Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Nach Malware- Scan 21 Infizierungen auf meinen Rechner gefunden. Was soll ich tun? (https://www.trojaner-board.de/100396-malware-scan-21-infizierungen-meinen-rechner-gefunden-tun.html)

Xtricer 16.06.2011 14:25
Nach Malware- Scan 21 Infizierungen auf meinen Rechner gefunden. Was soll ich tun?
 
Hallo,
ich habe das Problem, dass nach dem Maleware-Sacn (mit Malwarebytes Anti-Malware) 21 Infizierungen festgestellt wurden.

Anlass für Malwarebytes Anti-Malware war, dass nach dem öffnen von FireFox oder Microsoft Internet Explorer eine Meldung von Avira Antivir kam mit einem Trojanischen Pferd im System32. (C:\WINDOWS\system32\5017\components\AcroFF017.dll)

Habe schon hier im Forum nachgeschaut und einen für mich ähnlichen Fall gefunden (http://www.trojaner-board.de/100227-...l-ich-tun.html)


Nach dem Quick- Scan mit Malewarebytes kam es zu flogendem Protokoll:

Code:
Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Datenbank Version: 6869

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

16.06.2011 13:09:05
mbam-log-2011-06-16 (13-09-05).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 158853
Laufzeit: 7 Minute(n), 21 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 1
Infizierte Registrierungsschlüssel: 9
Infizierte Registrierungswerte: 2
Infizierte Dateiobjekte der Registrierung: 5
Infizierte Verzeichnisse: 1
Infizierte Dateien: 3

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
c:\programme\gemeinsame dateien\Spigot\wtxpcom\components\widgitoolbarff.dll (Adware.WidgiToolbar) -> Delete on reboot.

Infizierte Registrierungsschlüssel:
HKEY_CLASSES_ROOT\CLSID\{C689C99E-3A8C-4c87-A79C-C80DC9C81632} (Trojan.Banker) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\linkrdr.AIEbho.1 (Trojan.Banker) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\linkrdr.AIEbho (Trojan.Banker) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C689C99E-3A8C-4C87-A79C-C80DC9C81632} (Trojan.Banker) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{C689C99E-3A8C-4C87-A79C-C80DC9C81632} (Trojan.Banker) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{F919FBD3-A96B-4679-AF26-F551439BB5FD} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\WUSN.1 (Adware.WhenU) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\prh (Trojan.Banker) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\tst (Trojan.Banker) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAMME\GEMEINSAME DATEIEN\SPIGOT\WTXPCOM\COMPONENTS\WIDGITOOLBARFF.DLL (Adware.WidgiToolbar) -> Value: WIDGITOOLBARFF.DLL -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{B749D11F-25C8-0720-4852-E14F0EFB4CA0} (Trojan.ZbotR.Gen) -> Value: {B749D11F-25C8-0720-4852-E14F0EFB4CA0} -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.UserInit) -> Bad: (C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\appconf32.exe,) Good: (userinit.exe) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (PUM.Hijack.System.Hidden) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.

Infizierte Verzeichnisse:
c:\WINDOWS\system32\xmldm (Stolen.Data) -> Quarantined and deleted successfully.

Infizierte Dateien:
c:\programme\gemeinsame dateien\Spigot\wtxpcom\components\widgitoolbarff.dll (Adware.WidgiToolbar) -> Delete on reboot.
c:\WINDOWS\system32\srvblck2.tmp (Malware.Trace) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\acroiehelpe.txt (Malware.Trace) -> Quarantined and deleted successfully.

Anschließend hab ich das Ganze in OTL eingefügt, alle Programme geschlossen (wie in der Anleitung vorgegeben) und den Quick- Scan durchgeführt.
Bin nun ein wenig verunsichert, da etwas ganz anderes in der OTL.txt rauskam als bei der Anleitung bzw. dem Post von cosinus (dies bezieht sich auf den Fall von oben [nach malware scan 139 viren gefunden...])

Die OTL.txt kann ich dann auch noch posten!

Würde mich freuen wenn mir jm. helfen kann!

Danke im Vorraus
Xtricer

markusg 16.06.2011 14:59
was hast du bei otl eingefügt, das malwarebytes log?
Systemscan mit OTL
download otl:
http://filepony.de/download-otl/

Doppelklick auf die OTL.exe
(user von Windows 7 und Vista: Rechtsklick als Administrator ausführen)
1. Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
2. Hake an "scan all users"
3. Unter "Extra Registry wähle:
"Use Safelist" "LOP Check" "Purity Check"
4. Kopiere in die Textbox:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
5. Klicke "Scan"
6. 2 reporte werden erstellt:
OTL.Txt
Extras.Txt
beide posten.

Xtricer 16.06.2011 20:54
Ja hatte das maleware protokoll eingefügt. Nun habe ich das, was hier geschickt wurde eingefügt.

Folgendes kam dabei raus:

OTL Logfile:
Code:
OTL logfile created on: 16.06.2011 21:35:34 - Run 3
OTL by OldTimer - Version 3.2.24.0    Folder = C:\Dokumente und Einstellungen\christopher\Eigene Dateien\Downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1023,48 Mb Total Physical Memory | 622,27 Mb Available Physical Memory | 60,80% Memory free
2,40 Gb Paging File | 2,02 Gb Available in Paging File | 83,87% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 272,46 Gb Total Space | 3,90 Gb Free Space | 1,43% Space Free | Partition Type: NTFS
Drive D: | 2,05 Gb Total Space | 1,22 Gb Free Space | 59,65% Space Free | Partition Type: FAT32
Drive E: | 616,37 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
 
Computer Name: NAME-A0073FCD77 | User Name: christopher | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Dokumente und Einstellungen\christopher\Eigene Dateien\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Gemeinsame Dateien\Spigot\Search Settings\SearchSettings.exe (Spigot, Inc.)
PRC - C:\Programme\Application Updater\ApplicationUpdater.exe (Spigot, Inc.)
PRC - C:\WINDOWS\system32\dgdersvc.exe (Devguru Co., Ltd.)
PRC - C:\WINDOWS\system32\FsUsbExService.Exe (Teruten)
PRC - C:\Programme\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Programme\TomTom HOME 2\TomTomHOMERunner.exe (TomTom)
PRC - C:\Programme\TomTom HOME 2\TomTomHOMEService.exe (TomTom)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe (Creative Technology Ltd)
PRC - C:\Programme\Creative\Sync Manager Unicode\CTSyncU.exe ()
PRC - C:\Programme\avmwlanstick\WLanGUI.exe (AVM GmbH Berlin)
PRC - C:\Programme\avmwlanstick\WLanNetService.exe (AVM Berlin)
PRC - C:\WINDOWS\system32\LckFldService.exe ()
PRC - C:\Programme\CyberLink\Shared Files\CLML_NTService\CLMLService.exe (Cyberlink)
PRC - C:\Programme\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe (Cyberlink)
PRC - C:\Programme\CyberLink\PowerCinema\Kernel\TV\CLSched.exe ()
PRC - C:\Programme\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe ()
PRC - C:\Programme\CyberLink\PowerCinema\PCMService.exe (CyberLink Corp.)
PRC - C:\WINDOWS\system32\nvraidservice.exe (NVIDIA Corporation)
PRC - C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
PRC - C:\WINDOWS\system32\carpserv.exe (Conexant Systems, Inc.)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Dokumente und Einstellungen\christopher\Eigene Dateien\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll (Microsoft Corporation)
MOD - C:\Programme\MindSoft\MindSoft Utilities XP 9\msscript.ocx (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (qzkywoxa) --  File not found
SRV - (AppMgmt) --  File not found
SRV - (Application Updater) -- C:\Programme\Application Updater\ApplicationUpdater.exe (Spigot, Inc.)
SRV - (dgdersvc) -- C:\WINDOWS\system32\dgdersvc.exe (Devguru Co., Ltd.)
SRV - (FsUsbExService) -- C:\WINDOWS\system32\FsUsbExService.Exe (Teruten)
SRV - (TomTomHOMEService) -- C:\Programme\TomTom HOME 2\TomTomHOMEService.exe (TomTom)
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (AVM WLAN Connection Service) -- C:\Programme\avmwlanstick\WLanNetService.exe (AVM Berlin)
SRV - (LckFldService) -- C:\WINDOWS\system32\LckFldService.exe ()
SRV - (IDriverT) -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (CyberLink Media Library Service) -- C:\Programme\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe (Cyberlink)
SRV - (CLSched) CyberLink Task Scheduler (CTS) -- C:\Programme\CyberLink\PowerCinema\Kernel\TV\CLSched.exe ()
SRV - (CLCapSvc) CyberLink Background Capture Service (CBCS) -- C:\Programme\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe ()
SRV - (WmcCds) Windows Media Connect (WMC) -- c:\Programme\Windows Media Connect\mswmccds.exe (Microsoft Corporation)
SRV - (WmcCdsLs) -- C:\Programme\Windows Media Connect\mswmcls.exe (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (MBAMSwissArmy) -- C:\WINDOWS\system32\drivers\mbamswissarmy.sys (Malwarebytes Corporation)
DRV - (dgderdrv) -- C:\WINDOWS\system32\drivers\dgderdrv.sys (Devguru Co., Ltd)
DRV - (FsUsbExDisk) -- C:\WINDOWS\system32\FsUsbExDisk.Sys ()
DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (hamachi) -- C:\WINDOWS\system32\drivers\hamachi.sys (LogMeIn, Inc.)
DRV - (truecrypt) -- C:\WINDOWS\system32\drivers\truecrypt.sys (TrueCrypt Foundation)
DRV - (NwlnkIpx) -- C:\WINDOWS\system32\drivers\nwlnkipx.sys (Microsoft Corporation)
DRV - (MPE) -- C:\WINDOWS\system32\drivers\mpe.sys (Microsoft Corporation)
DRV - (FWLANUSB) -- C:\WINDOWS\system32\drivers\fwlanusb.sys (AVM GmbH)
DRV - (avmeject) -- C:\WINDOWS\system32\drivers\avmeject.sys (AVM Berlin)
DRV - (dtscsi) -- C:\WINDOWS\System32\Drivers\dtscsi.sys ()
DRV - (sptd) -- C:\WINDOWS\System32\Drivers\sptd.sys ()
DRV - (RT73) -- C:\WINDOWS\system32\drivers\rt73.sys (Ralink Technology, Corp.)
DRV - (sfvfs02) StarForce Protection VFS Driver (version 2.x) -- C:\WINDOWS\System32\drivers\sfvfs02.sys (Protection Technology)
DRV - (sfdrv01) StarForce Protection Environment Driver (version 1.x) -- C:\WINDOWS\System32\drivers\sfdrv01.sys (Protection Technology)
DRV - (sfhlp02) StarForce Protection Helper Driver (version 2.x) -- C:\WINDOWS\System32\drivers\sfhlp02.sys (Protection Technology)
DRV - (ASCTRM) -- C:\WINDOWS\System32\drivers\asctrm.sys (Windows (R) 2000 DDK provider)
DRV - (NPPTNT2) -- C:\WINDOWS\system32\npptNT2.sys (INCA Internet Co., Ltd.)
DRV - (nvatabus) -- C:\WINDOWS\system32\DRIVERS\nvatabus.sys (NVIDIA Corporation)
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
DRV - (yukonwxp) -- C:\WINDOWS\system32\drivers\yk51x86.sys (Marvell)
DRV - (3xHybrid) -- C:\WINDOWS\system32\drivers\3xHybrid.sys (Philips Semiconductors GmbH)
DRV - (NwlnkNb) -- C:\WINDOWS\system32\drivers\nwlnknb.sys (Microsoft Corporation)
DRV - (NwlnkSpx) -- C:\WINDOWS\system32\drivers\nwlnkspx.sys (Microsoft Corporation)
DRV - (ZD1211U(ZyDAS)) ZyDAS ZD1211 IEEE 802.11b+g Wireless LAN Driver (USB)(ZyDAS) -- C:\WINDOWS\system32\drivers\ZD1211U.sys (ZyDAS Technology Corporation)
DRV - (ZDBRGSYS) -- C:\WINDOWS\system32\ZDBRGSYS.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (ZDPNDIS5) -- C:\WINDOWS\system32\ZDPNDIS5.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (SCR33X USB Smart Card Reader) -- C:\WINDOWS\system32\drivers\SCR33X2K.sys (SCM Microsystems Inc.)
DRV - (ovt519) -- C:\WINDOWS\system32\drivers\ov519vid.sys (OmniVision Technologies, Inc.)
DRV - (IMT0521) -- C:\WINDOWS\system32\drivers\IMT0521.sys (Inmax Technology Corp.)
DRV - (HSF_DP) -- C:\WINDOWS\system32\drivers\HSF_DP.sys (Conexant Systems, Inc.)
DRV - (winachsf) -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (HSFHWBS2) -- C:\WINDOWS\system32\drivers\HSFHWBS2.sys (Conexant Systems, Inc.)
DRV - (StreamDispatcher) -- C:\WINDOWS\system32\drivers\strmdisp.sys (Conexant Systems, Inc.)
DRV - (PCLEPCI) -- C:\WINDOWS\system32\drivers\Pclepci.sys (Pinnacle Systems GmbH)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.targa.de
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://search.live.com/sphome.aspx
 
 
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.targa.de
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.targa.de
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.targa.de
 
IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.targa.de
 
IE - HKU\S-1-5-21-4147601781-1963535702-778001222-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://qip.ru
IE - HKU\S-1-5-21-4147601781-1963535702-778001222-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://search.qip.ru
IE - HKU\S-1-5-21-4147601781-1963535702-778001222-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Prev Search Page = hxxp://google.icq.com
IE - HKU\S-1-5-21-4147601781-1963535702-778001222-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.qip.ru
IE - HKU\S-1-5-21-4147601781-1963535702-778001222-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\S-1-5-21-4147601781-1963535702-778001222-1006\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie
IE - HKU\S-1-5-21-4147601781-1963535702-778001222-1006\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://search.qip.ru/ie
IE - HKU\S-1-5-21-4147601781-1963535702-778001222-1006\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKU\S-1-5-21-4147601781-1963535702-778001222-1006\..\URLSearchHook: {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - Reg Error: Key error. File not found
IE - HKU\S-1-5-21-4147601781-1963535702-778001222-1006\..\URLSearchHook: {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Programme\pdfforge Toolbar\IE\4.4\pdfforgeToolbarIE.dll (Spigot, Inc.)
IE - HKU\S-1-5-21-4147601781-1963535702-778001222-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "QIP Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://www.bing.com/search?FORM=IEFM1&q="
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=302398"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/pacman/"
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: pdfforge@mybrowserbar.com:4.4
FF - prefs.js..extensions.enabledItems: wtxpcom@mybrowserbar.com:4.4
FF - prefs.js..extensions.enabledItems: {184AA5E6-741D-464a-820E-94B3ABC2F3B4}:1.0
FF - prefs.js..keyword.URL: "hxxp://de.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=302398&p="
 
 
FF - HKLM\software\mozilla\Firefox\extensions\\{184AA5E6-741D-464a-820E-94B3ABC2F3B4}: C:\WINDOWS\system32\5018 [2011.06.14 15:29:02 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.17\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011.06.06 01:33:12 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.17\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011.05.03 17:17:46 | 000,000,000 | ---D | M]
 
[2010.02.20 11:46:49 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Mozilla\Extensions
[2009.10.10 16:48:23 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Mozilla\Extensions\home2@tomtom.com
[2011.06.16 21:11:10 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Mozilla\Firefox\Profiles\21732ymg.default\extensions
[2008.02.06 19:30:31 | 000,000,000 | ---D | M] ("StumbleUpon") -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Mozilla\Firefox\Profiles\21732ymg.default\extensions\{AE93811A-5C9A-4d34-8462-F7B864FC4696}
[2009.11.11 22:12:27 | 000,002,163 | ---- | M] () -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Mozilla\Firefox\Profiles\21732ymg.default\searchplugins\bing.xml
[2011.06.09 15:18:42 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Mozilla\Firefox\Profiles\21732ymg.default\searchplugins\icqplugin.xml
[2010.05.09 13:13:38 | 000,002,062 | ---- | M] () -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Mozilla\Firefox\Profiles\21732ymg.default\searchplugins\qip-search.xml
[2011.06.16 21:11:10 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2011.05.25 17:26:59 | 000,000,000 | ---D | M] (Widgi Toolbar Platform) -- C:\PROGRAMME\GEMEINSAME DATEIEN\SPIGOT\WTXPCOM
[2008.11.06 23:41:57 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAMME\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011.05.25 17:27:00 | 000,000,000 | ---D | M] (pdfforge Toolbar) -- C:\PROGRAMME\PDFFORGE TOOLBAR\FF
[2011.06.14 15:29:02 | 000,000,000 | ---D | M] (Java String Helper) -- C:\WINDOWS\SYSTEM32\5018
[2011.03.07 12:50:44 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2011.03.07 12:50:44 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2011.03.07 12:50:44 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2011.03.07 12:50:44 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2011.03.07 12:50:44 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.10.27 14:51:15 | 000,000,847 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (no name) - {184AA5E6-741D-464a-820E-94B3ABC2F3B4} - No CLSID value found.
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (no name) - {6C057FF2-31A2-4A40-A2F0-C01426A27BD3} -  File not found
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Programme\pdfforge Toolbar\IE\4.4\pdfforgeToolbarIE.dll (Spigot, Inc.)
O2 - BHO: (EpsonToolBandKicker Class) - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Programme\epson\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O3 - HKLM\..\Toolbar: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Programme\pdfforge Toolbar\IE\4.4\pdfforgeToolbarIE.dll (Spigot, Inc.)
O3 - HKLM\..\Toolbar: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programme\epson\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O3 - HKU\S-1-5-21-4147601781-1963535702-778001222-1006\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\S-1-5-21-4147601781-1963535702-778001222-1006\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.
O3 - HKU\S-1-5-21-4147601781-1963535702-778001222-1006\..\Toolbar\WebBrowser: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No CLSID value found.
O3 - HKU\S-1-5-21-4147601781-1963535702-778001222-1006\..\Toolbar\WebBrowser: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programme\epson\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [AVMWlanClient] C:\Programme\avmwlanstick\WLanGUI.exe (AVM GmbH Berlin)
O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation)
O4 - HKLM..\Run: [CARPService] C:\WINDOWS\System32\carpserv.exe (Conexant Systems, Inc.)
O4 - HKLM..\Run: [CTCheck] C:\Programme\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [DivXUpdate] C:\Programme\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [KernelFaultCheck]  File not found
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NVRaidService] C:\WINDOWS\system32\nvraidservice.exe (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [PCMService] C:\Programme\CyberLink\PowerCinema\PCMService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [SearchSettings] C:\Programme\Gemeinsame Dateien\Spigot\Search Settings\SearchSettings.exe (Spigot, Inc.)
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKU\S-1-5-21-4147601781-1963535702-778001222-1006..\Run: [CTSyncU.exe] C:\Programme\Creative\Sync Manager Unicode\CTSyncU.exe ()
O4 - HKU\S-1-5-21-4147601781-1963535702-778001222-1006..\Run: [ICQ]  File not found
O4 - HKU\S-1-5-21-4147601781-1963535702-778001222-1006..\Run: [KiesTrayAgent]  File not found
O4 - HKU\S-1-5-21-4147601781-1963535702-778001222-1006..\Run: [TomTomHOME.exe] C:\Programme\TomTom HOME 2\TomTomHOMERunner.exe (TomTom)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-4147601781-1963535702-778001222-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 91 00 00 00  [binary data]
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O12 - Plugin for: .UVR - C:\Programme\Internet Explorer\PLUGINS\NPUPano.dll (Ulead Systems, Inc.)
O15 - HKU\S-1-5-21-4147601781-1963535702-778001222-1006\..Trusted Domains: aol.com ([objects] * is out of zone range -  5)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} hxxp://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab (Checkers Class)
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} hxxp://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab (Minesweeper Flags Class)
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-24-0.cab (EPUImageControl Class)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} hxxp://spaces.msn.com//PhotoUpload/MsnPUpld.cab (MSN Photo Upload Tool)
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} hxxp://static.pe.schuelervz.net/photouploader/ImageUploader5.cab?nocache=1224952453 (Image Uploader Control)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1204659679768 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_10-windows-i586.cab (Java Plug-in 1.6.0_10)
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} hxxp://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab (MessengerStatsClient Class)
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} hxxp://messenger.msn.com/download/MsnMessengerSetupDownloader.cab (MsnMessengerSetupDownloadControl Class)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0014-0002-0018-ABCDEFFEDCBA} hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab (Java Plug-in 1.4.2_18)
O16 - DPF: {CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_08-windows-i586.cab (Java Plug-in 1.5.0_08)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Java Plug-in 1.6.0_01)
O16 - DPF: {CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_10-windows-i586.cab (Java Plug-in 1.6.0_10)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_10-windows-i586.cab (Java Plug-in 1.6.0_10)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} hxxp://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab (Minesweeper Flags Class)
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} hxxp://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab (Solitaire Showdown Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.220.1
O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop Components:0 () - file:///C:/DOKUME~1/CHRIST~1/LOKALE~1/Temp/msohtml1/02/clip_image002.jpg
O24 - Desktop Components:1 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\christopher\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\christopher\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005.01.22 19:33:56 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2004.01.15 09:25:14 | 000,000,053 | ---- | M] () - D:\AUTORUN.INF -- [ FAT32 ]
O32 - AutoRun File - [2004.01.20 14:50:52 | 000,020,480 | ---- | M] (TARGA GmbH) - D:\AUTORUN.EXE -- [ FAT32 ]
O32 - AutoRun File - [2003.10.09 13:53:23 | 000,000,000 | R--D | M] - E:\Autorun -- [ CDFS ]
O32 - AutoRun File - [2003.06.25 12:17:32 | 001,101,824 | R--- | M] () - E:\Autorun.exe -- [ CDFS ]
O32 - AutoRun File - [2003.06.25 06:59:54 | 000,001,982 | R--- | M] () - E:\autorun.csf -- [ CDFS ]
O32 - AutoRun File - [2003.06.20 07:01:00 | 000,000,027 | R--- | M] () - E:\autorun.inf -- [ CDFS ]
O32 - AutoRun File - [2003.06.25 12:17:30 | 000,087,060 | R--- | M] () - E:\autorun.obj -- [ CDFS ]
O33 - MountPoints2\{1c91aae0-f29d-11df-ac5b-00040ec9282a}\Shell\AutoRun\command - "" = H:\Toshiba\Launcher\start.exe
O33 - MountPoints2\{5a81937f-ad0d-11de-abab-001c4af4da56}\Shell\AutoRun\command - "" = H:\InstallTomTomHOME.exe
O33 - MountPoints2\{89131f12-1f03-11db-a9e0-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{89131f12-1f03-11db-a9e0-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{89131f12-1f03-11db-a9e0-00038a000015}\Shell\AutoRun\command - "" = N:\pushinst.exe
O33 - MountPoints2\{8e2676f2-6c09-11d9-b1cf-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{8e2676f2-6c09-11d9-b1cf-806d6172696f}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{a0725e2e-0044-11db-a9ca-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{a0725e2e-0044-11db-a9ca-806d6172696f}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{a0725e2e-0044-11db-a9ca-806d6172696f}\Shell\AutoRun\command - "" = E:\Autorun.exe -- [2003.06.25 12:17:32 | 001,101,824 | R--- | M] ()
O33 - MountPoints2\{c34cd8ee-6c6d-11d9-9827-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{c34cd8ee-6c6d-11d9-9827-806d6172696f}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{c6ff92df-bfd9-11dc-aa64-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{c6ff92df-bfd9-11dc-aa64-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{c6ff92df-bfd9-11dc-aa64-00038a000015}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\S-1-5-21-3666692665-148099885-633438025-500\rasman32.exe
O33 - MountPoints2\{d06a8141-6dfb-11d9-8068-806d6172696f}\Shell\AutoRun\command - "" = D:\AUTORUN.EXE -- [2004.01.20 14:50:52 | 000,020,480 | ---- | M] (TARGA GmbH)
O33 - MountPoints2\{d8430487-ca12-11da-a053-806d6172696f}\Shell\AutoRun\command - "" = D:\AUTORUN.EXE -- [2004.01.20 14:50:52 | 000,020,480 | ---- | M] (TARGA GmbH)
O33 - MountPoints2\{d8430488-ca12-11da-a053-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{d8430488-ca12-11da-a053-806d6172696f}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{efca3e28-c7b0-11da-8f3e-0011e202130b}\Shell - "" = AutoRun
O33 - MountPoints2\{efca3e28-c7b0-11da-8f3e-0011e202130b}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{f80b6d3f-a039-11d9-8e69-806d6172696f}\Shell\AutoRun\command - "" = D:\AUTORUN.EXE -- [2004.01.20 14:50:52 | 000,020,480 | ---- | M] (TARGA GmbH)
O33 - MountPoints2\{f80b6d40-a039-11d9-8e69-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{f80b6d40-a039-11d9-8e69-806d6172696f}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\N\Shell - "" = AutoRun
O33 - MountPoints2\N\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\N\Shell\AutoRun\command - "" = N:\pushinst.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: 6to4 -  File not found
NetSvcs: AppMgmt -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: qzkywoxa -  File not found
 
 
SafeBootMin: AppMgmt -  File not found
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vds - Service
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
SafeBootNet: AppMgmt -  File not found
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: nm -  File not found
SafeBootNet: nm.sys -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
ActiveX: {03F998B2-0E00-11D3-A498-00104B6EB52E} - Viewpoint Media Player
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)
ActiveX: {166B1BCA-3F9C-11CF-8075-444553540000} - Macromedia Shockwave Director 10.1
ActiveX: {1B00725B-C455-4DE6-BFB6-AD540AD427CD} - Viewpoint Media Player
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Macromedia Shockwave Director 10.1
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offlinebrowsingpaket
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer-Hilfe
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsererweiterungen
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - Zugang zu MSN Site
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - %SystemRoot%\system32\ie4uinit.exe
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML-Datenbindung
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer-Hauptschriftarten
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D} - Microsoft .NET Framework 1.1 Security Update (KB953297)
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML-Hilfe
ActiveX: {E78BFA60-5393-4C38-82AB-E8019E464EB4} - .NET Framework
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
 
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lhacm - C:\WINDOWS\System32\lhacm.acm (Microsoft Corporation)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\WINDOWS\System32\divx.dll (DivXNetworks, Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.VP60 - C:\WINDOWS\system32\vp6vfw.dll (On2.com)
Drivers32: vidc.VP61 - C:\WINDOWS\system32\vp6vfw.dll (On2.com)
Drivers32: VIDC.XFR1 - C:\WINDOWS\System32\xfcodec.dll ()
Drivers32: wave2 - C:\WINDOWS\System32\serwvdrv.dll (Microsoft Corporation)
Unable to start service SrService!
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.06.16 15:37:52 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\christopher\Recent
[2011.06.16 14:08:21 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\xmldm
[2011.06.16 12:58:53 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Malwarebytes
[2011.06.16 12:58:47 | 000,039,984 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011.06.16 12:58:47 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
[2011.06.16 12:58:45 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2011.06.16 12:58:42 | 000,022,712 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011.06.16 12:58:42 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2011.06.14 15:29:02 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\5018
[2011.06.11 00:09:26 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\5017
[2011.06.08 14:43:44 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\5016
[2011.06.07 00:34:29 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\UAs
[2011.06.07 00:33:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\5015
[2011.06.07 00:33:00 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\kock
[2011.06.05 12:44:15 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\christopher\Desktop\Urlaub fürs Gehirn
[2011.05.25 17:27:03 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Search Settings
[2011.05.25 17:26:59 | 000,000,000 | ---D | C] -- C:\Programme\pdfforge Toolbar
[2011.05.25 17:26:59 | 000,000,000 | ---D | C] -- C:\Programme\Application Updater
[2011.05.24 14:35:10 | 000,000,000 | ---D | C] -- C:\Programme\THQ
[2011.05.23 01:09:49 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\christopher\Desktop\ukulele
[2008.06.21 20:26:33 | 002,646,520 | ---- | C] (TrueCrypt Foundation) -- C:\Programme\TrueCrypt Setup.exe
[2008.06.21 20:26:33 | 001,221,312 | ---- | C] (TrueCrypt Foundation) -- C:\Programme\TrueCrypt Format.exe
[2008.06.21 20:26:33 | 001,106,112 | ---- | C] (TrueCrypt Foundation) -- C:\Programme\TrueCrypt.exe
[2008.06.21 20:26:33 | 000,230,080 | ---- | C] (TrueCrypt Foundation) -- C:\Programme\truecrypt-x64.sys
[2008.06.21 20:26:33 | 000,223,424 | ---- | C] (TrueCrypt Foundation) -- C:\Programme\truecrypt.sys
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.06.16 13:12:43 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011.06.16 13:12:41 | 1073,270,784 | -HS- | M] () -- C:\hiberfil.sys
[2011.06.16 12:58:47 | 000,000,756 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.06.16 00:41:53 | 000,138,520 | ---- | M] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2011.06.16 00:40:17 | 000,234,536 | ---- | M] () -- C:\WINDOWS\System32\PnkBstrB.xtr
[2011.06.08 16:36:35 | 001,154,401 | ---- | M] () -- C:\Dokumente und Einstellungen\christopher\Desktop\2011-06-08 16.36.35.jpg
[2011.06.07 21:19:01 | 000,016,257 | ---- | M] () -- C:\Dokumente und Einstellungen\christopher\Desktop\pdf.pdf
[2011.06.07 16:55:45 | 000,000,011 | ---- | M] () -- C:\WINDOWS\System32\urhtps.dat
[2011.06.07 11:36:02 | 001,107,309 | ---- | M] () -- C:\Dokumente und Einstellungen\christopher\Desktop\2011-06-07 11.36.02.jpg
[2011.06.01 17:42:28 | 000,043,164 | ---- | M] () -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\wklnhst.dat
[2011.06.01 13:04:08 | 000,061,663 | ---- | M] () -- C:\Dokumente und Einstellungen\christopher\Desktop\viewer1.png
[2011.06.01 12:56:51 | 000,075,696 | ---- | M] () -- C:\Dokumente und Einstellungen\christopher\Desktop\viewer.png
[2011.05.29 18:27:59 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011.05.29 09:11:30 | 000,039,984 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011.05.29 09:11:20 | 000,022,712 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011.05.23 22:10:53 | 001,824,809 | ---- | M] () -- C:\Dokumente und Einstellungen\christopher\Desktop\ufg.mp3
[2011.05.23 19:31:27 | 009,235,584 | ---- | M] () -- C:\Dokumente und Einstellungen\christopher\Desktop\ufg.flv
[2011.05.22 16:47:34 | 000,046,169 | ---- | M] () -- C:\Dokumente und Einstellungen\christopher\Desktop\2296.pdf
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.06.16 12:58:47 | 000,000,756 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.06.08 16:37:34 | 001,154,401 | ---- | C] () -- C:\Dokumente und Einstellungen\christopher\Desktop\2011-06-08 16.36.35.jpg
[2011.06.07 21:19:01 | 000,016,257 | ---- | C] () -- C:\Dokumente und Einstellungen\christopher\Desktop\pdf.pdf
[2011.06.07 16:55:45 | 000,000,011 | ---- | C] () -- C:\WINDOWS\System32\urhtps.dat
[2011.06.07 11:37:20 | 001,107,309 | ---- | C] () -- C:\Dokumente und Einstellungen\christopher\Desktop\2011-06-07 11.36.02.jpg
[2011.06.01 13:04:08 | 000,061,663 | ---- | C] () -- C:\Dokumente und Einstellungen\christopher\Desktop\viewer1.png
[2011.06.01 12:56:49 | 000,075,696 | ---- | C] () -- C:\Dokumente und Einstellungen\christopher\Desktop\viewer.png
[2011.05.23 22:10:44 | 001,824,809 | ---- | C] () -- C:\Dokumente und Einstellungen\christopher\Desktop\ufg.mp3
[2011.05.23 19:31:26 | 009,235,584 | ---- | C] () -- C:\Dokumente und Einstellungen\christopher\Desktop\ufg.flv
[2011.05.22 16:47:34 | 000,046,169 | ---- | C] () -- C:\Dokumente und Einstellungen\christopher\Desktop\2296.pdf
[2010.12.02 23:44:58 | 001,032,519 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-S-1-5-21-4147601781-1963535702-778001222-1006-0.dat
[2010.12.02 23:44:57 | 000,285,646 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-System.dat
[2010.12.02 21:32:14 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\FsUsbExDevice.Dll
[2010.12.02 21:32:14 | 000,036,640 | ---- | C] () -- C:\WINDOWS\System32\FsUsbExDisk.Sys
[2010.10.25 11:09:56 | 000,974,848 | ---- | C] () -- C:\WINDOWS\System32\cis-2.4.dll
[2010.10.25 11:09:56 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\issacapi_bs-2.3.dll
[2010.10.25 11:09:56 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\issacapi_pe-2.3.dll
[2010.10.25 11:09:56 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\issacapi_se-2.3.dll
[2010.01.17 14:56:48 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll
[2008.12.09 17:23:13 | 000,047,104 | RHS- | C] () -- C:\WINDOWS\System32\appconf32.exe
[2008.10.30 03:24:22 | 000,042,320 | ---- | C] () -- C:\WINDOWS\System32\xfcodec.dll
[2008.07.23 13:23:29 | 000,049,380 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2008.06.21 20:26:32 | 000,791,647 | ---- | C] () -- C:\Programme\TrueCrypt User Guide.pdf
[2008.03.24 22:17:05 | 000,000,029 | ---- | C] () -- C:\WINDOWS\DEBUGSM.INI
[2008.03.24 22:01:06 | 000,111,932 | ---- | C] () -- C:\WINDOWS\System32\EPPICPrinterDB.dat
[2008.03.24 22:01:06 | 000,031,053 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern131.dat
[2008.03.24 22:01:06 | 000,027,417 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern121.dat
[2008.03.24 22:01:06 | 000,026,154 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern1.dat
[2008.03.24 22:01:06 | 000,024,903 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern3.dat
[2008.03.24 22:01:06 | 000,021,390 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern5.dat
[2008.03.24 22:01:06 | 000,020,148 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern2.dat
[2008.03.24 22:01:06 | 000,011,811 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern4.dat
[2008.03.24 22:01:06 | 000,004,943 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern6.dat
[2008.03.24 22:01:06 | 000,001,146 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_DU.dat
[2008.03.24 22:01:06 | 000,001,139 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_PT.dat
[2008.03.24 22:01:06 | 000,001,139 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_BP.dat
[2008.03.24 22:01:06 | 000,001,136 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_ES.dat
[2008.03.24 22:01:06 | 000,001,129 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_FR.dat
[2008.03.24 22:01:06 | 000,001,129 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_CF.dat
[2008.03.24 22:01:06 | 000,001,120 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_IT.dat
[2008.03.24 22:01:06 | 000,001,107 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_GE.dat
[2008.03.24 22:01:06 | 000,001,104 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_EN.dat
[2008.03.24 22:01:06 | 000,000,097 | ---- | C] () -- C:\WINDOWS\System32\PICSDK.ini
[2008.03.24 21:59:55 | 000,000,025 | ---- | C] () -- C:\WINDOWS\CDE DX7400DEFGIPS.ini
[2008.01.31 18:20:49 | 000,000,311 | ---- | C] () -- C:\WINDOWS\game.ini
[2007.10.06 11:56:53 | 000,138,520 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2007.10.06 11:56:45 | 000,234,536 | ---- | C] () -- C:\WINDOWS\System32\PnkBstrB.exe
[2007.10.06 11:56:35 | 000,075,064 | ---- | C] () -- C:\WINDOWS\System32\PnkBstrA.exe
[2007.06.11 00:23:15 | 000,114,688 | ---- | C] () -- C:\WINDOWS\System32\netlogun.exe
[2007.05.05 13:05:46 | 000,000,000 | ---- | C] () -- C:\WINDOWS\mngui.INI
[2007.01.23 21:02:05 | 000,000,468 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI
[2007.01.23 21:02:05 | 000,000,030 | ---- | C] () -- C:\WINDOWS\System32\brss01a.ini
[2007.01.23 21:02:05 | 000,000,027 | ---- | C] () -- C:\WINDOWS\BRPP2KA.INI
[2007.01.23 20:57:52 | 000,000,050 | ---- | C] () -- C:\WINDOWS\System32\bridf05a.dat
[2007.01.23 20:56:17 | 000,027,114 | ---- | C] () -- C:\WINDOWS\maxlink.ini
[2006.11.04 09:57:54 | 000,637,620 | ---- | C] () -- C:\WINDOWS\uninst_7407.exe
[2006.11.04 09:57:54 | 000,001,760 | ---- | C] () -- C:\WINDOWS\uninst_7407.dat
[2006.11.04 09:56:05 | 000,637,620 | ---- | C] () -- C:\WINDOWS\uninst_6183.exe
[2006.11.04 09:56:05 | 000,001,893 | ---- | C] () -- C:\WINDOWS\uninst_6183.dat
[2006.11.04 09:41:28 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\xmltok.dll.off
[2006.11.04 09:41:28 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\xmlparse.dll.off
[2006.10.27 14:54:20 | 000,004,212 | -H-- | C] () -- C:\WINDOWS\System32\zllictbl.dat
[2006.10.27 14:54:02 | 000,018,344 | ---- | C] () -- C:\WINDOWS\System32\imsinstall_loc0407.dll
[2006.10.15 20:16:27 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\GkSui18.EXE
[2006.09.27 20:14:24 | 000,000,089 | ---- | C] () -- C:\WINDOWS\asciiart.ini
[2006.07.31 20:27:42 | 000,097,360 | ---- | C] () -- C:\WINDOWS\System32\drivers\Fwusb1b.bin
[2006.07.20 00:13:34 | 000,000,147 | ---- | C] () -- C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2006.07.09 21:51:16 | 000,012,288 | ---- | C] () -- C:\WINDOWS\impborl.dll
[2006.04.20 23:32:34 | 000,000,169 | ---- | C] () -- C:\WINDOWS\RtlRack.ini
[2006.02.19 11:40:55 | 000,005,734 | ---- | C] () -- C:\WINDOWS\cdPlayer.ini
[2005.12.28 15:34:34 | 000,223,128 | ---- | C] () -- C:\WINDOWS\System32\drivers\dtscsi.sys
[2005.12.28 15:30:42 | 000,096,384 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd9437.sys
[2005.12.15 22:14:15 | 000,107,132 | ---- | C] () -- C:\WINDOWS\UninstallFirefox.exe
[2005.12.15 22:14:09 | 000,003,032 | ---- | C] () -- C:\WINDOWS\mozver.dat
[2005.08.23 20:42:28 | 000,000,468 | ---- | C] () -- C:\WINDOWS\System32\mslck.dat
[2005.08.23 20:42:15 | 000,000,016 | ---- | C] () -- C:\WINDOWS\System32\Mlkf.dll
[2005.08.23 20:33:28 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\LckFldService.exe
[2005.08.23 20:33:26 | 000,153,088 | ---- | C] () -- C:\WINDOWS\System32\fldlckun.exe
[2005.08.03 08:58:19 | 000,043,520 | ---- | C] () -- C:\WINDOWS\System32\CmdLineExt03.dll
[2005.06.04 19:27:30 | 000,000,412 | ---- | C] () -- C:\WINDOWS\ulead32.ini
[2005.05.16 09:44:57 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\vidx16.dll
[2005.05.12 00:34:00 | 000,581,632 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll
[2005.04.19 21:31:48 | 000,000,072 | ---- | C] () -- C:\WINDOWS\Pex.INI
[2005.04.18 18:39:39 | 000,043,164 | ---- | C] () -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\wklnhst.dat
[2005.04.04 20:08:41 | 000,084,480 | ---- | C] () -- C:\Dokumente und Einstellungen\christopher\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2005.03.30 17:02:42 | 000,240,640 | ---- | C] () -- C:\WINDOWS\System32\NMOCOD.DLL
[2005.03.29 20:04:00 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\ZyDelReg.exe
[2005.03.29 20:03:52 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2005.03.29 20:03:51 | 000,156,672 | ---- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll
[2005.03.29 20:03:49 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2005.03.29 20:03:48 | 000,436,750 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2005.03.29 20:03:48 | 000,422,204 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2005.03.29 20:03:48 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2005.03.29 20:03:48 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2005.03.29 20:03:48 | 000,074,992 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2005.03.29 20:03:48 | 000,061,906 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2005.03.29 20:03:48 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2005.03.29 20:03:48 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2005.03.29 20:03:47 | 000,004,524 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2005.03.29 20:03:47 | 000,000,896 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2005.03.29 20:03:46 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2005.03.29 20:03:45 | 001,626,112 | ---- | C] () -- C:\WINDOWS\System32\nwiz.exe
[2005.03.29 20:03:43 | 001,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2005.03.29 20:03:43 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2005.03.29 20:03:43 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2005.03.29 20:03:43 | 000,223,232 | ---- | C] () -- C:\WINDOWS\System32\nvsataconnection.exe
[2005.03.29 20:03:41 | 001,478,656 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2005.03.29 20:03:41 | 001,339,392 | ---- | C] () -- C:\WINDOWS\System32\nvdspsch.exe
[2005.03.29 20:03:41 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2005.03.29 20:03:41 | 000,249,344 | ---- | C] () -- C:\WINDOWS\System32\NvRaidMan.exe
[2005.03.29 20:03:40 | 000,442,368 | ---- | C] () -- C:\WINDOWS\System32\nvappbar.exe
[2005.03.29 20:03:39 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2005.03.29 20:03:34 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2005.03.29 20:03:34 | 000,138,752 | ---- | C] () -- C:\WINDOWS\System32\MASE32.DLL
[2005.03.29 20:03:34 | 000,136,192 | ---- | C] () -- C:\WINDOWS\System32\MAMC32.DLL
[2005.03.29 20:03:34 | 000,057,856 | ---- | C] () -- C:\WINDOWS\System32\MASD32.DLL
[2005.03.29 20:03:34 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2005.03.29 20:03:33 | 000,196,096 | ---- | C] () -- C:\WINDOWS\System32\MACD32.DLL
[2005.03.29 20:03:33 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\MA32.DLL
[2005.03.29 20:03:32 | 001,663,068 | ---- | C] () -- C:\WINDOWS\System32\libmmd.dll
[2005.03.29 20:03:31 | 000,425,984 | ---- | C] () -- C:\WINDOWS\System32\keystone.exe
[2005.03.29 20:03:30 | 000,035,328 | ---- | C] () -- C:\WINDOWS\System32\INETWH32.DLL
[2005.03.29 20:03:30 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\InsDrvZD.dll
[2005.03.29 20:03:29 | 000,279,744 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2005.03.29 20:03:28 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2005.03.29 20:03:28 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2005.03.29 20:02:55 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2005.03.29 20:02:54 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2005.03.29 20:02:52 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\ChCfg.exe
[2005.03.29 20:02:49 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\34CoInstaller.dll
[2005.03.29 20:02:46 | 000,200,704 | ---- | C] () -- C:\WINDOWS\sel3110.exe
[2005.03.29 20:02:46 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2005.03.29 20:02:40 | 000,532,544 | ---- | C] () -- C:\WINDOWS\PIC.dll
[2005.03.29 20:02:40 | 000,000,063 | ---- | C] () -- C:\WINDOWS\PixieTool.INI
[2005.03.29 20:02:37 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2005.03.29 20:02:37 | 000,000,849 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2005.03.29 20:02:37 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2005.03.29 20:02:37 | 000,000,335 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2005.03.29 20:02:37 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2005.03.29 20:01:26 | 000,011,776 | ---- | C] () -- C:\WINDOWS\HIDMNT.dll
[2005.03.29 20:01:26 | 000,005,120 | ---- | C] () -- C:\WINDOWS\HKCYDLL.dll
[2005.03.29 20:01:12 | 000,000,821 | ---- | C] () -- C:\WINDOWS\HBCIKRNL.INI
[2005.03.29 20:01:03 | 000,049,152 | ---- | C] () -- C:\WINDOWS\CNYUSB.dll
[2005.03.29 20:01:03 | 000,040,960 | ---- | C] () -- C:\WINDOWS\CleanDev.exe
[2005.03.29 20:01:03 | 000,000,360 | ---- | C] () -- C:\WINDOWS\CNYHKey.ini
[2005.03.29 20:01:01 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2005.03.29 20:01:01 | 000,000,164 | ---- | C] () -- C:\WINDOWS\avrack.ini
[2005.03.29 20:00:59 | 000,032,528 | ---- | C] () -- C:\WINDOWS\amcap.exe
[2005.03.29 13:08:47 | 000,000,848 | ---- | C] () -- C:\WINDOWS\eReg.dat
[2005.03.29 12:09:15 | 000,000,144 | ---- | C] () -- C:\Dokumente und Einstellungen\christopher\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2002.03.04 11:16:34 | 000,110,592 | R--- | C] () -- C:\WINDOWS\System32\Jpeg32.dll
[1997.06.14 10:56:08 | 000,056,832 | ---- | C] () -- C:\WINDOWS\System32\iyvu9_32.dll
 
========== LOP Check ==========
 
[2006.09.24 19:20:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CodedColor
[2008.03.28 20:51:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\EPSON
[2006.08.14 23:36:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Messenger Plus!
[2006.02.27 20:52:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Pinnacle
[2010.12.02 20:28:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Samsung
[2007.01.23 20:55:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ScanSoft
[2009.10.10 16:49:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TomTom
[2008.04.16 21:08:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\UDL
[2005.03.29 19:57:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Ulead Systems
[2005.03.29 19:57:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Viewpoint
[2006.08.29 20:03:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\CCPublisher
[2009.12.11 18:42:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Desktopicon
[2008.03.24 22:26:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\EPSON
[2009.04.27 20:59:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\FinalBurner Video DVD
[2011.05.10 16:19:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\gtk-2.0
[2008.12.13 17:25:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\ICQ
[2006.08.06 23:36:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\ICQLite
[2008.07.21 18:18:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Miranda
[2010.10.12 14:01:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Miranda Fusion
[2006.08.24 15:50:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Musicmatch
[2009.01.18 22:29:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\OpenOffice.org
[2006.08.10 19:40:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\optiondead
[2010.01.18 18:08:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\pdfforge
[2006.08.07 15:56:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Polldefy
[2008.07.01 22:35:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\QIP
[2010.12.02 20:24:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Samsung
[2007.03.25 11:48:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\ScanSoft
[2007.04.29 11:38:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Screenshot Sender
[2011.05.25 17:27:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Search Settings
[2005.10.20 16:51:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Shareaza
[2007.05.01 18:19:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Teleca
[2009.10.10 16:48:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\TomTom
[2008.06.21 20:29:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\TrueCrypt
[2005.04.19 21:23:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Ulead Systems
[2008.05.08 16:05:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Viewpoint
[2010.08.16 13:31:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Ycqy
[2010.08.16 13:38:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Ynvaga
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
[2008.01.07 15:07:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Application Data\Microsoft
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2010.10.02 11:51:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Adobe
[2009.03.08 13:40:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\AdobeUM
[2009.04.27 20:45:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Ahead
[2010.10.13 17:33:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\AOL
[2007.03.27 22:37:44 | 000,000,000 | R--D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Brother
[2006.08.29 20:03:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\CCPublisher
[2008.06.23 20:52:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Creative
[2006.04.08 09:36:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\CyberLink
[2009.12.11 18:42:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Desktopicon
[2010.05.31 15:59:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\DivX
[2010.12.24 19:31:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\dvdcss
[2008.03.24 22:26:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\EPSON
[2009.04.27 20:59:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\FinalBurner Video DVD
[2006.02.07 20:16:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Google
[2011.05.10 16:19:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\gtk-2.0
[2009.02.09 21:00:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Hamachi
[2007.11.29 12:39:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Hamachi-Backup
[2005.04.25 19:39:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Help
[2008.12.13 17:25:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\ICQ
[2006.08.06 23:36:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\ICQLite
[2005.03.29 19:57:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Identities
[2008.03.24 22:01:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\InstallShield
[2006.03.01 18:00:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Macromedia
[2011.06.16 12:58:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Malwarebytes
[2009.12.23 19:28:30 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Microsoft
[2008.07.21 18:18:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Miranda
[2010.10.12 14:01:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Miranda Fusion
[2009.10.10 16:48:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Mozilla
[2006.01.15 00:58:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\MSN6
[2006.08.24 15:50:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Musicmatch
[2009.01.18 22:29:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\OpenOffice.org
[2006.08.10 19:40:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\optiondead
[2010.01.18 18:08:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\pdfforge
[2006.08.07 15:56:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Polldefy
[2008.07.01 22:35:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\QIP
[2010.12.02 20:24:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Samsung
[2007.03.25 11:48:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\ScanSoft
[2007.04.29 11:38:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Screenshot Sender
[2011.05.25 17:27:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Search Settings
[2005.10.20 16:51:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Shareaza
[2011.05.20 01:22:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Skype
[2005.05.17 20:11:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Sun
[2010.01.12 23:19:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\teamspeak2
[2007.05.01 18:19:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Teleca
[2009.10.10 16:48:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\TomTom
[2008.06.21 20:29:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\TrueCrypt
[2006.05.21 15:34:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\U3
[2005.04.19 21:23:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Ulead Systems
[2008.05.08 16:05:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Viewpoint
[2008.11.15 02:51:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\vlc
[2010.08.16 13:31:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Ycqy
[2010.08.16 13:38:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Ynvaga
[2005.03.29 19:57:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\You've Got Pictures Screensaver
 
< %APPDATA%\*.exe /s >
[2009.12.11 18:42:40 | 000,031,836 | ---- | M] () -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Desktopicon\uninst.exe
[2007.02.14 15:10:31 | 001,168,157 | ---- | M] () -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe
[2010.08.15 16:19:39 | 002,788,816 | ---- | M] (Adobe Systems, Inc.) -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe
[2011.03.21 23:22:10 | 000,388,096 | R--- | M] (Trend Micro Inc.) -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
[2008.06.22 10:16:54 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Microsoft\Installer\{71414EC2-0684-4A15-A85A-E0E259D117AF}\ARPPRODUCTICON.exe
[2008.06.22 10:16:54 | 000,163,840 | R--- | M] (Macrovision Corporation) -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Microsoft\Installer\{71414EC2-0684-4A15-A85A-E0E259D117AF}\m6animator.exe_71414EC206844A15A85AE0E259D117AF.exe
[2008.06.22 10:16:54 | 000,163,840 | R--- | M] (Macrovision Corporation) -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Microsoft\Installer\{71414EC2-0684-4A15-A85A-E0E259D117AF}\m6explorer.exe_71414EC206844A15A85AE0E259D117AF.exe
[2008.06.22 10:16:54 | 000,208,896 | R--- | M] (Macrovision Corporation) -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Microsoft\Installer\{71414EC2-0684-4A15-A85A-E0E259D117AF}\m6librarian.exe_71414EC206844A15A85AE0E259D117AF.exe
[2008.06.22 10:16:54 | 000,135,168 | R--- | M] (Macrovision Corporation) -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Microsoft\Installer\{71414EC2-0684-4A15-A85A-E0E259D117AF}\m6studio.exe_71414EC206844A15A85AE0E259D117AF.exe
[2008.06.22 10:16:54 | 000,025,214 | R--- | M] () -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Microsoft\Installer\{71414EC2-0684-4A15-A85A-E0E259D117AF}\m6tools.chm_71414EC206844A15A85AE0E259D117AF.exe
[2006.08.18 14:00:32 | 000,061,440 | R--- | M] (InstallShield Software Corp.) -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Microsoft\Installer\{ADF1F741-4BBC-4F7E-8C2C-9855D6318185}\ARPPRODUCTICON.exe
[2006.08.18 14:00:32 | 000,061,440 | R--- | M] (InstallShield Software Corp.) -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Microsoft\Installer\{ADF1F741-4BBC-4F7E-8C2C-9855D6318185}\NewShortcut10_ADF1F7414BBC4F7E8C2C9855D6318185.exe
[2006.08.18 14:00:32 | 000,061,440 | R--- | M] (InstallShield Software Corp.) -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Microsoft\Installer\{ADF1F741-4BBC-4F7E-8C2C-9855D6318185}\NewShortcut11_ADF1F7414BBC4F7E8C2C9855D6318185.exe
[2006.08.18 14:00:32 | 000,061,440 | R--- | M] (InstallShield Software Corp.) -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Microsoft\Installer\{ADF1F741-4BBC-4F7E-8C2C-9855D6318185}\NewShortcut12_ADF1F7414BBC4F7E8C2C9855D6318185.exe
[2006.08.18 14:00:32 | 000,053,248 | R--- | M] (InstallShield Software Corp.) -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Microsoft\Installer\{ADF1F741-4BBC-4F7E-8C2C-9855D6318185}\NewShortcut13_ADF1F7414BBC4F7E8C2C9855D6318185.exe
[2006.08.18 14:00:32 | 000,053,248 | R--- | M] (InstallShield Software Corp.) -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Microsoft\Installer\{ADF1F741-4BBC-4F7E-8C2C-9855D6318185}\NewShortcut14_ADF1F7414BBC4F7E8C2C9855D6318185.exe
[2006.08.18 14:00:32 | 000,061,440 | R--- | M] (InstallShield Software Corp.) -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Microsoft\Installer\{ADF1F741-4BBC-4F7E-8C2C-9855D6318185}\NewShortcut15_ADF1F7414BBC4F7E8C2C9855D6318185.exe
[2006.08.18 14:00:32 | 000,061,440 | R--- | M] (InstallShield Software Corp.) -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Microsoft\Installer\{ADF1F741-4BBC-4F7E-8C2C-9855D6318185}\NewShortcut16_ADF1F7414BBC4F7E8C2C9855D6318185.exe
[2006.08.18 14:00:32 | 000,061,440 | R--- | M] (InstallShield Software Corp.) -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Microsoft\Installer\{ADF1F741-4BBC-4F7E-8C2C-9855D6318185}\NewShortcut17_ADF1F7414BBC4F7E8C2C9855D6318185.exe
[2006.08.18 14:00:32 | 000,061,440 | R--- | M] (InstallShield Software Corp.) -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Microsoft\Installer\{ADF1F741-4BBC-4F7E-8C2C-9855D6318185}\NewShortcut18_ADF1F7414BBC4F7E8C2C9855D6318185.exe
[2006.08.18 14:00:32 | 000,061,440 | R--- | M] (InstallShield Software Corp.) -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Microsoft\Installer\{ADF1F741-4BBC-4F7E-8C2C-9855D6318185}\NewShortcut19_ADF1F7414BBC4F7E8C2C9855D6318185.exe
[2006.08.18 14:00:32 | 000,061,440 | R--- | M] (InstallShield Software Corp.) -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Microsoft\Installer\{ADF1F741-4BBC-4F7E-8C2C-9855D6318185}\NewShortcut20_ADF1F7414BBC4F7E8C2C9855D6318185.exe
[2006.08.18 14:00:32 | 000,061,440 | R--- | M] (InstallShield Software Corp.) -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Microsoft\Installer\{ADF1F741-4BBC-4F7E-8C2C-9855D6318185}\NewShortcut21_ADF1F7414BBC4F7E8C2C9855D6318185.exe
[2006.08.18 14:00:32 | 000,061,440 | R--- | M] (InstallShield Software Corp.) -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Microsoft\Installer\{ADF1F741-4BBC-4F7E-8C2C-9855D6318185}\NewShortcut22_ADF1F7414BBC4F7E8C2C9855D6318185.exe
[2006.08.18 14:00:32 | 000,053,248 | R--- | M] (InstallShield Software Corp.) -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Microsoft\Installer\{ADF1F741-4BBC-4F7E-8C2C-9855D6318185}\NewShortcut23_ADF1F7414BBC4F7E8C2C9855D6318185.exe
[2006.08.18 14:00:32 | 000,061,440 | R--- | M] (InstallShield Software Corp.) -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Microsoft\Installer\{ADF1F741-4BBC-4F7E-8C2C-9855D6318185}\NewShortcut24_ADF1F7414BBC4F7E8C2C9855D6318185.exe
[2006.08.18 14:00:32 | 000,061,440 | R--- | M] (InstallShield Software Corp.) -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Microsoft\Installer\{ADF1F741-4BBC-4F7E-8C2C-9855D6318185}\NewShortcut25_ADF1F7414BBC4F7E8C2C9855D6318185.exe
[2006.08.18 14:00:32 | 000,061,440 | R--- | M] (InstallShield Software Corp.) -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Microsoft\Installer\{ADF1F741-4BBC-4F7E-8C2C-9855D6318185}\NewShortcut2_ADF1F7414BBC4F7E8C2C9855D6318185.exe
[2006.08.18 14:00:32 | 000,061,440 | R--- | M] (InstallShield Software Corp.) -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Microsoft\Installer\{ADF1F741-4BBC-4F7E-8C2C-9855D6318185}\NewShortcut4_ADF1F7414BBC4F7E8C2C9855D6318185.exe
[2006.08.18 14:00:32 | 000,061,440 | R--- | M] (InstallShield Software Corp.) -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Microsoft\Installer\{ADF1F741-4BBC-4F7E-8C2C-9855D6318185}\NewShortcut6_ADF1F7414BBC4F7E8C2C9855D6318185.exe
[2006.08.18 14:00:32 | 000,061,440 | R--- | M] (InstallShield Software Corp.) -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Microsoft\Installer\{ADF1F741-4BBC-4F7E-8C2C-9855D6318185}\NewShortcut7_ADF1F7414BBC4F7E8C2C9855D6318185.exe
[2006.08.18 14:00:32 | 000,061,440 | R--- | M] (InstallShield Software Corp.) -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Microsoft\Installer\{ADF1F741-4BBC-4F7E-8C2C-9855D6318185}\NewShortcut8_ADF1F7414BBC4F7E8C2C9855D6318185.exe
[2006.08.18 14:00:32 | 000,061,440 | R--- | M] (InstallShield Software Corp.) -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Microsoft\Installer\{ADF1F741-4BBC-4F7E-8C2C-9855D6318185}\NewShortcut9_ADF1F7414BBC4F7E8C2C9855D6318185.exe
[2009.09.01 17:05:40 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Microsoft\Installer\{BCB313A5-1AD0-4829-9D6F-EB41C3CFCD4B}\Foren.exe
[2009.09.01 17:05:40 | 000,000,766 | R--- | M] () -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Microsoft\Installer\{BCB313A5-1AD0-4829-9D6F-EB41C3CFCD4B}\htmledit.exe
[2010.10.26 22:33:31 | 000,013,960 | ---- | M] () -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\Miranda Fusion\Profil\Erhaltene Dateien\h4ml3t\mein1stprog.exe
[2005.06.06 10:29:14 | 000,110,592 | ---- | M] () -- C:\Dokumente und Einstellungen\christopher\Anwendungsdaten\U3\temp\cleanup.exe
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2004.08.04 22:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2008.04.14 08:03:54 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2004.08.04 22:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp2.cab:AGP440.sys
[2008.04.14 08:03:54 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008.04.14 00:06:40 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008.04.14 00:06:40 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\dllcache\agp440.sys
[2008.04.14 00:06:40 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys
 
< MD5 for: ATAPI.SYS  >
[2004.08.04 22:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2008.04.14 08:03:54 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2004.08.04 22:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp2.cab:atapi.sys
[2008.04.14 08:03:54 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008.04.14 00:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008.04.14 00:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004.08.04 22:00:00 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
 
< MD5 for: EVENTLOG.DLL  >
[2008.04.14 07:52:12 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008.04.14 07:52:12 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll
[2004.08.04 22:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll
 
< MD5 for: EXPLORER.EXE  >
[2004.08.04 22:00:00 | 001,035,264 | ---- | M] (Microsoft Corporation) MD5=22FE1BE02EADDE1632E478E4125639E0 -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
[2008.04.14 07:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\explorer.exe
[2008.04.14 07:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe
 
< MD5 for: NETLOGON.DLL  >
[2008.04.14 07:52:20 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008.04.14 07:52:20 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll
[2004.08.04 22:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D27395EDCD3416AFD125A9370DCB585C -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll
 
< MD5 for: NVATABUS.SYS  >
[2004.12.08 01:15:54 | 000,087,936 | ---- | M] (NVIDIA Corporation) MD5=E4F1F95A6BBBFBBFF9A713C6063AA2CB -- C:\WINDOWS\system32\drivers\nvatabus.sys
[2004.12.08 01:15:54 | 000,087,936 | ---- | M] (NVIDIA Corporation) MD5=E4F1F95A6BBBFBBFF9A713C6063AA2CB -- C:\WINDOWS\system32\ReinstallBackups\0001\DriverFiles\nvatabus.sys
[2004.12.08 01:15:54 | 000,087,936 | ---- | M] (NVIDIA Corporation) MD5=E4F1F95A6BBBFBBFF9A713C6063AA2CB -- C:\WINDOWS\system32\ReinstallBackups\0006\DriverFiles\nvatabus.sys
[2004.12.08 01:15:54 | 000,087,936 | ---- | M] (NVIDIA Corporation) MD5=E4F1F95A6BBBFBBFF9A713C6063AA2CB -- C:\WINDOWS\system32\ReinstallBackups\0007\DriverFiles\nvatabus.sys
 
< MD5 for: SCECLI.DLL  >
[2008.04.14 07:52:24 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008.04.14 07:52:24 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll
[2004.08.04 22:00:00 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
 
< MD5 for: USER32.DLL  >
[2005.03.02 20:09:46 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=3751D7CF0E0A113D84414992146BCE6A -- C:\WINDOWS\$NtServicePackUninstall$\user32.dll
[2005.03.02 20:19:56 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=4C90159A69A5FD3EB39C71411F28FCFF -- C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll
[2004.08.04 22:00:00 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=56785FD5236D7B22CF471A6DA9DB46D8 -- C:\WINDOWS\$NtUninstallKB890859$\user32.dll
[2008.04.14 07:52:32 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\ServicePackFiles\i386\user32.dll
[2008.04.14 07:52:32 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.04.14 07:53:04 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008.04.14 07:53:04 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe
[2004.08.04 22:00:00 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2004.08.04 22:00:00 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2008.04.14 07:53:06 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008.04.14 07:53:06 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\dllcache\winlogon.exe
[2008.04.14 07:53:06 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2004.08.04 22:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys
[2004.08.04 22:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
[2005.12.28 15:34:34 | 000,223,128 | ---- | M] () Unable to obtain MD5 -- C:\WINDOWS\system32\drivers\dtscsi.sys
[2005.12.28 15:30:42 | 000,664,064 | ---- | M] () Unable to obtain MD5 -- C:\WINDOWS\system32\drivers\sptd.sys
[2010.06.22 22:43:22 | 000,096,384 | ---- | M] () Unable to obtain MD5 -- C:\WINDOWS\system32\drivers\sptd9437.sys
 
< %systemroot%\System32\config\*.sav >
[2005.01.22 20:25:52 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2005.01.22 20:25:52 | 000,638,976 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2005.01.22 20:25:52 | 000,471,040 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[4 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< End of report >
--- --- ---

Xtricer 16.06.2011 20:56
Bei Extras.txt kam folgendes raus:OTL EXTRAS Logfile:
Code:
OTL Extras logfile created on: 16.06.2011 21:35:34 - Run 3
OTL by OldTimer - Version 3.2.24.0    Folder = C:\Dokumente und Einstellungen\christopher\Eigene Dateien\Downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1023,48 Mb Total Physical Memory | 622,27 Mb Available Physical Memory | 60,80% Memory free
2,40 Gb Paging File | 2,02 Gb Available in Paging File | 83,87% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 272,46 Gb Total Space | 3,90 Gb Free Space | 1,43% Space Free | Partition Type: NTFS
Drive D: | 2,05 Gb Total Space | 1,22 Gb Free Space | 59,65% Space Free | Partition Type: FAT32
Drive E: | 616,37 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
 
Computer Name: NAME-A0073FCD77 | User Name: christopher | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] -- rundll32.exe shdocvw.dll,OpenURL %l
 
[HKEY_USERS\S-1-5-21-4147601781-1963535702-778001222-1006\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
InternetShortcut [open] -- rundll32.exe shdocvw.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- C:\Programme\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- C:\Programme\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Programme\Winamp\Winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Programme\Winamp\Winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Programme\Winamp\Winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 4
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"7012:TCP" = 7012:TCP:*:Enabled:xhscfw
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\CyberLink\PowerCinema\PowerCinema.exe" = C:\Programme\CyberLink\PowerCinema\PowerCinema.exe:*:Enabled:PowerCinema -- (CyberLink Corp.)
"C:\Programme\Shareaza\Shareaza.exe" = C:\Programme\Shareaza\Shareaza.exe:*:Enabled:Shareaza -- (Shareaza Development Team)
"C:\Programme\TrackMania Nations ESWC\TmNationsESWC.exe" = C:\Programme\TrackMania Nations ESWC\TmNationsESWC.exe:*:Enabled:TmNationsESWC
"C:\Programme\Xfire\Xfire.exe" = C:\Programme\Xfire\Xfire.exe:*:Enabled:Xfire
"C:\Programme\EA Games\Battlefield 2\BF2.exe" = C:\Programme\EA Games\Battlefield 2\BF2.exe:*:Disabled:Battlefield 2 -- ()
"C:\Programme\EA Games\Battlefield 2\bf2_w32ded.exe" = C:\Programme\EA Games\Battlefield 2\bf2_w32ded.exe:*:Disabled:Bf2_w32ded -- ()
"C:\Programme\EA Games\Battlefield 2\BF22.exe" = C:\Programme\EA Games\Battlefield 2\BF22.exe:*:Disabled:BF22 -- ()
"C:\Programme\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe" = C:\Programme\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:*:Enabled:Call of Duty(R) 4 - Modern Warfare(TM) -- ()
"C:\Programme\ICQ6.5\ICQ.exe" = C:\Programme\ICQ6.5\ICQ.exe:*:Enabled:ICQ6
"C:\Programme\Stardock Games\Sins of a Solar Empire\Sins of a Solar Empire.exe" = C:\Programme\Stardock Games\Sins of a Solar Empire\Sins of a Solar Empire.exe:*:Enabled:Sins of a Solar Empire -- (Ironclad Games)
"C:\Programme\QIP\qip.exe" = C:\Programme\QIP\qip.exe:*:Enabled:Quiet Internet Pager
"C:\Programme\Java\jdk1.6.0_10\jre\bin\java.exe" = C:\Programme\Java\jdk1.6.0_10\jre\bin\java.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Programme\Winamp\winamp.exe" = C:\Programme\Winamp\winamp.exe:*:Enabled:Winamp -- (Nullsoft)
"C:\Programme\Electronic Arts\Steam\SteamApps\gaming_sinnlos\counter-strike source\hl2.exe" = C:\Programme\Electronic Arts\Steam\SteamApps\gaming_sinnlos\counter-strike source\hl2.exe:*:Enabled:Counter-Strike: Source -- ()
"C:\Programme\Audiosurf\engine\QuestViewer.exe" = C:\Programme\Audiosurf\engine\QuestViewer.exe:*:Enabled:QuestViewer -- ()
"C:\Programme\Steam\Steam.exe" = C:\Programme\Steam\Steam.exe:*:Enabled:Steam -- (Valve Corporation)
"C:\Programme\AIM\aim.exe" = C:\Programme\AIM\aim.exe:*:Enabled:AIM
"C:\Programme\Steam\SteamApps\gaming_sinnlos\counter-strike source\hl2.exe" = C:\Programme\Steam\SteamApps\gaming_sinnlos\counter-strike source\hl2.exe:*:Enabled:Counter-Strike: Source -- ()
"C:\WINDOWS\system32\muzapp.exe" = C:\WINDOWS\system32\muzapp.exe:*:Enabled:MUZ AOD APP player -- (Musiccity Co.Ltd.)
"C:\Programme\Electronic Arts\Steam\SteamApps\gaming_sinnlos\dedicated server\hlds.exe" = C:\Programme\Electronic Arts\Steam\SteamApps\gaming_sinnlos\dedicated server\hlds.exe:*:Enabled:Dedicated Server -- (Valve)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{04858915-9F49-4B2A-AED4-DC49A7DE6A7B}" = Battlefield 2(TM)
"{05440044-64A6-4248-A026-9745C1E9E159}" = Microsoft Encarta Enzyklopädie 2005
"{06F80017-8F98-4C94-B868-52358569FC32}" = Command & Conquer(TM) Generäle
"{077A7810-A937-4465-AD08-ACED9807995F}" = ANNO 1602 Königs-Edition
"{086BADF8-9B1F-4E89-B207-2EDA520972D6}" = Grand Theft Auto San Andreas
"{16E217EA-C3E0-402D-8D4F-6189DB74497A}" = Studio 9.3 Patch
"{1A3E23D7-7A1E-43EC-B35D-EB8A31BED943}" = FinalBurner Free v2.10.0.153
"{1B2DBF55-05D4-4072-87D8-689141E262BD}" = Creative ZEN
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{20C45B32-5AB6-46A4-94EF-58950CAF05E5}" = EPSON Attach To Email
"{2217B0B4-35CB-48C6-B640-864DF2F30F99}" = OpenOffice.org 3.2
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{259C0ABB-A3B2-4D70-008F-BF7EE491B70B}" = Need for Speed™ Carbon
"{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = PowerCinema 4.0
"{26A24AE4-039D-4CA4-87B4-2F83216010FF}" = Java(TM) 6 Update 10
"{2A88F1BF-7041-4E42-84B1-6B4ACB83AC64}" = EPSON Scan Assistant
"{2EB81825-E9EE-44F4-8F51-1240C3898DC6}" = EPSON File Manager
"{2F315767-6230-4980-BE36-C2E91D42BBB8}" = die ReadKVK Applikation
"{3248F0A8-6813-11D6-A77B-00B0D0150080}" = J2SE Runtime Environment 5.0 Update 8
"{3248F0A8-6813-11D6-A77B-00B0D0160010}" = Java(TM) SE Runtime Environment 6 Update 1
"{32A3A4F4-B792-11D6-A78A-00B0D0160100}" = Java(TM) SE Development Kit 6 Update 10
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35A3A4F4-B792-11D6-A78A-00B0D0142180}" = Java 2 SDK, SE v1.4.2_18
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3CEA4CA8-CDD4-451C-B673-E8F17BE01B15}" = Ulead COOL 360 1.0
"{3D5E5C0A-5B36-4F98-99A7-287F7DBDCE03}" = Skype Plugin Manager
"{3D78F2A2-C893-4ABD-B5FE-AD7011837755}" = EPSON Easy Photo Print
"{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger
"{43DCF766-6838-4F9A-8C91-D92DA586DFA7}" = Microsoft Windows-Journal-Viewer
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{581CE7EA-A30D-0000-1211-088635773309}" = ZyDAS IEEE 802.11g Wireless LAN - USB
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call
"{6054F774-FEF0-46C6-9311-EC97FC576FC5}" = USB Wireless Keyboard Driver
"{67E4EE98-59F4-4220-89A6-A20AF5BEC689}" = Microsoft AutoRoute 2005
"{67EDD823-135A-4D59-87BD-950616D6E857}" = EPSON Copy Utility 3
"{6BFF4534-7608-41F0-85F7-31A0569D8960}" = eTrust Registration
"{71414EC2-0684-4A15-A85A-E0E259D117AF}" = Microangelo Toolset 6
"{7148F0A8-6813-11D6-A77B-00B0D0142180}" = Java 2 Runtime Environment, SE v1.4.2_18
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser und SDK
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{786C5747-0C40-4930-9AFE-113BCE553101}" = Adobe Stock Photos 1.0
"{7E20EFE6-E604-48C6-8B39-BA4742F2CDB4}" = Zune Desktop Theme
"{7F14F68C-17FA-4F88-B3FD-7F449C1EBF32}" = EPSON Web-To-Page
"{8C3727F2-8E37-49E4-820C-03B1677F53B6}" = Stronghold Crusader
"{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}" = TomTom HOME Visual Studio Merge Modules
"{911B0407-6000-11D3-8CFE-0050048383C9}" = Microsoft Word 2002
"{9313E9A6-03DF-11D5-88F8-005004361016}" = Pinnacle TRex
"{93EA9C3E-BDFD-4309-A605-9B5BBC0CCEFD}" = Camera RAW Plug-In for EPSON Creativity Suite
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9527A496-5DF9-412A-ADC7-168BA5379CA6}" = Microsoft Flight Simulator X
"{9580813D-94B1-4C28-9426-A441E2BB29A5}" = Counter-Strike: Source
"{998D6972-F58E-479D-9248-8F179E55AE38}" = Java DB 10.4.1.3
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9E491AB7-4589-48CA-9CBB-874CB2788391}" = Studio 9
"{A17EABB6-D0C6-44E5-820C-72DC7F495064}" = PaperPort
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{AC76BA86-7AD7-1031-7B44-A91000000001}" = Adobe Reader 9.1 - Deutsch
"{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}" = ABBYY FineReader 6.0 Sprint
"{ADF1F741-4BBC-4F7E-8C2C-9855D6318185}" = MindSoft Utilities XP 9.1
"{B26E3B0D-C2FA-4370-B068-7C476766F029}" = Microsoft Works
"{BCB313A5-1AD0-4829-9D6F-EB41C3CFCD4B}" = Phase 5 HTML-Editor
"{BCB52F35-4C56-49F2-A3D6-FDED54B01847}" = pdfforge Toolbar v4.4
"{C151CE54-E7EA-4804-854B-F515368B0798}" = Athlon 64 Processor Driver
"{C438DF2B-C5DF-4783-9CA5-9B89E501FA62}" = Works Update
"{C6A12D9B-D86A-4ee6-B980-95E4B26A2E13}" = Microsoft Works Suite-Add-Ins für Microsoft Word
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{D271DAE0-8D68-4C97-8356-A126D48A1D8C}" = Ulead Photo Explorer 8.0 SE Basic
"{D6CD26FD-CD7F-4C86-96A3-EEBFABE5FE47}" = Kies
"{D801B39E-CE01-409F-8E7C-B7976EA3C9DC}_is1" = Audiosurf
"{D9BAA0FD-3D69-43C2-B587-B153E402EFA3}" = Chipkartenleser Treiberinstallation
"{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty(R) 4 - Modern Warfare(TM)
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{ECCA8FE7-767A-4C8A-9DAA-BAB60F877C41}" = Sins of a Solar Empire
"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform
"{EF7E931D-DC84-471B-8DB6-A83358095474}" = EA Download Manager
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F6869CD2-3DB4-476D-A4C7-B3AE7C3ACF7B}" = Windows Media Connect
"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials
"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio
"{FCE65C4E-B0E8-4FBD-AD16-EDCBE6CD591F}" = HighMAT-Erweiterung für den Microsoft Windows XP-Assistenten zum Schreiben von CDs
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Age of Empires 2.0" = Microsoft Age of Empires II
"America Online de" = AOL Deutschland
"Anti-Blaxx_is1" = Anti-Blaxx 1.16
"ASCII Art - Machine_is1" = ASCII Art - Machine 1.2
"Audiosurf_is1" = Audiosurf Beta
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"AVMWLANCLI" = AVM FRITZ!WLAN
"BlueJ_is1" = BlueJ 2.5.0
"Camgoo TwoPlay_is1" = Camgoo TwoPlay
"CCleaner" = CCleaner
"CNXT_MODEM_PCI_VEN_14F1&DEV_2F00" = FM-56PCI-HSFi-AB
"Dia" = Dia (nur entfernen)
"DivX Codec" = DivX Codec
"DivX Setup.divx.com" = DivX-Setup
"DX-Ball 2 v1.25" = DX-Ball 2 v1.25
"eBay Icon" = eBay Icon
"EPSON Printer and Utilities" = EPSON-Drucker-Software
"EPSON Scanner" = EPSON Scan
"EPSON Stylus CX7300_CX8300_DX7400_DX8400 Benutzerhandbuch" = EPSON Stylus CX7300_CX8300_DX7400_DX8400 Handbuch
"Folder Access 2.1 Free Version" = Folder Access 2.1 Free Version
"Free WMA to MP3 Converter_is1" = Free WMA to MP3 Converter 1.08
"GeneRally105.zip_is1" = GeneRally105.zip
"Hamachi" = Hamachi 1.0.3.0
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"InstallShield_{06F80017-8F98-4C94-B868-52358569FC32}" = Command & Conquer(TM) Generäle
"InstallShield_{20C45B32-5AB6-46A4-94EF-58950CAF05E5}" = EPSON Attach To Email
"InstallShield_{9527A496-5DF9-412A-ADC7-168BA5379CA6}" = Microsoft Flight Simulator X
"InstallShield_{D6CD26FD-CD7F-4C86-96A3-EEBFABE5FE47}" = Kies
"InstallShield_{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty(R) 4 - Modern Warfare(TM)
"InstallShield_{EF7E931D-DC84-471B-8DB6-A83358095474}" = EA Download Manager
"IrfanView" = IrfanView (remove only)
"Macromedia Shockwave Player" = Macromedia Shockwave Player
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware Version 1.51.0.1200
"Messenger Plus! Live" = Messenger Plus! Live
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Miranda IM" = Miranda IM 0.7.10
"MirandaFusion" = Miranda Fusion 3.0.17.0
"Mozilla Firefox (3.6.17)" = Mozilla Firefox (3.6.17)
"MSNINST" = MSN
"nbi-nb-base-6.8.0.0.0" = NetBeans IDE 6.8
"NeroMultiInstaller!UninstallKey" = Nero Suite
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA Drivers" = NVIDIA Drivers
"PeerGuardian_is1" = PeerGuardian 2.0
"Quake 3 Arena Demo" = Quake 3 Arena Demo
"QuickTime" = QuickTime
"San Andreas Mod Installer1.0" = San Andreas Mod Installer
"Shareaza_is1" = Shareaza Version 2.2.0.0
"Shockwave" = Shockwave
"Silkroad" = Silkroad
"Skype_is1" = Skype 3.0
"SoftwareUpdUtility" = Download Updater (AOL LLC)
"ST6UNST #1" = Chipcard master 5.15
"StarUML_is1" = StarUML 5.0.2.1570
"Steam App 240" = Counter-Strike: Source
"SysInfo" = Creative Systeminformationen
"Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2
"TeamSpeak 2 Server_is1" = TeamSpeak 2 Server RC2
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"TomTom HOME" = TomTom HOME 2.7.2.1825
"ToolbarICQToolbar.ICQToolbarObjectIEToolbar" = ICQ  Toolbar
"TrueCrypt" = TrueCrypt
"VGA USB Camera" = VGA USB Camera
"ViewpointMediaPlayer" = Viewpoint Media Player
"VLC media player" = VLC media player 0.9.6
"Winamp" = Winamp (remove only)
"Windows Media Connect" = Windows Media Connect
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 10
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinGimp-2.0_is1" = GIMP 2.6.11
"WinGTK-2_is1" = GTK+ 2.10.11 runtime environment
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"WMFDist11" = Windows Media Format 11 runtime
"Works2005Setup" = Setup-Start von Microsoft Works 2005
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"ZENcast Organizer" = ZENcast Organizer
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-4147601781-1963535702-778001222-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Sins of a Solar Empire" = Sins of a Solar Empire
"TeamSpeak 3 Client" = TeamSpeak 3 Client
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 04.04.2011 17:12:12 | Computer Name = NAME-A0073FCD77 | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung hlds.exe, Version 4.1.1.1, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 06.04.2011 16:17:05 | Computer Name = NAME-A0073FCD77 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung explorer.exe, Version 6.0.2900.5512, fehlgeschlagenes
 Modul unknown, Version 0.0.0.0, Fehleradresse 0x030f5710.
 
Error - 19.04.2011 12:30:23 | Computer Name = NAME-A0073FCD77 | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung miranda32.exe, Version 0.9.18.2, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 26.04.2011 11:04:05 | Computer Name = NAME-A0073FCD77 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung , Version 0.0.0.0, fehlgeschlagenes Modul
 unknown, Version 0.0.0.0, Fehleradresse 0x035bd710.
 
Error - 26.04.2011 12:04:19 | Computer Name = NAME-A0073FCD77 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung explorer.exe, Version 6.0.2900.5512, fehlgeschlagenes
 Modul unknown, Version 0.0.0.0, Fehleradresse 0x03007710.
 
Error - 26.04.2011 12:06:56 | Computer Name = NAME-A0073FCD77 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung explorer.exe, Version 6.0.2900.5512, fehlgeschlagenes
 Modul unknown, Version 0.0.0.0, Fehleradresse 0x036a5710.
 
Error - 26.04.2011 12:41:13 | Computer Name = NAME-A0073FCD77 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung explorer.exe, Version 6.0.2900.5512, fehlgeschlagenes
 Modul unknown, Version 0.0.0.0, Fehleradresse 0x032d1710.
 
Error - 24.05.2011 13:25:05 | Computer Name = NAME-A0073FCD77 | Source = ESENT | ID = 490
Description = svchost (1000) Versuch, Datei "C:\WINDOWS\system32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb"
 für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der
 Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet
 wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
 
Error - 15.06.2011 10:31:22 | Computer Name = NAME-A0073FCD77 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung miranda32.exe, Version 0.9.23.0, fehlgeschlagenes
 Modul unknown, Version 0.0.0.0, Fehleradresse 0x5555ece0.
 
Error - 16.06.2011 08:59:03 | Computer Name = NAME-A0073FCD77 | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung OTL.exe, Version 3.2.24.0, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
[ System Events ]
Error - 14.06.2011 07:13:27 | Computer Name = NAME-A0073FCD77 | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Task Update" wurde mit folgendem Fehler beendet:  %%126
 
Error - 14.06.2011 07:15:53 | Computer Name = NAME-A0073FCD77 | Source = W32Time | ID = 39452689
Description = Zeitabieter "NtpClient": Beim DNS-Lookup für den manuell konfigurierten
 Peer  "time.windows.com,0x1" ist ein Fehler aufgetreten. Der DNS-Lookup wird in 15
 Minuten  wiederholt.  Fehler: Der Host war bei einem Socketvorgang nicht erreichbar.
 (0x80072751)
 
Error - 14.06.2011 07:15:53 | Computer Name = NAME-A0073FCD77 | Source = W32Time | ID = 39452701
Description = Der Zeitanbieter "NtpClient" wurde für die Zeiterfassung von mehreren
 Zeitquellen  konfiguriert. Es ist jedoch Keine der Quellen verfügbar. Innerhalb  der
 nächsten 14 Minuten wird kein Versuch unternommen, eine Verbindung  mit der Quelle
 herzustellen.  Der NtpClient verfügt über keine Quelle mit genauer Zeit.
 
Error - 16.06.2011 06:41:22 | Computer Name = NAME-A0073FCD77 | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Task Update" wurde mit folgendem Fehler beendet:  %%126
 
Error - 16.06.2011 07:13:00 | Computer Name = NAME-A0073FCD77 | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Task Update" wurde mit folgendem Fehler beendet:  %%126
 
Error - 16.06.2011 07:13:07 | Computer Name = NAME-A0073FCD77 | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  atapi  PCIIde
 
Error - 16.06.2011 15:18:02 | Computer Name = NAME-A0073FCD77 | Source = SRService | ID = 104
Description = Die Initialisierung der Systemwiederherstellung ist fehlgeschlagen.
 
Error - 16.06.2011 15:18:02 | Computer Name = NAME-A0073FCD77 | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Systemwiederherstellungsdienst" wurde mit folgendem Fehler
 beendet:  %%2
 
Error - 16.06.2011 15:36:25 | Computer Name = NAME-A0073FCD77 | Source = SRService | ID = 104
Description = Die Initialisierung der Systemwiederherstellung ist fehlgeschlagen.
 
Error - 16.06.2011 15:36:25 | Computer Name = NAME-A0073FCD77 | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Systemwiederherstellungsdienst" wurde mit folgendem Fehler
 beendet:  %%2
 
 
< End of report >
--- --- ---

markusg 17.06.2011 10:23
bitte erstelle und poste ein combofix log.
Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Xtricer 17.06.2011 12:09
combofix macht bei mir Probleme. Wenn es fast fertiggestellt ist, erscheint ein Bluescreen.

markusg 17.06.2011 12:34
starte mal im abgesicherten modus ohne netzwerk, ist meist bei pc start mit f8 zu erreichen und dann den modus auswählen, dort cf noch mal probieren

Xtricer 17.06.2011 14:45
Combofix Logfile:
Code:
ComboFix 11-06-16.02 - Administrator 17.06.2011  15:32:51.5.1 - x86 MINIMAL
Microsoft Windows XP Home Edition  5.1.2600.3.1252.49.1031.18.1023.818 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\christopher\Eigene Dateien\Downloads\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\dokumente und einstellungen\christopher\WINDOWS
c:\windows\IsUn0407.exe
c:\windows\system32\appconf32.exe
c:\windows\system32\fldlckun.exe
c:\windows\system32\kock
c:\windows\system32\muzapp.exe
c:\windows\system32\UAs
c:\windows\system32\UAs\firefox.exe_UAs001.dat
c:\windows\system32\UAs\iexplore.exe_UAs001.dat
c:\windows\system32\UAs\iexplore.exe_UAs002.dat
c:\windows\system32\xmldm
D:\Autorun.inf
.
.
(((((((((((((((((((((((  Dateien erstellt von 2011-05-17 bis 2011-06-17  ))))))))))))))))))))))))))))))
.
.
2011-06-17 12:14 . 2011-06-17 12:14        --------        d-----w-        c:\dokumente und einstellungen\Administrator
2011-06-16 10:58 . 2011-05-29 07:11        39984        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys
2011-06-16 10:58 . 2011-06-16 10:58        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2011-06-16 10:58 . 2011-06-16 10:58        --------        d-----w-        c:\programme\Malwarebytes' Anti-Malware
2011-06-16 10:58 . 2011-05-29 07:11        22712        ----a-w-        c:\windows\system32\drivers\mbam.sys
2011-06-14 13:29 . 2011-06-14 13:29        --------        d-----w-        c:\windows\system32\5018
2011-06-10 22:09 . 2011-06-10 22:09        --------        d-----w-        c:\windows\system32\5017
2011-06-08 12:43 . 2011-06-08 12:43        --------        d-----w-        c:\windows\system32\5016
2011-06-06 22:33 . 2011-06-06 22:33        --------        d-----w-        c:\windows\system32\5015
2011-05-25 15:26 . 2011-05-25 15:27        --------        d-----w-        c:\programme\pdfforge Toolbar
2011-05-25 15:26 . 2011-05-25 15:27        --------        d-----w-        c:\programme\Application Updater
2011-05-24 12:35 . 2011-05-24 12:35        --------        d-----w-        c:\programme\THQ
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-15 22:41 . 2007-10-06 09:56        138520        ----a-w-        c:\windows\system32\drivers\PnkBstrK.sys
2011-06-15 22:40 . 2009-07-07 17:21        234536        ----a-w-        c:\windows\system32\PnkBstrB.xtr
2011-06-15 22:40 . 2007-10-06 09:56        234536        ----a-w-        c:\windows\system32\PnkBstrB.exe
2008-06-21 18:26 . 2008-06-21 18:26        230080        ----a-w-        c:\programme\truecrypt-x64.sys
2008-06-21 18:26 . 2008-06-21 18:26        223424        ----a-w-        c:\programme\truecrypt.sys
2008-06-21 18:26 . 2008-06-21 18:26        1221312        ----a-w-        c:\programme\TrueCrypt Format.exe
2008-06-21 18:26 . 2008-06-21 18:26        1106112        ----a-w-        c:\programme\TrueCrypt.exe
2008-06-21 18:26 . 2008-06-21 18:26        2646520        ----a-w-        c:\programme\TrueCrypt Setup.exe
2003-01-13 17:59 . 2005-03-29 17:58        278528        ----a-w-        c:\programme\internet explorer\plugins\PanoViewer.dll
1999-04-30 23:00 . 2005-03-29 17:58        98304        ----a-w-        c:\programme\internet explorer\plugins\UPjpeg.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVRaidService"="c:\windows\system32\nvraidservice.exe" [2004-12-07 84480]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-10-24 8527872]
"nwiz"="nwiz.exe" [2007-10-24 1626112]
"SoundMan"="SOUNDMAN.EXE" [2004-11-16 77824]
"CARPService"="carpserv.exe" [2003-03-19 4608]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"PCMService"="c:\programme\CyberLink\PowerCinema\PCMService.exe" [2005-01-19 110744]
"AVMWlanClient"="c:\programme\avmwlanstick\wlangui.exe" [2006-02-22 1499136]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-10-24 81920]
"QuickTime Task"="c:\programme\QuickTime\qttask.exe" [2005-01-25 98304]
"CTCheck"="c:\programme\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe" [2007-11-06 397312]
"SunJavaUpdateSched"="c:\programme\Java\jre6\bin\jusched.exe" [2008-11-06 136600]
"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"DivXUpdate"="c:\programme\DivX\DivX Update\DivXUpdate.exe" [2010-04-12 1135912]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
"SearchSettings"="c:\programme\Gemeinsame Dateien\Spigot\Search Settings\SearchSettings.exe" [2011-05-06 532320]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\CyberLink\\PowerCinema\\PowerCinema.exe"=
"c:\\Programme\\Messenger\\msmsgs.exe"=
"c:\\Programme\\Windows Media Player\\wmplayer.exe"=
"c:\\Programme\\Shareaza\\Shareaza.exe"=
"c:\\Programme\\EA Games\\Battlefield 2\\BF2.exe"=
"c:\\Programme\\EA Games\\Battlefield 2\\bf2_w32ded.exe"=
"c:\\Programme\\EA Games\\Battlefield 2\\BF22.exe"=
"c:\\Programme\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\Programme\\Stardock Games\\Sins of a Solar Empire\\Sins of a Solar Empire.exe"=
"c:\\Programme\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Programme\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Programme\\Java\\jdk1.6.0_10\\jre\\bin\\java.exe"=
"c:\\Programme\\Winamp\\winamp.exe"=
"c:\\Programme\\Electronic Arts\\Steam\\SteamApps\\gaming_sinnlos\\counter-strike source\\hl2.exe"=
"c:\\Programme\\Audiosurf\\engine\\QuestViewer.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programme\\Steam\\Steam.exe"=
"c:\\Programme\\Steam\\SteamApps\\gaming_sinnlos\\counter-strike source\\hl2.exe"=
"c:\\Programme\\Electronic Arts\\Steam\\SteamApps\\gaming_sinnlos\\dedicated server\\hlds.exe"=
"c:\\Programme\\Skype\\Phone\\Skype.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"7012:TCP"= 7012:TCP:xhscfw
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [28.12.2005 15:30 664064]
S2 Application Updater;Application Updater;c:\programme\Application Updater\ApplicationUpdater.exe [06.05.2011 17:33 393112]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.03.2010 14:16 130384]
S2 dgdersvc;Device Error Recovery Service;c:\windows\system32\dgdersvc.exe [25.10.2010 11:07 95568]
S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [02.12.2010 21:32 217088]
S2 qzkywoxa;Task Update;c:\windows\system32\svchost.exe -k netsvcs [29.03.2005 20:03 14336]
S2 TomTomHOMEService;TomTomHOMEService;c:\programme\TomTom HOME 2\TomTomHOMEService.exe [27.08.2009 17:05 92008]
S3 3xHybrid;3xHybrid service;c:\windows\system32\drivers\3xHybrid.sys [29.03.2005 20:03 945152]
S3 avmeject;AVM Eject;c:\windows\system32\drivers\avmeject.sys [22.03.2008 18:45 4352]
S3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys [25.10.2010 11:07 18120]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [02.12.2010 21:32 36640]
S3 FWLANUSB;AVM FRITZ!WLAN;c:\windows\system32\drivers\fwlanusb.sys [31.07.2006 20:27 265088]
S3 IMT0521;Inmax USB IMT-0521 Smartcard Reader;c:\windows\system32\drivers\IMT0521.sys [29.03.2005 20:03 34825]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [16.06.2011 12:58 39984]
S3 SCR33X USB Smart Card Reader;SCR33X USB Smart Card Reader;c:\windows\system32\drivers\SCR33X2K.sys [29.03.2005 20:03 63608]
S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys --> c:\windows\system32\DRIVERS\ssadbus.sys [?]
S3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys --> c:\windows\system32\DRIVERS\ssadmdfl.sys [?]
S3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys --> c:\windows\system32\DRIVERS\ssadmdm.sys [?]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.03.2010 14:16 753504]
S3 ZDBRGSYS;ZDBRGSYS NDIS Protocol Driver;c:\windows\system32\ZDBRGSYS.sys [29.03.2005 20:04 19200]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
qzkywoxa
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.targa.de/
TCP: DhcpNameServer = 192.168.220.1
TCP: Interfaces\{591D72E8-63A0-4487-A7BA-EE6B468920BE}: NameServer = 192.168.2.1
FF - ProfilePath - c:\dokumente und einstellungen\christopher\Anwendungsdaten\Mozilla\Firefox\Profiles\21732ymg.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=IEFM1&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/pacman/
FF - prefs.js: keyword.URL - hxxp://de.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=302398&p=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\programme\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA} - c:\programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}
FF - Ext: Java Quick Starter: jqs@sun.com - c:\programme\Java\jre6\lib\deploy\jqs\ff
FF - Ext: JavaString Helper: {184AA5E6-741D-464a-820E-94B3ABC2F3B4} - c:\windows\system32\5018
FF - Ext: JavaString Helper: {184AA5E6-741D-464a-820E-94B3ABC2F3B4} - c:\windows\system32\5018
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{184AA5E6-741D-464a-820E-94B3ABC2F3B4} - (no file)
BHO-{6C057FF2-31A2-4A40-A2F0-C01426A27BD3} - c:\windows\system32\MFC71GRA.DLL
AddRemove-ASCII Art - Machine_is1 - c:\programme\ASCII Art - Machine\unins000.exe
AddRemove-Folder Access 2.1 Free Version - c:\progra~1\FOLDER~1\UNWISE.EXE
AddRemove-Free WMA to MP3 Converter_is1 - c:\programme\Free WMA to MP3 Converter\unins000.exe
AddRemove-Microsoft Interactive Training - c:\windows\IsUn0407.exe
AddRemove-TeamSpeak 3 Client - c:\programme\TeamSpeak 3 Client\uninstall.exe
AddRemove-WinGimp-2.0_is1 - h:\programme\GIMP-2.0\setup\unins000.exe
AddRemove-01_Simmental - c:\programme\SAMSUNG\USB Drivers\01_Simmental\Uninstall.exe
AddRemove-02_Siberian - c:\programme\SAMSUNG\USB Drivers\02_Siberian\Uninstall.exe
AddRemove-03_Swallowtail - c:\programme\SAMSUNG\USB Drivers\03_Swallowtail\Uninstall.exe
AddRemove-04_semseyite - c:\programme\SAMSUNG\USB Drivers\04_semseyite\Uninstall.exe
AddRemove-05_Sloan - c:\programme\SAMSUNG\USB Drivers\05_Sloan\Uninstall.exe
AddRemove-06_Spencer - c:\programme\SAMSUNG\USB Drivers\06_Spencer\Uninstall.exe
AddRemove-07_Schorl - c:\programme\SAMSUNG\USB Drivers\07_Schorl\Uninstall.exe
AddRemove-08_EMPChipset - c:\programme\SAMSUNG\USB Drivers\08_EMPChipset\Uninstall.exe
AddRemove-09_Hsp - c:\programme\SAMSUNG\USB Drivers\09_Hsp\Uninstall.exe
AddRemove-11_HSP_Plus_Default - c:\programme\SAMSUNG\USB Drivers\11_HSP_Plus_Default\Uninstall.exe
AddRemove-12_Symbian_USB_Download_Driver - c:\programme\SAMSUNG\USB Drivers\12_Symbian_USB_Download_Driver\Uninstall.exe
AddRemove-15_Symbian_Samsung_PC_DLC_Driver - c:\programme\SAMSUNG\USB Drivers\15_Symbian_Samsung_PC_DLC_Driver\Uninstall.exe
AddRemove-16_Shrewsbury - c:\programme\SAMSUNG\USB Drivers\16_Shrewsbury\Uninstall.exe
AddRemove-17_EMP_Chipset2 - c:\programme\SAMSUNG\USB Drivers\17_EMP_Chipset2\Uninstall.exe
AddRemove-18_Zinia_Serial_Driver - c:\programme\SAMSUNG\USB Drivers\18_Zinia_Serial_Driver\Uninstall.exe
AddRemove-19_VIA_driver - c:\programme\SAMSUNG\USB Drivers\19_VIA_driver\Uninstall.exe
AddRemove-20_NXP_Driver - c:\programme\SAMSUNG\USB Drivers\20_NXP_Driver\Uninstall.exe
AddRemove-21_Searsburg - c:\programme\SAMSUNG\USB Drivers\21_Searsburg\Uninstall.exe
AddRemove-22_WiBro_WiMAX - c:\programme\SAMSUNG\USB Drivers\22_WiBro_WiMAX\Uninstall.exe
AddRemove-24_flashusbdriver - c:\programme\SAMSUNG\USB Drivers\24_flashusbdriver\Uninstall.exe
AddRemove-25_escape - c:\programme\SAMSUNG\USB Drivers\25_escape\Uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2011-06-17 15:39
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'winlogon.exe'(256)
c:\windows\system32\sirenacm.dll
.
Zeit der Fertigstellung: 2011-06-17  15:40:34
ComboFix-quarantined-files.txt  2011-06-17 13:40
.
Vor Suchlauf: 5.346.058.240 Bytes frei
Nach Suchlauf: 5.290.323.968 Bytes frei
.
- - End Of File - - D09C76ED20E3CE7A7626B0A61A923C5A
--- --- ---


Alle Zeitangaben in WEZ +1. Es ist jetzt 17:55 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131