single SetupPackage - WinCC Single SetupPackage  V10.5 + SP2
"{400830CA-F056-4BBE-80A3-9DF9CA4FB889}" = TOSHIBA Direct Disc Writer
"{42590FE2-6BD0-429E-8F83-B490B5E51564}" = Simatic WinCC flexible 2008 SP1 
"{4323A3CF-D66F-46BC-AD16-B94D7BF05CF1}" = TOSHIBA Dienstprogramm für duales Zeigegerät
"{4FD4E004-E0C0-40BB-9BB6-9AD65EC2169E}" = NetObjects Fusion 11.0
"{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}" = Microsoft SQL Server Setup Support Files (English)
"{56190F69-01D3-46CA-9861-43377C5E9B87}" = TOSHIBA Utilities
"{59F6A514-9813-47A3-948C-8A155460CC2A}" = RICOH R5C83x/84x Flash Media Controller Driver Ver.3.54.05
"{5CB1636F-2342-4AEC-A7B2-95E9EBE48F0C}" = FSP-5000-RPS
"{5DA0E02F-970B-424B-BF41-513A5018E4C0}" = TOSHIBA Disc Creator
"{64212898-097F-4F3F-AECA-6D34A7EF82DF}" = TOSHIBA Zoom-Dienstprogramm
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{69449DE8-2C9E-478A-9CD5-CE501A0CBABD}" = Hardware Support Package for KTP400 Basic KTP600 Basic V1.3 + SP1 
"{6A2D840F-065F-40F7-8F92-9EE1188EDD9B}" = MOVITOOLS® 4.90
"{6C5F3BDC-0A1B-4436-A696-5939629D5C31}" = TOSHIBA DVD PLAYER
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{6DEF11C0-35FF-4160-A543-FDD336C4DAE5}" = Microsoft SQL Server 2005 Express Edition (WINCCPLUS)
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{75F9DAD1-792C-44E9-B48B-2E22C76E0CBF}" = OPC Core Components Redistributable
"{7670D32F-DAE6-4E49-8C8B-B3F08B5B1686}" = Microsoft SQL Server Native Client
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7862BAD8-A379-4128-8AA1-EFD5A9603C53}" = Wireless Hotkey
"{7E84FAC8-C518-40F9-9807-7455301D6D25}" = SamsungConnectivityCableDriver
"{7F3B0E97-447F-4199-84E3-7745BAA2E497}" = TOSHIBA Cooling Performance Diagnostic Tool
"{8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38}" = Microsoft .NET Framework 2.0 Language Pack - DEU
"{90140000-0010-0407-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders  (German) 14
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{91140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{91510407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Visio Professional 2003
"{943D9211-567E-4DD1-83AD-9A25A6FB0E92}" = TOSHIBA Wireless Manager
"{94A90C69-71C1-470A-88F5-AA47ECC96B40}" = TOSHIBA HDD Protection
"{978F72CE-7286-4703-AE43-E5DAA5445E7E}" = SIMATIC TS Adapter IE V1.0 
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9ACBDDE2-DD2D-4103-8ECE-D1A9F7F03D1A}" = TOSHIBA Power Saver
"{9B9856F7-FB16-4EDF-81FF-6382D0733D8F}" = Prosave V7.4 incl. SP4 
"{9BB69D0F-1369-4DBD-99A9-1BC228ED1031}" = Nero 7 Essentials
"{9DECD0F9-D3E8-48B0-A390-1CF09F54E3A4}" = TOSHIBA PC Health Monitor
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ALPS Touch Pad Driver
"{9FE35071-CAB2-4E79-93E7-BFC6A2DC5C5D}" = CD/DVD Drive Acoustic Silencer
"{A2075A09-28AA-4D30-9BCC-82EAD9FA51BD}" = TrueSuite Access Manager
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A43BF6A5-D5F0-4AAA-BF41-65995063EC44}" = MSXML 6.0 Parser
"{A4A4567C-5C29-4756-992D-F84D8250C435}" = VC User 71 RTL X86 ---
"{A6690C0E-B96E-4F0F-A8EB-D5B332454AC6}" = TOSHIBA Controls
"{ABE2EE7E-11F7-4374-B86B-CB75A5F276B0}" = TIA Portal Single SetupPackage - WINCCBASUCL  V10.5 + SP12
"{AC76BA86-7AD7-1031-7B44-A81200000003}" = Adobe Reader 8.1.2 - Deutsch
"{B05827EB-0CE5-460A-83D4-5A78779DC707}" = SIMATIC TeleService V6.1 
"{B1060346-9388-4C5B-AA52-176C39819E43}" = Microsoft .NET Compact Framework 2.0 SP2
"{B3372270-9C79-42D7-BF46-00755A0C1A87}" = SIMATIC  STEP 7 V5.5 
"{B5761811-28F3-4257-B537-815C5EEF472C}" = Vodafone Mobile Connect Lite
"{B5C5E1E0-BC7F-11D4-9D38-F29C8700CB4C}" = LUST DriveManager
"{BBF5493A-05FB-4449-90DE-84A61EB78154}" = TOSHIBA SD Memory Boot Utility
"{BCB4C18A-ACA6-4383-8688-E19933A705DD}" = Microsoft SOAP Toolkit 3.0
"{BDD83DC9-BEE9-4654-A5DA-CC46C250088D}" = TOSHIBA ConfigFree
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C0FC3B56-E345-40CD-A5CB-7EB791CE3E74}" = TOSHIBA Password Utility
"{C111BA56-9ACF-42FD-92D6-ED75618AB22E}" = SIMATIC S7-PCT V2.1 
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CCC02FDD-3A54-11D6-92A8-00A0245B3AC6}" = SIMATIC HMI Symbol Library
"{CCC15FDD-3A54-11D6-92A8-00A0245B3AC6}" = SIMATIC HMI ProSave
"{CCC16FDD-3A54-11D6-92A8-00A0245B3AC6}" = SIMATIC WinCC flexible OCX
"{CCC22ADD-3A54-11D6-92A8-00A0245B3AC6}" = SIMATIC SCL Compiler
"{CCC22FDD-3A54-11D6-92A8-00A0245B3AC6}" = SIMATIC HMI License Manager Panel Plugin
"{CCC59FDD-3A54-11D6-92A8-00A0245B3AC6}" = SIMATIC WinCC flexible Tag Simulator
"{CCC60FDD-3A54-11D6-92A8-00A0245B3AC6}" = SIMATIC WinCC flexible Simulator
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}" = Bluetooth Stack for Windows by Toshiba
"{D24DB8B9-BB6C-4334-9619-BA1C650E13D3}" = Microsoft Primary Interoperability Assemblies 2005
"{D8CE69B0-9274-4b8c-BA49-0FF6A20A3C65}" = SAMSUNG SYMBIAN USB Download Driver
"{DC62C484-A0B2-421A-9A0F-1ABFE1E10D71}" = TIA Portal Single SetupPackage - STEP 7 Single SetupPackage  V10.5 + SP2
"{DD304638-64D4-43C9-8B8F-48BE23564791}" = Presto! BizCard 5 SE (Deutsche Version)
"{E487EE7D-EAAA-4E2A-9116-E3B477D8A74F}" = TOSHIBA USB Sleep and Charge Utility
"{E7084B89-69E0-46B3-A118-8F99D06988CD}" = Microsoft SQL Server VSS Writer
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{E85D273D-7191-4232-99C8-FA1703A384D1}" = Siemens Automation License Manager V5.0 + SP1 
"{EBFF48F5-3CFA-436F-8FD5-94FB01D3A0A7}" = TOSHIBA SD Memory Utilities
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F193FC0E-9E18-40FC-A974-509A1BDD240A}" = Samsung New PC Studio
"{F1D4FDEE-BB94-4C17-8BB0-AC06DAF854BD}" = TIA Portal Single SetupPackage - HW Module Base Package  V10.5 + HF1
"{F42A5B5F-0772-49C9-881D-28C95C42C3DB}" = Silicon Laboratories CP210x VCP Drivers for Windows 2000/XP/2003 Server/Vista
"{F5546185-7698-4B2A-9E34-0FA7D39D0193}" = SIMATIC WinCC flexible Runtime 2008 SP1 
"{FA02ACAC-9E14-4878-A257-92A22A647C2C}" = LG USB Modem Drivers
"{FC4C645F-8EBC-4F1E-A517-D1505B43A374}" = TOSHIBA Wireless Key Logon
"3134FEF0E1D959EC0CC2E458C94B7057B2AC0CC9" = Windows-Treiberpaket - FTDI CDM Driver Package (10/22/2009 2.06.00)
"34EA302E7F4CBD17A19E33BBCB72363234956D7E" = Windows-Treiberpaket - Nokia Modem  (06/09/2010 4.5)
"4BC3EC2E4BABE05848AA433680B60D3B274AEA2A" = Windows-Treiberpaket - SEW-EURODRIVE GmbH & Co. KG (libusb0) LibUsbDevices  (11/20/2005 20051120)
"504244733D18C8F63FF584AEB290E3904E791693" = Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0)
"88EB56038379B8B7DCFB4D2448A60F52E064B265" = Windows-Treiberpaket - FTDI CDM Driver Package (10/22/2009 2.06.00)
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"COMBIVIS5" = COMBIVIS 5
"Communication Module Runtime_is1" = Communication Module Runtime Alpha 24 (0.8.1012.0301)
"DRIVEMANAGER" = Lust DRIVEMANAGER
"DVDVideoSoftTB Toolbar" = DVDVideoSoftTB Toolbar
"E24870CB6AA1C3511635FF9020A3E9471287FBE7" = Windows-Treiberpaket - MobileTop (sshpmdm) Modem  (01/26/2008 2.6.0.0)
"EEEE705096F837B7907659F100C9FE6DA001970F" = Windows-Treiberpaket - Nokia Modem  (06/09/2010 7.01.0.7)
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4.7
"Free YouTube Download_is1" = Free YouTube Download 2.8
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.9.35.324
"FSD" = FSD
"FTDICOMM" = FTDI USB Serial Converter Drivers
"Global Drive Control V4.7" = Global Drive Control V4.7
"Global Drive Loader  -  2.2" = Global Drive Loader  -  2.2
"Global Drive Oscilloscope -  1.2" = Global Drive Oscilloscope -  1.2
"GRAPH 7" = SIMATIC S7-GRAPH V5.0
"HECI" = Intel(R) Management Engine Interface
"ie8" = Windows Internet Explorer 8
"InstallShield_{068B2432-7CF2-449C-97A6-95E16E7F4880}" = OZ776 SCR Driver V1.1.4.202
"InstallShield_{2C38F661-26B7-445D-B87D-B53FE2D3BD42}" = TOSHIBA PC-Diagnose-Tool
"InstallShield_{42590FE2-6BD0-429E-8F83-B490B5E51564}" = SIMATIC WinCC flexible 2008 SP1
"InstallShield_{56190F69-01D3-46CA-9861-43377C5E9B87}" = TOSHIBA Dienstprogramme
"InstallShield_{5CB1636F-2342-4AEC-A7B2-95E9EBE48F0C}" = FSP-5000-RPS
"InstallShield_{7F3B0E97-447F-4199-84E3-7745BAA2E497}" = TOSHIBA Kühlleistungs-Diagnosetool
"InstallShield_{9ACBDDE2-DD2D-4103-8ECE-D1A9F7F03D1A}" = TOSHIBA Power Saver
"InstallShield_{C0FC3B56-E345-40CD-A5CB-7EB791CE3E74}" = TOSHIBA Passwort-Utility
"InstallShield_{F193FC0E-9E18-40FC-A974-509A1BDD240A}" = Samsung New PC Studio
"Lenze Communication" = Lenze Communication
"LOGO!Soft Comfort V6.1" = LOGO!Soft Comfort V6.1
"McAfee Security Scan" = McAfee Security Scan Plus
"MESOL" = Intel® Active-Management-Technologie
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 2.0 Language Pack - DEU" = Microsoft .NET Framework 2.0 Language Pack - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Mobile Partner" = Mobile Partner
"Mozilla Firefox (3.5.18)" = Mozilla Firefox (3.5.18)
"Nokia PC Suite" = Nokia PC Suite
"NVIDIA Drivers" = NVIDIA Drivers
"Office14.PROPLUSR" = Microsoft Office Professional Plus 2010
"PC Adapter USB" = SIMATIC PC Adapter USB V1.2
"PEAK OEM-Treiber" = PEAK OEM-Treiber
"PROSet" = Intel(R) Network Connections Drivers
"SAMSUNG Mobile Composite Device" = SAMSUNG Mobile Composite Device Software
"SAMSUNG Mobile Modem" = SAMSUNG Mobile Modem Driver Set
"Samsung Mobile Modem Device" = Samsung Mobile Modem Device Software
"SAMSUNG Mobile Modem V2" = SAMSUNG Mobile Modem V2 Software
"Samsung Mobile phone USB driver" = Samsung Mobile phone USB driver Software
"SAMSUNG Mobile USB Modem" = SAMSUNG Mobile USB Modem Software
"SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software
"SAMSUNG USB Mobile Device" = SAMSUNG USB Mobile Device Software
"SCL" = SIMATIC S7-SCL V5.3 + SP1
"SEW MotionStudio Uninstall" = MOVITOOLS-MotionStudio
"Siemens  Totally Integrated Automation Portal V10" = Siemens  Totally Integrated Automation Portal V10
"SLABCOMM&10C4&EA60" = Silicon Laboratories CP210x USB to UART Bridge (Driver Removal)
"TDspBtn" = TOSHIBA Utility zum Bildschirmwechsel
"TFNF5" = TOSHIBA Hotkey Utility für Anzeigegeräte
"TME" = Deinstallationsprogamm für TOSHIBA Mobile Extension3
"tools 8000" = tools 8000
"TOSHIBA Software Modem" = TOSHIBA Software Modem
"TS Adapter II" = SIMATIC TS Adapter II V1.1
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VLC media player 1.0.3
"Wdf01009" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
"Win2PDF_is1" = Win2PDF 3.20.1
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows Media Player" = Windows Media Player 10
"WindowsScriptHost" = Microsoft Windows Script Host
"WinRAR archiver" = WinRAR
"WTSS7Library" = SIMATIC TeleService S7-Library V6.1
 
========== Last 10 Event Log Errors ==========
 
Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!
 
< End of report >
--- --- ---


So habe dann jetzt auch Malwarebytes durchsuchen lassen. Hier die Berichte:

mbam-log:
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6433

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

24.04.2011 20:53:08
mbam-log-2011-04-24 (20-52-58).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|W:\|X:\|Y:\|Z:\|)
Durchsuchte Objekte: 452073
Laufzeit: 3 Stunde(n), 3 Minute(n), 59 Sekunde(n)

Infizierte Speicherprozesse: 1
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 3
Infizierte Verzeichnisse: 0
Infizierte Dateien: 4

Infizierte Speicherprozesse:
c:\dokumente und einstellungen\all users\anwendungsdaten\ynnafliceexu.exe (Trojan.FakeAlert) -> 3908 -> No action taken.

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YnnAflICEeXU (Trojan.FakeAlert) -> Value: YnnAflICEeXU -> No action taken.

Infizierte Dateiobjekte der Registrierung:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallPaper (PUM.Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (PUM.Hijack.TaskManager) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (PUM.Hijack.TaskManager) -> Bad: (1) Good: (0) -> No action taken.

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\dokumente und einstellungen\all users\anwendungsdaten\ynnafliceexu.exe (Trojan.FakeAlert) -> No action taken.
c:\dokumente und einstellungen\m.schattke.pus\lokale einstellungen\Temp\jar_cache63001.tmp (Trojan.FakeAlert) -> No action taken.
c:\system volume information\_restore{dc2da2ea-21ed-457b-93c3-d3405bd437b8}\rp344\a0057944.exe (Trojan.FakeAlert) -> No action taken.
c:\system volume information\_restore{dc2da2ea-21ed-457b-93c3-d3405bd437b8}\rp344\a0057980.exe (Trojan.FakeAlert) -> No action taken.


Hoffe das das schon alles etwas weiter hilft.
Bitte um schnelle Antwort!
Danke schonmal vorweg!
MfG Oemmel

cosinus 26.04.2011 15:07
Gibt es noch weitere Logs von Malwarebytes? Wenn ja bitte alle posten, die in Malwarebytes im Reiter Logdateien sichtbar sind.

Oemmel 26.04.2011 16:01
Hallo!
Nein mehr Logs habe ich leider nicht. Bin auf dem Gebiet auch ein Neuling. Also in der Logdatei ist nur eins sichtbar.
Oder habe ich dann was falsch gemacht?
Danke im Vorraus!
MfG Oemmel

cosinus 26.04.2011 18:25
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
[2011.04.22 19:06:24 | 000,569,344 | -H-- | C] (WinTrust) -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\YnnAflICEeXU.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008.07.21 14:21:57 | 000,000,000 | -H-- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{19a13668-a840-11de-8fa6-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{19a13668-a840-11de-8fa6-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{19a13668-a840-11de-8fa6-00037a7397ad}\Shell\AutoRun\command - "" = E:\StartVMCLite.exe
O33 - MountPoints2\{19a13669-a840-11de-8fa6-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{19a13669-a840-11de-8fa6-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{19a13669-a840-11de-8fa6-00037a7397ad}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{20b335c2-01a6-11df-8fec-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{20b335c2-01a6-11df-8fec-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{20b335c2-01a6-11df-8fec-00037a7397ad}\Shell\AutoRun\command - "" = E:\StartVMCLite.exe
O33 - MountPoints2\{722742e4-b106-11df-90f5-028037ec0200}\Shell - "" = AutoRun
O33 - MountPoints2\{722742e4-b106-11df-90f5-028037ec0200}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{722742e4-b106-11df-90f5-028037ec0200}\Shell\AutoRun\command - "" = G:\USBAutoRun.exe
O33 - MountPoints2\{ab86bb8a-1fd5-11e0-9188-00037a7397ad}\Shell\AutoRun\command - "" = E:\Launcher.exe
O33 - MountPoints2\{dd4d35da-b895-11de-8fb4-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{dd4d35da-b895-11de-8fb4-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{dd4d35da-b895-11de-8fb4-00037a7397ad}\Shell\AutoRun\command - "" = E:\StartVMCLite.exe
O33 - MountPoints2\{dd4d35db-b895-11de-8fb4-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{dd4d35db-b895-11de-8fb4-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{dd4d35db-b895-11de-8fb4-00037a7397ad}\Shell\AutoRun\command - "" = E:\StartVMCLite.exe
O33 - MountPoints2\{e6e44c34-b181-11de-8fac-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{e6e44c34-b181-11de-8fac-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{e6e44c34-b181-11de-8fac-00037a7397ad}\Shell\AutoRun\command - "" = E:\StartVMCLite.exe
O33 - MountPoints2\{e6e44c35-b181-11de-8fac-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{e6e44c35-b181-11de-8fac-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{e6e44c35-b181-11de-8fac-00037a7397ad}\Shell\AutoRun\command - "" = E:\StartVMCLite.exe
O33 - MountPoints2\{e71ea992-a761-11de-8fa4-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{e71ea992-a761-11de-8fa4-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{e71ea992-a761-11de-8fa4-00037a7397ad}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe
O33 - MountPoints2\{e98294cd-0213-11df-8fef-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{e98294cd-0213-11df-8fef-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{e98294cd-0213-11df-8fef-00037a7397ad}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{ec75db12-a827-11de-8fa5-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{ec75db12-a827-11de-8fa5-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{ec75db12-a827-11de-8fa5-00037a7397ad}\Shell\AutoRun\command - "" = E:\VMC_PBStarter.exe
O33 - MountPoints2\{ec75db13-a827-11de-8fa5-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{ec75db13-a827-11de-8fa5-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{ec75db13-a827-11de-8fa5-00037a7397ad}\Shell\AutoRun\command - "" = E:\VMC_PBStarter.exe
O33 - MountPoints2\{ec75db15-a827-11de-8fa5-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{ec75db15-a827-11de-8fa5-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{ec75db15-a827-11de-8fa5-00037a7397ad}\Shell\AutoRun\command - "" = E:\StartVMCLite.exe
O33 - MountPoints2\{fb98f666-01b3-11df-8fed-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{fb98f666-01b3-11df-8fed-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{fb98f666-01b3-11df-8fed-00037a7397ad}\Shell\AutoRun\command - "" = E:\StartVMCLite.exe
O33 - MountPoints2\{fb98f667-01b3-11df-8fed-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{fb98f667-01b3-11df-8fed-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{fb98f667-01b3-11df-8fed-00037a7397ad}\Shell\AutoRun\command - "" = E:\StartVMCLite.exe
:Commands
[purity]
[resethosts]
[emptytemp]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Oemmel 26.04.2011 19:54
So das habe ich dann schonmal gemacht mit dem Fix OTL.
Hier ist das File:

All processes killed
========== OTL ==========
File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\YnnAflICEeXU.exe not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\AUTOEXEC.BAT moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{19a13668-a840-11de-8fa6-00037a7397ad}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{19a13668-a840-11de-8fa6-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{19a13668-a840-11de-8fa6-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{19a13668-a840-11de-8fa6-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{19a13668-a840-11de-8fa6-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{19a13668-a840-11de-8fa6-00037a7397ad}\ not found.
File E:\StartVMCLite.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{19a13669-a840-11de-8fa6-00037a7397ad}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{19a13669-a840-11de-8fa6-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{19a13669-a840-11de-8fa6-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{19a13669-a840-11de-8fa6-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{19a13669-a840-11de-8fa6-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{19a13669-a840-11de-8fa6-00037a7397ad}\ not found.
File F:\StartVMCLite.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{20b335c2-01a6-11df-8fec-00037a7397ad}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20b335c2-01a6-11df-8fec-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{20b335c2-01a6-11df-8fec-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20b335c2-01a6-11df-8fec-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{20b335c2-01a6-11df-8fec-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20b335c2-01a6-11df-8fec-00037a7397ad}\ not found.
File E:\StartVMCLite.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{722742e4-b106-11df-90f5-028037ec0200}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{722742e4-b106-11df-90f5-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{722742e4-b106-11df-90f5-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{722742e4-b106-11df-90f5-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{722742e4-b106-11df-90f5-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{722742e4-b106-11df-90f5-028037ec0200}\ not found.
File G:\USBAutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ab86bb8a-1fd5-11e0-9188-00037a7397ad}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ab86bb8a-1fd5-11e0-9188-00037a7397ad}\ not found.
File E:\Launcher.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dd4d35da-b895-11de-8fb4-00037a7397ad}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{dd4d35da-b895-11de-8fb4-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dd4d35da-b895-11de-8fb4-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{dd4d35da-b895-11de-8fb4-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dd4d35da-b895-11de-8fb4-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{dd4d35da-b895-11de-8fb4-00037a7397ad}\ not found.
File E:\StartVMCLite.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dd4d35db-b895-11de-8fb4-00037a7397ad}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{dd4d35db-b895-11de-8fb4-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dd4d35db-b895-11de-8fb4-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{dd4d35db-b895-11de-8fb4-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dd4d35db-b895-11de-8fb4-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{dd4d35db-b895-11de-8fb4-00037a7397ad}\ not found.
File E:\StartVMCLite.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e6e44c34-b181-11de-8fac-00037a7397ad}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e6e44c34-b181-11de-8fac-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e6e44c34-b181-11de-8fac-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e6e44c34-b181-11de-8fac-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e6e44c34-b181-11de-8fac-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e6e44c34-b181-11de-8fac-00037a7397ad}\ not found.
File E:\StartVMCLite.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e6e44c35-b181-11de-8fac-00037a7397ad}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e6e44c35-b181-11de-8fac-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e6e44c35-b181-11de-8fac-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e6e44c35-b181-11de-8fac-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e6e44c35-b181-11de-8fac-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e6e44c35-b181-11de-8fac-00037a7397ad}\ not found.
File E:\StartVMCLite.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e71ea992-a761-11de-8fa4-00037a7397ad}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e71ea992-a761-11de-8fa4-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e71ea992-a761-11de-8fa4-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e71ea992-a761-11de-8fa4-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e71ea992-a761-11de-8fa4-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e71ea992-a761-11de-8fa4-00037a7397ad}\ not found.
File C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e98294cd-0213-11df-8fef-00037a7397ad}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e98294cd-0213-11df-8fef-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e98294cd-0213-11df-8fef-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e98294cd-0213-11df-8fef-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e98294cd-0213-11df-8fef-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e98294cd-0213-11df-8fef-00037a7397ad}\ not found.
File F:\StartVMCLite.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ec75db12-a827-11de-8fa5-00037a7397ad}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ec75db12-a827-11de-8fa5-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ec75db12-a827-11de-8fa5-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ec75db12-a827-11de-8fa5-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ec75db12-a827-11de-8fa5-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ec75db12-a827-11de-8fa5-00037a7397ad}\ not found.
File E:\VMC_PBStarter.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ec75db13-a827-11de-8fa5-00037a7397ad}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ec75db13-a827-11de-8fa5-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ec75db13-a827-11de-8fa5-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ec75db13-a827-11de-8fa5-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ec75db13-a827-11de-8fa5-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ec75db13-a827-11de-8fa5-00037a7397ad}\ not found.
File E:\VMC_PBStarter.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ec75db15-a827-11de-8fa5-00037a7397ad}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ec75db15-a827-11de-8fa5-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ec75db15-a827-11de-8fa5-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ec75db15-a827-11de-8fa5-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ec75db15-a827-11de-8fa5-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ec75db15-a827-11de-8fa5-00037a7397ad}\ not found.
File E:\StartVMCLite.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fb98f666-01b3-11df-8fed-00037a7397ad}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fb98f666-01b3-11df-8fed-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fb98f666-01b3-11df-8fed-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fb98f666-01b3-11df-8fed-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fb98f666-01b3-11df-8fed-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fb98f666-01b3-11df-8fed-00037a7397ad}\ not found.
File E:\StartVMCLite.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fb98f667-01b3-11df-8fed-00037a7397ad}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fb98f667-01b3-11df-8fed-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fb98f667-01b3-11df-8fed-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fb98f667-01b3-11df-8fed-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fb98f667-01b3-11df-8fed-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fb98f667-01b3-11df-8fed-00037a7397ad}\ not found.
File E:\StartVMCLite.exe not found.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 49152 bytes

User: Administrator.PUS
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 49286 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 49286 bytes

User: LocalService
->Temp folder emptied: 65536 bytes
->Temporary Internet Files folder emptied: 386949 bytes

User: M.Schattke
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 1310 bytes

User: M.Schattke.PUS
->Temp folder emptied: 89323147 bytes
->Temporary Internet Files folder emptied: 27872368 bytes
->Java cache emptied: 2309957 bytes
->FireFox cache emptied: 85824057 bytes
->Flash cache emptied: 15632 bytes

User: M6FE4~1~SCH

User: MSCHAT~1~PUS

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 66 bytes
%systemroot% .tmp files removed: 3261 bytes
%systemroot%\System32 .tmp files removed: 8197 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 32484629 bytes
RecycleBin emptied: 2874733686 bytes

Total Files Cleaned = 2.969,00 mb


OTL by OldTimer - Version 3.2.22.3 log created on 04262011_204423

Files\Folders moved on Reboot...
File\Folder C:\WINDOWS\temp\Perflib_Perfdata_2b4.dat not found!
File\Folder C:\WINDOWS\temp\Perflib_Perfdata_514.dat not found!

Registry entries deleted on Reboot...

Wie muss ich weiter gehen?
Danke schön im Vorraus!!

MfG Oemmel

cosinus 27.04.2011 09:26
Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Vista und 7 User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

Oemmel 27.04.2011 16:00
OK hier die Log von Kaspersky:

2011/04/27 16:58:40.0796 5896 TDSS rootkit removing tool 2.4.21.0 Mar 10 2011 12:26:28
2011/04/27 16:58:41.0078 5896 ================================================================================
2011/04/27 16:58:41.0078 5896 SystemInfo:
2011/04/27 16:58:41.0078 5896
2011/04/27 16:58:41.0078 5896 OS Version: 5.1.2600 ServicePack: 3.0
2011/04/27 16:58:41.0078 5896 Product type: Workstation
2011/04/27 16:58:41.0078 5896 ComputerName: TECRA
2011/04/27 16:58:41.0078 5896 UserName: M.Schattke
2011/04/27 16:58:41.0078 5896 Windows directory: C:\WINDOWS
2011/04/27 16:58:41.0078 5896 System windows directory: C:\WINDOWS
2011/04/27 16:58:41.0078 5896 Processor architecture: Intel x86
2011/04/27 16:58:41.0078 5896 Number of processors: 2
2011/04/27 16:58:41.0078 5896 Page size: 0x1000
2011/04/27 16:58:41.0078 5896 Boot type: Normal boot
2011/04/27 16:58:41.0078 5896 ================================================================================
2011/04/27 16:58:41.0265 5896 Initialize success
2011/04/27 16:58:48.0296 2184 ================================================================================
2011/04/27 16:58:48.0296 2184 Scan started
2011/04/27 16:58:48.0296 2184 Mode: Manual;
2011/04/27 16:58:48.0296 2184 ================================================================================
2011/04/27 16:58:48.0609 2184 ACPI (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2011/04/27 16:58:48.0671 2184 ACPIEC (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\drivers\ACPIEC.sys
2011/04/27 16:58:48.0718 2184 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
2011/04/27 16:58:48.0781 2184 AFD (7618d5218f2a614672ec61a80d854a37) C:\WINDOWS\System32\drivers\afd.sys
2011/04/27 16:58:48.0828 2184 AgereSoftModem (ce91b158fa490cf4c4d487a4130f4660) C:\WINDOWS\system32\DRIVERS\AGRSM.sys
2011/04/27 16:58:48.0906 2184 AlfaFF (4490b8bdf38750458eb9b24835fda8fe) C:\WINDOWS\system32\Drivers\AlfaFF.sys
2011/04/27 16:58:48.0953 2184 ApfiltrService (3ed81e8b4709d13e5a38db2d8e792b28) C:\WINDOWS\system32\DRIVERS\Apfiltr.sys
2011/04/27 16:58:48.0968 2184 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
2011/04/27 16:58:49.0046 2184 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2011/04/27 16:58:49.0171 2184 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
2011/04/27 16:58:49.0187 2184 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2011/04/27 16:58:49.0218 2184 ATSWPDRV (4e6833f9591dc6a37e70dc188793f5be) C:\WINDOWS\system32\DRIVERS\ATSwpDrv.sys
2011/04/27 16:58:49.0250 2184 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2011/04/27 16:58:49.0359 2184 avgio (0b497c79824f8e1bf22fa6aacd3de3a0) C:\Programme\Avira\AntiVir Desktop\avgio.sys
2011/04/27 16:58:49.0406 2184 avgntflt (14fe36d8f2c6a2435275338d061a0b66) C:\WINDOWS\system32\DRIVERS\avgntflt.sys
2011/04/27 16:58:49.0453 2184 avipbb (6d52060b59e7d79cd2a044b6add1f1ef) C:\WINDOWS\system32\DRIVERS\avipbb.sys
2011/04/27 16:58:49.0468 2184 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2011/04/27 16:58:49.0484 2184 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2011/04/27 16:58:49.0500 2184 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
2011/04/27 16:58:49.0531 2184 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2011/04/27 16:58:49.0546 2184 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
2011/04/27 16:58:49.0562 2184 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2011/04/27 16:58:49.0640 2184 CmBatt (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
2011/04/27 16:58:49.0687 2184 Compbatt (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
2011/04/27 16:58:49.0796 2184 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
2011/04/27 16:58:49.0843 2184 dmboot (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys
2011/04/27 16:58:49.0984 2184 dmio (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys
2011/04/27 16:58:50.0000 2184 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2011/04/27 16:58:50.0031 2184 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
2011/04/27 16:58:50.0093 2184 dpmcslv (0bd72e62c3974c4f5e4372dba971901b) C:\WINDOWS\system32\drivers\dpmcslv.sys
2011/04/27 16:58:50.0140 2184 Dpmtrcdd (01275752a9bbaabac8ac306985fac300) C:\WINDOWS\system32\DRIVERS\dpmtrcdd.sys
2011/04/27 16:58:50.0171 2184 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
2011/04/27 16:58:50.0218 2184 e1yexpress (96967facc0307093b9098f817a4409e6) C:\WINDOWS\system32\DRIVERS\e1y5132.sys
2011/04/27 16:58:50.0281 2184 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
2011/04/27 16:58:50.0312 2184 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
2011/04/27 16:58:50.0343 2184 Fips (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys
2011/04/27 16:58:50.0359 2184 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
2011/04/27 16:58:50.0390 2184 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
2011/04/27 16:58:50.0453 2184 FsUsbExDisk (790a4ca68f44be35967b3df61f3e4675) C:\WINDOWS\system32\FsUsbExDisk.SYS
2011/04/27 16:58:50.0468 2184 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2011/04/27 16:58:50.0531 2184 FTDIBUS (b7aa8283ec551d3a3b924e520e0621a7) C:\WINDOWS\system32\drivers\ftdibus.sys
2011/04/27 16:58:50.0703 2184 Ftdisk (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2011/04/27 16:58:50.0734 2184 FTSER2K (596d31583ce332b5514520d74837f434) C:\WINDOWS\system32\drivers\ftser2k.sys
2011/04/27 16:58:50.0781 2184 fwkbdrtm (1587bd21f05076687d2896396fcbab7d) C:\WINDOWS\system32\drivers\fwkbdrtm.sys
2011/04/27 16:58:50.0812 2184 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2011/04/27 16:58:50.0859 2184 guardian2 (c0bdab85f3e8b2138c513255e2bcc4d8) C:\WINDOWS\system32\Drivers\oz776.sys
2011/04/27 16:58:50.0890 2184 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
2011/04/27 16:58:50.0953 2184 HECI (2df64415a28ce036ac6acec7645a996f) C:\WINDOWS\system32\DRIVERS\HECI.sys
2011/04/27 16:58:51.0000 2184 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2011/04/27 16:58:51.0062 2184 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
2011/04/27 16:58:51.0218 2184 hwdatacard (8adf5ef39e896a65beded878494ee2b6) C:\WINDOWS\system32\DRIVERS\ewusbmdm.sys
2011/04/27 16:58:51.0281 2184 i8042prt (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
2011/04/27 16:58:51.0328 2184 iaStor (db0cc620b27a928d968c1a1e9cd9cb87) C:\WINDOWS\system32\drivers\iaStor.sys
2011/04/27 16:58:51.0343 2184 IFXTPM (667cfdb801df771f47b7c39373c2d850) C:\WINDOWS\system32\DRIVERS\IFXTPM.SYS
2011/04/27 16:58:51.0359 2184 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
2011/04/27 16:58:51.0531 2184 IntcAzAudAddService (febb470bf0de4dbebbf72b79df993c5f) C:\WINDOWS\system32\drivers\RtkHDAud.sys
2011/04/27 16:58:51.0718 2184 intelppm (4c7d2750158ed6e7ad642d97bffae351) C:\WINDOWS\system32\DRIVERS\intelppm.sys
2011/04/27 16:58:51.0750 2184 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
2011/04/27 16:58:51.0765 2184 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2011/04/27 16:58:51.0765 2184 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2011/04/27 16:58:51.0812 2184 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2011/04/27 16:58:51.0828 2184 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2011/04/27 16:58:51.0843 2184 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
2011/04/27 16:58:51.0859 2184 isapnp (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2011/04/27 16:58:51.0890 2184 Kbdclass (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2011/04/27 16:58:51.0937 2184 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
2011/04/27 16:58:51.0984 2184 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
2011/04/27 16:58:52.0046 2184 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2011/04/27 16:58:52.0062 2184 Modem (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys
2011/04/27 16:58:52.0078 2184 Mouclass (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2011/04/27 16:58:52.0109 2184 mouhid (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2011/04/27 16:58:52.0125 2184 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
2011/04/27 16:58:52.0156 2184 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2011/04/27 16:58:52.0218 2184 MRxSmb (0ea4d8ed179b75f8afa7998ba22285ca) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2011/04/27 16:58:52.0343 2184 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
2011/04/27 16:58:52.0375 2184 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2011/04/27 16:58:52.0390 2184 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2011/04/27 16:58:52.0406 2184 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
2011/04/27 16:58:52.0421 2184 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2011/04/27 16:58:52.0437 2184 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
2011/04/27 16:58:52.0437 2184 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys
2011/04/27 16:58:52.0453 2184 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
2011/04/27 16:58:52.0500 2184 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
2011/04/27 16:58:52.0500 2184 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
2011/04/27 16:58:52.0515 2184 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2011/04/27 16:58:52.0531 2184 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2011/04/27 16:58:52.0546 2184 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2011/04/27 16:58:52.0609 2184 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
2011/04/27 16:58:52.0625 2184 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
2011/04/27 16:58:52.0656 2184 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
2011/04/27 16:58:52.0671 2184 Netdevio (1265eb253ed4ebe4acb3bd5f548ff796) C:\WINDOWS\system32\DRIVERS\netdevio.sys
2011/04/27 16:58:52.0812 2184 NETw5x32 (0888844230083ce3b47395102bca8207) C:\WINDOWS\system32\DRIVERS\NETw5x32.sys
2011/04/27 16:58:53.0000 2184 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
2011/04/27 16:58:53.0046 2184 nmwcd (c3963d85b721a7f80d8a55f4e2867a3a) C:\WINDOWS\system32\drivers\ccdcmb.sys
2011/04/27 16:58:53.0093 2184 nmwcdc (3859c69a77793180548802dac9f34a38) C:\WINDOWS\system32\drivers\ccdcmbo.sys
2011/04/27 16:58:53.0156 2184 nmwcdnsu (338f83ee9cb9e15eeacf0cbb90218cbf) C:\WINDOWS\system32\drivers\nmwcdnsu.sys
2011/04/27 16:58:53.0203 2184 nmwcdnsuc (d15bac979144fb69ed28f97b2dd84d48) C:\WINDOWS\system32\drivers\nmwcdnsuc.sys
2011/04/27 16:58:53.0234 2184 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
2011/04/27 16:58:53.0265 2184 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
2011/04/27 16:58:53.0359 2184 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2011/04/27 16:58:53.0578 2184 nv (47458b1993b62cb98702dcf8165df916) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
2011/04/27 16:58:53.0906 2184 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2011/04/27 16:58:53.0921 2184 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2011/04/27 16:58:53.0953 2184 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
2011/04/27 16:58:53.0984 2184 Parport (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\drivers\Parport.sys
2011/04/27 16:58:54.0000 2184 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
2011/04/27 16:58:54.0015 2184 ParVdm (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys
2011/04/27 16:58:54.0062 2184 pccsmcfd (fd2041e9ba03db7764b2248f02475079) C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys
2011/04/27 16:58:54.0078 2184 PCI (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys
2011/04/27 16:58:54.0093 2184 PCIIde (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\DRIVERS\pciide.sys
2011/04/27 16:58:54.0109 2184 Pcmcia (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\DRIVERS\pcmcia.sys
2011/04/27 16:58:54.0234 2184 Peakcan (41d43e6d2bd13e7db1998dead7279121) C:\WINDOWS\system32\Drivers\Peakcan.sys
2011/04/27 16:58:54.0296 2184 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2011/04/27 16:58:54.0312 2184 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
2011/04/27 16:58:54.0328 2184 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2011/04/27 16:58:54.0390 2184 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2011/04/27 16:58:54.0406 2184 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2011/04/27 16:58:54.0421 2184 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2011/04/27 16:58:54.0437 2184 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2011/04/27 16:58:54.0484 2184 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2011/04/27 16:58:54.0484 2184 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2011/04/27 16:58:54.0531 2184 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
2011/04/27 16:58:54.0546 2184 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
2011/04/27 16:58:54.0578 2184 redbook (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys
2011/04/27 16:58:54.0703 2184 rimmptsk (c2ef513bbe069f0d4ee0938a76f975d3) C:\WINDOWS\system32\DRIVERS\rimmptsk.sys
2011/04/27 16:58:54.0718 2184 rimsptsk (c398bca91216755b098679a8da8a2300) C:\WINDOWS\system32\DRIVERS\rimsptsk.sys
2011/04/27 16:58:54.0750 2184 rismxdp (2a2554cb24506e0a0508fc395c4a1b42) C:\WINDOWS\system32\DRIVERS\rixdptsk.sys
2011/04/27 16:58:54.0796 2184 s7odpx2x (4d32eb360791def1ead57cefbfe0adcf) C:\WINDOWS\System32\Drivers\S7odpx2x.sys
2011/04/27 16:58:54.0843 2184 s7oefs_x (f4e4348f0ecc78a61a190e447eb2467d) C:\WINDOWS\System32\drivers\s7oefs_x.sys
2011/04/27 16:58:54.0890 2184 S7opcsrtx (b5ceca2a3654e6e38ff795e485fbaeb1) C:\WINDOWS\system32\DRIVERS\s7opcsrtx.sys
2011/04/27 16:58:54.0953 2184 s7osmcax (d92ce0ed46fd55a705e7b0d4308e6c99) C:\WINDOWS\System32\Drivers\s7osmcax.sys
2011/04/27 16:58:55.0046 2184 s7otranx (201edaa9b5ea9953e8bb4744f1c814f4) C:\WINDOWS\System32\Drivers\s7otranx.sys
2011/04/27 16:58:55.0234 2184 s7otsadx (60b2a377cdec2f2c2eae5b02ded2f7e4) C:\WINDOWS\System32\Drivers\s7otsadx.sys
2011/04/27 16:58:55.0281 2184 S7OUPC2X (67fa72287eb80c47fd68227276e0478c) C:\WINDOWS\system32\DRIVERS\s7oupc2x.sys
2011/04/27 16:58:55.0343 2184 S7OUTS2X (4c65f1fbc44c685d539b5cadd1950722) C:\WINDOWS\system32\DRIVERS\s7outs2x.sys
2011/04/27 16:58:55.0406 2184 s7snsrtx (1b2666464be6719e1122c53eba487dd6) C:\WINDOWS\system32\DRIVERS\s7snsrtx.sys
2011/04/27 16:58:55.0453 2184 sdbus (8d04819a3ce51b9eb47e5689b44d43c4) C:\WINDOWS\system32\DRIVERS\sdbus.sys
2011/04/27 16:58:55.0468 2184 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2011/04/27 16:58:55.0515 2184 Sentinel (d23fc3f409fdbb2a5c230abc137c4b45) C:\WINDOWS\System32\Drivers\SENTINEL.SYS
2011/04/27 16:58:55.0531 2184 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
2011/04/27 16:58:55.0546 2184 Serial (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\DRIVERS\serial.sys
2011/04/27 16:58:55.0562 2184 sffdisk (0fa803c64df0914b41f807ea276bf2a6) C:\WINDOWS\system32\DRIVERS\sffdisk.sys
2011/04/27 16:58:55.0578 2184 sffp_sd (c17c331e435ed8737525c86a7557b3ac) C:\WINDOWS\system32\DRIVERS\sffp_sd.sys
2011/04/27 16:58:55.0593 2184 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\DRIVERS\sfloppy.sys
2011/04/27 16:58:55.0609 2184 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
2011/04/27 16:58:55.0687 2184 SNTIE (977ee8bba2db440fcac1bf2b8af1e7bf) C:\WINDOWS\system32\DRIVERS\sntie.sys
2011/04/27 16:58:55.0828 2184 Sony_EricssonWWSC (c159ec2ff2c1d8f83bfb005e15adf7df) C:\WINDOWS\system32\DRIVERS\toshscard.sys
2011/04/27 16:58:55.0859 2184 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
2011/04/27 16:58:55.0890 2184 sr (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys
2011/04/27 16:58:55.0937 2184 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
2011/04/27 16:58:55.0968 2184 sscdbus (d6870895fe46a464a19141440eb6cc1e) C:\WINDOWS\system32\DRIVERS\sscdbus.sys
2011/04/27 16:58:55.0984 2184 sscdmdfl (0fe167362e4689b716cdc8d93adedda8) C:\WINDOWS\system32\DRIVERS\sscdmdfl.sys
2011/04/27 16:58:56.0015 2184 sscdmdm (55a15707e32b6709242ad127e62ca55a) C:\WINDOWS\system32\DRIVERS\sscdmdm.sys
2011/04/27 16:58:56.0078 2184 ssmdrv (5ec550b8952882ee856b862cf648522d) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
2011/04/27 16:58:56.0140 2184 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
2011/04/27 16:58:56.0156 2184 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
2011/04/27 16:58:56.0156 2184 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
2011/04/27 16:58:56.0234 2184 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
2011/04/27 16:58:56.0390 2184 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2011/04/27 16:58:56.0421 2184 tdcmdpst (2f8bfbdb5824c71f672779b4b8cf8b01) C:\WINDOWS\system32\DRIVERS\tdcmdpst.sys
2011/04/27 16:58:56.0437 2184 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
2011/04/27 16:58:56.0453 2184 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
2011/04/27 16:58:56.0500 2184 tdudf (f56a9327c58ff985616c5e197472932c) C:\WINDOWS\system32\DRIVERS\tdudf.sys
2011/04/27 16:58:56.0531 2184 TEchoCan (65855534483d0c1330703100b31cac00) C:\WINDOWS\system32\DRIVERS\TEchoCan.sys
2011/04/27 16:58:56.0562 2184 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
2011/04/27 16:58:56.0593 2184 Thpdrv (f4846d3a19da42efd57efc816f1b2a62) C:\WINDOWS\system32\DRIVERS\thpdrv.sys
2011/04/27 16:58:56.0593 2184 Thpevm (beeca51c9ef368a1038e455278e4715e) C:\WINDOWS\system32\DRIVERS\Thpevm.SYS
2011/04/27 16:58:56.0609 2184 TMEI3E (684bfb1e9abb05d3f48c53f3cd16a3e6) C:\WINDOWS\system32\Drivers\TMEI3E.SYS
2011/04/27 16:58:56.0656 2184 toshbus (b917441f0f8ae5c2e2fda5a8fd30c5de) C:\WINDOWS\system32\DRIVERS\toshbus.sys
2011/04/27 16:58:56.0718 2184 toshcard (0265937f18e11810ab4533fed4bddda0) C:\WINDOWS\system32\DRIVERS\toshcard.sys
2011/04/27 16:58:56.0781 2184 toshgps (086e3cb76c68d66ccb04f70dfc94b122) C:\WINDOWS\system32\DRIVERS\toshgps.sys
2011/04/27 16:58:56.0937 2184 toshidpt (e362d54fd394999c4178936396664e57) C:\WINDOWS\system32\drivers\Toshidpt.sys
2011/04/27 16:58:56.0953 2184 toshmdfl (d3705e9e71ba6cb24efa9640e72f06eb) C:\WINDOWS\system32\DRIVERS\toshmdfl.sys
2011/04/27 16:58:56.0968 2184 toshmdfl2 (5b7ce10f4ca0238c16614b5c4bb2e365) C:\WINDOWS\system32\DRIVERS\toshmdfl2.sys
2011/04/27 16:58:57.0000 2184 toshmdm (627c02ebb15328d232fe32db669cf144) C:\WINDOWS\system32\DRIVERS\toshmdm.sys
2011/04/27 16:58:57.0062 2184 toshmdm2 (04190c7cd02ce5fcc4afb09fc4998d36) C:\WINDOWS\system32\DRIVERS\toshmdm2.sys
2011/04/27 16:58:57.0078 2184 toshnd5 (b8a93861509b167359e390c7a871f7fc) C:\WINDOWS\system32\DRIVERS\toshnd5.sys
2011/04/27 16:58:57.0093 2184 toshunic (1a11f66a40786a5c8b66068e0c6f1760) C:\WINDOWS\system32\DRIVERS\toshunic.sys
2011/04/27 16:58:57.0140 2184 tosporte (2c15b4856f929ac7dd144044d8334b54) C:\WINDOWS\system32\DRIVERS\tosporte.sys
2011/04/27 16:58:57.0187 2184 tosrfbd (cd6e9c27adc6b37b0b3df29cc83e15a7) C:\WINDOWS\system32\DRIVERS\tosrfbd.sys
2011/04/27 16:58:57.0218 2184 tosrfbnp (181e217a7a326817d97946d045b3cb46) C:\WINDOWS\system32\Drivers\tosrfbnp.sys
2011/04/27 16:58:57.0250 2184 Tosrfcom (e90ace3b4fa7a85f992bc21eb779c407) C:\WINDOWS\system32\Drivers\tosrfcom.sys
2011/04/27 16:58:57.0296 2184 tosrfec (5c4103544612e5011ef46301b93d1aa6) C:\WINDOWS\system32\DRIVERS\tosrfec.sys
2011/04/27 16:58:57.0312 2184 Tosrfhid (d3f87c46c7c9e5db99fbd3d17121b891) C:\WINDOWS\system32\DRIVERS\Tosrfhid.sys
2011/04/27 16:58:57.0328 2184 tosrfnds (c52fd27b9adf3a1f22cb90e6bcf9b0cb) C:\WINDOWS\system32\DRIVERS\tosrfnds.sys
2011/04/27 16:58:57.0359 2184 TosRfSnd (156d63f6898e4d95f2962f2b72862868) C:\WINDOWS\system32\drivers\tosrfsnd.sys
2011/04/27 16:58:57.0375 2184 Tosrfusb (98c04a6432ce9c2ad328f57b9384d348) C:\WINDOWS\system32\DRIVERS\tosrfusb.sys
2011/04/27 16:58:57.0437 2184 tos_sps32 (4399a9bf7d8f49991a07fd86590a1619) C:\WINDOWS\system32\DRIVERS\tos_sps32.sys
2011/04/27 16:58:57.0578 2184 trudf (3f9ba8878aa26d0831116733f9bc53ff) C:\WINDOWS\system32\DRIVERS\trudf.sys
2011/04/27 16:58:57.0593 2184 TVALZ (73d3312955f805054e32fabdca5230b1) C:\WINDOWS\system32\DRIVERS\TVALZ.SYS
2011/04/27 16:58:57.0625 2184 TVALZFL (e03f5ca8d4edb4ce8141a3242e1261f8) C:\WINDOWS\system32\DRIVERS\TVALZFL.sys
2011/04/27 16:58:57.0640 2184 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
2011/04/27 16:58:57.0656 2184 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
2011/04/27 16:58:57.0718 2184 upperdev (0ccadc7391021376edbb8aa649d04e68) C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys
2011/04/27 16:58:57.0765 2184 usbaudio (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys
2011/04/27 16:58:57.0828 2184 usbbus (9419faac6552a51542dbba02971c841c) C:\WINDOWS\system32\DRIVERS\lgusbbus.sys
2011/04/27 16:58:57.0875 2184 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2011/04/27 16:58:57.0906 2184 UsbDiag (c0a466fa4ffec464320e159bc1bbdc0c) C:\WINDOWS\system32\DRIVERS\lgusbdiag.sys
2011/04/27 16:58:57.0921 2184 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2011/04/27 16:58:57.0937 2184 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2011/04/27 16:58:57.0953 2184 USBModem (f74a54774a9b0afeb3c40adec68aa600) C:\WINDOWS\system32\DRIVERS\lgusbmodem.sys
2011/04/27 16:58:58.0000 2184 usbmp (b6610e3de8d1ee8574f957d1060f1d7f) C:\WINDOWS\system32\Drivers\usbmp.sys
2011/04/27 16:58:58.0140 2184 usbser (1c888b000c2f9492f4b15b5b6b84873e) C:\WINDOWS\system32\drivers\usbser.sys
2011/04/27 16:58:58.0156 2184 UsbserFilt (68b4f83cccf70a2ff32ee142c234332a) C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys
2011/04/27 16:58:58.0203 2184 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2011/04/27 16:58:58.0250 2184 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
2011/04/27 16:58:58.0296 2184 usbvideo (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINDOWS\system32\Drivers\usbvideo.sys
2011/04/27 16:58:58.0328 2184 UVCFTR (8c5094a8ab24de7496c7c19942f2df04) C:\WINDOWS\system32\Drivers\UVCFTR_S.SYS
2011/04/27 16:58:58.0343 2184 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
2011/04/27 16:58:58.0390 2184 VolSnap (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys
2011/04/27 16:58:58.0421 2184 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2011/04/27 16:58:58.0500 2184 Wdf01000 (d918617b46457b9ac28027722e30f647) C:\WINDOWS\system32\Drivers\wdf01000.sys
2011/04/27 16:58:58.0578 2184 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
2011/04/27 16:58:58.0625 2184 WmiAcpi (c42584fd66ce9e17403aebca199f7bdb) C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
2011/04/27 16:58:58.0656 2184 WpdUsb (c1b3d9d75c3fb735f5fa3a5806aded57) C:\WINDOWS\system32\Drivers\wpdusb.sys
2011/04/27 16:58:58.0687 2184 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
2011/04/27 16:58:58.0906 2184 ================================================================================
2011/04/27 16:58:58.0906 2184 Scan finished
2011/04/27 16:58:58.0906 2184 ================================================================================

Oemmel 27.04.2011 16:05
Ja cool! Danke sind jetzt schonmal alle dateien und ordner wieder da!!! *FREU*

Danke danke!!

cosinus 27.04.2011 18:32
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.
http://saved.im/mtm0nzyzmzd5/cofi.jpg
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Oemmel 28.04.2011 10:41
Habe erst CCleaner gestartet das hat auch soweit geklappt. Dann habe ich Combofix gestartet, musste erst updaten, habe ich auch gemacht, dann sollte ich die Wiederherstellungskonsole installieren, habe ich dann gemacht, dann fing es an zu laufen und auf mal ging der Bildschirm auf blau zeigt kurz ein parr texte an, glaube von wegen schwerwiegender Fehler oder so, und der Laptop startete dann aufmal neu. Habe jetzt die Text Datei nicht und wenn ich auch meine Festplatte gucke zeigt er da nichts mehr an. Habe ich etwas falsch gemacht??
Danke schonmal!!

Oemmel 28.04.2011 12:28
Wollte versuchen nen Screenshot hoch zu laden. Aber klappt irgendwie nicht.

cosinus 28.04.2011 15:40
Starte Windows neu, lösch die alte cofi.exe, lade CF neu als cofi.exe runter und probier es bitte nochmal.

Oemmel 28.04.2011 16:10
So habe das jetzt nochmal gemacht, aber kam wieder das selbe. Habe CF gestartet, der macht dann bis ca Stufe 50 und dann wird der Desktop blau mit vielen texten aber wird sofort schwarz und startet neu. Nachdem der hochgefahren ist kommt eine kleine einblendung von wegen nach einem schwerwiegenden Fehler wurde Windows neu gestartet....
Und auf die Festplatte kann ich immer noch nicht zu greifen, da sehe ich nur die Daten die ich neu installiert habe.
Mache ich etwas falsch?? MfG Oemmel

cosinus 28.04.2011 18:42
Ich brauch den Quarantäneordner von Combofix. Bitte folgendes machen:

1.) GANZ WICHTIG!! Virenscanner deaktivieren, der darf da nicht rummurksen!
2.) Ordner C:\Qoobox in eine Datei zippen
3.) die erstellte ZIP-Datei hier hochladen => http://www.trojaner-board.de/54791-a...ner-board.html
4.) Wenns erfolgreich war Bescheid sagen
5.) Erst dann wieder den Virenscanner einschalten

Oemmel 28.04.2011 19:10
So habe die Datei hochgeladen ist aber ne rar datei. Hoffe es hat auch geklappt

cosinus 28.04.2011 19:21
Hm, das Ding ist unbrauchbar, offensichtlich hat CF garnichts gemacht :(

Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.


Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.
  • Doppelklick auf die MBRCheck.exe.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Das Tool braucht nur wenige Sekunden.
  • Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.
Poste mir bitte den Inhalt des .txt Dokumentes

Oemmel 28.04.2011 19:54
Wenn ich GMR starten will stürzt der Laptop immer ab. Es kommt dann auch der blaue Dektop mit dem ganzen Texten, nur der ist so schnell wieder weg das man nichts lesen kann. Versuche jetzt OSAM.

Oemmel 28.04.2011 20:03
So hier sind die OSAM Logs.
OSAM Logfile:
Code:
Report of OSAM: Autorun Manager v5.0.11926.0
Online Solutions. Complex Protection for Information Systems
Saved at 21:02:06 on 28.04.2011

OS: Windows XP Professional Service Pack 3 (Build 2600)
Default Browser: Mozilla Corporation Firefox 3.5.18

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"DDCommCPL.cpl" - ? - C:\WINDOWS\system32\DDCommCPL.cpl  (File found, but it contains no detailed information)
"fwDH485Cpl.cpl" - "Siemens AG" - C:\WINDOWS\system32\fwDH485Cpl.cpl
"Hwsetup.cpl" - "TOSHIBA Corp." - C:\WINDOWS\system32\Hwsetup.cpl
"infocardcpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\infocardcpl.cpl
"ISUSPM.cpl" - "Macrovision Corporation" - C:\WINDOWS\system32\ISUSPM.cpl
"javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl
"LocalCOM.cpl" - "TOSHIBA CORPORATION" - C:\WINDOWS\system32\LocalCOM.cpl
"nvcpl.cpl" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvcpl.cpl
"nvtuicpl.cpl" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvtuicpl.cpl
"Pcan2.cpl" - "PEAK-System Technik GmbH" - C:\WINDOWS\system32\Pcan2.cpl
"S7epaepx.cpl" - "SIEMENS AG" - C:\WINDOWS\system32\S7epaepx.cpl
"S7EPATDX.CPL" - "SIEMENS AG" - C:\WINDOWS\system32\S7EPATDX.CPL
"S7UBCPLX.CPL" - "SIEMENS AG" - C:\WINDOWS\system32\S7UBCPLX.CPL
"SimaticInternetSettings.cpl" - "Siemens AG" - C:\WINDOWS\system32\SimaticInternetSettings.cpl
"ThpProp.cpl" - "TOSHIBA Corporation" - C:\WINDOWS\system32\ThpProp.cpl
"Tmeprop.cpl" - "TOSHIBA Corp." - C:\WINDOWS\system32\Tmeprop.cpl
"TOSCDSPD.cpl" - ? - C:\WINDOWS\system32\TOSCDSPD.cpl  (File found, but it contains no detailed information)
"TPwrSave.cpl" - "TOSHIBA Corporation" - C:\WINDOWS\system32\TPwrSave.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"Avira AntiVir Personal - Free Antivirus " - "Avira GmbH" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl
"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\MLCFG32.CPL
"Nero BurnRights" - "Nero AG" - C:\Programme\Nero\Nero 7\Nero Toolkit\NeroBurnRights.cpl
"NokiaConnectionManager" - "Nokia" - C:\PROGRA~1\Nokia\NOKIAP~1\CONNEC~1.CPL
"ToshSrv" - "TOSHIBA Corporation" - C:\Programme\TOSHIBA\TOSHIBA Controls\ToshSrv.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"AlfaFF mini-filter driver" (AlfaFF) - "Alfa Corporation" - C:\WINDOWS\System32\Drivers\AlfaFF.sys
"avgio" (avgio) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avgio.sys
"avgntflt" (avgntflt) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avipbb.sys
"catchme" (catchme) - ? - C:\DOKUME~1\MSCHAT~1.PUS\LOKALE~1\Temp\catchme.sys  (File not found)
"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys  (File not found)
"dpmcslv" (dpmcslv) - "Siemens AG" - C:\WINDOWS\system32\drivers\dpmcslv.sys
"Dpmtrcdd" (Dpmtrcdd) - "SIEMENS AG" - C:\WINDOWS\System32\DRIVERS\dpmtrcdd.sys
"FsUsbExDisk" (FsUsbExDisk) - ? - C:\WINDOWS\system32\FsUsbExDisk.SYS  (File found, but it contains no detailed information)
"fwkbdrtm" (fwkbdrtm) - "Siemens AG" - C:\WINDOWS\system32\drivers\fwkbdrtm.sys
"i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys  (File not found)
"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)
"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)
"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)
"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)
"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)
"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)
"Peakcan" (Peakcan) - "PEAK-System Technik GmbH, Darmstadt, Germany" - C:\WINDOWS\System32\Drivers\Peakcan.sys
"PROFINET IO RT-Protocol (LLDP)" (S7opcsrtx) - "SIEMENS AG" - C:\WINDOWS\System32\DRIVERS\s7opcsrtx.sys
"PROFINET IO RT-Protocol V1.0" (s7snsrtx) - "SIEMENS AG" - C:\WINDOWS\System32\DRIVERS\s7snsrtx.sys
"s7osmcax" (s7osmcax) - "SIEMENS AG" - C:\WINDOWS\System32\Drivers\s7osmcax.sys
"s7otranx" (s7otranx) - "SIEMENS AG" - C:\WINDOWS\System32\Drivers\s7otranx.sys
"s7otsadx" (s7otsadx) - "SIEMENS AG" - C:\WINDOWS\System32\Drivers\s7otsadx.sys
"Sentinel" (Sentinel) - "Rainbow Technologies, Inc." - C:\WINDOWS\System32\Drivers\SENTINEL.SYS
"SIMATIC Industrial Ethernet (ISO)" (SNTIE) - "SIEMENS AG" - C:\WINDOWS\System32\DRIVERS\sntie.sys
"SIMATIC MPI/EFS Driver" (s7oefs_x) - "SIEMENS AG" - C:\WINDOWS\System32\drivers\s7oefs_x.sys
"SIMATIC MPI/PROFIBUS DPX2 Driver" (s7odpx2x) - "SIEMENS AG" - C:\WINDOWS\System32\Drivers\S7odpx2x.sys
"SIMATIC TS Adapter II Driver" (S7OUTS2X) - "SIEMENS AG" - C:\WINDOWS\System32\DRIVERS\s7outs2x.sys
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\ssmdrv.sys
"TMEI3E" (TMEI3E) - "Toshiba Corporation" - C:\WINDOWS\System32\Drivers\TMEI3E.SYS
"TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver" (TVALZFL) - "TOSHIBA Corporation" - C:\WINDOWS\System32\DRIVERS\TVALZFL.sys
"TOSHIBA Network Device Usermode I/O Protocol" (Netdevio) - "TOSHIBA Corporation." - C:\WINDOWS\System32\DRIVERS\netdevio.sys
"usbmp" (usbmp) - "Bosch GmbH, Germany" - C:\WINDOWS\System32\Drivers\usbmp.sys
"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)

[Explorer]
-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----
{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{7D4D6379-F301-4311-BEBA-E26EB0561882} "NeroDigitalColumnHandler Class" - "Nero AG" - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroDigitalExt.dll
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - c:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{807553E5-5146-11D5-A672-00B0D022E945} "text/xml" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----
{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{3D60EDA7-9AB4-4DA8-864C-D9B5F2E7281D} "Arbeitsbereiche" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
{45C6AFA5-2C13-402f-BC5D-45CC8172EF6B} "Bluetooth-Informationsaustausch" - "TOSHIBA" - C:\WINDOWS\system32\TosBtExt.dll
{D66DC78C-4F61-447F-942B-3FB6980118CF} "CInfoTipShellExt Class" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Visio11\VISSHE.DLL
{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - deskpan.dll  (File not found)
{1CDB2949-8F65-4355-8456-263E7C208A5D} "Desktop Explorer" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll
{1E9B04FB-F9E5-4718-997B-B8DA88302A47} "Desktop Explorer Menu" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll
{9A2DDB3F-AA13-4EAA-8EF5-962A7ABE1D0E} "FilePtcMenu" - "Arachnoid Biometrics Identification Group Corp." - C:\Programme\TrueSuite Access Manager\FilePtcMenu.dll
{1D2680C9-0E2A-469d-B787-065558BC7D43} "Fusion Cache" - "Microsoft Corporation" - c:\WINDOWS\system32\mscoree.dll
{99FD978C-D287-4F50-827F-B2C658EDA8E7} "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} "Groove Explorer Icon Overlay 2 (GFS Stub)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
{920E6DB1-9907-4370-B3A0-BAFC03D81399} "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
{16F3DD56-1AF5-4347-846D-7C10C4192619} "Groove Explorer Icon Overlay 3 (GFS Folder)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
{2916C86E-86A6-43FE-8112-43ABE6BF8DCC} "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
{2A541AE1-5BF6-4665-A8A3-CFA9672E4291} "Groove Folder Synchronization" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
{6C467336-8281-4E60-8204-430CED96822D} "Groove GFS Context Menu Handler" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
{A449600E-1DC6-4232-B948-9BD794D62056} "Groove GFS Stub Icon Handler" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
{387E725D-DC16-4D76-B310-2C93ED4752A0} "Groove XML Icon Handler" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
{A4EEBF66-92EB-4F2A-9F1E-2F6D14B30DA6} "IconOvrly" - "Arachnoid Biometrics Identification Group Corp." - C:\Programme\TrueSuite Access Manager\IconOvrly.dll
{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -  (File not found | COM-object registry key not found)
{506F4668-F13E-4AA1-BB04-B43203AB3CC0} "ImageExtractorShellExt Class" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Visio11\VISSHE.DLL
{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -  (File not found | COM-object registry key not found)
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office14\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE14\msoshext.dll
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE14\msoshext.dll
{0875DCB6-C686-4243-9432-ADCCF0B9F2D7} "Microsoft OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office14\ONFILTER.DLL
{00020D75-0000-0000-C000-000000000046} "Microsoft Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\MLSHEXT.DLL
{B327765E-D724-4347-8B16-78AE18552FC3} "NeroDigitalIconHandler Class" - "Nero AG" - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroDigitalExt.dll
{7F1CF152-04F8-453A-B34C-E609530A9DC8} "NeroDigitalPropSheetHandler Class" - "Nero AG" - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroDigitalExt.dll
{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A} "Nokia Phone Browser" - "Nokia" - C:\Programme\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
{1E9B04FB-F9E5-4718-997B-B8DA88302A48} "nView Desktop Context Menu" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll
{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office14\OLKFSTUB.DLL
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\shlext.dll
{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - c:\WINDOWS\system32\dfshim.dll
{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -  (File not found | COM-object registry key not found)
{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - c:\WINDOWS\system32\dfshim.dll
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Web Folders" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\MSONSEXT.DLL
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Programme\WinRAR\rarext.dll

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "DVDVideoSoftTB Toolbar" - "Conduit Ltd." - C:\Programme\DVDVideoSoftTB\tbDVD1.dll
ITBar7Height "ITBar7Height" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBarLayout" - ? -  (File not found | COM-object registry key not found)
-----( HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks )-----
{872b5b88-9db5-4310-bdd0-ac189557e5f5} "DVDVideoSoftTB Toolbar" - "Conduit Ltd." - C:\Programme\DVDVideoSoftTB\tbDVD1.dll
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_06" - "Sun Microsystems, Inc." - C:\Programme\Java\jre1.6.0_06\bin\npjpi160_06.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} "Java Plug-in 1.6.0_06" - "Sun Microsystems, Inc." - C:\Programme\Java\jre1.6.0_06\bin\npjpi160_06.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_06" - "Sun Microsystems, Inc." - C:\Programme\Java\jre1.6.0_06\bin\npjpi160_06.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll
{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBC} "ClsidExtension" - "Sun Microsystems, Inc." - C:\Programme\Java\jre1.6.0_06\bin\npjpi160_06.dll
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Recherchieren" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
{FFFDC614-B694-4AE6-AB38-5D6374584B52} "Verknüpfte &OneNote-Notizen" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
{872b5b88-9db5-4310-bdd0-ac189557e5f5} "DVDVideoSoftTB Toolbar" - "Conduit Ltd." - C:\Programme\DVDVideoSoftTB\tbDVD1.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader" - "Adobe Systems Incorporated" - c:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
{872b5b88-9db5-4310-bdd0-ac189557e5f5} "DVDVideoSoftTB Toolbar" - "Conduit Ltd." - C:\Programme\DVDVideoSoftTB\tbDVD1.dll
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
{B4F3A835-0E21-4959-BA22-42B3008E02FF} "Office Document Cache Handler" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} "SSVHelper Class" - "Sun Microsystems, Inc." - C:\Programme\Java\jre1.6.0_06\bin\ssv.dll

[Logon]
-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----
"Bluetooth Manager.lnk" - "TOSHIBA CORPORATION." - C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe  (Shortcut exists | File exists)
"desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini
-----( %UserProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\M.Schattke.PUS\Startmenü\Programme\Autostart\desktop.ini
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"AutoStartNPSAgent" - "Samsung Electronics Co., Ltd." - C:\Programme\Samsung\Samsung New PC Studio\NPSAgent.exe
"ISUSPM" - "Macrovision Corporation" - "C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Macrovision\FLEXnet Connect\6\ISUSPM.exe" -scheduler
"PC Suite Tray" - "Nokia" - "C:\Programme\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
"TOSCDSPD" - "TOSHIBA" - C:\Programme\TOSHIBA\TOSCDSPD\toscdspd.exe
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"000StTHK" - ? - 000StTHK.exe  (File found, but it contains no detailed information)
"00THotkey" - "TOSHIBA Corporation" - C:\WINDOWS\system32\00THotkey.exe
"avgnt" - "Avira GmbH" - "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
"BCSSync" - "Microsoft Corporation" - "C:\Programme\Microsoft Office\Office14\BCSSync.exe" /DelayServices
"DpUtil" - "TOSHIBA" - C:\Programme\TOSHIBA\DualPointUtility\TEDTray.exe
"FingerPrintNotifer" - "AuthenTec, Inc" - "C:\Programme\TrueSuite Access Manager\FpNotifier.exe"
"ITSecMng" - " TOSHIBA CORPORATION" - %ProgramFiles%\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe /START
"NDSTray.exe" - ? - NDSTray.exe  (File not found)
"NeroFilterCheck" - "Nero AG" - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe
"NVRotateSysTray" - "NVIDIA Corporation" - rundll32.exe C:\WINDOWS\system32\nvsysrot.dll,Enable
"nwiz" - "NVIDIA Corporation" - nwiz.exe /installquiet /keeploaded /nodetect
"picon" - "Intel Corporation" - "C:\Programme\Gemeinsame Dateien\Intel\Privacy Icon\PrivacyIconClient.exe" -startup
"PwdBank" - "Arachnoid Biometrics Identification Group" - "C:\Programme\TrueSuite Access Manager\PwdBank.exe"
"S7UB Start" - "SIEMENS AG" - "C:\Programme\Gemeinsame Dateien\Siemens\S7ubtoox\s7ubtstx.exe" -StartDB
"SiemensAutomationFileStorage" - "Siemens AG" - C:\Programme\Siemens\Automation\Portal V10\Bin\Siemens.Automation.ObjectFrame.FileStorage.Server.exe preload
"TAudEffect" - "TOSHIBA" - C:\Programme\TOSHIBA\TAudEffect\TAudEff.exe /run
"TFncKy" - ? - TFncKy.exe  (File not found)
"TFNF5" - "TOSHIBA Corp." - TFNF5.exe
"ThpSrv" - "TOSHIBA Corporation" - C:\WINDOWS\system32\thpsrv /logon
"TMERzCtl.EXE" - "TOSHIBA" - C:\Programme\TOSHIBA\TME3\TMERzCtl.EXE /Service
"TMESRV.EXE" - "TOSHIBA" - C:\Programme\TOSHIBA\TME3\TMESRV31.EXE /Logon
"TOSDCR" - "TOSHIBA Corporation" - TOSDCR.EXE
"TOSHIBA_3G_UTY" - "TOSHIBA CORPORATION" - C:\Programme\Toshiba\3GUty\TW3GCTRL.exe
"TosHKCW.exe" - "TOSHIBA CORPORATION" - "C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe"
"TPSMain" - "TOSHIBA Corporation" - TPSMain.exe
"TPSODDCtl" - "TOSHIBA Corporation" - TPSODDCtl.exe
"UsbMonitor" - ? - "C:\Programme\TrueSuite Access Manager\usbnotify.exe"  (File found, but it contains no detailed information)

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"Toshiba Bluetooth Monitor" - "TOSHIBA CORPORATION." - C:\WINDOWS\system32\tbtmon.dll
"Win2PDF Port" - ? - C:\WINDOWS\system32\win2pdfm.dll  (File found, but it contains no detailed information)

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
"3G RF Power Control Utility" (TW3GSVC) - "TOSHIBA CORPORATION" - C:\Programme\Toshiba\3GUty\tw3gsvc.exe
"ASP.NET-Zustandsdienst" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
"Authentec memory manager service" (Authentec memory manager) - "AuthenTec Inc." - C:\WINDOWS\system32\TAMSvr.exe
"Automation License Manager Service" (almservice) - "SIEMENS AG" - C:\Programme\Gemeinsame Dateien\Siemens\sws\almsrv\almsrvx.exe
"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avguard.exe
"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\sched.exe
"ConfigFree Service" (CFSvcs) - "TOSHIBA CORPORATION" - C:\Programme\TOSHIBA\ConfigFree\CFSvcs.exe
"Fingerprint Server" (FingerprintServer) - "AuthenTec,Inc" - C:\WINDOWS\system32\FpLogonServ.exe
"FsUsbExService" (FsUsbExService) - "Teruten" - C:\WINDOWS\system32\FsUsbExService.Exe
"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
"Intel(R) Active Management Technology Local Management Service" (LMS) - "Intel Corporation" - C:\Programme\Intel\AMT\LMS.exe
"Intel(R) Active Management Technology User Notification Service" (UNS) - "Intel Corporation" - C:\Programme\Gemeinsame Dateien\Intel\Privacy Icon\UNS\UNS.exe
"MCT10 Service" (MCT10 Service) - ? - C:\Programme\Danfoss Drives\VLT Motion Control Tool\MCT 10 Set-up Software\MCTServ.exe  (File found, but it contains no detailed information)
"Microsoft SharePoint Workspace Audit Service" (Microsoft SharePoint Workspace Audit Service) - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office14\GROOVE.EXE
"Office  Source Engine" (ose) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE
"Office Software Protection Platform" (osppsvc) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
"OpcEnum" (OpcEnum) - "OPC Foundation" - C:\WINDOWS\system32\OpcEnum.exe
"S7 Global Services" (s7asysvx) - "SIEMENS AG" - C:\Programme\Siemens\Step7\S7BIN\s7asysvx.exe
"S7TraceServiceX" (S7TraceServiceX) - "SIEMENS AG" - C:\Programme\Gemeinsame Dateien\Siemens\Automation\TraceEngine\bin\S7TraceServiceX.exe
"ServiceLayer" (ServiceLayer) - "Nokia" - C:\Programme\PC Connectivity Solution\ServiceLayer.exe
"SIMATIC IEPG Help Service" (s7oiehsx) - "SIEMENS AG" - C:\Programme\Gemeinsame Dateien\Siemens\S7IEPG\s7oiehsx.exe
"SQL Server (WINCCFLEXEXPRESS)" (MSSQL$WINCCFLEXEXPRESS) - "Microsoft Corporation" - c:\Programme\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
"SQL Server (WINCCPLUS)" (MSSQL$WINCCPLUS) - "Microsoft Corporation" - c:\Programme\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe
"SQL Server Browser" (SQLBrowser) - "Microsoft Corporation" - c:\Programme\Microsoft SQL Server\90\Shared\sqlbrowser.exe
"SQL Server VSS Writer" (SQLWriter) - "Microsoft Corporation" - c:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe
"Tmesrv3" (Tmesrv) - "TOSHIBA" - C:\Programme\TOSHIBA\TME3\Tmesrv31.exe
"TOSHIBA Bluetooth Service" (TOSHIBA Bluetooth Service) - "TOSHIBA CORPORATION" - c:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
"TOSHIBA Festplattenschutz" (Thpsrv) - "TOSHIBA Corporation" - C:\WINDOWS\system32\ThpSrv.exe
"TOSHIBA Navi Support Service" (TNaviSrv) - "TOSHIBA Corporation" - C:\Programme\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
"TOSHIBA Optical Disc Drive Service" (TODDSrv) - "TOSHIBA Corporation" - C:\WINDOWS\system32\TODDSrv.exe
"TPCH Service" (TPCHSrv) - "TOSHIBA Corporation" - C:\Programme\TOSHIBA\TPHM\TPCHSrv.exe
"TransferTool" (TransferTool) - "Bosch" - C:\FSP_5000_RPS\RAMV\Tools\TransferTool.exe
"TransferToolNet" (TransferToolNet) - "Bosch" - C:\FSP_5000_RPS\RAMV\Tools\TransferToolNet.exe
"Windows CardSpace" (idsvc) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
"Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe

[Winlogon]
-----( HKCU\Control Panel\IOProcs )-----
"MVB" - ? - mvfs32.dll  (File not found)
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----
"ATFUS" - "AuthenTec,Inc" - C:\WINDOWS\system32\FpWinLogonNp.dll
"TosBtNP" - "TOSHIBA CORPORATION" - C:\WINDOWS\system32\TosBtNP.dll
"WgaLogon" - "Microsoft Corporation" - C:\WINDOWS\system32\WgaLogon.dll

===[ Logfile end ]=========================================[ Logfile end ]===
--- --- ---
If You have questions or want to get some help, You can visit Online Solutions :: Index

Oemmel 28.04.2011 20:06
Und hier den MBR Text:

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Professional
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x03c0000c

Kernel Drivers (total 176):
0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
0x806E6000 \WINDOWS\system32\hal.dll
0xBA5A8000 \WINDOWS\system32\KDCOM.DLL
0xBA4B8000 \WINDOWS\system32\BOOTVID.dll
0xB9F78000 ACPI.sys
0xBA5AA000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xB9F67000 pci.sys
0xBA0A8000 isapnp.sys
0xBA0B8000 ohci1394.sys
0xBA0C8000 \WINDOWS\system32\DRIVERS\1394BUS.SYS
0xBA4BC000 compbatt.sys
0xBA4C0000 \WINDOWS\system32\DRIVERS\BATTC.SYS
0xBA328000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xB9F49000 pcmcia.sys
0xBA0D8000 MountMgr.sys
0xB9F2A000 ftdisk.sys
0xBA5AC000 dmload.sys
0xB9F04000 dmio.sys
0xBA330000 PartMgr.sys
0xBA0E8000 VolSnap.sys
0xB9E1E000 iaStor.sys
0xBA0F8000 disk.sys
0xBA108000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xB9DFE000 fltMgr.sys
0xB9DEC000 sr.sys
0xBA118000 AlfaFF.sys
0xB9DD5000 \WINDOWS\system32\Drivers\ksecdd.sys
0xB9D48000 Ntfs.sys
0xB9D1B000 NDIS.sys
0xBA338000 TVALZ.SYS
0xB9CD8000 tos_sps32.sys
0xBA5AE000 Thpevm.SYS
0xBA340000 thpdrv.sys
0xB9CBE000 Mup.sys
0xB95A4000 \SystemRoot\system32\DRIVERS\nv4_mini.sys
0xB9590000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xBA318000 \SystemRoot\system32\DRIVERS\HECI.sys
0xB9552000 \SystemRoot\system32\DRIVERS\e1y5132.sys
0xBA3D0000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xB952E000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xBA400000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xB9506000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0xB9190000 \SystemRoot\system32\DRIVERS\NETw5x32.sys
0xBA158000 \SystemRoot\system32\DRIVERS\nic1394.sys
0xB917C000 \SystemRoot\system32\DRIVERS\sdbus.sys
0xB916B000 \SystemRoot\system32\DRIVERS\rimmptsk.sys
0xB9157000 \SystemRoot\system32\DRIVERS\rimsptsk.sys
0xB9105000 \SystemRoot\system32\DRIVERS\rixdptsk.sys
0xBA168000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0xBA418000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xBA420000 \SystemRoot\System32\Drivers\fwkbdrtm.SYS
0xB90EC000 \SystemRoot\system32\DRIVERS\Apfiltr.sys
0xBA448000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xBA178000 \SystemRoot\system32\DRIVERS\IFXTPM.SYS
0xBA188000 \SystemRoot\system32\DRIVERS\serial.sys
0xB9C7A000 \SystemRoot\system32\DRIVERS\serenum.sys
0xB9C72000 \SystemRoot\system32\DRIVERS\tdcmdpst.sys
0xBA198000 \SystemRoot\system32\DRIVERS\imapi.sys
0xBA1A8000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xBA1B8000 \SystemRoot\system32\DRIVERS\redbook.sys
0xB90A1000 \SystemRoot\system32\DRIVERS\ks.sys
0xB9C5E000 \SystemRoot\system32\DRIVERS\tosrfec.sys
0xB9C56000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0xBA5D2000 \SystemRoot\system32\DRIVERS\TVALZFL.sys
0xB9C4E000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0xBA1C8000 \SystemRoot\system32\DRIVERS\intelppm.sys
0xBA1D8000 \SystemRoot\System32\Drivers\tosrfcom.sys
0xBA7E7000 \SystemRoot\system32\DRIVERS\audstub.sys
0xBA1E8000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xBA578000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xB8FEA000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xBA1F8000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xBA208000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xBA3A0000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xB8FD9000 \SystemRoot\system32\DRIVERS\psched.sys
0xBA218000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xBA3C8000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xBA3E0000 \SystemRoot\system32\DRIVERS\raspti.sys
0xB8FA9000 \SystemRoot\system32\DRIVERS\rdpdr.sys
0xBA228000 \SystemRoot\system32\DRIVERS\termdd.sys
0xBA5DA000 \SystemRoot\system32\DRIVERS\swenum.sys
0xB8F23000 \SystemRoot\system32\DRIVERS\update.sys
0xBA5A0000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xBA238000 \SystemRoot\system32\DRIVERS\tosporte.sys
0xBA248000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xBA258000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xBA5E4000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xB7A36000 \SystemRoot\system32\drivers\RtkHDAud.sys
0xB7A12000 \SystemRoot\system32\drivers\portcls.sys
0xBA268000 \SystemRoot\system32\drivers\drmk.sys
0xB79A7000 \SystemRoot\system32\DRIVERS\TEchoCan.sys
0xB788B000 \SystemRoot\system32\DRIVERS\AGRSM.sys
0xBA458000 \SystemRoot\System32\Drivers\Modem.SYS
0xBA5F2000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xBA776000 \SystemRoot\System32\Drivers\Null.SYS
0xBA5F6000 \SystemRoot\System32\Drivers\Beep.SYS
0xBA4A0000 \SystemRoot\System32\drivers\vga.sys
0xBA5FA000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xBA5FE000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xBA4B0000 \SystemRoot\System32\Drivers\Msfs.SYS
0xBA358000 \SystemRoot\System32\Drivers\Npfs.SYS
0xB7EE7000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xB7768000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xB770F000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xB76BF000 \SystemRoot\system32\DRIVERS\netbt.sys
0xB7699000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xBA2C8000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xB7677000 \SystemRoot\System32\drivers\afd.sys
0xBA2D8000 \SystemRoot\system32\DRIVERS\arp1394.sys
0xBA2E8000 \SystemRoot\system32\DRIVERS\netbios.sys
0xBA604000 \SystemRoot\System32\Drivers\TMEI3E.SYS
0xBA360000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
0xB764C000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xB75DC000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xBA2F8000 \SystemRoot\System32\Drivers\Fips.SYS
0xB75C0000 \SystemRoot\system32\DRIVERS\avipbb.sys
0xBA60A000 \??\C:\Programme\Avira\AntiVir Desktop\avgio.sys
0xB7578000 \SystemRoot\system32\DRIVERS\toshbus.sys
0xBA610000 \SystemRoot\system32\DRIVERS\toshwh.sys
0xB7555000 \SystemRoot\system32\DRIVERS\ATSwpDrv.sys
0xBA470000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0xB74F8000 \SystemRoot\system32\DRIVERS\toshmdm.sys
0xBA61A000 \SystemRoot\system32\DRIVERS\toshcm.sys
0xB9081000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xB7EEB000 \SystemRoot\system32\DRIVERS\toshmdfl.sys
0xB7490000 \SystemRoot\system32\DRIVERS\toshmdm2.sys
0xB770B000 \SystemRoot\system32\DRIVERS\toshmdfl2.sys
0xB740D000 \SystemRoot\system32\DRIVERS\toshcard.sys
0xBA478000 \SystemRoot\system32\DRIVERS\toshscard.sys
0xB73AC000 \SystemRoot\system32\DRIVERS\toshunic.sys
0xBA6A0000 \SystemRoot\system32\DRIVERS\toshcr.sys
0xB7397000 \SystemRoot\system32\DRIVERS\toshgps.sys
0xB9071000 \SystemRoot\System32\Drivers\UVCFTR_S.SYS
0xB7379000 \SystemRoot\System32\Drivers\usbvideo.sys
0xBA350000 \SystemRoot\system32\DRIVERS\toshnd5.sys
0xB72AB000 \SystemRoot\System32\Drivers\dump_iaStor.sys
0xBF800000 \SystemRoot\System32\win32k.sys
0xB7877000 \SystemRoot\System32\drivers\Dxapi.sys
0xBA488000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xBA714000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF012000 \SystemRoot\System32\nv4_disp.dll
0xB5E57000 \SystemRoot\system32\DRIVERS\avgntflt.sys
0xB5D9D000 \SystemRoot\system32\DRIVERS\tdudf.sys
0xB5D8C000 \SystemRoot\System32\Drivers\Udfs.SYS
0xB5D6B000 \SystemRoot\system32\DRIVERS\trudf.sys
0xBF60E000 \SystemRoot\System32\ATMFD.DLL
0xB5CA0000 \SystemRoot\system32\DRIVERS\sntie.sys
0xB5CFF000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xB5EF3000 \SystemRoot\system32\DRIVERS\netdevio.sys
0xB5C66000 \SystemRoot\system32\DRIVERS\s7snsrtx.sys
0xB5A59000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xB5A1C000 \SystemRoot\system32\drivers\wdmaud.sys
0xB5B0E000 \SystemRoot\system32\drivers\sysaudio.sys
0xB587A000 \SystemRoot\System32\Drivers\Peakcan.sys
0xB5867000 \SystemRoot\System32\Drivers\S7odpx2x.sys
0xB583C000 \SystemRoot\System32\Drivers\s7osmcax.sys
0xB57BF000 \SystemRoot\System32\Drivers\s7otranx.sys
0xB5795000 \SystemRoot\System32\Drivers\s7otsadx.sys
0xB5781000 \SystemRoot\System32\Drivers\SENTINEL.SYS
0xB59B6000 \SystemRoot\System32\DRIVERS\dpmtrcdd.sys
0xB5571000 \SystemRoot\system32\DRIVERS\srv.sys
0xB46F4000 \SystemRoot\System32\Drivers\HTTP.sys
0xB4946000 \??\C:\WINDOWS\system32\FsUsbExDisk.SYS
0xB3AD7000 \SystemRoot\system32\DRIVERS\tosrfusb.sys
0xB2B7C000 \SystemRoot\system32\DRIVERS\tosrfbd.sys
0xB2B19000 \SystemRoot\system32\DRIVERS\Tosrfhid.sys
0xB40A9000 \SystemRoot\System32\Drivers\tosrfbnp.sys
0xB5191000 \SystemRoot\system32\DRIVERS\tosrfnds.sys
0xBA688000 \SystemRoot\system32\drivers\Toshidpt.sys
0xB5001000 \SystemRoot\system32\drivers\HIDCLASS.SYS
0xB5181000 \SystemRoot\system32\drivers\HIDPARSE.SYS
0xB5551000 \SystemRoot\system32\DRIVERS\mouhid.sys
0xBA3E8000 \SystemRoot\system32\DRIVERS\s7opcsrtx.sys
0xB1206000 \SystemRoot\system32\drivers\kmixer.sys
0x7C910000 \WINDOWS\system32\ntdll.dll

Processes (total 99):
0 System Idle Process
4 SYSTEM
1000 C:\WINDOWS\system32\smss.exe
1228 csrss.exe
1260 C:\WINDOWS\system32\winlogon.exe
1308 C:\WINDOWS\system32\services.exe
1328 C:\WINDOWS\system32\lsass.exe
1512 C:\WINDOWS\system32\TAMSvr.exe
1524 C:\WINDOWS\system32\svchost.exe
1588 svchost.exe
1628 C:\WINDOWS\system32\svchost.exe
1904 svchost.exe
1936 svchost.exe
468 C:\WINDOWS\system32\spoolsv.exe
572 scardsvr.exe
600 C:\Programme\Avira\AntiVir Desktop\sched.exe
620 C:\Programme\Toshiba\3GUty\tw3gsvc.exe
676 svchost.exe
556 C:\WINDOWS\system32\agrsmsvc.exe
1240 C:\Programme\Gemeinsame Dateien\Siemens\SWS\almsrv\almsrvx.exe
1536 C:\Programme\Avira\AntiVir Desktop\avguard.exe
1672 C:\Programme\Toshiba\ConfigFree\CFSvcs.exe
1768 C:\WINDOWS\system32\FsUsbExService.Exe
1800 C:\Programme\Intel\AMT\LMS.exe
1836 C:\Programme\Danfoss Drives\VLT Motion Control Tool\MCT 10 Set-up Software\MCTServ.exe
2044 C:\WINDOWS\explorer.exe
324 C:\Programme\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
508 ALMPanelPlugin.exe
1060 C:\Programme\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe
1120 C:\WINDOWS\RTHDCPL.exe
1792 C:\WINDOWS\system32\00THotkey.exe
848 C:\WINDOWS\system32\nvsvc32.exe
2064 C:\Programme\Toshiba\TAudEffect\TAudEff.exe
2096 C:\Programme\Siemens\Step7\S7BIN\s7asysvx.exe
2108 C:\Programme\Apoint2K\Apoint.exe
2152 C:\Programme\Gemeinsame Dateien\Siemens\S7IEPG\s7oiehsx.exe
2168 C:\Programme\Toshiba\Bluetooth Toshiba Stack\ItSecMng.exe
2220 C:\Programme\Gemeinsame Dateien\Siemens\Automation\TraceEngine\bin\S7TraceServiceX.exe
2252 C:\WINDOWS\system32\TPSMain.exe
2300 C:\Programme\Microsoft SQL Server\90\Shared\sqlbrowser.exe
2328 C:\Programme\Toshiba\TME3\TMERzCtl.exe
2396 C:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe
2460 C:\WINDOWS\system32\svchost.exe
2468 C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe
2504 C:\WINDOWS\system32\TPSBattM.exe
2508 C:\WINDOWS\system32\ThpSrv.exe
2540 C:\Programme\Toshiba\ConfigFree\NDSTray.exe
2568 C:\Programme\Toshiba\TME3\TMESRV31.exe
2580 C:\Programme\Toshiba\TOSHIBA Controls\TFncKy.exe
2588 C:\Programme\TrueSuite Access Manager\FpNotifier.exe
2620 C:\Programme\TrueSuite Access Manager\usbnotify.exe
2648 C:\Programme\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
2676 C:\Programme\TrueSuite Access Manager\PwdBank.exe
2728 C:\Programme\Apoint2K\ApntEx.exe
2756 C:\Programme\Toshiba\DualPointUtility\TEDTray.exe
2796 C:\Programme\TrueSuite Access Manager\CssSvr.exe
2816 C:\Programme\Toshiba\TME3\TMEEJME.exe
2868 C:\WINDOWS\system32\TODDSrv.exe
2896 C:\WINDOWS\system32\rundll32.exe
2956 C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
3004 C:\WINDOWS\system32\TFNF5.exe
3076 C:\WINDOWS\system32\ThpSrv.exe
3132 C:\Programme\Toshiba\TPHM\TPCHSrv.exe
3136 C:\Programme\Gemeinsame Dateien\Intel\Privacy Icon\PrivacyIconClient.exe
3224 C:\WINDOWS\system32\rundll32.exe
3252 C:\Programme\Toshiba\3GUty\tw3gctrl.exe
3328 C:\FSP_5000_RPS\RAMV\Tools\TransferTool.exe
3340 C:\Programme\Avira\AntiVir Desktop\avgnt.exe
3608 C:\FSP_5000_RPS\RAMV\Tools\TransferTool.exe
3656 C:\FSP_5000_RPS\RAMV\Tools\TransferToolNet.exe
3712 C:\Programme\Gemeinsame Dateien\Siemens\S7UBTOOX\S7ubTstx.exe
3892 wdfmgr.exe
3900 C:\Programme\Siemens\Automation\Portal V10\Bin\Siemens.Automation.ObjectFrame.FileStorage.Server.exe
3976 C:\WINDOWS\system32\ctfmon.exe
4032 C:\Programme\Gemeinsame Dateien\Intel\Privacy Icon\UNS\UNS.exe
4048 C:\Programme\Toshiba\TOSCDSPD\TOSCDSPD.exe
272 C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Macrovision\FLEXnet Connect\6\ISUSPM.exe
316 C:\Programme\Messenger\msmsgs.exe
852 C:\Programme\Samsung\Samsung New PC Studio\NPSAgent.exe
1852 C:\Programme\Nokia\Nokia PC Suite 7\PCSuite.exe
3112 C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
3584 C:\Programme\Gemeinsame Dateien\Siemens\SQLANY\dbsrv9.exe
2436 C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
3580 C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
3884 C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtHSP.exe
3928 C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtBty.exe
1472 C:\Programme\PC Connectivity Solution\ServiceLayer.exe
3316 alg.exe
4476 C:\Programme\PC Connectivity Solution\Transports\NclUSBSrv.exe
4504 C:\Programme\PC Connectivity Solution\Transports\NclRSSrv.exe
4596 C:\Programme\PC Connectivity Solution\Transports\NclToBTSrv.exe
824 C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe
4100 C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosOBEX.exe
4548 C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtProc.exe
5704 C:\WINDOWS\system32\wuauclt.exe
1612 C:\Programme\Mozilla Firefox\firefox.exe
2960 wmiprvse.exe
5500 C:\Dokumente und Einstellungen\M.Schattke.PUS\Desktop\osam.exe
6028 C:\Dokumente und Einstellungen\M.Schattke.PUS\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)

PhysicalDrive0 Model Number: HitachiHTS723232L9A360, Rev: FC4OC30F

Size Device Name MBR Status
--------------------------------------------
298 GB \\.\PhysicalDrive0 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A


Done!

cosinus 28.04.2011 20:37
Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Oemmel 29.04.2011 07:57
So hier die Logs.

Malwarebytes' Anti-Malware 1.50.1.1100
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Datenbank Version: 6465

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

28.04.2011 23:10:52
mbam-log-2011-04-28 (23-10-52).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|W:\|X:\|Y:\|Z:\|)
Durchsuchte Objekte: 430147
Laufzeit: 1 Stunde(n), 23 Minute(n), 37 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)


und super Anti Spyware

SUPERAntiSpyware Scan Log
SUPERAntiSpyware.com | Remove Malware | Remove Spyware - AntiMalware, AntiSpyware, AntiAdware!

Generated 04/29/2011 at 00:13 AM

Application Version : 4.51.1000

Core Rules Database Version : 6948
Trace Rules Database Version: 4760

Scan type : Complete Scan
Total Scan Time : 00:52:25

Memory items scanned : 676
Memory threats detected : 0
Registry items scanned : 10744
Registry threats detected : 1
File items scanned : 33089
File threats detected : 5

Adware.IEPlugin
HKCR\Remove

Adware.Tracking Cookie
C:\Dokumente und Einstellungen\M.Schattke\Cookies\m.schattke@atdmt[1].txt
C:\Dokumente und Einstellungen\M.Schattke\Cookies\m.schattke@bs.serving-sys[2].txt
C:\Dokumente und Einstellungen\M.Schattke\Cookies\m.schattke@doubleclick[2].txt
C:\Dokumente und Einstellungen\M.Schattke\Cookies\m.schattke@msnportal.112.2o7[1].txt
C:\Dokumente und Einstellungen\M.Schattke\Cookies\m.schattke@serving-sys[1].txt

cosinus 29.04.2011 11:55
Sieht ok aus, da wurden nur Cookies gefunden.
Noch Probleme oder weitere Funde in der Zwischenzeit?

Oemmel 29.04.2011 12:40
Ja das einzigste Problem ist noch das ich auf C: meine Ordner nur Transparent sehen kann.
Sonst fällt mir soweit nichts auf. Avira meldet auch nichts mehr.
MfG Oemmel

Oemmel 29.04.2011 13:22
Habe nochmal Unhide gestartet, habe jetzt fast alle ordner sichtbar also voll sichtbar. nur son paar sind noch transparent.

Oemmel 29.04.2011 13:34
So ich habe es glaube ich, hatte noch in Ordneroptionen Ansicht den Punkt an : alle Dateien und Ordner anzeigen.

cosinus 29.04.2011 20:03
Dann wären wir durch! :abklatsch:

Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update



PDF-Reader aktualisieren
Dein Adobe Reader ist nicht aktuell, was ein großes Sicherheitsrisiko darstellt. Du solltest daher besser die alte Version über Systemsteuerung => Software deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst.

Ich empfehle einen alternativen PDF-Reader wie SumatraPDF oder Foxit PDF Reader, beide sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers, hier der direkte Downloadlink:

Mozilla und andere Browser => http://filepony.de/?q=Flash+Player
Internet Explorer => http://fpdownload.adobe.com/get/flas..._player_ax.exe


Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

Oemmel 06.05.2011 17:00
So habe alles gemacht. Laptop funzt wieder richtig. Super geile Hilfe hier!! Kann mich nur ganz herzlich dafür bedanken!! Danke danke danke!! MfG Oemmel


Alle Zeitangaben in WEZ +1. Es ist jetzt 20:30 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131