Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Antimaleware doctor seit 2 Tagen auf dem Rechner (https://www.trojaner-board.de/90528-antimaleware-doctor-seit-2-tagen-rechner.html)

Chopper Mark 08.09.2010 08:50
Antimaleware doctor seit 2 Tagen auf dem Rechner
 
Hallo zusammen,

ich habe das gleiche Problem wie viele andere in dem Board und habe bereits Schritte eingeleitet, um dieses Problem Herr zu werden, leider konnte ich es nur eindämmen.

1. Schritt: Installation von Anti-Malware und zwei Quick scanns durchgeführt wie einmal einen kompletten:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4052

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18943

08.09.2010 09:45:42
mbam-log-2010-09-08 (09-45-42).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 120575
Laufzeit: 8 Minute(n), 48 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 2
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Antimalware Doctor (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Antimalware Doctor Inc (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)


2. Schritt: Otl installiert...

danke für Eure Hilfe

kira 08.09.2010 13:00
Hallo und Herzlich Willkommen! :)

Bevor wir unsere Zusammenarbeit beginnen, [Bitte Vollständig lesen]:
Zitat:
  • "Fernbehandlungen/Fernhilfe" und die damit verbundenen Haftungsrisken:
    - da die Fehlerprüfung und Handlung werden über große Entfernungen durchgeführt, besteht keine Haftung unsererseits für die daraus entstehenden Folgen.
    - also, jede Haftung für die daraus entstandene Schäden wird ausgeschlossen, ANWEISUNGEN UND DEREN BEFOLGUNG, ERFOLGT AUF DEINE EIGENE VERANTWORTUNG!
  • Charakteristische Merkmale/Profilinformationen:
    - aus der verwendeten Loglisten oder Logdateien - wie z.B. deinen Realnamen, Seriennummer in Programm etc)- kannst Du herauslöschen oder durch [X] ersetzen
  • Die Systemprüfung und Bereinigung:
    - kann einige Zeit in Anspruch nehmen (je nach Art der Infektion), kann aber sogar so stark kompromittiert sein, so dass eine wirkungsvolle technische Säuberung ist nicht mehr möglich bzw Du es neu installieren musst
  • Innerhalb der Betreuungszeit:
    - ohne Abspräche bitte nicht auf eigene Faust handeln!- bei Problemen nachfragen.
  • Die Reihenfolge:
    - genau so wie beschrieben bitte einhalten, nicht selbst die Reihenfolge wählen!
  • Ansonsten unsere Forumsregeln:
    - Bitte erst lesen, dann posten!-> Für alle Hilfesuchenden! Was muss ich vor der Eröffnung eines Themas beachten?
1.
- Lade dir Random's System Information Tool (RSIT) von random/random herunter
- an einen Ort deiner Wahl und führe die rsit.exe aus
- wird "Hijackthis" auch von Rsit installiert und ausgeführt
- RSIT erstellt 2 Logfiles (C:\rsit\log.txt und C:\rsit\info.txt) mit erweiterten Infos von deinem System - diese beide bitte komplett hier posten
**Kannst Du das Log in Textdatei speichern und hier anhängen (auf "Erweitert" klicken)

2.
Bitte Versteckte - und Systemdateien sichtbar machen den Link hier anklicken:
System-Dateien und -Ordner unter XP und Vista sichtbar machen
Am Ende unserer Arbeit, kannst wieder rückgängig machen!

3.
→ Lade Dir HJTscanlist.zip herunter
→ entpacke die Datei auf deinem Desktop
→ Bei WindowsXP Home musst vor dem Scan zusätzlich tasklist.zip installieren
→ per Doppelklick starten
→ Wähle dein Betriebsystem aus - Vista
→ Wenn Du gefragt wirst, die Option "Einstellung" (1) - scanlist" wählen
→ Nach kurzer Zeit sollte sich Dein Editor öffnen und die Datei hjtscanlist.txt präsentieren
→ Bitte kopiere den Inhalt hier in Deinen Thread.

4.
Ich würde gerne noch all deine installierten Programme sehen:
Lade dir das Tool "Ccleaner" herunter
installieren (Software-Lizenzvereinbarung lesen, falls angeboten wird "Füge CCleaner Yahoo! Toolbar hinzu" abwählen)→ starten→ falls nötig - unter Options settings-> "german" einstellen
dann klick auf "Extra (um die installierten Programme auch anzuzeigen)→ weiter auf "Als Textdatei speichern..."
wird eine Textdatei (*.txt) erstellt, kopiere dazu den Inhalt und füge ihn da ein

Zitat:
Damit dein Thread übersichtlicher und schön lesbar bleibt, am besten nutze den Code-Tags für deinen Post:
→ vor dein Log schreibst Du (also am Anfang des Logfiles):[code]
hier kommt dein Logfile rein - z.B hjtsanlist o. sonstiges
→ dahinter - also am Ende der Logdatei: [/code]
gruß
Coverflow

Chopper Mark 08.09.2010 17:15
RSIT Logfile:
Code:
Logfile of random's system information tool 1.08 (written by random/random)
Run by CHOPPER at 2010-09-08 18:08:56
Microsoft® Windows Vista™ Home Basic  Service Pack 2
System drive C: has 90 GB (59%) free of 152 GB
Total RAM: 2939 MB (58% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:09:37, on 08.09.2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18943)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\acrotray.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\3DataManager\3DataManager.exe
C:\Program Files\3DataManager\bmctl.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\MICROS~2\OFFICE11\OUTLOOK.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\MobileMeServices.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\CHOPPER\Desktop\RSIT.exe
C:\Program Files\trend micro\CHOPPER.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ÿþ127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [TOSCDSPD] TOSCDSPD.EXE
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [mediafix70700en02.exe] C:\Users\CHOPPER\AppData\Roaming\7AAE33C15546045B4D5D2294BA51076D\mediafix70700en02.exe
O4 - HKLM\..\Policies\Explorer\Run: [a5x3tq] C:\Users\CHOPPER\AppData\Local\Temp\202fbh.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O4 - Global Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: VPN Client.lnk = ?
O8 - Extra context menu item: An vorhandenes PDF anfügen - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
O8 - Extra context menu item: In Adobe PDF konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: eBay - Der weltweite Online Marktplatz - {76577871-04EC-495E-A12B-91F7C3600AFA} - eBay: Neue und gebrauchte Elektronikartikel, Autos, Kleidung, Sammlerstücke, Sportartikel und mehr ? alles zu günstigen Preisen (file missing)
O9 - Extra button: Amazon.de - {8A918C1D-E123-4E36-B562-5C1519E434CE} - Amazon.de: Günstige Preise bei Elektronik & Foto, DVD, Musik, Bücher, Games, Spielzeug & mehr (file missing)
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} (EPUImageControl Class) - hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-29-0.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://ciscosales.webex.com/client/T27L10NSP11EP6/webex/ieatgpc1.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{CC9483D6-A0D7-436C-96BD-75D9060F5458}: NameServer = 213.94.78.16 213.94.78.17
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Dienst "Bonjour" (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate1ca13662dfdf350) (gupdate1ca13662dfdf350) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Jumpstart Wifi Protected Setup (jswpsapi) - Atheros Communications, Inc. - C:\Program Files\Jumpstart\jswpsapi.exe
O23 - Service: NMSAccess - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: @%SystemRoot%\System32\TUProgSt.exe,-1 (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\Windows\System32\TUProgSt.exe
O23 - Service: WTGService - Unknown owner - C:\Program Files\3DataManager\WTGService.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 10133 bytes

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\tasks\User_Feed_Synchronization-{2B6B8F49-631F-48A1-8032-E5B3E00E4760}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2010-06-16 61888]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2010-07-11 278192]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
Adobe PDF Conversion Toolbar Helper - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll [2010-06-16 320928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll [2010-07-11 814648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-07-29 35840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll [2010-06-16 320928]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll [2009-11-24 953800]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2010-07-11 278192]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2008-06-25 150040]
"Persistence"=C:\Windows\system32\igfxpers.exe [2008-06-25 145944]
"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2008-04-08 6037504]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2009-04-09 2029640]
"Acrobat Assistant 8.0"=C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe [2010-06-16 624056]
""= []
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2010-03-17 421888]
"DivXUpdate"=C:\Program Files\DivX\DivX Update\DivXUpdate.exe [2010-06-03 1144104]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-06-09 976832]
"AppleSyncNotifier"=C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [2010-07-13 47904]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2010-07-21 141608]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"a5x3tq"=C:\Users\CHOPPER\AppData\Local\Temp\202fbh.exe []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-04-10 1233920]
"TOSCDSPD"=TOSCDSPD.EXE []
"Skype"=C:\Program Files\Skype\\Phone\Skype.exe [2010-05-13 26192168]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2010-01-30 39408]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2009-10-30 369200]
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-21 202240]
"mediafix70700en02.exe"=C:\Users\CHOPPER\AppData\Roaming\7AAE33C15546045B4D5D2294BA51076D\mediafix70700en02.exe []

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
VPN Client.lnk - C:\Windows\Installer\{A7091E1D-36A4-47F1-A739-173CC341414F}\Icon3E5562ED7.ico

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2008-06-12 208896]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"EnableLUA"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"BindDirectlyToPropertySetStorage"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\FlashFXP\FlashFXP.exe"="C:\Program Files\FlashFXP\FlashFXP.exe:*:Enabled:FlashFXP v3"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"C:\Program Files\FlashFXP\FlashFXP.exe"="C:\Program Files\FlashFXP\FlashFXP.exe:*:Enabled:FlashFXP v3"

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-09-08 18:08:56 ----D---- C:\Program Files\trend micro
2010-09-08 18:08:55 ----D---- C:\rsit
2010-09-07 22:23:32 ----A---- C:\Windows\lsrslt.ini
2010-09-07 20:54:08 ----D---- C:\Windows\Minidump
2010-09-07 20:03:14 ----D---- C:\Users\CHOPPER\AppData\Roaming\Malwarebytes
2010-09-07 20:03:05 ----A---- C:\Windows\system32\drivers\mbamswissarmy.sys
2010-09-07 20:03:03 ----D---- C:\ProgramData\Malwarebytes
2010-09-07 20:03:03 ----A---- C:\Windows\system32\drivers\mbam.sys
2010-09-07 20:03:02 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-09-07 17:53:30 ----RASH---- C:\MSDOS.SYS
2010-09-07 17:53:30 ----RASH---- C:\IO.SYS
2010-09-07 17:52:52 ----D---- C:\Users\CHOPPER\AppData\Roaming\7AAE33C15546045B4D5D2294BA51076D
2010-08-11 09:58:01 ----A---- C:\Windows\system32\iertutil.dll
2010-08-11 09:57:58 ----A---- C:\Windows\system32\mshtml.dll
2010-08-11 09:57:53 ----A---- C:\Windows\system32\ieframe.dll
2010-08-11 09:57:51 ----A---- C:\Windows\system32\urlmon.dll
2010-08-11 09:57:50 ----A---- C:\Windows\system32\msfeeds.dll
2010-08-11 09:57:49 ----A---- C:\Windows\system32\wininet.dll
2010-08-11 09:57:49 ----A---- C:\Windows\system32\iedkcs32.dll
2010-08-11 09:57:49 ----A---- C:\Windows\system32\ie4uinit.exe
2010-08-11 09:57:48 ----A---- C:\Windows\system32\mstime.dll
2010-08-11 09:57:48 ----A---- C:\Windows\system32\ieui.dll
2010-08-11 09:57:47 ----A---- C:\Windows\system32\occache.dll
2010-08-11 09:57:47 ----A---- C:\Windows\system32\msfeedsbs.dll
2010-08-11 09:57:47 ----A---- C:\Windows\system32\ieUnatt.exe
2010-08-11 09:57:47 ----A---- C:\Windows\system32\iesysprep.dll
2010-08-11 09:57:47 ----A---- C:\Windows\system32\iesetup.dll
2010-08-11 09:57:47 ----A---- C:\Windows\system32\iernonce.dll
2010-08-11 09:57:47 ----A---- C:\Windows\system32\iepeers.dll
2010-08-11 09:57:46 ----A---- C:\Windows\system32\msfeedssync.exe
2010-08-11 09:57:46 ----A---- C:\Windows\system32\jsproxy.dll
2010-08-11 09:54:39 ----A---- C:\Windows\system32\drivers\tcpip.sys
2010-08-11 09:54:36 ----A---- C:\Windows\system32\schannel.dll
2010-08-11 09:54:24 ----A---- C:\Windows\system32\ntkrnlpa.exe
2010-08-11 09:54:21 ----A---- C:\Windows\system32\ntoskrnl.exe
2010-08-11 09:54:04 ----A---- C:\Windows\system32\win32k.sys
2010-08-11 09:54:00 ----A---- C:\Windows\system32\msxml3.dll
2010-08-11 09:53:39 ----A---- C:\Windows\system32\rtutils.dll
2010-08-11 09:53:28 ----A---- C:\Windows\system32\drivers\srv.sys
2010-08-11 09:53:27 ----A---- C:\Windows\system32\drivers\srv2.sys
2010-08-11 09:52:43 ----A---- C:\Windows\system32\iccvid.dll

======List of files/folders modified in the last 1 months======

2010-09-08 18:09:17 ----D---- C:\Windows\Prefetch
2010-09-08 18:09:08 ----D---- C:\Windows\Temp
2010-09-08 18:08:56 ----RD---- C:\Program Files
2010-09-08 14:06:43 ----D---- C:\Users\CHOPPER\AppData\Roaming\Skype
2010-09-08 14:06:37 ----D---- C:\Users\CHOPPER\AppData\Roaming\vlc
2010-09-08 12:36:17 ----D---- C:\Users\CHOPPER\AppData\Roaming\3DataManager
2010-09-08 12:36:14 ----D---- C:\Users\CHOPPER\AppData\Roaming\skypePM
2010-09-08 07:50:35 ----AD---- C:\Windows\System32
2010-09-08 07:50:34 ----D---- C:\Windows\inf
2010-09-08 07:50:34 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-09-08 05:49:54 ----D---- C:\Windows\system32\LogFiles
2010-09-07 22:47:42 ----D---- C:\Windows
2010-09-07 22:43:21 ----D---- C:\Windows\system32\drivers\etc
2010-09-07 22:24:20 ----RD---- C:\Windows\Offline Web Pages
2010-09-07 22:24:20 ----D---- C:\Windows\system32\drivers
2010-09-07 20:03:03 ----HD---- C:\ProgramData
2010-09-07 13:54:10 ----D---- C:\Users\CHOPPER\AppData\Roaming\Adobe
2010-09-07 13:29:38 ----SHD---- C:\Windows\Installer
2010-09-02 17:46:00 ----D---- C:\Windows\system32\catroot2
2010-08-12 17:10:29 ----D---- C:\Windows\Microsoft.NET
2010-08-12 17:09:53 ----RSD---- C:\Windows\assembly
2010-08-11 10:28:03 ----D---- C:\Windows\winsxs
2010-08-11 10:15:07 ----D---- C:\Program Files\Internet Explorer
2010-08-11 10:15:06 ----D---- C:\Windows\system32\migration
2010-08-11 10:15:01 ----D---- C:\Program Files\Movie Maker
2010-08-11 10:08:24 ----D---- C:\Windows\system32\catroot
2010-08-11 10:08:19 ----D---- C:\Program Files\Windows Mail

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 iaStor;Intel AHCI Controller; C:\Windows\system32\DRIVERS\iaStor.sys [2008-04-15 312344]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2010-02-07 691696]
R0 tos_sps32;TOSHIBA tos_sps32 Service; C:\Windows\system32\DRIVERS\tos_sps32.sys [2008-07-18 279376]
R0 TVALZ;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Driver; C:\Windows\system32\DRIVERS\TVALZ_O.SYS [2007-11-09 23640]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2009-04-09 107256]
R1 jswpslwf;JumpStart Wireless Filter Driver; C:\Windows\system32\DRIVERS\jswpslwf.sys [2008-04-28 20384]
R1 tcpipBM;Bytemobile Kernel Network Provider; C:\Windows\system32\drivers\tcpipBM.sys [2009-02-20 18816]
R2 CVPNDRVA;Cisco Systems Inc. IPSec Driver; \??\C:\Windows\system32\Drivers\CVPNDRVA.sys [2008-06-19 306299]
R2 eamon;eamon; C:\Windows\system32\DRIVERS\eamon.sys [2009-04-09 113960]
R2 epfwwfpr;epfwwfpr; C:\Windows\system32\DRIVERS\epfwwfpr.sys [2009-04-09 93312]
R2 mdmxsdk;mdmxsdk; C:\Windows\system32\DRIVERS\mdmxsdk.sys [2006-06-18 12672]
R2 XAudio;XAudio; C:\Windows\system32\DRIVERS\xaudio.sys [2007-10-17 8704]
R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athr.sys [2008-05-19 912384]
R3 DNE;Deterministic Network Enhancer Miniport; C:\Windows\system32\DRIVERS\dne2000.sys [2008-03-29 125328]
R3 FwLnk;FwLnk Driver; C:\Windows\system32\DRIVERS\FwLnk.sys [2006-11-20 7168]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600]
R3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\HSX_DPV.sys [2007-11-01 985600]
R3 HSXHWAZL;HSXHWAZL; C:\Windows\system32\DRIVERS\HSXHWAZL.sys [2007-11-01 208896]
R3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\Windows\system32\DRIVERS\ewusbmdm.sys [2009-09-10 102912]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2008-06-12 2381312]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2008-04-09 2095512]
R3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh86.sys [2008-04-15 118784]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2007-12-06 196400]
R3 winachsf;winachsf; C:\Windows\system32\DRIVERS\HSX_CNXT.sys [2007-11-01 661504]
R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-21 83328]
S0 BMLoad;Bytemobile Boot Time Load Driver; C:\Windows\system32\drivers\BMLoad.sys [2009-02-20 22528]
S3 AgereSoftModem;Agere Systems-Softmodem; C:\Windows\system32\DRIVERS\AGRSM.sys [2006-11-02 983552]
S3 aunxs4ey;aunxs4ey; C:\Windows\system32\drivers\aunxs4ey.sys []
S3 CVirtA;Cisco Systems VPN Adapter; C:\Windows\system32\DRIVERS\CVirtA.sys [2007-01-18 5275]
S3 drmkaud;Microsoft Kernel-DRM-Audioentschlüsselung; C:\Windows\system32\drivers\drmkaud.sys [2008-01-21 5632]
S3 HdAudAddService;Microsoft 1.1 UAA-Funktionstreiber für High Definition Audio-Dienst; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 HSFHWAZL;HSFHWAZL; C:\Windows\system32\DRIVERS\VSTAZL3.SYS [2008-01-21 200704]
S3 hwusbdev;Huawei DataCard USB PNP Device; C:\Windows\system32\DRIVERS\ewusbdev.sys [2010-05-10 101248]
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-21 8192]
S3 MSPCLOCK;Microsoft Proxy für Streaming Clock; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-21 5888]
S3 MSPQM;Microsoft Proxy für Streaming Quality Manager; C:\Windows\system32\drivers\MSPQM.sys [2008-01-21 5504]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink-Konvertierung; C:\Windows\system32\drivers\MSTEE.sys [2008-01-21 6016]
S3 nmwcd;Nokia USB Phone Parent; C:\Windows\system32\drivers\ccdcmb.sys [2010-02-26 18176]
S3 nmwcdc;Nokia USB Generic; C:\Windows\system32\drivers\ccdcmbo.sys [2010-02-26 22528]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 RTSTOR;Realtek USB 2.0 Card Reader; C:\Windows\system32\drivers\RTSTOR.SYS [2008-04-02 62976]
S3 StarOpen;StarOpen; C:\Windows\system32\drivers\StarOpen.sys [2009-11-12 7168]
S3 upperdev;upperdev; C:\Windows\system32\DRIVERS\usbser_lowerflt.sys [2010-02-26 8192]
S3 USBAAPL;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl.sys [2010-04-19 41984]
S3 usbser;USB Modem Driver; C:\Windows\system32\DRIVERS\usbser.sys [2009-04-10 27648]
S3 usbvideo;USB-Videogerät (WDM); C:\Windows\System32\Drivers\usbvideo.sys [2008-01-21 134016]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2009-10-01 40448]
S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys [2008-01-21 6656]
S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys [2008-01-21 386616]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2010-06-10 144176]
R2 Bonjour Service;Dienst "Bonjour"; C:\Program Files\Bonjour\mDNSResponder.exe [2010-05-18 345376]
R2 CISVC;@%systemroot%\system32\CISVC.EXE,-1; C:\Windows\system32\CISVC.EXE [2008-01-21 11264]
R2 CVPND;Cisco Systems, Inc. VPN Service; C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe [2008-06-19 1528608]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2009-04-09 731840]
R2 NMSAccess;NMSAccess; C:\Program Files\CDBurnerXP\NMSAccessU.exe [2010-03-04 71096]
R2 TuneUp.ProgramStatisticsSvc;@%SystemRoot%\System32\TUProgSt.exe,-1; C:\Windows\System32\TUProgSt.exe [2009-07-29 603904]
R2 UxTuneUp;@%SystemRoot%\System32\uxtuneup.dll,-4096; C:\Windows\System32\svchost.exe [2008-01-21 21504]
R2 WTGService;WTGService; C:\Program Files\3DataManager\WTGService.exe [2009-10-12 312784]
R2 XAudioService;XAudioService; C:\Windows\system32\DRIVERS\xaudio.exe [2007-10-17 386560]
R3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2009-10-10 654848]
R3 iPod Service;iPod-Dienst; C:\Program Files\iPod\bin\iPodService.exe [2010-07-21 540968]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 gupdate1ca13662dfdf350;Google Update Service (gupdate1ca13662dfdf350); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-08-02 133104]
S3 Adobe LM Service;Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [2009-10-23 72704]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe [2009-04-09 20680]
S3 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-21 21504]
S3 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2010-01-30 182768]
S3 jswpsapi;Jumpstart Wifi Protected Setup; C:\Program Files\Jumpstart\jswpsapi.exe [2008-04-16 954368]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2010-04-27 611840]
S3 TuneUp.Defrag;@%SystemRoot%\System32\TuneUpDefragService.exe,-1; C:\Windows\System32\TuneUpDefragService.exe [2009-07-29 360192]
S3 WPFFontCache_v0400;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100; C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]

-----------------EOF-----------------
--- --- ---

Chopper Mark 08.09.2010 17:16
RSIT Logfile:
Code:
Logfile of random's system information tool 1.08 (written by random/random)
Run by CHOPPER at 2010-09-08 18:08:56
Microsoft® Windows Vista™ Home Basic  Service Pack 2
System drive C: has 90 GB (59%) free of 152 GB
Total RAM: 2939 MB (58% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:09:37, on 08.09.2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18943)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\acrotray.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\3DataManager\3DataManager.exe
C:\Program Files\3DataManager\bmctl.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\MICROS~2\OFFICE11\OUTLOOK.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\MobileMeServices.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\CHOPPER\Desktop\RSIT.exe
C:\Program Files\trend micro\CHOPPER.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ÿþ127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [TOSCDSPD] TOSCDSPD.EXE
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [mediafix70700en02.exe] C:\Users\CHOPPER\AppData\Roaming\7AAE33C15546045B4D5D2294BA51076D\mediafix70700en02.exe
O4 - HKLM\..\Policies\Explorer\Run: [a5x3tq] C:\Users\CHOPPER\AppData\Local\Temp\202fbh.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O4 - Global Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: VPN Client.lnk = ?
O8 - Extra context menu item: An vorhandenes PDF anfügen - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
O8 - Extra context menu item: In Adobe PDF konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: eBay - Der weltweite Online Marktplatz - {76577871-04EC-495E-A12B-91F7C3600AFA} - eBay: Neue und gebrauchte Elektronikartikel, Autos, Kleidung, Sammlerstücke, Sportartikel und mehr ? alles zu günstigen Preisen (file missing)
O9 - Extra button: Amazon.de - {8A918C1D-E123-4E36-B562-5C1519E434CE} - Amazon.de: Günstige Preise bei Elektronik & Foto, DVD, Musik, Bücher, Games, Spielzeug & mehr (file missing)
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} (EPUImageControl Class) - hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-29-0.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://ciscosales.webex.com/client/T27L10NSP11EP6/webex/ieatgpc1.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{CC9483D6-A0D7-436C-96BD-75D9060F5458}: NameServer = 213.94.78.16 213.94.78.17
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Dienst "Bonjour" (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate1ca13662dfdf350) (gupdate1ca13662dfdf350) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Jumpstart Wifi Protected Setup (jswpsapi) - Atheros Communications, Inc. - C:\Program Files\Jumpstart\jswpsapi.exe
O23 - Service: NMSAccess - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: @%SystemRoot%\System32\TUProgSt.exe,-1 (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\Windows\System32\TUProgSt.exe
O23 - Service: WTGService - Unknown owner - C:\Program Files\3DataManager\WTGService.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 10133 bytes

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\tasks\User_Feed_Synchronization-{2B6B8F49-631F-48A1-8032-E5B3E00E4760}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2010-06-16 61888]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2010-07-11 278192]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
Adobe PDF Conversion Toolbar Helper - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll [2010-06-16 320928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll [2010-07-11 814648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-07-29 35840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll [2010-06-16 320928]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll [2009-11-24 953800]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2010-07-11 278192]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2008-06-25 150040]
"Persistence"=C:\Windows\system32\igfxpers.exe [2008-06-25 145944]
"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2008-04-08 6037504]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2009-04-09 2029640]
"Acrobat Assistant 8.0"=C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe [2010-06-16 624056]
""= []
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2010-03-17 421888]
"DivXUpdate"=C:\Program Files\DivX\DivX Update\DivXUpdate.exe [2010-06-03 1144104]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-06-09 976832]
"AppleSyncNotifier"=C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [2010-07-13 47904]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2010-07-21 141608]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"a5x3tq"=C:\Users\CHOPPER\AppData\Local\Temp\202fbh.exe []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-04-10 1233920]
"TOSCDSPD"=TOSCDSPD.EXE []
"Skype"=C:\Program Files\Skype\\Phone\Skype.exe [2010-05-13 26192168]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2010-01-30 39408]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2009-10-30 369200]
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-21 202240]
"mediafix70700en02.exe"=C:\Users\CHOPPER\AppData\Roaming\7AAE33C15546045B4D5D2294BA51076D\mediafix70700en02.exe []

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
VPN Client.lnk - C:\Windows\Installer\{A7091E1D-36A4-47F1-A739-173CC341414F}\Icon3E5562ED7.ico

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2008-06-12 208896]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"EnableLUA"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"BindDirectlyToPropertySetStorage"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\FlashFXP\FlashFXP.exe"="C:\Program Files\FlashFXP\FlashFXP.exe:*:Enabled:FlashFXP v3"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"C:\Program Files\FlashFXP\FlashFXP.exe"="C:\Program Files\FlashFXP\FlashFXP.exe:*:Enabled:FlashFXP v3"

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-09-08 18:08:56 ----D---- C:\Program Files\trend micro
2010-09-08 18:08:55 ----D---- C:\rsit
2010-09-07 22:23:32 ----A---- C:\Windows\lsrslt.ini
2010-09-07 20:54:08 ----D---- C:\Windows\Minidump
2010-09-07 20:03:14 ----D---- C:\Users\CHOPPER\AppData\Roaming\Malwarebytes
2010-09-07 20:03:05 ----A---- C:\Windows\system32\drivers\mbamswissarmy.sys
2010-09-07 20:03:03 ----D---- C:\ProgramData\Malwarebytes
2010-09-07 20:03:03 ----A---- C:\Windows\system32\drivers\mbam.sys
2010-09-07 20:03:02 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-09-07 17:53:30 ----RASH---- C:\MSDOS.SYS
2010-09-07 17:53:30 ----RASH---- C:\IO.SYS
2010-09-07 17:52:52 ----D---- C:\Users\CHOPPER\AppData\Roaming\7AAE33C15546045B4D5D2294BA51076D
2010-08-11 09:58:01 ----A---- C:\Windows\system32\iertutil.dll
2010-08-11 09:57:58 ----A---- C:\Windows\system32\mshtml.dll
2010-08-11 09:57:53 ----A---- C:\Windows\system32\ieframe.dll
2010-08-11 09:57:51 ----A---- C:\Windows\system32\urlmon.dll
2010-08-11 09:57:50 ----A---- C:\Windows\system32\msfeeds.dll
2010-08-11 09:57:49 ----A---- C:\Windows\system32\wininet.dll
2010-08-11 09:57:49 ----A---- C:\Windows\system32\iedkcs32.dll
2010-08-11 09:57:49 ----A---- C:\Windows\system32\ie4uinit.exe
2010-08-11 09:57:48 ----A---- C:\Windows\system32\mstime.dll
2010-08-11 09:57:48 ----A---- C:\Windows\system32\ieui.dll
2010-08-11 09:57:47 ----A---- C:\Windows\system32\occache.dll
2010-08-11 09:57:47 ----A---- C:\Windows\system32\msfeedsbs.dll
2010-08-11 09:57:47 ----A---- C:\Windows\system32\ieUnatt.exe
2010-08-11 09:57:47 ----A---- C:\Windows\system32\iesysprep.dll
2010-08-11 09:57:47 ----A---- C:\Windows\system32\iesetup.dll
2010-08-11 09:57:47 ----A---- C:\Windows\system32\iernonce.dll
2010-08-11 09:57:47 ----A---- C:\Windows\system32\iepeers.dll
2010-08-11 09:57:46 ----A---- C:\Windows\system32\msfeedssync.exe
2010-08-11 09:57:46 ----A---- C:\Windows\system32\jsproxy.dll
2010-08-11 09:54:39 ----A---- C:\Windows\system32\drivers\tcpip.sys
2010-08-11 09:54:36 ----A---- C:\Windows\system32\schannel.dll
2010-08-11 09:54:24 ----A---- C:\Windows\system32\ntkrnlpa.exe
2010-08-11 09:54:21 ----A---- C:\Windows\system32\ntoskrnl.exe
2010-08-11 09:54:04 ----A---- C:\Windows\system32\win32k.sys
2010-08-11 09:54:00 ----A---- C:\Windows\system32\msxml3.dll
2010-08-11 09:53:39 ----A---- C:\Windows\system32\rtutils.dll
2010-08-11 09:53:28 ----A---- C:\Windows\system32\drivers\srv.sys
2010-08-11 09:53:27 ----A---- C:\Windows\system32\drivers\srv2.sys
2010-08-11 09:52:43 ----A---- C:\Windows\system32\iccvid.dll

======List of files/folders modified in the last 1 months======

2010-09-08 18:09:17 ----D---- C:\Windows\Prefetch
2010-09-08 18:09:08 ----D---- C:\Windows\Temp
2010-09-08 18:08:56 ----RD---- C:\Program Files
2010-09-08 14:06:43 ----D---- C:\Users\CHOPPER\AppData\Roaming\Skype
2010-09-08 14:06:37 ----D---- C:\Users\CHOPPER\AppData\Roaming\vlc
2010-09-08 12:36:17 ----D---- C:\Users\CHOPPER\AppData\Roaming\3DataManager
2010-09-08 12:36:14 ----D---- C:\Users\CHOPPER\AppData\Roaming\skypePM
2010-09-08 07:50:35 ----AD---- C:\Windows\System32
2010-09-08 07:50:34 ----D---- C:\Windows\inf
2010-09-08 07:50:34 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-09-08 05:49:54 ----D---- C:\Windows\system32\LogFiles
2010-09-07 22:47:42 ----D---- C:\Windows
2010-09-07 22:43:21 ----D---- C:\Windows\system32\drivers\etc
2010-09-07 22:24:20 ----RD---- C:\Windows\Offline Web Pages
2010-09-07 22:24:20 ----D---- C:\Windows\system32\drivers
2010-09-07 20:03:03 ----HD---- C:\ProgramData
2010-09-07 13:54:10 ----D---- C:\Users\CHOPPER\AppData\Roaming\Adobe
2010-09-07 13:29:38 ----SHD---- C:\Windows\Installer
2010-09-02 17:46:00 ----D---- C:\Windows\system32\catroot2
2010-08-12 17:10:29 ----D---- C:\Windows\Microsoft.NET
2010-08-12 17:09:53 ----RSD---- C:\Windows\assembly
2010-08-11 10:28:03 ----D---- C:\Windows\winsxs
2010-08-11 10:15:07 ----D---- C:\Program Files\Internet Explorer
2010-08-11 10:15:06 ----D---- C:\Windows\system32\migration
2010-08-11 10:15:01 ----D---- C:\Program Files\Movie Maker
2010-08-11 10:08:24 ----D---- C:\Windows\system32\catroot
2010-08-11 10:08:19 ----D---- C:\Program Files\Windows Mail

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 iaStor;Intel AHCI Controller; C:\Windows\system32\DRIVERS\iaStor.sys [2008-04-15 312344]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2010-02-07 691696]
R0 tos_sps32;TOSHIBA tos_sps32 Service; C:\Windows\system32\DRIVERS\tos_sps32.sys [2008-07-18 279376]
R0 TVALZ;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Driver; C:\Windows\system32\DRIVERS\TVALZ_O.SYS [2007-11-09 23640]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2009-04-09 107256]
R1 jswpslwf;JumpStart Wireless Filter Driver; C:\Windows\system32\DRIVERS\jswpslwf.sys [2008-04-28 20384]
R1 tcpipBM;Bytemobile Kernel Network Provider; C:\Windows\system32\drivers\tcpipBM.sys [2009-02-20 18816]
R2 CVPNDRVA;Cisco Systems Inc. IPSec Driver; \??\C:\Windows\system32\Drivers\CVPNDRVA.sys [2008-06-19 306299]
R2 eamon;eamon; C:\Windows\system32\DRIVERS\eamon.sys [2009-04-09 113960]
R2 epfwwfpr;epfwwfpr; C:\Windows\system32\DRIVERS\epfwwfpr.sys [2009-04-09 93312]
R2 mdmxsdk;mdmxsdk; C:\Windows\system32\DRIVERS\mdmxsdk.sys [2006-06-18 12672]
R2 XAudio;XAudio; C:\Windows\system32\DRIVERS\xaudio.sys [2007-10-17 8704]
R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athr.sys [2008-05-19 912384]
R3 DNE;Deterministic Network Enhancer Miniport; C:\Windows\system32\DRIVERS\dne2000.sys [2008-03-29 125328]
R3 FwLnk;FwLnk Driver; C:\Windows\system32\DRIVERS\FwLnk.sys [2006-11-20 7168]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600]
R3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\HSX_DPV.sys [2007-11-01 985600]
R3 HSXHWAZL;HSXHWAZL; C:\Windows\system32\DRIVERS\HSXHWAZL.sys [2007-11-01 208896]
R3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\Windows\system32\DRIVERS\ewusbmdm.sys [2009-09-10 102912]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2008-06-12 2381312]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2008-04-09 2095512]
R3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh86.sys [2008-04-15 118784]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2007-12-06 196400]
R3 winachsf;winachsf; C:\Windows\system32\DRIVERS\HSX_CNXT.sys [2007-11-01 661504]
R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-21 83328]
S0 BMLoad;Bytemobile Boot Time Load Driver; C:\Windows\system32\drivers\BMLoad.sys [2009-02-20 22528]
S3 AgereSoftModem;Agere Systems-Softmodem; C:\Windows\system32\DRIVERS\AGRSM.sys [2006-11-02 983552]
S3 aunxs4ey;aunxs4ey; C:\Windows\system32\drivers\aunxs4ey.sys []
S3 CVirtA;Cisco Systems VPN Adapter; C:\Windows\system32\DRIVERS\CVirtA.sys [2007-01-18 5275]
S3 drmkaud;Microsoft Kernel-DRM-Audioentschlüsselung; C:\Windows\system32\drivers\drmkaud.sys [2008-01-21 5632]
S3 HdAudAddService;Microsoft 1.1 UAA-Funktionstreiber für High Definition Audio-Dienst; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 HSFHWAZL;HSFHWAZL; C:\Windows\system32\DRIVERS\VSTAZL3.SYS [2008-01-21 200704]
S3 hwusbdev;Huawei DataCard USB PNP Device; C:\Windows\system32\DRIVERS\ewusbdev.sys [2010-05-10 101248]
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-21 8192]
S3 MSPCLOCK;Microsoft Proxy für Streaming Clock; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-21 5888]
S3 MSPQM;Microsoft Proxy für Streaming Quality Manager; C:\Windows\system32\drivers\MSPQM.sys [2008-01-21 5504]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink-Konvertierung; C:\Windows\system32\drivers\MSTEE.sys [2008-01-21 6016]
S3 nmwcd;Nokia USB Phone Parent; C:\Windows\system32\drivers\ccdcmb.sys [2010-02-26 18176]
S3 nmwcdc;Nokia USB Generic; C:\Windows\system32\drivers\ccdcmbo.sys [2010-02-26 22528]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 RTSTOR;Realtek USB 2.0 Card Reader; C:\Windows\system32\drivers\RTSTOR.SYS [2008-04-02 62976]
S3 StarOpen;StarOpen; C:\Windows\system32\drivers\StarOpen.sys [2009-11-12 7168]
S3 upperdev;upperdev; C:\Windows\system32\DRIVERS\usbser_lowerflt.sys [2010-02-26 8192]
S3 USBAAPL;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl.sys [2010-04-19 41984]
S3 usbser;USB Modem Driver; C:\Windows\system32\DRIVERS\usbser.sys [2009-04-10 27648]
S3 usbvideo;USB-Videogerät (WDM); C:\Windows\System32\Drivers\usbvideo.sys [2008-01-21 134016]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2009-10-01 40448]
S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys [2008-01-21 6656]
S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys [2008-01-21 386616]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2010-06-10 144176]
R2 Bonjour Service;Dienst "Bonjour"; C:\Program Files\Bonjour\mDNSResponder.exe [2010-05-18 345376]
R2 CISVC;@%systemroot%\system32\CISVC.EXE,-1; C:\Windows\system32\CISVC.EXE [2008-01-21 11264]
R2 CVPND;Cisco Systems, Inc. VPN Service; C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe [2008-06-19 1528608]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2009-04-09 731840]
R2 NMSAccess;NMSAccess; C:\Program Files\CDBurnerXP\NMSAccessU.exe [2010-03-04 71096]
R2 TuneUp.ProgramStatisticsSvc;@%SystemRoot%\System32\TUProgSt.exe,-1; C:\Windows\System32\TUProgSt.exe [2009-07-29 603904]
R2 UxTuneUp;@%SystemRoot%\System32\uxtuneup.dll,-4096; C:\Windows\System32\svchost.exe [2008-01-21 21504]
R2 WTGService;WTGService; C:\Program Files\3DataManager\WTGService.exe [2009-10-12 312784]
R2 XAudioService;XAudioService; C:\Windows\system32\DRIVERS\xaudio.exe [2007-10-17 386560]
R3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2009-10-10 654848]
R3 iPod Service;iPod-Dienst; C:\Program Files\iPod\bin\iPodService.exe [2010-07-21 540968]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 gupdate1ca13662dfdf350;Google Update Service (gupdate1ca13662dfdf350); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-08-02 133104]
S3 Adobe LM Service;Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [2009-10-23 72704]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe [2009-04-09 20680]
S3 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-21 21504]
S3 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2010-01-30 182768]
S3 jswpsapi;Jumpstart Wifi Protected Setup; C:\Program Files\Jumpstart\jswpsapi.exe [2008-04-16 954368]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2010-04-27 611840]
S3 TuneUp.Defrag;@%SystemRoot%\System32\TuneUpDefragService.exe,-1; C:\Windows\System32\TuneUpDefragService.exe [2009-07-29 360192]
S3 WPFFontCache_v0400;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100; C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]

-----------------EOF-----------------
--- --- ---

Chopper Mark 08.09.2010 17:17
info.txtRSIT Logfile:
Code:
logfile of random's system information tool 1.08 2010-09-08 18:09:41

======Uninstall list======

-->C:\ProgramData\DivX\DivX7\DivX Codec\DivXCodecUninstall.exe /CODEC
-->C:\ProgramData\DivX\DivX7\DivX Converter\DivXConverterUninstall.exe /CONVERTER
-->msiexec /I {B2F5D08C-7E79-4FCD-AAF4-57AD35FF0601}
3DataManager-->C:\Program Files\3DataManager\Uninstaller.exe
Adobe After Effects CS3 Presets-->MsiExec.exe /I{193EAFD0-1BAF-4FB4-B18F-79D5D6A4B285}
Adobe Anchor Service CS3-->MsiExec.exe /I{90176341-0A8B-4CCC-A78D-F862228A6B95}
Adobe Asset Services CS3-->MsiExec.exe /I{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}
Adobe Bridge 1.0-->MsiExec.exe /I{B74D4E10-6884-0000-0000-000000000101}
Adobe Bridge CS3-->MsiExec.exe /I{9C9824D9-9000-4373-A6A5-D0E5D4831394}
Adobe Bridge Start Meeting-->MsiExec.exe /I{08B32819-6EEF-4057-AEDA-5AB681A36A23}
Adobe BridgeTalk Plugin CS3-->MsiExec.exe /I{B73CFB12-C814-4638-AFFD-7E3AAFAF0B4E}
Adobe Camera Raw 4.0-->MsiExec.exe /I{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}
Adobe CMaps-->MsiExec.exe /I{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}
Adobe Color - Photoshop Specific-->MsiExec.exe /I{A2D81E70-2A98-4A08-A628-94388B063C5E}
Adobe Color Common Settings-->C:\Program Files\Common Files\Adobe\Installers\6c8e2cb4fd241c55406016127a6ab2e\Setup.exe
Adobe Color Common Settings-->MsiExec.exe /I{6D4AC5A4-4CF9-4F90-8111-B9B53CE257BF}
Adobe Color EU Recommended Settings-->MsiExec.exe /I{73B5D990-04EA-4751-B10F-5534770B91F2}
Adobe Color JA Extra Settings-->MsiExec.exe /I{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}
Adobe Color NA Extra Settings-->MsiExec.exe /I{FF29A7E2-FF40-4D07-B7E4-2093DE59E10A}
Adobe Common File Installer-->MsiExec.exe /I{8EDBA74D-0686-4C99-BFDD-F894678E5101}
Adobe Creative Suite 2-->C:\PROGRA~1\INSTAL~1\{0134A~1\setup.exe /relaunched/rootloc=d:\adobe creative suite\creative suite 2.0 dt/lang=0407
Adobe Creative Suite 3 Master Collection hinzufügen oder entfernen-->C:\Program Files\Common Files\Adobe\Installers\67a7fb1e97aa14ee9ef0950eb6fd757\Setup.exe
Adobe Creative Suite 3 Master Collection-->MsiExec.exe /I{DA896917-C1DA-45B2-B4D2-68162F16C0DD}
Adobe Default Language CS3-->MsiExec.exe /I{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}
Adobe Device Central CS3-->MsiExec.exe /I{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}
Adobe ExtendScript Toolkit 2-->C:\Program Files\Common Files\Adobe\Installers\3e054d2218e7aa282c2369d939e58ff\Setup.exe
Adobe ExtendScript Toolkit 2-->MsiExec.exe /I{24D7346D-D4B4-45E8-98EA-75EC14B42DD8}
Adobe Extension Manager CS3-->MsiExec.exe /I{BE5F3842-8309-4754-92D5-83E02E6077A3}
Adobe Flash Player 10 ActiveX-->C:\Windows\system32\Macromed\Flash\FlashUtil10h_ActiveX.exe -maintain activex
Adobe Flash Player 10 Plugin-->C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Flash Player 9 Plugin-->MsiExec.exe /X{88D422DB-E9C7-4E16-9D80-2999F4FD6AD9}
Adobe Fonts All-->MsiExec.exe /I{6ABE0BEE-D572-4FE8-B434-9E72A289431B}
Adobe Help Center 1.0-->MsiExec.exe /I{E9787678-119F-4D52-B551-6739B2B22101}
Adobe Help Viewer CS3-->MsiExec.exe /I{7ACFB90E-8FD0-4397-AD3A-5195412623A3}
Adobe InDesign CS3 Icon Handler-->MsiExec.exe /I{EA7B3CC4-366D-4CF6-8350-FD7A7034116E}
Adobe InDesign CS3-->MsiExec.exe /I{411E0CC3-587A-468C-B461-95FAFD05E4DE}
Adobe Linguistics CS3-->MsiExec.exe /I{54793AA1-5001-42F4-ABB6-C364617C6078}
Adobe MotionPicture Color Files-->MsiExec.exe /I{6B708481-748A-4EB4-97C1-CD386244FF77}
Adobe PDF Library Files-->MsiExec.exe /I{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}
Adobe Photoshop CS3-->MsiExec.exe /I{D3C605D8-3A5E-4BAD-965D-2C61441BF2AC}
Adobe Setup-->MsiExec.exe /I{64C1FA9A-FA94-4B6E-B3E4-8573738E4AD1}
Adobe Setup-->MsiExec.exe /I{B3C02EC1-A7B0-4987-9A43-8789426AAA7D}
Adobe Setup-->MsiExec.exe /I{DFFDDCF5-CB32-4354-8823-1B9E68025953}
Adobe SING CS3-->MsiExec.exe /I{B671CBFD-4109-4D35-9252-3062D3CCB7B2}
Adobe Stock Photos 1.0-->MsiExec.exe /I{786C5747-0C40-4930-9AFE-113BCE553101}
Adobe Stock Photos CS3-->MsiExec.exe /I{29E5EA97-5F74-4A57-B8B2-D4F169117183}
Adobe SVG Viewer 3.0-->C:\Program Files\Common Files\Adobe\SVG Viewer 3.0\Uninstall\Winstall.exe -u -fC:\Program Files\Common Files\Adobe\SVG Viewer 3.0\Uninstall\Install.log
Adobe Type Support-->MsiExec.exe /I{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}
Adobe Update Manager CS3-->MsiExec.exe /I{E69AE897-9E0B-485C-8552-7841F48D42D8}
Adobe Version Cue CS3 Client-->MsiExec.exe /I{D0DFF92A-492E-4C40-B862-A74A173C25C5}
Adobe Video Profiles-->MsiExec.exe /I{845A8DB9-8802-4FD3-9FE3-938A6C46A2EC}
Adobe WAS CS3-->MsiExec.exe /I{C5BD220A-EFE8-48A5-B70E-9503D535FACE}
Adobe WinSoft Linguistics Plugin-->MsiExec.exe /I{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}
Adobe XMP DVA Panels CS3-->MsiExec.exe /I{0224CACC-994D-45F8-B973-D65056EA9C2F}
Adobe XMP Panels CS3-->MsiExec.exe /I{D5A31AB1-345D-47C7-A87B-036A669F6DF1}
AHV content for Acrobat and Flash-->MsiExec.exe /I{6BBAA81D-6A7E-43AD-8889-2F002DCAAFDD}
Apple Application Support-->MsiExec.exe /I{B2D328BE-45AD-4D92-96F9-2151490A203E}
Apple Mobile Device Support-->MsiExec.exe /I{85991ED2-010C-4930-96FA-52F43C2CE98A}
Apple Software Update-->MsiExec.exe /I{C41300B9-185D-475E-BFEC-39EF732F19B1}
Atheros Driver Installation Program-->C:\Program Files\InstallShield Installation Information\{C3A32068-8AB1-4327-BB16-BED9C6219DC7}\setup.exe -runfromtemp -l0x0007
Atheros Wi-Fi Protected Setup Library-->C:\Program Files\InstallShield Installation Information\{B0BCDCBD-863D-4CAB-BF68-8D1F6B1BDC13}\setup.exe -runfromtemp -l0x0007 -removeonly
Bonjour-->MsiExec.exe /X{0CB9668D-F979-4F31-B8B8-67FE90F929F8}
Brother HL-2030-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{90FBA013-266D-4FDB-942A-026398320CD0}\SETUP.exe" -l0x7  -removeonly /uninst
CD/DVD Drive Acoustic Silencer-->C:\Program Files\InstallShield Installation Information\{9FE35071-CAB2-4E79-93E7-BFC6A2DC5C5D}\setup.exe -runfromtemp -l0x0007 -removeonly
CDBurnerXP-->"C:\Program Files\CDBurnerXP\unins000.exe"
Cisco EAP-FAST Module-->MsiExec.exe /I{415B2719-AD3A-4944-B404-C472DB6085B3}
Cisco LEAP Module-->MsiExec.exe /I{83770D14-21B9-44B3-8689-F7B523F94560}
Cisco PEAP Module-->MsiExec.exe /I{669C7BD8-DAA2-49B6-966C-F1E2AAE6B17E}
Cisco Systems VPN Client 5.0.03.0560-->MsiExec.exe /X{A7091E1D-36A4-47F1-A739-173CC341414F}
DAEMON Tools Toolbar-->C:\Program Files\DAEMON Tools Toolbar\uninst.exe
DHTML Editing Component-->MsiExec.exe /I{2EA870FA-585F-4187-903D-CB9FFD21E2E0}
DivX Converter-->C:\ProgramData\DivX\DivX7\DivX Converter\DivXConverterUninstall.exe /CONVERTER
DivX Plus DirectShow Filters-->C:\ProgramData\DivX\DivX7\DivX Plus DirectShow Filters\DivXDSFiltersUninstall.exe /DSFILTERS
DivX-Setup-->C:\ProgramData\DivX\Setup\DivXSetup.exe /uninstall /bundleGroupId divx.com
EVEREST Ultimate Edition v4.20-->"C:\Program Files\Lavalys\EVEREST Ultimate Edition\unins000.exe"
Fischer Weltalmanach 2005-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{DC5EAFC7-4EFB-4AAC-9590-97B627B8BC36}
Google Chrome-->"C:\Program Files\Google\Chrome\Application\5.0.375.127\Installer\setup.exe" --uninstall --system-level
Google Toolbar for Internet Explorer-->"C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarManager_223E2B8E7BAD9544.exe" /uninstall
Google Toolbar for Internet Explorer-->MsiExec.exe /I{18455581-E099-4BA8-BC6B-F34B2F06600C}
Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
HDAUDIO Soft Data Fax Modem with SmartCP-->C:\Program Files\CONEXANT\CNXT_MODEM_PCI_VEN_14F1&DEV_2C06&SUBSYS_14F10000\UIU32m.exe -U -IPDZONCMzK.INF
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall  /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
Intel(R) Graphics Media Accelerator Driver-->C:\Windows\system32\igxpun.exe -uninstall
Intel® Matrix Storage Manager-->C:\Windows\system32\imsmudlg.exe -uninstall
iTunes-->MsiExec.exe /I{91F7F3F3-CE80-48C3-8327-7D24A0A5716A}
Java(TM) 6 Update 13-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216013FF}
Java(TM) 6 Update 6-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160060}
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU-->c:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - deu\setup.exe
Microsoft .NET Framework 3.5 Language Pack SP1 - deu-->MsiExec.exe /I{052FDD78-A6EA-3187-8386-C82F4CA3A929}
Microsoft .NET Framework 3.5 SP1-->C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft .NET Framework 4 Client Profile DEU Language Pack-->C:\Windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\ClientLP\Setup.exe /repair /x86 /lcid 1031 /parameterfolder ClientLP
Microsoft .NET Framework 4 Client Profile DEU Language Pack-->MsiExec.exe /X{F750C986-5310-3A5A-95F8-4EC71C8AC01C}
Microsoft .NET Framework 4 Client Profile-->C:\Windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\Setup.exe /repair /x86 /parameterfolder Client
Microsoft .NET Framework 4 Client Profile-->MsiExec.exe /X{3C3901C5-3455-3E0A-A214-0B093A5070A6}
Microsoft Office Professional Edition 2003-->MsiExec.exe /I{90110407-6000-11D3-8CFE-0150048383C9}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{837b34e3-7c30-493c-8f6a-2b0f04e2912c}
Mozilla Firefox (3.5.3)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSXML 4.0 SP2 (KB941833)-->MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 4.0 SP2 (KB973688)-->MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}
NetWaiting-->C:\Program Files\InstallShield Installation Information\{3F92ABBB-6BBF-11D5-B229-002078017FBF}\setup.exe -runfromtemp -l0x0007 -removeonly
Nokia Connectivity Cable Driver-->MsiExec.exe /I{1B9B5B3B-28E7-4E59-A80D-D670AA984514}
PC Connectivity Solution-->MsiExec.exe /I{DCD22647-6D31-479D-8F97-16D0AA934D9E}
PDF Settings-->MsiExec.exe /I{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}
QuickTime-->MsiExec.exe /I{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}
Realtek 8169 8168 8101E 8102E Ethernet Driver-->C:\Program Files\InstallShield Installation Information\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}\setup.exe -runfromtemp -l0x0007 -removeonly
Realtek High Definition Audio Driver-->RtlUpd.exe -r -m -nrg2709
Realtek USB 2.0 Card Reader-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\setup.exe" -l0x9  -removeonly
Safari-->MsiExec.exe /I{AFAC914D-9E83-4A89-8ABE-427521C82CCF}
Security Update for Windows Media Encoder (KB979332)-->msiexec.exe /I {E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E} MSIPATCHREMOVE={950E24CA-CA7E-4606-8F0D-DEDBC94F2A1E} /qb
Skype Toolbars-->MsiExec.exe /I{981029E0-7FC9-4CF3-AB39-6F133621921A}
Skype™ 4.2-->MsiExec.exe /X{D103C4BA-F905-437A-8049-DB24763BBE36}
SPSS Statistics 17.0-->MsiExec.exe /X{46B65150-F8AA-42F2-94FB-2729A8AE5F7E}
Synaptics Pointing Device Driver-->rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall
TuneUp Utilities 2009-->MsiExec.exe /I{55A29068-F2CE-456C-9148-C869879E2357}
Turbo Lister 2-->MsiExec.exe /X{8927E07C-97F7-4A54-88FB-D976F50DD46E}
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
VC80CRTRedist - 8.0.50727.4053-->MsiExec.exe /I{5EE7D259-D137-4438-9A5F-42F432EC0421}
VLC media player 1.0.1-->C:\Program Files\VideoLAN\VLC\uninstall.exe
WebEx-->C:\PROGRA~2\WebEx\atcliun.exe
Windows Media Encoder 9 Series-->msiexec.exe /I {E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}
Windows Media Encoder 9 Series-->MsiExec.exe /I{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}
Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0)-->C:\PROGRA~1\DIFX\B4723E9A0713E5B1\dpinst.exe /u C:\Windows\system32\DRVSTORE\pccsmcfd_A3B3916E5D8138F59EE218321B27B044D3B18294\pccsmcfd.inf
WinRAR-->C:\Program Files\WinRAR\uninstall.exe

======Hosts File======

::1      localhost

======Security center information======

AS: Windows Defender

======System event log======

Computer Name: Bertl
Event Code: 7036
Message: Dienst "DNS-Client" befindet sich jetzt im Status "Ausgeführt".
Record Number: 65129
Source Name: Service Control Manager
Time Written: 20100117182807.000000-000
Event Type: Informationen
User:

Computer Name: Bertl
Event Code: 7036
Message: Dienst "CNG-Schlüsselisolation" befindet sich jetzt im Status "Ausgeführt".
Record Number: 65128
Source Name: Service Control Manager
Time Written: 20100117182807.000000-000
Event Type: Informationen
User:

Computer Name: Bertl
Event Code: 7036
Message: Dienst "Netzwerkspeicher-Schnittstellendienst" befindet sich jetzt im Status "Ausgeführt".
Record Number: 65127
Source Name: Service Control Manager
Time Written: 20100117182807.000000-000
Event Type: Informationen
User:

Computer Name: Bertl
Event Code: 7036
Message: Dienst "Windows Driver Foundation - Benutzermodus-Treiberframework" befindet sich jetzt im Status "Ausgeführt".
Record Number: 65126
Source Name: Service Control Manager
Time Written: 20100117182807.000000-000
Event Type: Informationen
User:

Computer Name: Bertl
Event Code: 7036
Message: Dienst "Sicherheitskonto-Manager" befindet sich jetzt im Status "Ausgeführt".
Record Number: 65125
Source Name: Service Control Manager
Time Written: 20100117182807.000000-000
Event Type: Informationen
User:

=====Application event log=====

Computer Name: Bertl
Event Code: 100
Message: Task Scheduling Error: m->NextScheduledEvent 347118
Record Number: 182141
Source Name: Bonjour Service
Time Written: 20100701105127.000000-000
Event Type: Fehler
User:

Computer Name: Bertl
Event Code: 100
Message: Task Scheduling Error: Continuously busy for more than a second
Record Number: 182140
Source Name: Bonjour Service
Time Written: 20100701105127.000000-000
Event Type: Fehler
User:

Computer Name: Bertl
Event Code: 100
Message: Task Scheduling Error: m->NextScheduledSPRetry 346120
Record Number: 182139
Source Name: Bonjour Service
Time Written: 20100701105126.000000-000
Event Type: Fehler
User:

Computer Name: Bertl
Event Code: 100
Message: Task Scheduling Error: m->NextScheduledEvent 346120
Record Number: 182138
Source Name: Bonjour Service
Time Written: 20100701105126.000000-000
Event Type: Fehler
User:

Computer Name: Bertl
Event Code: 100
Message: Task Scheduling Error: Continuously busy for more than a second
Record Number: 182137
Source Name: Bonjour Service
Time Written: 20100701105126.000000-000
Event Type: Fehler
User:

=====Security event log=====

Computer Name: ADMINIS-H2DKW9H
Event Code: 4648
Message: Anmeldeversuch mit expliziten Anmeldeinformationen.

Antragsteller:
        Sicherheits-ID:                S-1-5-18
        Kontoname:                ADMINIS-H2DKW9H$
        Kontodomäne:                WORKGROUP
        Anmelde-ID:                0x3e7
        Anmelde-GUID:                {00000000-0000-0000-0000-000000000000}

Konto, dessen Anmeldeinformationen verwendet wurden:
        Kontoname:                SYSTEM
        Kontodomäne:                NT-AUTORITÄT
        Anmelde-GUID:                {00000000-0000-0000-0000-000000000000}

Zielserver:
        Zielservername:        localhost
        Weitere Informationen:        localhost

Prozessinformationen:
        Prozess-ID:                0x248
        Prozessname:                C:\Windows\System32\services.exe

Netzwerkinformationen:
        Netzwerkadresse:        -
        Port:                        -

Dieses Ereignis wird bei einem Anmeldeversuch durch einen Prozess generiert, wenn ausdrücklich die Anmeldeinformationen des Kontos angegeben werden.  Dies ist normalerweise der Fall in Batch-Konfigurationen, z. B. bei geplanten Aufgaben oder wenn der Befehl "runas" verwendet wird.
Record Number: 713
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20080813123930.294268-000
Event Type: Überwachung erfolgreich
User:

Computer Name: ADMINIS-H2DKW9H
Event Code: 4672
Message: Einer neuen Anmeldung wurden besondere Rechte zugewiesen.

Antragsteller:
        Sicherheits-ID:                S-1-5-18
        Kontoname:                SYSTEM
        Kontodomäne:                NT-AUTORITÄT
        Anmelde-ID:                0x3e7

Berechtigungen:                SeAssignPrimaryTokenPrivilege
                        SeTcbPrivilege
                        SeSecurityPrivilege
                        SeTakeOwnershipPrivilege
                        SeLoadDriverPrivilege
                        SeBackupPrivilege
                        SeRestorePrivilege
                        SeDebugPrivilege
                        SeAuditPrivilege
                        SeSystemEnvironmentPrivilege
                        SeImpersonatePrivilege
Record Number: 712
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20080813123930.231868-000
Event Type: Überwachung erfolgreich
User:

Computer Name: ADMINIS-H2DKW9H
Event Code: 4624
Message: Ein Konto wurde erfolgreich angemeldet.

Antragsteller:
        Sicherheits-ID:                S-1-5-18
        Kontoname:                ADMINIS-H2DKW9H$
        Kontodomäne:                WORKGROUP
        Anmelde-ID:                0x3e7

Anmeldetyp:                        5

Neue Anmeldung:
        Sicherheits-ID:                S-1-5-18
        Kontoname:                SYSTEM
        Kontodomäne:                NT-AUTORITÄT
        Anmelde-ID:                0x3e7
        Anmelde-GUID:                {00000000-0000-0000-0000-000000000000}

Prozessinformationen:
        Prozess-ID:                0x248
        Prozessname:                C:\Windows\System32\services.exe

Netzwerkinformationen:
        Arbeitsstationsname:       
        Quellnetzwerkadresse:        -
        Quellport:                -

Detaillierte Authentifizierungsinformationen:
        Anmeldeprozess:                Advapi 
        Authentifizierungspaket:        Negotiate
        Übertragene Dienste:        -
        Paketname (nur NTLM):        -
        Schlüssellänge:                0

Dieses Ereignis wird beim Erstellen einer Anmeldesitzung generiert. Es wird auf dem Computer generiert, auf den zugegriffen wurde.

Die Antragstellerfelder geben das Konto auf dem lokalen System an, von dem die Anmeldung angefordert wurde. Dies ist meistens ein Dienst wie der Serverdienst oder ein lokaler Prozess wie "Winlogon.exe" oder "Services.exe".

Das Anmeldetypfeld gibt den jeweiligen Anmeldetyp an. Die häufigsten Typen sind 2 (interaktiv) und 3 (Netzwerk).

Die Felder für die neue Anmeldung geben das Konto an, für das die Anmeldung erstellt wurde, d. h. das angemeldete Konto.

Die Netzwerkfelder geben die Quelle einer Remoteanmeldeanforderung an. der Arbeitsstationsname ist nicht immer verfügbar und kann in manchen Fällen leer bleiben.

Die Felder für die Authentifizierungsinformationen enthalten detaillierte Informationen zu dieser speziellen Anmeldeanforderung.
        - Die Anmelde-GUID ist ein eindeutiger Bezeichner, der verwendet werden kann, um dieses Ereignis mit einem KDC-Ereignis zu korrelieren.
        - Die übertragenen Dienste geben an, welche Zwischendienste an der Anmeldeanforderung beteiligt waren.
        - Der Paketname gibt das in den NTLM-Protokollen verwendete Unterprotokoll an.
        - Die Schlüssellänge gibt die Länge des generierten Sitzungsschlüssels an. Wenn kein Sitzungsschlüssel angefordert wurde, ist dieser Wert 0.
Record Number: 711
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20080813123930.231868-000
Event Type: Überwachung erfolgreich
User:

Computer Name: ADMINIS-H2DKW9H
Event Code: 4648
Message: Anmeldeversuch mit expliziten Anmeldeinformationen.

Antragsteller:
        Sicherheits-ID:                S-1-5-18
        Kontoname:                ADMINIS-H2DKW9H$
        Kontodomäne:                WORKGROUP
        Anmelde-ID:                0x3e7
        Anmelde-GUID:                {00000000-0000-0000-0000-000000000000}

Konto, dessen Anmeldeinformationen verwendet wurden:
        Kontoname:                SYSTEM
        Kontodomäne:                NT-AUTORITÄT
        Anmelde-GUID:                {00000000-0000-0000-0000-000000000000}

Zielserver:
        Zielservername:        localhost
        Weitere Informationen:        localhost

Prozessinformationen:
        Prozess-ID:                0x248
        Prozessname:                C:\Windows\System32\services.exe

Netzwerkinformationen:
        Netzwerkadresse:        -
        Port:                        -

Dieses Ereignis wird bei einem Anmeldeversuch durch einen Prozess generiert, wenn ausdrücklich die Anmeldeinformationen des Kontos angegeben werden.  Dies ist normalerweise der Fall in Batch-Konfigurationen, z. B. bei geplanten Aufgaben oder wenn der Befehl "runas" verwendet wird.
Record Number: 710
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20080813123930.231868-000
Event Type: Überwachung erfolgreich
User:

Computer Name: ADMINIS-H2DKW9H
Event Code: 1102
Message: Das Überwachungsprotokoll wurde gelöscht.
Subjekt:
        Sicherheits- ID:        S-1-5-21-1868333482-3534415354-526744358-500
        Kontoname:        Administrator
        Domänenname:        ADMINIS-H2DKW9H
        Logon-ID:        0x21688
Record Number: 709
Source Name: Microsoft-Windows-Eventlog
Time Written: 20080813123922.119868-000
Event Type: Überwachung erfolgreich
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=C:\Program Files\PC Connectivity Solution\;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\PROGRA~1\COMMON~1\ULEADS~1\MPEG;C:\Program Files\Common Files\DivX Shared\;C:\Program Files\Common Files\Adobe\AGL;C:\Program Files\QuickTime\QTSystem\
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=x86
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 13, GenuineIntel
"PROCESSOR_REVISION"=0f0d
"NUMBER_OF_PROCESSORS"=2
"TRACE_FORMAT_SEARCH_PATH"=\\NTREL202.ntdev.corp.microsoft.com\4F18C3A5-CA09-4DBD-B6FC-219FDD4C6BE0\TraceFormat
"DFSTRACINGON"=FALSE
"asl.log"=Destination=file;OnFirstLog=command,environment
"CLASSPATH"=.;C:\Program Files\Java\jre6\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre6\lib\ext\QTJava.zip

-----------------EOF-----------------
--- --- ---

Chopper Mark 08.09.2010 17:31
Code:

                        $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
                        º                                    º
                                    hjtscanlist v2.0             
                        º                                    º
                        $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

Microsoft Windows [Version 6.0.6002]
 
 
C:

  08.09.2010 18:09    C:\rsit --------- 0 
  08.09.2010 18:08    C:\Program Files --------- 20480 
      C:\hiberfil.sys ---------   
      C:\pagefile.sys ---------   
  07.09.2010 22:47    C:\Windows --------- 28672 
  07.09.2010 20:03    C:\ProgramData --------- 8192 
  07.09.2010 19:41    C:\rkill.log --------- 589 
  07.09.2010 17:53    C:\IO.SYS --------- 0 
  07.09.2010 17:53    C:\MSDOS.SYS --------- 0 
  19.01.2010 16:20    C:\InstallHelper.log --------- 343 
  23.10.2009 20:16    C:\$RECYCLE.BIN --------- 0 
  29.07.2009 16:18    C:\System Volume Information --------- 32768 
  29.07.2009 15:50    C:\Boot --------- 4096 
  29.07.2009 13:23    C:\Toshiba --------- 4096 
  29.07.2009 13:15    C:\Users --------- 4096 
  29.07.2009 13:12    C:\Programme --------- 0 
  29.07.2009 13:12    C:\Dokumente und Einstellungen --------- 0 
  29.07.2009 11:47    C:\RHDSetup.log --------- 651 
  10.04.2009 23:36    C:\bootmgr --------- 333257 
  06.02.2009 06:42    C:\SWSTAMP.TXT --------- 229 
  13.08.2008 14:25    C:\Works --------- 0 
  13.08.2008 13:28    C:\Intel --------- 0 
  13.08.2008 12:34    C:\BOOTSECT.BAK --------- 8192 
  21.01.2008 04:43    C:\PerfLogs --------- 0 
  02.11.2006 14:59    C:\Documents and Settings --------- 0 
  18.09.2006 23:43    C:\config.sys --------- 10 
  18.09.2006 23:43    C:\autoexec.bat --------- 24 
----------------------------------------

 
C:\Windows

  08.09.2010 18:08    C:\Windows\WindowsUpdate.log --------- 1416164 
  08.09.2010 18:04    C:\Windows\bootstat.dat --------- 67584 
  08.09.2010 10:52    C:\Windows\lsrslt.ini --------- 3086 
  08.09.2010 09:52    C:\Windows\PFRO.log --------- 11648 
  07.09.2010 20:54    C:\Windows\MEMORY.DMP --------- 231676293 
  07.09.2010 17:52    C:\Windows\srun.log --------- 12 
  23.08.2010 11:09    C:\Windows\setupact.log --------- 40179 
  02.08.2010 10:25    C:\Windows\DPINST.LOG --------- 15114 
  11.07.2010 13:34    C:\Windows\BRWMARK.INI --------- 432 
  26.11.2009 09:49    C:\Windows\msxml4-KB973688-deu.LOG --------- 295312 
  19.09.2009 18:39    C:\Windows\VPNInstall.MIF --------- 1594 
  19.09.2009 18:38    C:\Windows\VPNUnInstall.MIF --------- 1594 
  29.07.2009 18:51    C:\Windows\BRDIAG.INI --------- 40 
  29.07.2009 18:51    C:\Windows\HL-2030.INI --------- 9013 
  29.07.2009 18:51    C:\Windows\BRVIDEO.INI --------- 145 
  29.07.2009 18:51    C:\Windows\Brownie.ini --------- 23 
  29.07.2009 16:24    C:\Windows\nsreg.dat --------- 0 
  29.07.2009 16:23    C:\Windows\ie8_main.log --------- 2084 
  29.07.2009 15:58    C:\Windows\win.ini --------- 240 
  29.07.2009 15:56    C:\Windows\ODBC.INI --------- 400 
  29.07.2009 13:54    C:\Windows\msxml4-KB954430-deu.LOG --------- 287956 
  29.07.2009 11:47    C:\Windows\DIFxAPI.dll --------- 319456 
  29.07.2009 11:47    C:\Windows\HideWin.exe --------- 315392 
  10.04.2009 23:27    C:\Windows\explorer.exe --------- 2926592 
  13.08.2008 14:48    C:\Windows\csup.txt --------- 10 
  13.08.2008 13:51    C:\Windows\NDSTray.INI --------- 0 
  13.08.2008 13:01    C:\Windows\msxml4-KB941833-deu.LOG --------- 266764 
  08.04.2008 15:14    C:\Windows\RtHDVCpl.exe --------- 6037504 
  02.04.2008 09:27    C:\Windows\RtlUpd.exe --------- 1196032 
  05.03.2008 18:07    C:\Windows\RtlExUpd.dll --------- 520192 
  21.01.2008 04:57    C:\Windows\WindowsShell.Manifest --------- 749 
  21.01.2008 04:34    C:\Windows\regedit.exe --------- 134656 
  21.01.2008 04:34    C:\Windows\bfsvc.exe --------- 58880 
  21.01.2008 04:34    C:\Windows\fveupdate.exe --------- 13312 
  21.01.2008 04:33    C:\Windows\HelpPane.exe --------- 498176 
  21.01.2008 04:33    C:\Windows\notepad.exe --------- 151040 
  16.01.2008 12:13    C:\Windows\Thumbs.db --------- 4096 
  20.11.2007 18:15    C:\Windows\SkyTel.exe --------- 1826816 
  14.11.2007 15:18    C:\Windows\USetup.iss --------- 553 
  03.11.2006 14:30    C:\Windows\oemlogo.bmp --------- 43254 
  02.11.2006 14:49    C:\Windows\setuperr.log --------- 0 
  02.11.2006 14:45    C:\Windows\SETUPAPI.LOG --------- 94 
  02.11.2006 14:34    C:\Windows\WMSysPr9.prx --------- 316640 
  02.11.2006 14:33    C:\Windows\twunk_16.exe --------- 49680 
  02.11.2006 14:33    C:\Windows\twunk_32.exe --------- 31232 
  02.11.2006 14:33    C:\Windows\twain_32.dll --------- 50688 
  02.11.2006 14:33    C:\Windows\twain.dll --------- 94784 
  02.11.2006 11:45    C:\Windows\winhlp32.exe --------- 9216 
  02.11.2006 11:45    C:\Windows\hh.exe --------- 14848 
  02.11.2006 09:46    C:\Windows\mib.bin --------- 43131 
  19.09.2006 13:41    C:\Windows\HomeBasic.xml --------- 8286 
  18.09.2006 23:46    C:\Windows\system.ini --------- 219 
  18.09.2006 23:43    C:\Windows\_default.pif --------- 707 
  18.09.2006 23:43    C:\Windows\winhelp.exe --------- 256192 
  18.09.2006 23:30    C:\Windows\msdfmap.ini --------- 1405 
----------------------------------------

 
C:\Windows\System

 02.04.2008 15:00      C:\Windows\System\DriveIcon.dll --------- 6428192
 27.09.2007 15:32      C:\Windows\System\ms.ico --------- 34530
 27.09.2007 15:17      C:\Windows\System\sm.ico --------- 37041
 27.09.2007 15:12      C:\Windows\System\sd.ico --------- 38660
 27.09.2007 15:04      C:\Windows\System\cf.ico --------- 37300
 02.11.2006 14:33      C:\Windows\System\mciwave.drv --------- 28160
 02.11.2006 14:33      C:\Windows\System\mciseq.drv --------- 25264
 02.11.2006 14:33      C:\Windows\System\avifile.dll --------- 109456
 02.11.2006 14:33      C:\Windows\System\mciavi.drv --------- 73376
 02.11.2006 14:33      C:\Windows\System\avicap.dll --------- 69584
 02.11.2006 14:33      C:\Windows\System\msvideo.dll --------- 126912
 02.11.2006 09:10      C:\Windows\System\OLESVR.DLL --------- 24064
 02.11.2006 09:10      C:\Windows\System\WFWNET.DRV --------- 12704
 02.11.2006 09:10      C:\Windows\System\COMMDLG.DLL --------- 32816
 02.11.2006 09:10      C:\Windows\System\TIMER.DRV --------- 4048
 02.11.2006 09:10      C:\Windows\System\MMSYSTEM.DLL --------- 68992
 02.11.2006 09:10      C:\Windows\System\mmtask.tsk --------- 1152
 02.11.2006 09:10      C:\Windows\System\mouse.drv --------- 2032
 02.11.2006 09:10      C:\Windows\System\vga.drv --------- 2176
 02.11.2006 09:10      C:\Windows\System\sound.drv --------- 1744
 02.11.2006 09:10      C:\Windows\System\keyboard.drv --------- 2000
 02.11.2006 09:10      C:\Windows\System\SHELL.DLL --------- 5120
 02.11.2006 09:10      C:\Windows\System\system.drv --------- 3360
 18.09.2006 23:43      C:\Windows\System\ver.dll --------- 9008
 18.09.2006 23:43      C:\Windows\System\olecli.dll --------- 82944
 18.09.2006 23:43      C:\Windows\System\lzexpand.dll --------- 9936
 18.09.2006 23:35      C:\Windows\System\stdole.tlb --------- 5532
 30.06.2004 16:24      C:\Windows\System\MyMulti.ico --------- 5430
----------------------------------------

 
C:\Windows\System32

 08.09.2010 18:21    C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 --------- 3216 
 08.09.2010 18:21    C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 --------- 3216 
 08.09.2010 09:52    C:\Windows\system32\FNTCACHE.DAT --------- 1672056 
 08.09.2010 07:50    C:\Windows\system32\perfh009.dat --------- 601410 
 08.09.2010 07:50    C:\Windows\system32\perfc009.dat --------- 106184 
 08.09.2010 07:50    C:\Windows\system32\perfh007.dat --------- 635170 
 08.09.2010 07:50    C:\Windows\system32\perfc007.dat --------- 129052 
 08.09.2010 07:50    C:\Windows\system32\PerfStringBackup.INI --------- 1462982 
 08.09.2010 05:49    C:\Windows\system32\LogFiles --------- 0 
 07.09.2010 22:42    C:\Windows\system32\jt9kgbb.log --------- 2 
 07.09.2010 22:24    C:\Windows\system32\drivers --------- 65536 
 02.09.2010 17:46    C:\Windows\system32\catroot2 --------- 28672 
 11.08.2010 10:15    C:\Windows\system32\migration --------- 0 
 11.08.2010 10:08    C:\Windows\system32\catroot --------- 4096 
 03.08.2010 20:09    C:\Windows\system32\mrt.exe --------- 35962312 
 02.08.2010 10:31    C:\Windows\system32\wbem --------- 65536 
 02.08.2010 10:25    C:\Windows\system32\DRVSTORE --------- 0 
 28.07.2010 11:08    C:\Windows\system32\mlfcache.dat --------- 121284 
 26.07.2010 17:51    C:\Windows\system32\shell32.dll --------- 11584512 
 20.07.2010 21:05    C:\Windows\system32\Tasks --------- 4096 
 26.06.2010 11:11    C:\Windows\system32\de-DE --------- 262144 
 26.06.2010 11:07    C:\Windows\system32\en-US --------- 8192 
 26.06.2010 08:05    C:\Windows\system32\wininet.dll --------- 916480 
 26.06.2010 08:05    C:\Windows\system32\urlmon.dll --------- 1210368 
 26.06.2010 08:04    C:\Windows\system32\occache.dll --------- 206848 
 26.06.2010 08:03    C:\Windows\system32\mstime.dll --------- 611840 
 26.06.2010 08:03    C:\Windows\system32\mshtml.dll --------- 5951488 
 26.06.2010 08:03    C:\Windows\system32\msfeedsbs.dll --------- 55296 
 26.06.2010 08:03    C:\Windows\system32\msfeeds.dll --------- 599040 
 26.06.2010 08:02    C:\Windows\system32\jsproxy.dll --------- 25600 
 26.06.2010 08:02    C:\Windows\system32\inetcpl.cpl --------- 1469440 
 26.06.2010 08:02    C:\Windows\system32\ieui.dll --------- 164352 
 26.06.2010 08:02    C:\Windows\system32\iesysprep.dll --------- 109056 
 26.06.2010 08:02    C:\Windows\system32\iesetup.dll --------- 71680 
 26.06.2010 08:02    C:\Windows\system32\iertutil.dll --------- 1986560 
 26.06.2010 08:02    C:\Windows\system32\iernonce.dll --------- 55808 
 26.06.2010 08:02    C:\Windows\system32\iepeers.dll --------- 184320 
 26.06.2010 08:02    C:\Windows\system32\ieframe.dll --------- 11077120 
 26.06.2010 08:02    C:\Windows\system32\iedkcs32.dll --------- 387584 
 26.06.2010 06:25    C:\Windows\system32\ieUnatt.exe --------- 133632 
 26.06.2010 06:24    C:\Windows\system32\ie4uinit.exe --------- 173056 
 26.06.2010 06:24    C:\Windows\system32\msfeedssync.exe --------- 13312 
 26.06.2010 06:23    C:\Windows\system32\mshtml.tlb --------- 1638912 
 21.06.2010 15:37    C:\Windows\system32\win32k.sys --------- 2037760 
 18.06.2010 19:31    C:\Windows\system32\rtutils.dll --------- 36864 
 11.06.2010 18:16    C:\Windows\system32\schannel.dll --------- 274944 
 11.06.2010 18:15    C:\Windows\system32\msxml3.dll --------- 1248768 
 08.06.2010 19:35    C:\Windows\system32\ntoskrnl.exe --------- 3548040 
 08.06.2010 19:35    C:\Windows\system32\ntkrnlpa.exe --------- 3600768 
 27.05.2010 22:08    C:\Windows\system32\iccvid.dll --------- 81920 
 26.05.2010 19:06    C:\Windows\system32\atmlib.dll --------- 34304 
 26.05.2010 16:47    C:\Windows\system32\atmfd.dll --------- 289792 
 21.05.2010 14:14    C:\Windows\system32\MpSigStub.exe --------- 221568 
 18.05.2010 16:35    C:\Windows\system32\dns-sd.exe --------- 107808 
 18.05.2010 16:35    C:\Windows\system32\dnssd.dll --------- 91424 
 27.04.2010 00:04    C:\Windows\system32\DivXControlPanelApplet.cpl --------- 353592 
 23.04.2010 16:13    C:\Windows\system32\tzres.dll --------- 2048 
 19.04.2010 20:47    C:\Windows\system32\usbaaplrc.dll --------- 3062048 
 16.04.2010 18:43    C:\Windows\system32\Apphlpdm.dll --------- 28672 
 16.04.2010 16:39    C:\Windows\system32\GameUXLegacyGDFs.dll --------- 4240384 
 05.04.2010 19:01    C:\Windows\system32\asycfilt.dll --------- 67072 
 02.04.2010 19:34    C:\Windows\system32\declrds.ax --------- 45568 
 18.03.2010 13:16    C:\Windows\system32\msvcr100_clr0400.dll --------- 771424 
 17.03.2010 21:53    C:\Windows\system32\QuickTimeVR.qtx --------- 94208 
 17.03.2010 21:53    C:\Windows\system32\QuickTime.qts --------- 69632 
 12.03.2010 00:27    C:\Windows\system32\WDI --------- 4096 
 10.03.2010 21:29    C:\Windows\system32\dpl100.dll --------- 94208 
 05.03.2010 16:01    C:\Windows\system32\vbscript.dll --------- 420352 
 26.02.2010 14:32    C:\Windows\system32\nmwcdcocls.dll --------- 662016 
 26.02.2010 14:32    C:\Windows\system32\nmwcdcls.dll --------- 92672 
 26.02.2010 14:19    C:\Windows\system32\wdfcoinstaller01009.dll --------- 1461992 
 19.02.2010 21:27    C:\Windows\system32\DivX.dll --------- 720384 
 19.02.2010 21:27    C:\Windows\system32\divx_xx0c.dll --------- 856064 
 19.02.2010 21:27    C:\Windows\system32\divx_xx11.dll --------- 839680 
 19.02.2010 21:27    C:\Windows\system32\divx_xx16.dll --------- 843776 
 19.02.2010 21:27    C:\Windows\system32\divx_xx0a.dll --------- 847872 
 19.02.2010 21:27    C:\Windows\system32\divx_xx07.dll --------- 856064 
 18.02.2010 15:30    C:\Windows\system32\iphlpsvc.dll --------- 200704 
 12.02.2010 12:32    C:\Windows\system32\browserchoice.exe --------- 293376 
 29.01.2010 17:40    C:\Windows\system32\inetcomm.dll --------- 738816 
 25.01.2010 14:00    C:\Windows\system32\secproc_ssp_isv.dll --------- 152576 
 25.01.2010 14:00    C:\Windows\system32\secproc_ssp.dll --------- 152064 
 25.01.2010 14:00    C:\Windows\system32\secproc_isv.dll --------- 471552 
 25.01.2010 14:00    C:\Windows\system32\secproc.dll --------- 471552 
 25.01.2010 13:58    C:\Windows\system32\msdrm.dll --------- 332288 
 25.01.2010 10:21    C:\Windows\system32\RMActivate_ssp_isv.exe --------- 346624 
 25.01.2010 10:21    C:\Windows\system32\RMActivate_isv.exe --------- 526336 
 25.01.2010 10:21    C:\Windows\system32\RMActivate_ssp.exe --------- 347136 
 25.01.2010 10:21    C:\Windows\system32\RMActivate.exe --------- 518144 
 21.01.2010 17:05    C:\Windows\system32\l3codeca.acm --------- 62464 
 13.01.2010 19:34    C:\Windows\system32\cabview.dll --------- 98304 
 06.01.2010 17:39    C:\Windows\system32\gameux.dll --------- 1696256 
 23.12.2009 13:33    C:\Windows\system32\wintrust.dll --------- 172032 
 04.12.2009 20:30    C:\Windows\system32\tsbyuv.dll --------- 12288 
 04.12.2009 20:29    C:\Windows\system32\quartz.dll --------- 1314816 
 04.12.2009 20:28    C:\Windows\system32\msyuv.dll --------- 22528 
 04.12.2009 20:28    C:\Windows\system32\msvfw32.dll --------- 123904 
 04.12.2009 20:28    C:\Windows\system32\msvidc32.dll --------- 31744 
 04.12.2009 20:28    C:\Windows\system32\msrle32.dll --------- 13312 
 04.12.2009 20:28    C:\Windows\system32\mciavi32.dll --------- 82944 
----------------------------------------

 
C:\Windows\Prefetch

 08.09.2010 18:29    C:\Windows\Prefetch\CMD.EXE-4A81B364.pf --------- 10372 
 08.09.2010 18:29    C:\Windows\Prefetch\WINRAR.EXE-94E7D80C.pf --------- 34438 
 08.09.2010 18:28    C:\Windows\Prefetch\DLLHOST.EXE-5E46FA0D.pf --------- 50022 
 08.09.2010 18:27    C:\Windows\Prefetch\VERCLSID.EXE-7C52E31C.pf --------- 20444 
 08.09.2010 18:27    C:\Windows\Prefetch\SSVAGENT.EXE-D0A26E22.pf --------- 12214 
 08.09.2010 18:23    C:\Windows\Prefetch\GOOGLEUPDATE.EXE-FE771DDA.pf --------- 36964 
 08.09.2010 18:23    C:\Windows\Prefetch\GOOGLECRASHHANDLER.EXE-7E19D64C.pf --------- 16624 
 08.09.2010 18:21    C:\Windows\Prefetch\WMIPRVSE.EXE-1628051C.pf --------- 34474 
 08.09.2010 18:19    C:\Windows\Prefetch\TASKENG.EXE-48D4E289.pf --------- 16900 
 08.09.2010 18:19    C:\Windows\Prefetch\RUNDLL32.EXE-1304AE86.pf --------- 30914 
 08.09.2010 18:19    C:\Windows\Prefetch\SEARCHFILTERHOST.EXE-77482212.pf --------- 16318 
 08.09.2010 18:19    C:\Windows\Prefetch\SEARCHPROTOCOLHOST.EXE-0CB8CADE.pf --------- 24300 
 08.09.2010 18:19    C:\Windows\Prefetch\IEXPLORE.EXE-908C99F8.pf --------- 172822 
 08.09.2010 18:14    C:\Windows\Prefetch\NOTEPAD.EXE-D8414F97.pf --------- 16476 
 08.09.2010 18:11    C:\Windows\Prefetch\SKYPEPM.EXE-EECA8925.pf --------- 36070 
 08.09.2010 18:11    C:\Windows\Prefetch\SKYPE.EXE-4929A84C.pf --------- 178150 
 08.09.2010 18:09    C:\Windows\Prefetch\CHOPPER.EXE-2444CB6E.pf --------- 132912 
 08.09.2010 18:08    C:\Windows\Prefetch\RSIT.EXE-B30D9FD6.pf --------- 20518 
 08.09.2010 18:08    C:\Windows\Prefetch\WMIADAP.EXE-F8DFDFA2.pf --------- 16970 
 08.09.2010 18:08    C:\Windows\Prefetch\TRUSTEDINSTALLER.EXE-3CC531E5.pf --------- 31268 
 08.09.2010 18:07    C:\Windows\Prefetch\WINWORD.EXE-71DAFA5C.pf --------- 104950 
 08.09.2010 18:07    C:\Windows\Prefetch\MOBILEMESERVICES.EXE-6A3AD033.pf --------- 36710 
 08.09.2010 18:07    C:\Windows\Prefetch\OUTLOOK.EXE-C10375AB.pf --------- 135790 
 08.09.2010 18:07    C:\Windows\Prefetch\DLLHOST.EXE-CC8C22CE.pf --------- 18768 
 08.09.2010 18:07    C:\Windows\Prefetch\MSCORSVW.EXE-C3C515BD.pf --------- 17950 
 08.09.2010 18:07    C:\Windows\Prefetch\BMCTL.EXE-C7786C70.pf --------- 20526 
 08.09.2010 18:06    C:\Windows\Prefetch\ReadyBoot --------- 4096 
 08.09.2010 18:06    C:\Windows\Prefetch\MSFEEDSSYNC.EXE-6E6FBDF4.pf --------- 16964 
 08.09.2010 18:05    C:\Windows\Prefetch\NET.EXE-DF44F913.pf --------- 12456 
 08.09.2010 18:05    C:\Windows\Prefetch\NET1.EXE-849DA590.pf --------- 8926 
 08.09.2010 18:05    C:\Windows\Prefetch\3DATAMANAGER.EXE-FE6C2246.pf --------- 66714 
 08.09.2010 18:05    C:\Windows\Prefetch\NTOSBOOT-B00DFAAD.pf --------- 3466966 
 08.09.2010 14:06    C:\Windows\Prefetch\AgGlFgAppHistory.db --------- 2327259 
 08.09.2010 14:06    C:\Windows\Prefetch\AgGlFaultHistory.db --------- 940360 
 08.09.2010 14:06    C:\Windows\Prefetch\AgGlGlobalHistory.db --------- 4381216 
 08.09.2010 14:06    C:\Windows\Prefetch\AgRobust.db --------- 154780 
 08.09.2010 14:06    C:\Windows\Prefetch\PfSvPerfStats.bin --------- 508 
 08.09.2010 14:06    C:\Windows\Prefetch\MOBSYNC.EXE-C5E2284F.pf --------- 33086 
 08.09.2010 14:06    C:\Windows\Prefetch\WMPLAYER.EXE-BAD6BD53.pf --------- 73602 
 08.09.2010 13:50    C:\Windows\Prefetch\WERFAULT.EXE-E69F695A.pf --------- 139328 
 08.09.2010 13:49    C:\Windows\Prefetch\VLC.EXE-A11F73EE.pf --------- 163944 
 08.09.2010 13:29    C:\Windows\Prefetch\OUTLOOK.EXE-2D9482FD.pf --------- 149604 
 08.09.2010 13:29    C:\Windows\Prefetch\SSVAGENT.EXE-42E515EF.pf --------- 12056 
 08.09.2010 10:52    C:\Windows\Prefetch\LOGONUI.EXE-09140401.pf --------- 32404 
 08.09.2010 09:54    C:\Windows\Prefetch\ACRODIST.EXE-9531DF40.pf --------- 279784 
 08.09.2010 09:54    C:\Windows\Prefetch\IPODSERVICE.EXE-37C43D64.pf --------- 17778 
 08.09.2010 09:54    C:\Windows\Prefetch\FNPLICENSINGSERVICE.EXE-FAD19408.pf --------- 13534 
 08.09.2010 09:54    C:\Windows\Prefetch\EXPLORER.EXE-A80E4F97.pf --------- 122098 
 08.09.2010 09:54    C:\Windows\Prefetch\DWM.EXE-6FFD3DA8.pf --------- 30748 
 08.09.2010 09:54    C:\Windows\Prefetch\USERINIT.EXE-2257A3E7.pf --------- 11380 
 08.09.2010 09:54    C:\Windows\Prefetch\SVCHOST.EXE-17944F30.pf --------- 13906 
 08.09.2010 09:54    C:\Windows\Prefetch\SVCHOST.EXE-63699C7D.pf --------- 16232 
 08.09.2010 09:54    C:\Windows\Prefetch\SLSVC.EXE-53F2276F.pf --------- 24740 
 08.09.2010 09:54    C:\Windows\Prefetch\DLLHOST.EXE-766398D2.pf --------- 18246 
 08.09.2010 09:46    C:\Windows\Prefetch\OTL.EXE-B464C92F.pf --------- 29710 
 08.09.2010 09:45    C:\Windows\Prefetch\REGEDIT.EXE-90FEEA06.pf --------- 16940 
 08.09.2010 09:36    C:\Windows\Prefetch\MBAM.EXE-305FF92C.pf --------- 72586 
 08.09.2010 09:27    C:\Windows\Prefetch\WUDFHOST.EXE-AFFEF87C.pf --------- 18116 
 08.09.2010 08:06    C:\Windows\Prefetch\DLLHOST.EXE-412EAFE6.pf --------- 59948 
 08.09.2010 07:36    C:\Windows\Prefetch\DISTNOTED.EXE-BFFB20F1.pf --------- 19440 
 08.09.2010 07:36    C:\Windows\Prefetch\APPLEMOBILEDEVICEHELPER.EXE-96A367D7.pf --------- 41690 
 08.09.2010 07:36    C:\Windows\Prefetch\ITUNES.EXE-2A42B776.pf --------- 181042 
 07.09.2010 22:42    C:\Windows\Prefetch\202FBH.EXE-611E728A.pf --------- 54402 
 07.09.2010 22:42    C:\Windows\Prefetch\SC.EXE-945D79AE.pf --------- 5840 
 07.09.2010 21:49    C:\Windows\Prefetch\LOGON.SCR-30601369.pf --------- 27500 
 07.09.2010 20:56    C:\Windows\Prefetch\TUPROGST.EXE-D76A9E80.pf --------- 10566 
 07.09.2010 20:56    C:\Windows\Prefetch\SVCHOST.EXE-61AE5AB6.pf --------- 22610 
 07.09.2010 20:56    C:\Windows\Prefetch\NMSACCESSU.EXE-F87870D8.pf --------- 9460 
 07.09.2010 20:03    C:\Windows\Prefetch\REGSVR32.EXE-8461DBEE.pf --------- 21542 
 07.09.2010 20:03    C:\Windows\Prefetch\MBAMGUI.EXE-4FE652ED.pf --------- 9638 
 07.09.2010 20:02    C:\Windows\Prefetch\LANGHANS.TMP-8794400B.pf --------- 17190 
 07.09.2010 20:02    C:\Windows\Prefetch\LANGHANS.EXE-E1784210.pf --------- 16734 
 07.09.2010 19:47    C:\Windows\Prefetch\TASKMGR.EXE-5F5F473D.pf --------- 38480 
 07.09.2010 19:41    C:\Windows\Prefetch\FINDSTR.EXE-2E9C6FE2.pf --------- 8098 
 07.09.2010 19:41    C:\Windows\Prefetch\SED.RKEXE-CEE26115.pf --------- 5622 
 07.09.2010 19:41    C:\Windows\Prefetch\PEV.RKEXE-5A9E9820.pf --------- 13290 
 07.09.2010 19:41    C:\Windows\Prefetch\RKILL[1].COM-94109342.pf --------- 17400 
 07.09.2010 19:41    C:\Windows\Prefetch\NIRCMDC.RKEXE-781E5061.pf --------- 11080 
 07.09.2010 19:12    C:\Windows\Prefetch\GOOGLEUPDATERSERVICE.EXE-09540BCD.pf --------- 18090 
 07.09.2010 19:11    C:\Windows\Prefetch\AgGlUAD_P_S-1-5-21-4115003710-1310814880-3572474894-1000.db --------- 1093352 
 07.09.2010 19:11    C:\Windows\Prefetch\AgGlUAD_S-1-5-21-4115003710-1310814880-3572474894-1000.db --------- 1876538 
 07.09.2010 18:40    C:\Windows\Prefetch\RUNDLL32.EXE-597B13E4.pf --------- 33512 
 07.09.2010 18:40    C:\Windows\Prefetch\RUNDLL32.EXE-ABE51709.pf --------- 58904 
 07.09.2010 18:39    C:\Windows\Prefetch\RUNDLL32.EXE-D61D9405.pf --------- 64934 
 07.09.2010 18:19    C:\Windows\Prefetch\RUNDLL32.EXE-E8AC3089.pf --------- 43898 
 07.09.2010 18:19    C:\Windows\Prefetch\CONTROL.EXE-817F8F1D.pf --------- 18866 
 07.09.2010 18:08    C:\Windows\Prefetch\MEDIAFIX70700EN02.EXE-506F9F7B.pf --------- 23262 
 07.09.2010 17:53    C:\Windows\Prefetch\NTVDM.EXE-F6564EE5.pf --------- 17130 
 07.09.2010 17:53    C:\Windows\Prefetch\MNSRWXOCEA.EXE-69A14A61.pf --------- 43442 
 07.09.2010 17:53    C:\Windows\Prefetch\XSWCOENARM.EXE-04839BA9.pf --------- 11806 
 07.09.2010 17:52    C:\Windows\Prefetch\XRMNESWCAO.EXE-E8FF2869.pf --------- 34384 
 07.09.2010 17:38    C:\Windows\Prefetch\MSHTA.EXE-A970B441.pf --------- 52498 
 07.09.2010 17:38    C:\Windows\Prefetch\JP2LAUNCHER.EXE-7C1F11C1.pf --------- 15676 
 07.09.2010 17:38    C:\Windows\Prefetch\JAVA.EXE-E27B75C2.pf --------- 143410 
 07.09.2010 14:14    C:\Windows\Prefetch\ADOBEARM.EXE-719325FF.pf --------- 24376 
 07.09.2010 14:13    C:\Windows\Prefetch\ACROBAT.EXE-B894D3AF.pf --------- 182426 
 07.09.2010 14:08    C:\Windows\Prefetch\PHOTOSHOP.EXE-B0641B9D.pf --------- 207758 
 07.09.2010 13:54    C:\Windows\Prefetch\INDESIGN.EXE-4811996F.pf --------- 297972 
 07.09.2010 13:51    C:\Windows\Prefetch\BRIDGE.EXE-B3232697.pf --------- 185092 
 07.09.2010 13:47    C:\Windows\Prefetch\ADOBEUPDATER.EXE-9A17D89B.pf --------- 37494 
 07.09.2010 13:30    C:\Windows\Prefetch\ACROBATINFO.EXE-8D0EA9C3.pf --------- 90860 
 07.09.2010 13:29    C:\Windows\Prefetch\OSE.EXE-533D8AC9.pf --------- 6146 
 07.09.2010 13:29    C:\Windows\Prefetch\MSIEXEC.EXE-A2D55CB6.pf --------- 50986 
 07.09.2010 12:14    C:\Windows\Prefetch\MPCMDRUN.EXE-F401FBB4.pf --------- 970 
 07.09.2010 07:51    C:\Windows\Prefetch\WUAUCLT.EXE-70318591.pf --------- 28248 
 07.09.2010 07:51    C:\Windows\Prefetch\MPAS-D_BD1.EXE-97E29C40.pf --------- 28444 
 07.09.2010 07:51    C:\Windows\Prefetch\MPMINISIGSTUB.EXE-46CCE307.pf --------- 6236 
 07.09.2010 07:51    C:\Windows\Prefetch\MPSIGSTUB.EXE-6CB27A06.pf --------- 74738 
 06.09.2010 20:23    C:\Windows\Prefetch\AgCx_SC2.db --------- 969068 
 06.09.2010 10:48    C:\Windows\Prefetch\DLLHOST.EXE-7ED62AA2.pf --------- 16462 
 06.09.2010 10:48    C:\Windows\Prefetch\SOFTWAREUPDATE.EXE-631B74E4.pf --------- 23404 
 06.09.2010 07:29    C:\Windows\Prefetch\WERCON.EXE-E36BD04E.pf --------- 23664 
 03.09.2010 12:56    C:\Windows\Prefetch\AgCx_SC1.db --------- 797121 
 03.09.2010 12:55    C:\Windows\Prefetch\AgCx_SC1.db.trx --------- 226440 
 03.09.2010 08:01    C:\Windows\Prefetch\MPMINISIGSTUB.EXE-3CA36934.pf --------- 6962 
 02.09.2010 17:53    C:\Windows\Prefetch\EKRN.EXE-510E8303.pf --------- 97590 
 02.09.2010 17:53    C:\Windows\Prefetch\WERMGR.EXE-0F2AC88C.pf --------- 19638 
 31.08.2010 10:11    C:\Windows\Prefetch\MPMINISIGSTUB.EXE-E54DE4D0.pf --------- 6106 
 29.08.2010 12:29    C:\Windows\Prefetch\SPSSENGINE.EXE-84E6D573.pf --------- 130002 
 29.08.2010 12:29    C:\Windows\Prefetch\STATISTICS.EXE-FC75D9CF.pf --------- 187738 
 28.08.2010 19:17    C:\Windows\Prefetch\MPMINISIGSTUB.EXE-81930EF0.pf --------- 6340 
 27.08.2010 09:59    C:\Windows\Prefetch\EXCEL.EXE-804D5D87.pf --------- 79522 
 26.08.2010 21:44    C:\Windows\Prefetch\SNDVOL.EXE-5D4CC7D6.pf --------- 21558 
 24.08.2010 15:45    C:\Windows\Prefetch\DFRGNTFS.EXE-7E4077FE.pf --------- 85630 
 24.08.2010 15:45    C:\Windows\Prefetch\DEFRAG.EXE-588F90AD.pf --------- 13154 
 24.08.2010 15:45    C:\Windows\Prefetch\Layout.ini --------- 1255032 
 24.08.2010 10:24    C:\Windows\Prefetch\MPAS-FE_BD.EXE-BB62FD5E.pf --------- 40998 
 24.08.2010 10:24    C:\Windows\Prefetch\MPSIGSTUB.EXE-74D24E24.pf --------- 164048 
 29.07.2009 11:45    C:\Windows\Prefetch\AgAppLaunch.db --------- 332116 
----------------------------------------

 
C:\Windows\Tasks

 08.09.2010 18:23    C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job --------- 1096 
 08.09.2010 18:23    C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job --------- 1092 
 08.09.2010 18:06    C:\Windows\Tasks\User_Feed_Synchronization-{2B6B8F49-631F-48A1-8032-E5B3E00E4760}.job --------- 426 
 08.09.2010 18:04    C:\Windows\Tasks\SA.DAT --------- 6 
 08.09.2010 14:06    C:\Windows\Tasks\SCHEDLGU.TXT --------- 32630 
----------------------------------------

 
C:\Windows\Temp

 08.09.2010 18:21    C:\Windows\Temp\coinlog.log --------- 302 
 08.09.2010 18:09    C:\Windows\Temp\dneinst.log --------- 364945 
 08.09.2010 10:52    C:\Windows\Temp\HTT56F6.tmp --------- 157923 
----------------------------------------

 
C:\Users\CHOPPER\AppData\Local\Temp

 08.09.2010 18:20    C:\Users\CHOPPER\AppData\Local\Temp\CHOPPER.bmp --------- 31832 
 08.09.2010 18:19    C:\Users\CHOPPER\AppData\Local\Temp\~DF1FE.tmp --------- 73728 
 08.09.2010 18:17    C:\Users\CHOPPER\AppData\Local\Temp\~DF95B8.tmp --------- 69632 
 08.09.2010 18:14    C:\Users\CHOPPER\AppData\Local\Temp\~DFFD40.tmp --------- 16384 
 08.09.2010 18:07    C:\Users\CHOPPER\AppData\Local\Temp\~DF9E2E.tmp --------- 512 
 08.09.2010 18:07    C:\Users\CHOPPER\AppData\Local\Temp\~DF6689.tmp --------- 16384 
 08.09.2010 18:07    C:\Users\CHOPPER\AppData\Local\Temp\~DF6690.tmp --------- 512 
 08.09.2010 18:07    C:\Users\CHOPPER\AppData\Local\Temp\~DFEC79.tmp --------- 512 
 08.09.2010 18:07    C:\Users\CHOPPER\AppData\Local\Temp\~DFEC6C.tmp --------- 32768 
 08.09.2010 18:07    C:\Users\CHOPPER\AppData\Local\Temp\~DFE2F0.tmp --------- 16384 
 08.09.2010 18:07    C:\Users\CHOPPER\AppData\Local\Temp\~DFE34B.tmp --------- 512 
 08.09.2010 18:07    C:\Users\CHOPPER\AppData\Local\Temp\~DFE1E7.tmp --------- 512 
 08.09.2010 18:07    C:\Users\CHOPPER\AppData\Local\Temp\~DFE0FF.tmp --------- 49152 
 08.09.2010 18:07    C:\Users\CHOPPER\AppData\Local\Temp\~DFF55F.tmp --------- 16384 
 08.09.2010 18:07    C:\Users\CHOPPER\AppData\Local\Temp\~DFE47F.tmp --------- 16384 
 08.09.2010 18:05    C:\Users\CHOPPER\AppData\Local\Temp\Acrobat Distiller 8 --------- 0 
 08.09.2010 18:05    C:\Users\CHOPPER\AppData\Local\Temp\AdobeARM.log --------- 6390 
 08.09.2010 18:05    C:\Users\CHOPPER\AppData\Local\Temp\WPDNSE --------- 0 
 08.09.2010 18:05    C:\Users\CHOPPER\AppData\Local\Temp\libFNP_events.log --------- 1620 
 08.09.2010 18:04    C:\Users\CHOPPER\AppData\Local\Temp\div7A2E.tmp --------- 0 
 08.09.2010 13:50    C:\Users\CHOPPER\AppData\Local\Temp\divB154.tmp --------- 0 
 08.09.2010 12:38    C:\Users\CHOPPER\AppData\Local\Temp\Word8.0 --------- 0 
 08.09.2010 12:34    C:\Users\CHOPPER\AppData\Local\Temp\wmplog03.sqm --------- 2194 
 08.09.2010 09:55    C:\Users\CHOPPER\AppData\Local\Temp\~DFCBDA.tmp --------- 32768 
 08.09.2010 09:53    C:\Users\CHOPPER\AppData\Local\Temp\div61ED.tmp --------- 0 
 08.09.2010 09:53    C:\Users\CHOPPER\AppData\Local\Temp\wmplog02.sqm --------- 2458 
 08.09.2010 09:35    C:\Users\CHOPPER\AppData\Local\Temp\~DFEBA8.tmp --------- 65536 
 08.09.2010 09:29    C:\Users\CHOPPER\AppData\Local\Temp\~DF5510.tmp --------- 32768 
 08.09.2010 09:26    C:\Users\CHOPPER\AppData\Local\Temp\div77AE.tmp --------- 0 
 08.09.2010 07:36    C:\Users\CHOPPER\AppData\Local\Temp\~DF22EE.tmp --------- 16384 
 08.09.2010 07:36    C:\Users\CHOPPER\AppData\Local\Temp\000A27002064F8D3 --------- 0 
 08.09.2010 07:34    C:\Users\CHOPPER\AppData\Local\Temp\wmplog01.sqm --------- 2250 
 08.09.2010 07:34    C:\Users\CHOPPER\AppData\Local\Temp\divCE17.tmp --------- 0 
 07.09.2010 22:54    C:\Users\CHOPPER\AppData\Local\Temp\VBE --------- 0 
 07.09.2010 22:51    C:\Users\CHOPPER\AppData\Local\Temp\Low --------- 0 
 07.09.2010 22:50    C:\Users\CHOPPER\AppData\Local\Temp\wmplog00.sqm --------- 2250 
 07.09.2010 22:49    C:\Users\CHOPPER\AppData\Local\Temp\divB70E.tmp --------- 0 
----------------------------------------

 
C:\Program Files

 08.09.2010 18:09    C:\Program Files\trend micro --------- 0 
 07.09.2010 20:03    C:\Program Files\Malwarebytes' Anti-Malware --------- 4096 
 11.08.2010 10:15    C:\Program Files\Internet Explorer --------- 4096 
 11.08.2010 10:15    C:\Program Files\Movie Maker --------- 4096 
 11.08.2010 10:08    C:\Program Files\Windows Mail --------- 4096 
 02.08.2010 10:50    C:\Program Files\Common Files --------- 4096 
 02.08.2010 10:50    C:\Program Files\Nokia --------- 0 
 02.08.2010 10:25    C:\Program Files\DIFX --------- 0 
 02.08.2010 10:24    C:\Program Files\PC Connectivity Solution --------- 12288 
 27.07.2010 15:29    C:\Program Files\iTunes --------- 4096 
 27.07.2010 15:28    C:\Program Files\iPod --------- 0 
 27.07.2010 15:15    C:\Program Files\Safari --------- 4096 
 12.07.2010 11:25    C:\Program Files\DivX --------- 8192 
 11.07.2010 09:37    C:\Program Files\Bonjour --------- 4096 
 30.06.2010 22:12    C:\Program Files\Mozilla Firefox --------- 24576 
 26.06.2010 11:07    C:\Program Files\Microsoft.NET --------- 0 
 27.05.2010 20:55    C:\Program Files\Norton Security Scan --------- 0 
 13.05.2010 16:35    C:\Program Files\QuickTime --------- 4096 
 13.05.2010 16:34    C:\Program Files\Apple Software Update --------- 4096 
 10.05.2010 18:13    C:\Program Files\3DataManager --------- 16384 
 10.05.2010 18:13    C:\Program Files\3-addons --------- 0 
 31.03.2010 12:56    C:\Program Files\CDBurnerXP --------- 12288 
 07.02.2010 20:31    C:\Program Files\DAEMON Tools Toolbar --------- 4096 
 07.02.2010 20:31    C:\Program Files\DAEMON Tools Lite --------- 4096 
 30.01.2010 17:39    C:\Program Files\Google --------- 4096 
 19.01.2010 16:20    C:\Program Files\eBay --------- 0 
 17.11.2009 11:54    C:\Program Files\Windows Portable Devices --------- 0 
 31.10.2009 11:07    C:\Program Files\Windows Media Player --------- 4096 
 23.10.2009 20:01    C:\Program Files\Adobe --------- 4096 
 09.10.2009 14:04    C:\Program Files\WinRAR --------- 4096 
 18.09.2009 17:51    C:\Program Files\InstallShield Installation Information --------- 8192 
 18.09.2009 17:51    C:\Program Files\Systhema --------- 0 
 04.09.2009 15:52    C:\Program Files\Cisco Systems --------- 0 
 31.07.2009 01:33    C:\Program Files\VideoLAN --------- 0 
 29.07.2009 19:10    C:\Program Files\Lavalys --------- 0 
 29.07.2009 19:06    C:\Program Files\Skype --------- 0 
 29.07.2009 18:51    C:\Program Files\Brownie --------- 0 
 29.07.2009 18:49    C:\Program Files\Brother --------- 0 
 29.07.2009 17:10    C:\Program Files\ESET --------- 0 
 29.07.2009 16:53    C:\Program Files\SPSSInc --------- 0 
 29.07.2009 16:00    C:\Program Files\TuneUp Utilities 2009 --------- 49152 
 29.07.2009 15:55    C:\Program Files\Microsoft Office --------- 4096 
 29.07.2009 15:40    C:\Program Files\Windows Calendar --------- 0 
 29.07.2009 15:40    C:\Program Files\Windows Sidebar --------- 4096 
 29.07.2009 15:40    C:\Program Files\Windows Collaboration --------- 4096 
 29.07.2009 15:40    C:\Program Files\Windows Photo Gallery --------- 4096 
 29.07.2009 15:40    C:\Program Files\Windows Defender --------- 4096 
 29.07.2009 15:22    C:\Program Files\TOSHIBA --------- 4096 
 29.07.2009 14:52    C:\Program Files\Microsoft Works --------- 0 
 29.07.2009 14:44    C:\Program Files\Java --------- 0 
 29.07.2009 13:22    C:\Program Files\Jumpstart --------- 4096 
 29.07.2009 13:12    C:\Program Files\Windows NT --------- 4096 
 29.07.2009 13:12    C:\Program Files\Gemeinsame Dateien --------- 0 
 29.07.2009 11:54    C:\Program Files\Atheros --------- 0 
 29.07.2009 11:53    C:\Program Files\Cisco --------- 0 
 29.07.2009 11:52    C:\Program Files\NetWaiting --------- 8192 
 29.07.2009 11:51    C:\Program Files\CONEXANT --------- 0 
 29.07.2009 11:47    C:\Program Files\Realtek --------- 0 
 29.07.2009 11:46    C:\Program Files\Intel --------- 0 
 13.08.2008 13:59    C:\Program Files\Windows Media Components --------- 0 
 13.08.2008 13:55    C:\Program Files\Ulead Systems --------- 0 
 13.08.2008 13:40    C:\Program Files\Synaptics --------- 0 
 13.08.2008 13:01    C:\Program Files\MSXML 4.0 --------- 0 
 21.01.2008 04:57    C:\Program Files\desktop.ini --------- 174 
 02.11.2006 14:58    C:\Program Files\Uninstall Information --------- 0 
 02.11.2006 14:35    C:\Program Files\Microsoft Games --------- 4096 
 02.11.2006 14:35    C:\Program Files\Reference Assemblies --------- 0 
 02.11.2006 14:35    C:\Program Files\MSBuild --------- 0 
----------------------------------------

 
C:\ProgramData\..

CHOPPER   
Public   
Default   
desktop.ini   
Default User   
All Users   
----------------------------------------

 
C:\Windows\system32\drivers\etc\hosts

127.0.0.1      localhost
::1      localhost

----------------------------------------

 

Abbildname                    PID Sitzungsname      Sitz.-Nr. Speichernutzung
========================= ======== ================ =========== ===============
System Idle Process              0 Services                  0            24 K
System                          4 Services                  0        13.020 K
smss.exe                      488 Services                  0          612 K
csrss.exe                      560 Services                  0        5.208 K
wininit.exe                    604 Services                  0        3.648 K
csrss.exe                      616 Console                    1        8.880 K
services.exe                  648 Services                  0        6.180 K
lsass.exe                      660 Services                  0        2.624 K
lsm.exe                        668 Services                  0        3.180 K
winlogon.exe                  752 Console                    1        4.548 K
svchost.exe                    864 Services                  0        5.988 K
svchost.exe                    924 Services                  0        6.064 K
svchost.exe                    976 Services                  0        23.080 K
svchost.exe                  1084 Services                  0        10.648 K
svchost.exe                  1136 Services                  0        75.416 K
svchost.exe                  1164 Services                  0        96.628 K
audiodg.exe                  1256 Services                  0        17.392 K
svchost.exe                  1276 Services                  0        3.828 K
SLsvc.exe                    1292 Services                  0        9.336 K
svchost.exe                  1320 Services                  0        12.096 K
svchost.exe                  1468 Services                  0        12.496 K
spoolsv.exe                  1744 Services                  0        8.036 K
taskeng.exe                  1772 Services                  0        5.472 K
dwm.exe                      1784 Console                    1        31.016 K
wlanext.exe                  1812 Services                  0        4.588 K
explorer.exe                  1824 Console                    1        49.336 K
svchost.exe                  1880 Services                  0        10.604 K
taskeng.exe                  1976 Console                    1        8.512 K
AppleMobileDeviceService.      548 Services                  0        3.144 K
igfxtray.exe                  664 Console                    1        3.872 K
mDNSResponder.exe            1100 Services                  0        4.560 K
igfxpers.exe                  1172 Console                    1        3.980 K
RtHDVCpl.exe                  1436 Console                    1        5.816 K
CISVC.EXE                    1480 Services                  0          212 K
egui.exe                      1588 Console                    1        6.876 K
acrotray.exe                  848 Console                    1        6.136 K
cvpnd.exe                    1952 Services                  0        5.708 K
DivXUpdate.exe                296 Console                    1        7.916 K
ekrn.exe                      1004 Services                  0        33.768 K
iTunesHelper.exe              1680 Console                    1        8.612 K
sidebar.exe                  1908 Console                    1        8.320 K
TOSCDSPD.exe                  2088 Console                    1        3.084 K
GoogleToolbarNotifier.exe    2100 Console                    1          572 K
DTLite.exe                    2124 Console                    1        4.908 K
wmpnscfg.exe                  2136 Console                    1        4.304 K
PresentationFontCache.exe    2228 Services                  0        6.592 K
igfxsrvc.exe                  2236 Console                    1        3.884 K
NMSAccessU.exe                2340 Services                  0        2.332 K
svchost.exe                  2372 Services                  0        5.284 K
TUProgSt.exe                  2420 Services                  0        3.680 K
svchost.exe                  2456 Services                  0        1.800 K
SearchIndexer.exe            2484 Services                  0        15.008 K
WTGService.exe                2644 Services                  0        5.028 K
XAudio.exe                    2720 Services                  0        2.120 K
WUDFHost.exe                  3196 Services                  0        4.076 K
FNPLicensingService.exe      3448 Services                  0        2.760 K
wmpnetwk.exe                  3492 Services                  0        18.520 K
mobsync.exe                  3748 Console                    1        5.648 K
iPodService.exe              2200 Services                  0        4.372 K
3DataManager.exe              3700 Console                    1        23.848 K
bmctl.exe                      168 Console                    1        6.252 K
iexplore.exe                  3440 Console                    1        25.536 K
iexplore.exe                  3664 Console                    1        65.084 K
OUTLOOK.EXE                  3484 Console                    1        53.904 K
MobileMeServices.exe          3416 Console                    1        8.648 K
WINWORD.EXE                  4140 Console                    1        23.928 K
iexplore.exe                  5940 Console                    1        55.344 K
Skype.exe                    2276 Console                    1        65.848 K
skypePM.exe                  4252 Console                    1        24.676 K
iexplore.exe                  4620 Console                    1        52.136 K
cmd.exe                      4988 Console                    1        2.840 K
dllhost.exe                  1316 Console                    1        4.196 K
SearchProtocolHost.exe        4432 Services                  0        5.368 K
SearchFilterHost.exe          5420 Services                  0        4.428 K
tasklist.exe                  3000 Console                    1        4.644 K
WmiPrvSE.exe                  5996 Services                  0        5.764 K

 
***** Ende des Scans 08.09.2010 um 18:30:09,52 ***

kira 09.09.2010 13:01
1.
Punkt 4. - bitte noch nachreichen:-> http://www.trojaner-board.de/90528-a...tml#post565626

2.
Schliesse alle Programme einschliesslich Internet Explorer und fixe mit Hijackthis die Einträge aus der nachfolgenden Codebox (HijackThis starten→ "Do a system scan only"→ Einträge auswählen→ Häckhen setzen→ "Fix checked" klicken→ PC neu aufstarten):
HijackThis erstellt ein Backup, Falls bei "Fixen" etwas schief geht, kann man unter "View the list of backups"- die Objekte wiederherstellen
Code:
O4 - HKCU\..\Run: [mediafix70700en02.exe] C:\Users\CHOPPER\AppData\Roaming\7AAE33C15546045B4D5D2294BA51076D\mediafix70700e n02.exe
O4 - HKLM\..\Policies\Explorer\Run: [a5x3tq] C:\Users\CHOPPER\AppData\Local\Temp\202fbh.exe
3.
poste erneut - nach der vorgenommenen Reinigungsaktion:
► TrendMicro™ HijackThis™ -Logfile - Keine offenen Fenster, solang bis HijackThis läuft!!


Alle Zeitangaben in WEZ +1. Es ist jetzt 06:48 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131