Trojaner-Board - iceyochtffau.exe oder was ist das

Hallo,
ich habe mir wohl irgend etwas eingefangen das heist mein pc.

hab vieles hier aus den foren versucht hab so den eindruck als würde das ding sich ständig ändern
ich benutze firefox und trotz dem kommt rein sporaadisch immer mal wieder eine meldung über skript probleme von ie angefangen hat das mit schwarzem bildschirm und versteckten dateien dies konnte ich laut anleitung von hier beheben.
hoffe ihr könnt mir helfen

hier mal was otl sagt

OTL logfile created on: 26.04.2011 09:11:15 - Run 3
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Dokumente und Einstellungen\u********\Eigene Dateien\Download
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

511,00 Mb Total Physical Memory | 50,00 Mb Available Physical Memory | 10,00% Memory free
1,00 Gb Paging File | 1,00 Gb Available in Paging File | 48,00% Paging File free
Paging file location(s): C:\pagefile.sys 1000 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 74,52 Gb Total Space | 44,95 Gb Free Space | 60,32% Space Free | Partition Type: NTFS

Computer Name: LABTOP-u******** | User Name: u******** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011.04.26 08:19:06 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\u********\Eigene Dateien\Download\OTL.exe
PRC - [2011.04.25 17:31:20 | 000,496,128 | ---- | M] (Crawler.com) -- C:\Programme\Spyware Terminator\sp_rsser.exe
PRC - [2011.04.23 17:37:19 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe
PRC - [2011.04.08 05:05:30 | 002,536,696 | ---- | M] (Crawler.com) -- C:\Programme\Crawler\Toolbar\CToolbar.exe
PRC - [2010.02.16 23:53:18 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Java\jre6\bin\java.exe
PRC - [2010.01.11 16:21:52 | 000,246,504 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
PRC - [2009.11.10 10:28:08 | 000,112,592 | ---- | M] (Threat Expert Ltd.) -- C:\Programme\Spyware Doctor\BDT\BDTUpdateService.exe
PRC - [2009.08.06 09:00:24 | 000,185,089 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2009.07.20 11:51:52 | 000,935,208 | ---- | M] (Nero AG) -- C:\Programme\Gemeinsame Dateien\Nero\Nero BackItUp 4\NBService.exe
PRC - [2009.06.22 16:21:58 | 000,304,592 | ---- | M] () -- C:\Programme\XSManager\WTGService.exe
PRC - [2009.06.17 12:28:46 | 000,157,968 | R--- | M] (4G Systems GmbH & Co. KG) -- C:\WINDOWS\starter4g.exe
PRC - [2009.06.17 12:28:08 | 000,125,200 | R--- | M] (4G Systems GmbH & Co. KG) -- C:\WINDOWS\service4g.exe
PRC - [2009.06.11 12:44:39 | 000,108,289 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2005.12.28 13:00:56 | 000,569,413 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Wireless\Bin\EOUWiz.exe
PRC - [2005.12.28 12:56:16 | 000,602,182 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Wireless\Bin\iFrmewrk.exe
PRC - [2005.12.28 12:55:40 | 000,667,718 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Wireless\Bin\ZCfgSvc.exe
PRC - [2005.12.28 12:52:32 | 000,397,381 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Wireless\Bin\Dot1XCfg.exe
PRC - [2004.08.04 00:57:54 | 001,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2004.01.19 11:07:54 | 000,065,536 | R--- | M] () -- C:\WINDOWS\ATK0100\Hcontrol.exe
PRC - [2004.01.19 11:07:52 | 001,253,376 | R--- | M] () -- C:\WINDOWS\ATK0100\ATKOSD.exe
PRC - [1998.12.16 23:09:20 | 000,057,393 | R--- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Office\Office\OUTLOOK.EXE

========== Modules (SafeList) ==========

MOD - [2011.04.26 08:19:06 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\u********\Eigene Dateien\Download\OTL.exe
MOD - [2004.08.04 00:54:28 | 001,050,624 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll

========== Win32 Services (SafeList) ==========

SRV - [2011.04.25 17:31:20 | 000,496,128 | ---- | M] (Crawler.com) [Auto | Running] -- C:\Programme\Spyware Terminator\sp_rsser.exe -- (sp_rssrv)
SRV - [2010.01.18 14:14:24 | 001,141,712 | ---- | M] (PC Tools) [On_Demand | Stopped] -- C:\Programme\Spyware Doctor\pctsSvc.exe -- (sdCoreService)
SRV - [2009.12.09 15:23:34 | 000,365,280 | ---- | M] (PC Tools) [On_Demand | Stopped] -- C:\Programme\Spyware Doctor\pctsAuxs.exe -- (sdAuxService)
SRV - [2009.11.10 10:28:08 | 000,112,592 | ---- | M] (Threat Expert Ltd.) [Auto | Running] -- C:\Programme\Spyware Doctor\BDT\BDTUpdateService.exe -- (Browser Defender Update Service)
SRV - [2009.08.06 09:00:24 | 000,185,089 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2009.07.20 11:51:52 | 000,935,208 | ---- | M] (Nero AG) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0)
SRV - [2009.06.22 16:21:58 | 000,304,592 | ---- | M] () [Auto | Running] -- C:\Programme\XSManager\WTGService.exe -- (WTGService)
SRV - [2009.06.17 12:28:08 | 000,125,200 | R--- | M] (4G Systems GmbH & Co. KG) [Auto | Running] -- C:\WINDOWS\service4g.exe -- (XS Stick Service)
SRV - [2009.06.11 12:44:39 | 000,108,289 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2008.10.15 18:13:58 | 000,439,632 | ---- | M] (RealVNC Ltd.) [Disabled | Stopped] -- C:\Programme\RealVNC\VNC4\WinVNC4.exe -- (WinVNC4)

========== Driver Services (SafeList) ==========

DRV - [2011.04.25 17:31:20 | 000,142,592 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\sp_rsdrv2.sys -- (sp_rsdrv2)
DRV - [2010.09.15 22:33:04 | 000,027,632 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\seehcri.sys -- (seehcri)
DRV - [2010.09.13 23:05:13 | 000,002,103 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\system32\KeybdIO.sys -- (KeybdIO)
DRV - [2009.09.23 16:10:06 | 000,207,280 | ---- | M] (PC Tools) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\PCTCore.sys -- (PCTCore)
DRV - [2009.06.11 12:44:39 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.04.28 08:05:28 | 000,096,104 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2009.04.06 10:13:52 | 000,025,512 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ggsemc.sys -- (ggsemc)
DRV - [2009.04.06 10:13:52 | 000,013,224 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ggflt.sys -- (ggflt)
DRV - [2009.02.13 12:29:07 | 000,022,360 | ---- | M] (Avira GmbH) [File_System | Boot | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\avgntmgr.sys -- (avgntmgr)
DRV - [2009.02.13 12:17:49 | 000,045,416 | ---- | M] (Avira GmbH) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\avgntdd.sys -- (avgntdd)
DRV - [2008.11.19 20:22:36 | 000,025,216 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\tap0901.sys -- (tap0901)
DRV - [2008.10.31 17:19:38 | 000,103,424 | ---- | M] (Mobile Connector) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\cmnsusbser.sys -- (cmnsusbser)
DRV - [2008.05.16 12:33:14 | 000,115,752 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s0016unic.sys -- (s0016unic) Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM)
DRV - [2008.05.16 12:33:14 | 000,025,512 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s0016nd5.sys -- (s0016nd5) Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS)
DRV - [2008.05.16 12:33:14 | 000,015,016 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s0016mdfl.sys -- (s0016mdfl)
DRV - [2008.05.16 12:33:12 | 000,120,744 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s0016mdm.sys -- (s0016mdm)
DRV - [2008.05.16 12:33:12 | 000,114,216 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s0016mgmt.sys -- (s0016mgmt) Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM)
DRV - [2008.05.16 12:33:12 | 000,110,632 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s0016obex.sys -- (s0016obex)
DRV - [2008.05.16 12:33:12 | 000,089,256 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s0016bus.sys -- (s0016bus) Sony Ericsson Device 0016 driver (WDM)
DRV - [2005.12.28 14:22:08 | 000,013,568 | ---- | M] (Intel Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\s24trans.sys -- (s24trans)
DRV - [2005.09.12 10:49:44 | 003,298,432 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\w29n51.sys -- (w29n51) Intel(R)
DRV - [2005.07.25 10:04:08 | 000,048,640 | ---- | M] (Prolific Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ser2pl.sys -- (Ser2pl)
DRV - [2005.03.01 11:46:56 | 000,053,632 | ---- | M] (Siemens AG) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Gigusb.sys -- (Gigusb)
DRV - [2005.03.01 11:36:02 | 000,008,448 | ---- | M] (Siemens AG) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\DectEnum.sys -- (DectEnum)
DRV - [2005.03.01 11:33:18 | 000,113,408 | ---- | M] (Siemens AG) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\siellif.sys -- (siellif)
DRV - [2004.09.08 16:22:04 | 000,050,759 | ---- | M] (SIEMENS AG) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\IUAPIWDM.sys -- (IUAPIWDM) ISDN USB Interface (Ver. 1.20.0032)
DRV - [2004.09.08 16:22:02 | 000,263,751 | ---- | M] (SIEMENS AG) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\hrcmpa.sys -- (HRCMPA) ISDN Wan driver (Ver. 1.20.0032)
DRV - [2004.08.03 23:04:34 | 000,012,672 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usb8023.sys -- (USB_RNDIS)
DRV - [2004.04.01 21:43:08 | 000,669,696 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2004.03.24 20:44:44 | 001,657,344 | R--- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\w22n51.sys -- (w22n51) Intel(R)
DRV - [2004.03.24 04:12:34 | 000,017,280 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\nsndis5.sys -- (NSNDIS5)
DRV - [2004.02.19 01:23:26 | 000,242,640 | R--- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\stac97.sys -- (STAC97) Audio Driver (WDM)
DRV - [2004.01.19 11:07:52 | 000,005,786 | R--- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ATKACPI.sys -- (MTsensor)
DRV - [2003.11.19 02:36:48 | 000,197,504 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWICH.sys -- (HSFHWICH)
DRV - [2003.11.19 02:36:46 | 001,043,072 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DP.sys -- (HSF_DP)
DRV - [2003.11.19 02:36:46 | 000,678,400 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2003.10.24 09:16:26 | 000,112,896 | R--- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\b57xp32.sys -- (b57w2k)
DRV - [2003.10.20 20:09:26 | 000,065,664 | ---- | M] (REDC) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\rmedia.sys -- (rmedia)
DRV - [2002.11.21 19:34:37 | 000,073,728 | ---- | M] (Rainbow Technologies, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\System32\Drivers\SENTINEL.SYS -- (Sentinel)
DRV - [2002.11.20 09:52:14 | 000,033,664 | R--- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\gv3.sys -- (gv3)
DRV - [2002.07.15 12:43:06 | 000,073,660 | ---- | M] (elmeg Kommunikationstechnik) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ElgTaDrv.sys -- (ElgTaDrv)
DRV - [2001.08.30 15:38:26 | 000,195,060 | ---- | M] (Jungo) [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\WINDRVR.SYS -- (WinDriver)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = hxxp://dnl.crawler.com/support/sa_customize.aspx?TbId=60347
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.crawler.com/search/ie.aspx?tb_id=60347

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.crawler.com/homepage.aspx?tbid=60347
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKCU\..\URLSearchHook: {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\Programme\Crawler\Toolbar\ctbr.dll (Crawler.com)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Crawler Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="
FF - prefs.js..browser.search.order.1: "Crawler Search"
FF - prefs.js..browser.search.selectedEngine: ""
FF - prefs.js..browser.startup.homepage: "hxxp://www.crawler.com/homepage.aspx?tbid=60347"
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: firebug@software.joehewitt.com:1.5.4
FF - prefs.js..keyword.URL: "hxxp://www.crawler.com/search/dispatcher.aspx?tp=aus&tbid=60347&qkw="

FF - HKLM\software\mozilla\Firefox\extensions\\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}: C:\Programme\Crawler\Toolbar\firefox\ [2011.04.25 17:32:31 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011.04.23 17:37:43 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011.04.23 17:37:43 | 000,000,000 | ---D | M]

[2010.04.05 11:11:09 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\u********\Anwendungsdaten\Mozilla\Extensions
[2010.04.05 11:11:09 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\u********\Anwendungsdaten\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2011.04.25 08:44:15 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\u********\Anwendungsdaten\Mozilla\Firefox\Profiles\qxrizb4b.default\extensions
[2010.12.11 16:41:22 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Dokumente und Einstellungen\u********\Anwendungsdaten\Mozilla\Firefox\Profiles\qxrizb4b.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2011.04.23 16:55:28 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
File not found (No name found) --
() (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\u********\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\QXRIZB4B.DEFAULT\EXTENSIONS\FIREBUG@SOFTWARE.JOEHEWITT.COM.XPI
[2011.04.25 17:32:31 | 000,000,000 | ---D | M] (Crawler Toolbar) -- C:\PROGRAMME\CRAWLER\TOOLBAR\FIREFOX
[2010.02.16 23:53:20 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAMME\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011.04.23 17:37:18 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Programme\Mozilla Firefox\components\browsercomps.dll
[2011.04.23 17:37:25 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2011.04.23 17:37:25 | 000,002,252 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\bing.xml
[2009.09.21 12:24:16 | 000,001,329 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\crawlersrch.xml
[2011.04.23 17:37:25 | 000,001,153 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2011.04.23 17:37:26 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2011.04.23 17:37:26 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2011.04.23 17:37:26 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml

O1 HOSTS File: ([2010.12.12 15:38:09 | 000,000,854 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 193.7.168.25 www.cangregori.de
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (&Crawler Toolbar Helper) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\Programme\Crawler\Toolbar\ctbr.dll (Crawler.com)
O2 - BHO: (PC Tools Browser Guard BHO) - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Programme\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.6.6209.1142\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Programme\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O3 - HKLM\..\Toolbar: (&Crawler Toolbar) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\Programme\Crawler\Toolbar\ctbr.dll (Crawler.com)
O4 - HKLM..\Run: [ATIModeChange] C:\WINDOWS\System32\Ati2mdxx.exe (ATI Technologies, Inc.)
O4 - HKLM..\Run: [EOUApp] C:\Programme\Intel\Wireless\Bin\EOUWiz.exe (Intel Corporation)
O4 - HKLM..\Run: [Hcontrol] C:\WINDOWS\ATK0100\Hcontrol.exe ()
O4 - HKLM..\Run: [IntelWireless] C:\Programme\Intel\Wireless\Bin\ifrmewrk.exe (Intel Corporation)
O4 - HKLM..\Run: [IntelZeroConfig] C:\Programme\Intel\Wireless\bin\ZCfgSvc.exe (Intel Corporation)
O4 - HKLM..\Run: [SpywareTerminator] C:\Programme\Spyware Terminator\SpywareTerminatorShield.exe (Crawler.com)
O4 - HKLM..\Run: [starter4g] C:\WINDOWS\starter4g.exe (4G Systems GmbH & Co. KG)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
O4 - HKCU..\Run: [SpywareTerminatorUpdate] C:\Programme\Spyware Terminator\SpywareTerminatorUpdate.exe (Crawler.com)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Google Sidewiki... - C:\Programme\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll (Google Inc.)
O9 - Extra Button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Programme\PokerStars.NET\PokerStarsUpdate.exe (PokerStars)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Programme\Gemeinsame Dateien\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Programme\Gemeinsame Dateien\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Programme\Gemeinsame Dateien\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000028 - C:\Programme\Gemeinsame Dateien\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O15 - HKCU\..Trusted Domains: ([]msn in Arbeitsplatz)
O16 - DPF: {8970206C-9776-44A3-AF8D-82DD7D46A2E6} hxxp://192.168.195.30/XViewer.cab (XViewer Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 82.212.62.62 78.42.43.62
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\tbr {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\Programme\Crawler\Toolbar\ctbr.dll (Crawler.com)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\u********\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\u********\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008.11.12 12:18:13 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{119cfa00-fddc-11de-981a-000e3585cab9}\Shell - "" = AutoRun
O33 - MountPoints2\{119cfa00-fddc-11de-981a-000e3585cab9}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{119cfa00-fddc-11de-981a-000e3585cab9}\Shell\AutoRun\command - "" = E:\autorun.exe
O33 - MountPoints2\{53c1e400-d8d5-11de-97b2-000e3585cab9}\Shell - "" = AutoRun
O33 - MountPoints2\{53c1e400-d8d5-11de-97b2-000e3585cab9}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{53c1e400-d8d5-11de-97b2-000e3585cab9}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{53c1e403-d8d5-11de-97b2-000e3585cab9}\Shell - "" = AutoRun
O33 - MountPoints2\{53c1e403-d8d5-11de-97b2-000e3585cab9}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{53c1e403-d8d5-11de-97b2-000e3585cab9}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{7a061510-9c8f-11de-9719-000e3585cab9}\Shell - "" = AutoRun
O33 - MountPoints2\{7a061510-9c8f-11de-9719-000e3585cab9}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{7a061510-9c8f-11de-9719-000e3585cab9}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011.04.25 17:31:59 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Crawler Toolbar
[2011.04.25 17:31:32 | 000,000,000 | ---D | C] -- C:\Programme\Crawler
[2011.04.25 17:31:15 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\u********\Anwendungsdaten\Spyware Terminator
[2011.04.25 17:31:06 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Spyware Terminator
[2011.04.25 17:31:01 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spyware Terminator
[2011.04.25 17:30:58 | 000,000,000 | ---D | C] -- C:\Programme\Spyware Terminator
[2011.04.25 16:55:06 | 000,149,456 | ---- | C] (PC Tools) -- C:\WINDOWS\SGDetectionTool.dll
[2011.04.25 16:55:05 | 001,640,400 | ---- | C] (Threat Expert Ltd.) -- C:\WINDOWS\PCTBDCore.dll
[2011.04.25 16:55:05 | 000,165,840 | ---- | C] (Threat Expert Ltd.) -- C:\WINDOWS\PCTBDRes.dll
[2011.04.25 16:53:04 | 000,233,136 | ---- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\pctgntdi.sys
[2011.04.25 16:52:47 | 000,207,280 | ---- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\PCTCore.sys
[2011.04.25 16:52:47 | 000,087,784 | ---- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\PCTAppEvent.sys
[2011.04.25 16:52:38 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Spyware Doctor
[2011.04.25 16:52:28 | 000,070,408 | ---- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\pctplsg.sys
[2011.04.25 16:51:59 | 000,000,000 | ---D | C] -- C:\Programme\Spyware Doctor
[2011.04.25 16:51:59 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\PC Tools
[2011.04.25 16:51:59 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\u********\Anwendungsdaten\PC Tools
[2011.04.25 16:51:59 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Tools
[2011.04.25 16:51:32 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
[2011.04.25 08:54:15 | 000,657,776 | ---- | C] (Microsoft Corporation) -- C:\WindowsXP-KB961451-v2-x86-DEU.exe
[2011.04.24 11:39:54 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\u********\Anwendungsdaten\Malwarebytes
[2011.04.24 10:05:42 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011.04.24 10:05:42 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
[2011.04.24 10:05:35 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2011.04.24 10:05:28 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2011.04.24 09:36:29 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\u********\Recent
[2011.04.24 03:10:48 | 000,000,000 | -HSD | C] -- C:\found.001
[2011.04.13 19:31:27 | 000,000,000 | ---D | C] -- C:\Programme\Nitroxrechner 4.5
[2011.04.13 19:31:19 | 000,304,128 | ---- | C] (InstallShield Corporation, Inc.) -- C:\WINDOWS\unin0407.exe
[2002.11.11 03:00:10 | 000,204,800 | ---- | C] ( ) -- C:\WINDOWS\System32\SlpV24s.exe
[2002.11.11 03:00:10 | 000,073,728 | ---- | C] ( ) -- C:\WINDOWS\System32\SlpV24.dll
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011.04.26 09:10:01 | 000,001,084 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011.04.26 08:10:12 | 000,001,080 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011.04.26 07:58:52 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011.04.26 07:56:11 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011.04.25 17:33:18 | 000,000,769 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Spyware Terminator.lnk
[2011.04.25 17:31:20 | 000,142,592 | ---- | M] () -- C:\WINDOWS\System32\drivers\sp_rsdrv2.sys
[2011.04.25 16:52:40 | 000,001,587 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Spyware Doctor.lnk
[2011.04.25 08:39:07 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2011.04.24 10:05:44 | 000,000,756 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.04.24 03:28:23 | 000,000,392 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\16047924
[2011.04.24 03:25:50 | 000,000,120 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\~16047924
[2011.04.24 03:25:49 | 000,000,136 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\~16047924r
[2011.04.13 19:31:46 | 000,000,008 | ---- | M] () -- C:\winset32.rt2
[2011.04.13 19:31:32 | 000,000,012 | ---- | M] () -- C:\System.ft1
[2011.04.04 20:17:18 | 000,004,640 | ---- | M] () -- C:\WINDOWS\WINCMD.INI
[2011.03.28 23:38:18 | 000,014,814 | ---- | M] () -- C:\Dokumente und Einstellungen\u********\Desktop\lampe.cdr
[2011.03.28 17:11:52 | 000,339,804 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2011.03.28 17:11:52 | 000,329,768 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011.03.28 17:11:52 | 000,058,488 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2011.03.28 17:11:52 | 000,047,670 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011.03.27 16:24:40 | 000,014,960 | ---- | M] () -- C:\Dokumente und Einstellungen\u********\Desktop\Backup_of_lampe.cdr
[2011.03.27 11:12:15 | 000,593,913 | ---- | M] () -- C:\Dokumente und Einstellungen\u********\Desktop\ee_bfa_so.pdf
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011.04.25 17:33:18 | 000,000,769 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Spyware Terminator.lnk
[2011.04.25 17:31:20 | 000,142,592 | ---- | C] () -- C:\WINDOWS\System32\drivers\sp_rsdrv2.sys
[2011.04.25 16:55:06 | 001,152,444 | ---- | C] () -- C:\WINDOWS\UDB.zip
[2011.04.25 16:55:06 | 000,767,952 | ---- | C] () -- C:\WINDOWS\BDTSupport.dll
[2011.04.25 16:55:06 | 000,000,882 | ---- | C] () -- C:\WINDOWS\RegSDImport.xml
[2011.04.25 16:55:06 | 000,000,880 | ---- | C] () -- C:\WINDOWS\RegISSImport.xml
[2011.04.25 16:55:06 | 000,000,131 | ---- | C] () -- C:\WINDOWS\IDB.zip
[2011.04.25 16:53:04 | 000,007,387 | ---- | C] () -- C:\WINDOWS\System32\drivers\pctgntdi.cat
[2011.04.25 16:52:47 | 000,007,412 | ---- | C] () -- C:\WINDOWS\System32\drivers\PCTAppEvent.cat
[2011.04.25 16:52:47 | 000,007,383 | ---- | C] () -- C:\WINDOWS\System32\drivers\pctcore.cat
[2011.04.25 16:52:40 | 000,001,587 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Spyware Doctor.lnk
[2011.04.25 16:52:28 | 000,007,383 | ---- | C] () -- C:\WINDOWS\System32\drivers\pctplsg.cat
[2011.04.24 10:05:44 | 000,000,756 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.04.24 03:25:49 | 000,000,136 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\~16047924r
[2011.04.24 03:25:49 | 000,000,120 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\~16047924
[2011.04.24 03:25:12 | 000,000,392 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\16047924
[2011.04.23 17:37:57 | 000,000,702 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Mozilla Firefox.lnk
[2011.04.13 19:31:32 | 000,000,012 | ---- | C] () -- C:\System.ft1
[2011.04.13 19:31:32 | 000,000,008 | ---- | C] () -- C:\winset32.rt2
[2011.03.27 16:24:40 | 000,014,960 | ---- | C] () -- C:\Dokumente und Einstellungen\u********\Desktop\Backup_of_lampe.cdr
[2011.03.27 16:15:37 | 000,014,814 | ---- | C] () -- C:\Dokumente und Einstellungen\u********\Desktop\lampe.cdr
[2011.03.27 11:12:15 | 000,593,913 | ---- | C] () -- C:\Dokumente und Einstellungen\u********\Desktop\ee_bfa_so.pdf
[2011.03.07 23:39:57 | 000,000,036 | ---- | C] () -- C:\WINDOWS\iltwain.ini
[2010.11.10 10:59:40 | 000,134,116 | ---- | C] () -- C:\WINDOWS\ColorPic Uninstaller.exe
[2010.09.13 23:05:13 | 000,002,103 | ---- | C] () -- C:\WINDOWS\System32\KeybdIO.sys
[2010.09.13 23:01:24 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\KBIOCTRL.dll
[2010.08.31 09:23:35 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010.04.05 23:08:35 | 000,098,304 | ---- | C] () -- C:\WINDOWS\FunambolAddin.dll
[2009.09.10 17:31:48 | 000,037,876 | ---- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2009.07.18 18:31:37 | 000,000,292 | ---- | C] () -- C:\WINDOWS\wcx_ftp.ini
[2009.06.11 14:00:16 | 000,019,456 | ---- | C] () -- C:\Dokumente und Einstellungen\u********\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.04.01 20:26:27 | 000,108,032 | ---- | C] () -- C:\WINDOWS\System32\sh33w32.dll
[2009.04.01 20:24:53 | 000,039,095 | ---- | C] () -- C:\WINDOWS\iccsigs.dat
[2009.02.27 07:20:06 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\SynTPCoI.dll
[2008.11.14 01:17:04 | 000,000,056 | ---- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2008.11.12 16:05:00 | 000,004,640 | ---- | C] () -- C:\WINDOWS\WINCMD.INI
[2008.11.12 14:27:25 | 000,000,403 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2008.11.12 12:56:54 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2008.11.12 12:45:11 | 000,006,272 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASLM75.SYS.SYS
[2008.11.12 12:31:11 | 000,005,786 | R--- | C] () -- C:\WINDOWS\System32\drivers\ATKACPI.sys
[2008.11.12 12:28:26 | 000,007,424 | R--- | C] () -- C:\WINDOWS\System32\drivers\MMIOPORT.SYS
[2008.11.12 12:21:58 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2008.11.12 12:13:56 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2008.11.12 12:03:10 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2008.11.12 12:01:43 | 000,183,424 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2004.08.02 14:20:40 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004.04.01 21:43:08 | 000,397,312 | ---- | C] () -- C:\WINDOWS\System32\ati2evxx.exe
[2004.04.01 21:43:08 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\ati2evxx.dll
[2003.04.02 14:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2003.04.02 14:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2003.04.02 14:00:00 | 000,339,804 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2003.04.02 14:00:00 | 000,329,768 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2003.04.02 14:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2003.04.02 14:00:00 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2003.04.02 14:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2003.04.02 14:00:00 | 000,058,488 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2003.04.02 14:00:00 | 000,047,670 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2003.04.02 14:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2003.04.02 14:00:00 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2003.04.02 14:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2003.04.02 14:00:00 | 000,004,461 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2003.04.02 14:00:00 | 000,001,788 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2003.04.02 14:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2002.11.21 19:34:39 | 000,017,920 | ---- | C] () -- C:\WINDOWS\System32\IMPLODE.DLL
[2002.06.25 12:01:34 | 000,163,840 | ---- | C] () -- C:\WINDOWS\System32\ELAPI.dll
[2002.04.26 10:42:12 | 000,000,619 | ---- | C] () -- C:\WINDOWS\polysun33.ini
[1999.01.22 20:46:58 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\MSRTEDIT.DLL
[1996.04.14 14:55:06 | 000,014,336 | ---- | C] () -- C:\WINDOWS\WEBDIAL.EXE

========== LOP Check ==========

[2010.12.26 20:34:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\BVRP Software
[2011.04.25 18:16:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spyware Terminator
[2011.04.26 07:58:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
[2010.01.17 22:26:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software
[2010.01.17 22:24:16 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
[2010.04.04 19:31:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\u********\Anwendungsdaten\Funambol
[2010.04.06 00:05:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\u********\Anwendungsdaten\OLXConvertAgentClient
[2008.12.14 16:19:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\u********\Anwendungsdaten\OpenOffice.org
[2010.11.27 16:34:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\u********\Anwendungsdaten\PhotoLine
[2011.04.25 17:35:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\u********\Anwendungsdaten\Spyware Terminator
[2010.04.05 11:10:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\u********\Anwendungsdaten\Thunderbird
[2010.01.17 22:26:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\u********\Anwendungsdaten\TuneUp Software
[2010.03.30 19:18:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\u********\Anwendungsdaten\XSManager

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 158 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:DFC5A2B2
@Alternate Data Stream - 115 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:A8ADE5D8

< End of report >