Trojaner-Board - ICQ - Links zu Bildern werden seltsam geöffnet?

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - ICQ - Links zu Bildern werden seltsam geöffnet? (https://www.trojaner-board.de/98825-icq-links-bildern-seltsam-geoeffnet.html)

ICQ - Links zu Bildern werden seltsam geöffnet?

Guten Tag!

Erst einmal Hallo! Ich bin der Neue. ;D

Seit einer Weile werden Links zu Bildern die mir Freunde per ICQ schicken seltsam geöffnet.. Es scheint als hätte da irgendeine icq-tools.de Software ihre Finger im Spiel gehabt. Scheint irgendwas mit soul.im und/oder yodl.de zu tun haben, ich komme allerdings nicht dahinter wodurch dieses Phänomen ausgelöst wird, da ich meines Wissens nach keine Software von icq-tools.de mehr drauf habe. (Nicht mehr - allerdings hatte ich glaube ich mal soul.im installiert.. Bin aber nicht sicher!)

So schaut es aus wenn mir jemand einen Link schickt und ich diesem folge.

Ich hoffe, dass mir jemand bei diesem Problem helfen kann.

Edit: Okay scheinbar muss ich das mit dem Screenshot anders machen.^^ Entschuldigt.

Hallo und :hallo:

Bitte routinemäßig einen Vollscan mit malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

Danach OTL-Custom:

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den Inhalt in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox.

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

/md5start

wininit.exe

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Hey! Habe leider gerade nicht die Zeit für einen vollständigen Scan, ich habe aber noch einen Log von einem vollständigen Scan, den ich am 24. April gemacht habe. Diesen und den OTL Log habe ich an den Beitrag angehangen, da mein Beitrag sonst zu lang ist. :S

Vielen Dank schonmal für die Antwort. (:

Mach bitte den Vollscan mit aktuellen Signaturen sofort wenn du Zeit dafür hast.

So! Pardon, es hat etwas gedauert bis ich die Zeit gefunden hab. Bin grad voll im Abistress ;)

Jedenfalls hab ich eben vollständig gescannt und die Signaturen natürlich vorher aufgefrischt.

Code:

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org
 

Datenbank Version: 6554
 

Windows 5.1.2600 Service Pack 3

Internet Explorer 7.0.5730.13
 

11.05.2011 14:54:38

mbam-log-2011-05-11 (14-54-38).txt
 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)

Durchsuchte Objekte: 350955

Laufzeit: 2 Stunde(n), 4 Minute(n), 14 Sekunde(n)
 

Infizierte Speicherprozesse: 0

Infizierte Speichermodule: 0

Infizierte Registrierungsschlüssel: 0

Infizierte Registrierungswerte: 0

Infizierte Dateiobjekte der Registrierung: 0

Infizierte Verzeichnisse: 0

Infizierte Dateien: 1
 

Infizierte Speicherprozesse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung:

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien:

c:\WINDOWS\installer\{a8606865-6d52-44c1-82bd-a3c9a80222d4}\icon07da9d2a.txt (Trojan.Agent) -> Quarantined and deleted successfully.

Den Schädling habe ich natürlich von MBAM entfernen lassen..

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

:OTL

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.05.17 13:13:30 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O33 - MountPoints2\{ee5b88da-74b7-11db-b79b-001617a12b15}\Shell - "" = AutoRun

O33 - MountPoints2\{ee5b88da-74b7-11db-b79b-001617a12b15}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{ee5b88da-74b7-11db-b79b-001617a12b15}\Shell\AutoRun\command - "" = I:\Gothic.exe

[2008.06.25 12:33:07 | 001,713,058 | -HS- | C] () -- C:\WINDOWS\System32\ofqjvdbb.ini

[2008.06.25 12:31:46 | 000,459,969 | -HS- | C] () -- C:\WINDOWS\System32\xyIStBeg.ini

[2008.03.03 18:02:01 | 000,000,088 | RHS- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\05FEEDCB26.sys

@Alternate Data Stream - 161 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:B3D74A13

@Alternate Data Stream - 125 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:2BE9FEFC

@Alternate Data Stream - 122 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:CB0AACC9

@Alternate Data Stream - 106 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:DFC5A2B2

@Alternate Data Stream - 100 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:F768B6EF

:Commands

[purity]

[resethosts]

[emptytemp]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Erledigt:

Code:

All processes killed

========== OTL ==========

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!

C:\AUTOEXEC.BAT moved successfully.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ee5b88da-74b7-11db-b79b-001617a12b15}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ee5b88da-74b7-11db-b79b-001617a12b15}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ee5b88da-74b7-11db-b79b-001617a12b15}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ee5b88da-74b7-11db-b79b-001617a12b15}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ee5b88da-74b7-11db-b79b-001617a12b15}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ee5b88da-74b7-11db-b79b-001617a12b15}\ not found.

File I:\Gothic.exe not found.

C:\WINDOWS\system32\ofqjvdbb.ini moved successfully.

C:\WINDOWS\system32\xyIStBeg.ini moved successfully.

C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\05FEEDCB26.sys moved successfully.

ADS C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:B3D74A13 deleted successfully.

ADS C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:2BE9FEFC deleted successfully.

ADS C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:CB0AACC9 deleted successfully.

ADS C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:DFC5A2B2 deleted successfully.

ADS C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:F768B6EF deleted successfully.

========== COMMANDS ==========

C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

 

[EMPTYTEMP]

 

User: All Users

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

->Java cache emptied: 0 bytes

->Flash cache emptied: 348 bytes

 

User: XXX

->Temp folder emptied: 1692033670 bytes

->Temporary Internet Files folder emptied: 47590359 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 1240154114 bytes

->Opera cache emptied: 30297815 bytes

->Flash cache emptied: 2835173 bytes

 

User: LocalService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 32902 bytes

 

User: NetworkService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 48537867 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 29747893 bytes

%systemroot%\System32 .tmp files removed: 5545984 bytes

%systemroot%\System32\dllcache .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 7527860 bytes

RecycleBin emptied: 0 bytes

 

Total Files Cleaned = 2.961,00 mb

 

 

OTL by OldTimer - Version 3.2.22.3 log created on 05112011_161349
 

Files\Folders moved on Reboot...

File\Folder C:\WINDOWS\temp\Perflib_Perfdata_658.dat not found!
 

Registry entries deleted on Reboot...

Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - also beide Haken setzen, auf Start scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

http://www.trojaner-board.de/attachm...rnen-start.png

Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Vista und 7 User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

Erledigt:

Code:

2011/05/11 16:45:48.0107 2632        TDSS rootkit removing tool 2.5.0.0 May  1 2011 14:20:16

2011/05/11 16:45:48.0420 2632        ================================================================================

2011/05/11 16:45:48.0420 2632        SystemInfo:

2011/05/11 16:45:48.0420 2632        

2011/05/11 16:45:48.0420 2632        OS Version: 5.1.2600 ServicePack: 3.0

2011/05/11 16:45:48.0420 2632        Product type: Workstation

2011/05/11 16:45:48.0420 2632        ComputerName: XXX

2011/05/11 16:45:48.0420 2632        UserName: XXX

2011/05/11 16:45:48.0420 2632        Windows directory: C:\WINDOWS

2011/05/11 16:45:48.0420 2632        System windows directory: C:\WINDOWS

2011/05/11 16:45:48.0435 2632        Processor architecture: Intel x86

2011/05/11 16:45:48.0435 2632        Number of processors: 2

2011/05/11 16:45:48.0435 2632        Page size: 0x1000

2011/05/11 16:45:48.0435 2632        Boot type: Normal boot

2011/05/11 16:45:48.0435 2632        ================================================================================

2011/05/11 16:45:49.0717 2632        Initialize success

2011/05/11 16:45:56.0232 3688        ================================================================================

2011/05/11 16:45:56.0232 3688        Scan started

2011/05/11 16:45:56.0232 3688        Mode: Manual; 

2011/05/11 16:45:56.0232 3688        ================================================================================

2011/05/11 16:45:58.0279 3688        ACEDRV07        (4e5451dd0aec8504d7f8030dd2d4c416) C:\WINDOWS\system32\drivers\ACEDRV07.sys

2011/05/11 16:45:58.0467 3688        ACPI            (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys

2011/05/11 16:45:58.0545 3688        ACPIEC          (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\drivers\ACPIEC.sys

2011/05/11 16:45:58.0732 3688        aec             (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys

2011/05/11 16:45:58.0842 3688        AFD             (7e775010ef291da96ad17ca4b17137d7) C:\WINDOWS\System32\drivers\afd.sys

2011/05/11 16:45:59.0232 3688        ALCXWDM         (dd8520280304b6145a6be31008748c7c) C:\WINDOWS\system32\drivers\ALCXWDM.SYS

2011/05/11 16:45:59.0670 3688        Arp1394         (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys

2011/05/11 16:45:59.0967 3688        Aspi32          (b979979ab8027f7f53fb16ec4229b7db) C:\WINDOWS\system32\drivers\aspi32.sys

2011/05/11 16:46:00.0092 3688        AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys

2011/05/11 16:46:00.0185 3688        atapi           (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys

2011/05/11 16:46:00.0342 3688        Atmarpc         (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys

2011/05/11 16:46:00.0435 3688        audstub         (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys

2011/05/11 16:46:00.0545 3688        avgio           (0b497c79824f8e1bf22fa6aacd3de3a0) C:\Programme\Avira\AntiVir Desktop\avgio.sys

2011/05/11 16:46:00.0685 3688        avgntflt        (47b879406246ffdced59e18d331a0e7d) C:\WINDOWS\system32\DRIVERS\avgntflt.sys

2011/05/11 16:46:00.0779 3688        avipbb          (5fedef54757b34fb611b9ec8fb399364) C:\WINDOWS\system32\DRIVERS\avipbb.sys

2011/05/11 16:46:00.0998 3688        Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys

2011/05/11 16:46:01.0107 3688        BlueletAudio    (5ff9a3f3476d726ae62da82d5da94c36) C:\WINDOWS\system32\DRIVERS\blueletaudio.sys

2011/05/11 16:46:01.0201 3688        BlueletSCOAudio (bd91afc523fd59f881e1763c38fb772f) C:\WINDOWS\system32\DRIVERS\BlueletSCOAudio.sys

2011/05/11 16:46:01.0310 3688        BT              (c5cce2b26f73f8cf7f3c82159e79aa08) C:\WINDOWS\system32\DRIVERS\btnetdrv.sys

2011/05/11 16:46:01.0404 3688        Btcsrusb        (fb2abc6d08d9f8d5ed8e02cbd18b39bb) C:\WINDOWS\system32\Drivers\btcusb.sys

2011/05/11 16:46:01.0498 3688        BTHidEnum       (ce643d0918123d76a5caab008fca9663) C:\WINDOWS\system32\Drivers\vbtenum.sys

2011/05/11 16:46:01.0607 3688        BTHidMgr        (dfca4fe4c8aec786b4d0f432eb730f48) C:\WINDOWS\system32\Drivers\BTHidMgr.sys

2011/05/11 16:46:01.0717 3688        cbidf2k         (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys

2011/05/11 16:46:01.0810 3688        CCDECODE        (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys

2011/05/11 16:46:01.0951 3688        Cdaudio         (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys

2011/05/11 16:46:02.0060 3688        Cdfs            (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys

2011/05/11 16:46:02.0154 3688        Cdrom           (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys

2011/05/11 16:46:02.0654 3688        Disk            (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys

2011/05/11 16:46:02.0764 3688        dmboot          (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys

2011/05/11 16:46:02.0967 3688        dmio            (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys

2011/05/11 16:46:03.0060 3688        dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys

2011/05/11 16:46:03.0170 3688        DMusic          (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys

2011/05/11 16:46:03.0326 3688        drmkaud         (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys

2011/05/11 16:46:03.0498 3688        EL90XBC         (6e883bf518296a40959131c2304af714) C:\WINDOWS\system32\DRIVERS\el90xbc5.sys

2011/05/11 16:46:03.0576 3688        epmntdrv        (f07ba56b0235f15eff8f10dc6389c42e) C:\WINDOWS\system32\epmntdrv.sys

2011/05/11 16:46:03.0857 3688        EuGdiDrv        (1f2f4ab15ce03ecc257feb2f6dc5a013) C:\WINDOWS\system32\EuGdiDrv.sys

2011/05/11 16:46:03.0982 3688        Fastfat         (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys

2011/05/11 16:46:04.0139 3688        Fdc             (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys

2011/05/11 16:46:04.0232 3688        Fips            (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys

2011/05/11 16:46:04.0326 3688        Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys

2011/05/11 16:46:04.0435 3688        FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys

2011/05/11 16:46:04.0545 3688        Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys

2011/05/11 16:46:04.0685 3688        Ftdisk          (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys

2011/05/11 16:46:04.0779 3688        GEARAspiWDM     (4ac51459805264affd5f6fdfb9d9235f) C:\WINDOWS\system32\Drivers\GEARAspiWDM.sys

2011/05/11 16:46:04.0889 3688        Gpc             (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys

2011/05/11 16:46:04.0967 3688        hamachi         (7929a161f9951d173ca9900fe7067391) C:\WINDOWS\system32\DRIVERS\hamachi.sys

2011/05/11 16:46:05.0092 3688        HidUsb          (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys

2011/05/11 16:46:05.0279 3688        HPZid412        (30ca91e657cede2f95359d6ef186f650) C:\WINDOWS\system32\DRIVERS\HPZid412.sys

2011/05/11 16:46:05.0357 3688        HPZipr12        (efd31afa752aa7c7bbb57bcbe2b01c78) C:\WINDOWS\system32\DRIVERS\HPZipr12.sys

2011/05/11 16:46:05.0498 3688        HPZius12        (7ac43c38ca8fd7ed0b0a4466f753e06e) C:\WINDOWS\system32\DRIVERS\HPZius12.sys

2011/05/11 16:46:05.0592 3688        HssDrv          (4f28652ec514fa1ba473bc1a695a5c98) C:\WINDOWS\system32\DRIVERS\HssDrv.sys

2011/05/11 16:46:05.0748 3688        HTTP            (f6aacf5bce2893e0c1754afeb672e5c9) C:\WINDOWS\system32\Drivers\HTTP.sys

2011/05/11 16:46:05.0920 3688        i8042prt        (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys

2011/05/11 16:46:06.0045 3688        Imapi           (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys

2011/05/11 16:46:06.0279 3688        intelppm        (4c7d2750158ed6e7ad642d97bffae351) C:\WINDOWS\system32\DRIVERS\intelppm.sys

2011/05/11 16:46:06.0342 3688        Ip6Fw           (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys

2011/05/11 16:46:06.0435 3688        IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys

2011/05/11 16:46:06.0514 3688        IpInIp          (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys

2011/05/11 16:46:06.0639 3688        IpNat           (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys

2011/05/11 16:46:06.0717 3688        IPSec           (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys

2011/05/11 16:46:06.0810 3688        IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys

2011/05/11 16:46:06.0935 3688        isapnp          (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys

2011/05/11 16:46:07.0029 3688        Kbdclass        (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys

2011/05/11 16:46:07.0107 3688        kbdhid          (b6d6c117d771c98130497265f26d1882) C:\WINDOWS\system32\DRIVERS\kbdhid.sys

2011/05/11 16:46:07.0201 3688        kmixer          (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys

2011/05/11 16:46:07.0310 3688        KSecDD          (1705745d900dabf2d89f90ebaddc7517) C:\WINDOWS\system32\drivers\KSecDD.sys

2011/05/11 16:46:07.0545 3688        LBeepKE         (c99ba72106a858cb8b521bb4c02c93ed) C:\WINDOWS\system32\Drivers\LBeepKE.sys

2011/05/11 16:46:07.0732 3688        LHidFilt        (318b3d608fbec44b7e0c23bf759dced5) C:\WINDOWS\system32\DRIVERS\LHidFilt.Sys

2011/05/11 16:46:07.0982 3688        mnmdd           (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys

2011/05/11 16:46:08.0060 3688        Modem           (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys

2011/05/11 16:46:08.0170 3688        Mouclass        (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys

2011/05/11 16:46:08.0248 3688        mouhid          (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys

2011/05/11 16:46:08.0342 3688        MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys

2011/05/11 16:46:08.0545 3688        MPE             (c0f8e0c2c3c0437cf37c6781896dc3ec) C:\WINDOWS\system32\DRIVERS\MPE.sys

2011/05/11 16:46:08.0732 3688        MRxDAV          (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys

2011/05/11 16:46:08.0842 3688        MRxSmb          (f3aefb11abc521122b67095044169e98) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys

2011/05/11 16:46:08.0967 3688        MS1000          (fbbb1a51eb6e43b40144a05932766d6c) C:\WINDOWS\system32\DRIVERS\MS1000.sys

2011/05/11 16:46:09.0107 3688        Msfs            (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys

2011/05/11 16:46:09.0217 3688        MSKSSRV         (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys

2011/05/11 16:46:09.0310 3688        MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys

2011/05/11 16:46:09.0389 3688        MSPQM           (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys

2011/05/11 16:46:09.0514 3688        mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys

2011/05/11 16:46:09.0576 3688        MSTEE           (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys

2011/05/11 16:46:09.0654 3688        Mup             (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys

2011/05/11 16:46:09.0748 3688        NABTSFEC        (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys

2011/05/11 16:46:09.0842 3688        NDIS            (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys

2011/05/11 16:46:09.0935 3688        NdisIP          (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys

2011/05/11 16:46:10.0045 3688        NdisTapi        (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys

2011/05/11 16:46:10.0123 3688        Ndisuio         (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys

2011/05/11 16:46:10.0201 3688        NdisWan         (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys

2011/05/11 16:46:10.0279 3688        NDProxy         (6215023940cfd3702b46abc304e1d45a) C:\WINDOWS\system32\drivers\NDProxy.sys

2011/05/11 16:46:10.0404 3688        NetBIOS         (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys

2011/05/11 16:46:10.0498 3688        NetBT           (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys

2011/05/11 16:46:10.0685 3688        NIC1394         (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys

2011/05/11 16:46:10.0795 3688        nm              (1e421a6bcf2203cc61b821ada9de878b) C:\WINDOWS\system32\DRIVERS\NMnt.sys

2011/05/11 16:46:10.0920 3688        nocashio        (03bba4dedefb48c510061529651b453a) C:\WINDOWS\system32\drivers\nocashio.sys

2011/05/11 16:46:10.0982 3688        Npfs            (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys

2011/05/11 16:46:11.0154 3688        Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys

2011/05/11 16:46:11.0373 3688        Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys

2011/05/11 16:46:11.0451 3688        NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys

2011/05/11 16:46:11.0529 3688        NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys

2011/05/11 16:46:11.0639 3688        ohci1394        (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys

2011/05/11 16:46:11.0732 3688        Parport         (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\DRIVERS\parport.sys

2011/05/11 16:46:11.0826 3688        PartMgr         (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys

2011/05/11 16:46:11.0920 3688        ParVdm          (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys

2011/05/11 16:46:12.0014 3688        PCI             (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys

2011/05/11 16:46:12.0170 3688        PCIIde          (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\DRIVERS\pciide.sys

2011/05/11 16:46:12.0248 3688        Pcmcia          (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\drivers\Pcmcia.sys

2011/05/11 16:46:12.0342 3688        pcouffin        (5b6c11de7e839c05248ced8825470fef) C:\WINDOWS\system32\Drivers\pcouffin.sys

2011/05/11 16:46:12.0795 3688        pfc             (444f122e68db44c0589227781f3c8b3f) C:\WINDOWS\system32\drivers\pfc.sys

2011/05/11 16:46:12.0920 3688        PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys

2011/05/11 16:46:13.0029 3688        prodrv06        (0dfd0df9ab7a227cedf97fadee60f793) C:\WINDOWS\System32\drivers\prodrv06.sys

2011/05/11 16:46:13.0279 3688        prohlp02        (f2e44d17ea6334b39f35cc42251b2aca) C:\WINDOWS\system32\drivers\prohlp02.sys

2011/05/11 16:46:13.0373 3688        prosync1        (f3471e7971ee62420451d958da635064) C:\WINDOWS\system32\drivers\prosync1.sys

2011/05/11 16:46:13.0467 3688        PSched          (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys

2011/05/11 16:46:13.0545 3688        Ptilink         (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys

2011/05/11 16:46:13.0623 3688        PxHelp20        (e42e3433dbb4cffe8fdd91eab29aea8e) C:\WINDOWS\system32\Drivers\PxHelp20.sys

2011/05/11 16:46:13.0967 3688        RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys

2011/05/11 16:46:14.0045 3688        Rasl2tp         (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys

2011/05/11 16:46:14.0139 3688        RasPppoe        (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys

2011/05/11 16:46:14.0201 3688        Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys

2011/05/11 16:46:14.0295 3688        Rdbss           (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys

2011/05/11 16:46:14.0435 3688        RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys

2011/05/11 16:46:14.0545 3688        RDPWD           (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys

2011/05/11 16:46:14.0685 3688        redbook         (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys

2011/05/11 16:46:14.0826 3688        ROOTMODEM       (d8b0b4ade32574b2d9c5cc34dc0dbbe7) C:\WINDOWS\system32\Drivers\RootMdm.sys

2011/05/11 16:46:14.0951 3688        rspndr          (a3b23fb3f295694091f51865f98588b2) C:\WINDOWS\system32\DRIVERS\rspndr.sys

2011/05/11 16:46:15.0060 3688        RTL8023xp       (cf84b1f0e8b14d4120aaf9cf35cbb265) C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys

2011/05/11 16:46:15.0264 3688        SE27bus         (59a9eb4073a39895af314780d0a032fa) C:\WINDOWS\system32\DRIVERS\SE27bus.sys

2011/05/11 16:46:15.0342 3688        SE27mdfl        (d53e7e53107d1796825540129f8fe89f) C:\WINDOWS\system32\DRIVERS\SE27mdfl.sys

2011/05/11 16:46:15.0451 3688        SE27mdm         (2afa2f65a6e91da5b5070e734769827e) C:\WINDOWS\system32\DRIVERS\SE27mdm.sys

2011/05/11 16:46:15.0545 3688        SE27mgmt        (5a33a8d7b44c7bd8abe248b4dcd1ff3c) C:\WINDOWS\system32\DRIVERS\SE27mgmt.sys

2011/05/11 16:46:15.0654 3688        se27nd5         (bb30139683bbf3ee89ec931393d9335c) C:\WINDOWS\system32\DRIVERS\se27nd5.sys

2011/05/11 16:46:15.0764 3688        SE27obex        (5da6ff71e94b9134ddd094ebb09f05e6) C:\WINDOWS\system32\DRIVERS\SE27obex.sys

2011/05/11 16:46:15.0873 3688        se27unic        (4d54a9d7c22157ab3d2442e8bcf5ecd2) C:\WINDOWS\system32\DRIVERS\se27unic.sys

2011/05/11 16:46:15.0951 3688        Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys

2011/05/11 16:46:16.0060 3688        serenum         (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys

2011/05/11 16:46:16.0123 3688        Serial          (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\DRIVERS\serial.sys

2011/05/11 16:46:16.0326 3688        sfdrv01         (4c0d673281178cb496011a2e28571fc8) C:\WINDOWS\system32\drivers\sfdrv01.sys

2011/05/11 16:46:16.0451 3688        sfhlp01         (462aee0ea0481ea8bd45cac876a4ccc4) C:\WINDOWS\system32\drivers\sfhlp01.sys

2011/05/11 16:46:16.0514 3688        sfhlp02         (15be2b5e4dc5b8623cf167720682abc9) C:\WINDOWS\system32\drivers\sfhlp02.sys

2011/05/11 16:46:16.0607 3688        Sfloppy         (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys

2011/05/11 16:46:16.0701 3688        sfvfs02         (d5a7e09d2c6a702809e49190d52adc9f) C:\WINDOWS\system32\drivers\sfvfs02.sys

2011/05/11 16:46:16.0920 3688        SLEE_17_DRIVER  (eaca11d07d7e74d72b913089b75b1416) C:\WINDOWS\system32\drivers\Sleen17.sys

2011/05/11 16:46:16.0982 3688        SLIP            (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys

2011/05/11 16:46:17.0076 3688        SoC PC-Camera Service (105531f39b6f85bb0a025182d8d8c37b) C:\WINDOWS\system32\DRIVERS\pfc027.sys

2011/05/11 16:46:17.0217 3688        splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys

2011/05/11 16:46:17.0342 3688        sptd            (cdddec541bc3c96f91ecb48759673505) C:\WINDOWS\system32\Drivers\sptd.sys

2011/05/11 16:46:17.0342 3688        Suspicious file (NoAccess): C:\WINDOWS\system32\Drivers\sptd.sys. md5: cdddec541bc3c96f91ecb48759673505

2011/05/11 16:46:17.0357 3688        sptd - detected LockedFile.Multi.Generic (1)

2011/05/11 16:46:17.0451 3688        sr              (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys

2011/05/11 16:46:17.0576 3688        Srv             (da852e3e0bf1cea75d756f9866241e57) C:\WINDOWS\system32\DRIVERS\srv.sys

2011/05/11 16:46:17.0779 3688        ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys

2011/05/11 16:46:17.0873 3688        StarOpen        (f92254b0bcfcd10caac7bccc7cb7f467) C:\WINDOWS\system32\drivers\StarOpen.sys

2011/05/11 16:46:17.0998 3688        streamip        (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys

2011/05/11 16:46:18.0139 3688        swenum          (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys

2011/05/11 16:46:18.0264 3688        swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys

2011/05/11 16:46:18.0592 3688        sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys

2011/05/11 16:46:18.0701 3688        tap0901         (1e89de7a4fb7a854ebb241d0aa8996dd) C:\WINDOWS\system32\DRIVERS\tap0901.sys

2011/05/11 16:46:18.0795 3688        taphss          (0c3b2a9c4bd2dd9a6c2e4084314dd719) C:\WINDOWS\system32\DRIVERS\taphss.sys

2011/05/11 16:46:18.0904 3688        Tcpip           (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys

2011/05/11 16:46:19.0060 3688        TDPIPE          (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys

2011/05/11 16:46:19.0139 3688        TDTCP           (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys

2011/05/11 16:46:19.0264 3688        TermDD          (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys

2011/05/11 16:46:19.0467 3688        uagp35          (d85938f272d1bcf3db3a31fc0a048928) C:\WINDOWS\system32\DRIVERS\uagp35.sys

2011/05/11 16:46:19.0560 3688        Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys

2011/05/11 16:46:19.0654 3688        UimBus          (a25e0481da469c3af6ad18c1534b874c) C:\WINDOWS\system32\DRIVERS\UimBus.sys

2011/05/11 16:46:19.0732 3688        Uim_IM          (ec2ede874e0eb50a509269676cf5f4bd) C:\WINDOWS\system32\Drivers\Uim_IM.sys

2011/05/11 16:46:19.0920 3688        UnlockerDriver5 (bb879dcfd22926efbeb3298129898cbb) C:\Programme\Unlocker\UnlockerDriver5.sys

2011/05/11 16:46:20.0014 3688        Update          (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys

2011/05/11 16:46:20.0248 3688        USBAAPL         (d4fb6ecc60a428564ba8768b0e23c0fc) C:\WINDOWS\system32\Drivers\usbaapl.sys

2011/05/11 16:46:20.0373 3688        usbccgp         (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys

2011/05/11 16:46:20.0482 3688        usbehci         (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys

2011/05/11 16:46:20.0576 3688        usbhub          (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys

2011/05/11 16:46:20.0654 3688        usbprint        (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys

2011/05/11 16:46:20.0764 3688        usbscan         (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys

2011/05/11 16:46:20.0857 3688        usbstor         (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

2011/05/11 16:46:20.0920 3688        usbuhci         (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys

2011/05/11 16:46:21.0029 3688        uscbs109        (88dcf14ccbdd645e6b8b20eb0810831b) C:\WINDOWS\system32\DRIVERS\uscbs109.sys

2011/05/11 16:46:21.0154 3688        uscsc109        (80018637740c8f80e3ab237ac9fca704) C:\WINDOWS\system32\DRIVERS\uscsc109.sys

2011/05/11 16:46:21.0295 3688        VComm           (51750b0539986186c6931fc40d171521) C:\WINDOWS\system32\DRIVERS\VComm.sys

2011/05/11 16:46:21.0389 3688        VcommMgr        (6d9c891c0a761afed1f3609c2e56f2b9) C:\WINDOWS\system32\Drivers\VcommMgr.sys

2011/05/11 16:46:21.0467 3688        VgaSave         (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys

2011/05/11 16:46:21.0576 3688        viagfx          (9c6544e2ca533a131b3d11a5f4699ebd) C:\WINDOWS\system32\DRIVERS\vtmini.sys

2011/05/11 16:46:21.0685 3688        ViaIde          (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\drivers\ViaIde.sys

2011/05/11 16:46:21.0810 3688        viamraid        (f199939205dccc7836ae5ab8b5dd5e83) C:\WINDOWS\system32\drivers\viamraid.sys

2011/05/11 16:46:21.0904 3688        ViBus           (fd85c55b66797542a8c8a7348ed0675a) C:\WINDOWS\system32\DRIVERS\ViBus.sys

2011/05/11 16:46:21.0998 3688        videX32         (510b5097e81cd36d603d7d5c93820bbd) C:\WINDOWS\system32\DRIVERS\videX32.sys

2011/05/11 16:46:22.0092 3688        ViPrt           (7c69b1b6dec5f8584aa352e522af1476) C:\WINDOWS\system32\DRIVERS\ViPrt.sys

2011/05/11 16:46:22.0185 3688        VolSnap         (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys

2011/05/11 16:46:22.0326 3688        w810bus         (5e8b60606fc4173b69cdecd964f22d28) C:\WINDOWS\system32\DRIVERS\w810bus.sys

2011/05/11 16:46:22.0451 3688        w810mdfl        (c0cc4f5a3c58b4c07ec4a82a5ae24714) C:\WINDOWS\system32\DRIVERS\w810mdfl.sys

2011/05/11 16:46:22.0576 3688        w810mdm         (2aafeedc3bfe14419cbce7ceea59dd05) C:\WINDOWS\system32\DRIVERS\w810mdm.sys

2011/05/11 16:46:22.0685 3688        Wanarp          (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys

2011/05/11 16:46:22.0810 3688        Wdf01000        (d918617b46457b9ac28027722e30f647) C:\WINDOWS\system32\Drivers\wdf01000.sys

2011/05/11 16:46:23.0014 3688        wdmaud          (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys

2011/05/11 16:46:23.0310 3688        WpdUsb          (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys

2011/05/11 16:46:23.0467 3688        WSTCODEC        (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS

2011/05/11 16:46:23.0592 3688        WudfPf          (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys

2011/05/11 16:46:23.0701 3688        WudfRd          (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys

2011/05/11 16:46:24.0560 3688        ================================================================================

2011/05/11 16:46:24.0560 3688        Scan finished

2011/05/11 16:46:24.0560 3688        ================================================================================

2011/05/11 16:46:24.0623 2456        Detected object count: 1

2011/05/11 16:46:58.0029 2456        LockedFile.Multi.Generic(sptd) - User select action: Skip

Wusste aber nicht, welche Aktion ich auswählen sollte.

Edit: Hätte ich mal den Thread gelesen.. Werde den Scan erneut durchführen und den Schädling entfernen lassen..^^
Edit²: Sorry, habe gerade gesehen, dass das Objekt als 'suspicious' eingestuft wurde, jedoch nicht als 'malicious'.. Soll ich trotzdem entfernen (delete), oder was ist zu tun?

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.

http://saved.im/mtm0nzyzmzd5/cofi.jpg

Dann folgende Anleitung durchlesen und abarbeiten -> CCleaner Systembereinigung

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Du hast aber beide Edits gelesen, oder? Muss ich bevor ich ComboFix ausführe den Fund mit TDSS Killer löschen?

Nein SPTD ist ok, kannste so lassen.

Code:

ComboFix 11-05-10.02 - XXX 11.05.2011  17:20:46.1.2 - x86

Microsoft Windows XP Home Edition  5.1.2600.3.1252.49.1031.18.958.210 [GMT 2:00]

ausgeführt von:: c:\dokumente und einstellungen\XXX\Desktop\cofi.exe

AV: AntiVir Desktop *Enabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}

AV: Avira AntiVir PersonalEdition Classic *Disabled/Updated* {84C966AC-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Disabled/Updated* {85399A1C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Disabled/Updated* {853E4984-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {00000000-0000-0000-0000-000000000000}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {00000246-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {80722100-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {84C1BDDC-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {84C3D054-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {84C576D4-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {84CC4914-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {84CC7054-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {84D69C1C-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {84E75AA4-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {84F4DDDC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {84FBCB64-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8500F51C-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8516156C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85165B9C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {851915BC-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {851ABA5C-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {851C48C4-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {851DD7A4-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {851E45E4-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {851E4ACC-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {851E89A4-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {851EBA5C-FFA4-0115-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {851EDDDC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {851F14D4-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {851F3C44-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {851F77E4-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8520172C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8520397C-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85205714-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8520636C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85210724-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85210794-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85211764-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85217BB4-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8521E924-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8521EA5C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8521EC34-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85220DDC-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8522377C-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852248FC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852255BC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8522C60C-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8522CC44-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852364AC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852364DC-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85236DDC-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8523CA1C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852419B4-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85242B44-FFA4-00FE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85248C1C-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852493E4-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8524EC1C-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8525381C-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85258394-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85258DDC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8525C594-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85260DB4-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8526B94C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85270924-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852759A4-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85275AAC-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85276DDC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8527760C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852787E4-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8527ADDC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8527CB5C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8527E50C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85281054-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85282054-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85283DDC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8528478C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8528ABD4-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8528C3DC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8528CA94-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8528CDDC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8528EDDC-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85295BF4-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85299614-FFA4-00EF-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852A5C1C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852AAB64-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852B43F4-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852B6A1C-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852B7354-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852B7DDC-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852B82B4-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852BDA84-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852BF5A4-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852C1054-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852C39D4-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852C529C-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852C7DDC-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852CBA5C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852CDDDC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852CFC1C-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852D232C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852D338C-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852D48AC-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852D4A34-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852D6244-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852D660C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852DD054-FFA4-00C9-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852E47C4-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852EC574-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852F5C1C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852F6DDC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852FB714-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {853027EC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85304C24-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8530A714-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8530D73C-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8530EDDC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8531E2DC-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8532740C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8532DDDC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {853384EC-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8533D464-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {853406BC-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8534098C-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85343A84-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85344924-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85346DDC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8536ADDC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8536E3D4-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85377B84-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {853786F4-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {853794A4-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8537C404-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8537D4AC-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8537F89C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {853808D4-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8538990C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8538E7E4-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85390C1C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {853992D4-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8539945C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {853994DC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8539B6D4-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8539CCE4-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {853A1584-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {853A1C1C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {853A22EC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {853AD704-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {853B3914-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {853BD70C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {853BE15C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {853BE9F4-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {853C3C44-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {853C7C1C-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {853D21F4-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {853D7B64-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {853DCA74-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8540662C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8540A054-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8541A54C-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8541B90C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8541D5FC-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8545C434-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85460054-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85460574-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {854773A4-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85477C2C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85485894-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8548BBB4-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {854923CC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {854A4DDC-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {854A58CC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {854A973C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {854B94CC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {854BD564-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {854D46FC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {854E2DDC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85509804-FFA4-0107-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8550AA4C-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85510834-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8553BC1C-FFA4-00EF-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8557F23C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8559689C-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85597054-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {855B1514-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {855BF9C4-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {855C6A6C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {855CB994-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {855CFDDC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {855D2554-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85620A5C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {856B890C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {BADB0D00-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {BADB0D00-FFA4-00F5-0D24-347CA8A3377C}

AV: BitDefender Antivirus *Disabled/Updated* {6C4BB89C-B0ED-4F41-A29C-4373888923BB}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\dokumente und einstellungen\XXX\Anwendungsdaten\inst.exe

c:\dokumente und einstellungen\XXX\Anwendungsdaten\XXXlog.dat

c:\dokumente und einstellungen\XXX\Eigene Dateien\mspaint.exe

c:\dokumente und einstellungen\XXX\WINDOWS

c:\dokumente und einstellungen\XXX\WINDOWS\WB.ini

c:\dokumente und einstellungen\XXX\WINDOWS\win.ini

c:\programme\Hotspot Shield\HssIE\HsSIe.dll

c:\windows\ST6UNST.000

c:\windows\system32\install

c:\windows\system32\iptepqdt.ini

c:\windows\system32\muzapp.exe

c:\windows\system32\paypal.url

c:\windows\system32\scrnrdr.exe

c:\windows\system32\SrchSTS.exe

c:\windows\system32\tmp.reg

c:\windows\system32\TsDJmUtv.ini

c:\windows\system32\TsDJmUtv.ini2

c:\windows\system32\VIRepair

c:\windows\system32\VIRepair\vi.sif

c:\windows\system32\winx.url

c:\windows\wpe pro.INI

c:\windows\XSxS

.

Infizierte Kopie von c:\windows\system32\midimap.dll wurde gefunden und desinfiziert 

Kopie von - c:\windows\NiwradSoft Shell Pack\Backup\midimap.dll wurde wiederhergestellt 

.

.

(((((((((((((((((((((((   Dateien erstellt von 2011-04-11 bis 2011-05-11  ))))))))))))))))))))))))))))))

.

.

2011-05-11 14:13 . 2011-05-11 14:13        --------        d-----w-        C:\_OTL

2011-05-10 19:25 . 2011-05-10 19:26        --------        d-----w-        c:\programme\TagRunner

2011-05-10 19:11 . 2011-05-10 19:11        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\RapidSolution

2011-05-09 16:20 . 2011-05-09 16:20        --------        d-----w-        c:\dokumente und einstellungen\XXX\Lokale Einstellungen\Anwendungsdaten\Secunia PSI

2011-05-09 16:20 . 2011-05-09 16:20        --------        d-----w-        c:\programme\Secunia

2011-05-09 15:57 . 2011-05-09 15:57        --------        d-----w-        c:\programme\Mein Gutscheincode Finder

2011-05-09 15:52 . 2011-05-09 15:54        --------        d-----w-        c:\programme\ICQ7.5

2011-05-08 19:17 . 2011-05-08 19:17        --------        d-----w-        c:\dokumente und einstellungen\XXX\Lokale Einstellungen\Anwendungsdaten\Temp

2011-05-03 18:47 . 2011-05-03 18:56        --------        d-----w-        c:\programme\YouFreeTV

2011-04-28 09:42 . 2011-04-28 09:42        --------        d-----w-        c:\windows\USB Vibration

2011-04-28 09:42 . 2002-08-02 00:20        151552        ----a-w-        c:\programme\Gemeinsame Dateien\InstallShield\Professional\RunTime\0700\Intel32\iuser.dll

2011-04-28 09:42 . 2011-04-28 09:42        270468        ----a-w-        c:\programme\Gemeinsame Dateien\InstallShield\Professional\RunTime\0700\Intel32\Setup.dll

2011-04-28 09:42 . 2011-04-28 09:42        159876        ----a-w-        c:\programme\Gemeinsame Dateien\InstallShield\Professional\RunTime\0700\Intel32\IGdi.dll

2011-04-28 09:42 . 2002-08-05 08:46        57344        ----a-w-        c:\programme\Gemeinsame Dateien\InstallShield\Professional\RunTime\0700\Intel32\ctor.dll

2011-04-28 09:42 . 2002-08-02 01:10        5632        ----a-w-        c:\programme\Gemeinsame Dateien\InstallShield\Professional\RunTime\0700\Intel32\DotNetInstaller.exe

2011-04-28 09:42 . 2002-08-02 00:20        634880        ----a-w-        c:\programme\Gemeinsame Dateien\InstallShield\Professional\RunTime\0700\Intel32\iKernel.dll

2011-04-28 09:42 . 2002-08-02 00:20        237568        ----a-w-        c:\programme\Gemeinsame Dateien\InstallShield\Professional\RunTime\0700\Intel32\iscript.dll

2011-04-28 09:42 . 2011-04-28 09:42        --------        d-----w-        c:\programme\USB Vibration

2011-04-26 12:45 . 2011-04-26 12:45        --------        d-----w-        c:\programme\iPod

2011-04-26 12:40 . 2011-04-26 12:40        --------        d-----w-        c:\programme\Bonjour

2011-04-25 12:54 . 2011-04-28 20:30        --------        d-----w-        c:\dokumente und einstellungen\XXX\Anwendungsdaten\vlc

2011-04-24 16:38 . 2011-05-01 23:43        --------        d-----w-        c:\programme\Xpadder

2011-04-24 15:08 . 2011-04-24 16:42        --------        d-----w-        c:\programme\Recettear

2011-04-17 23:27 . 2011-04-17 23:27        --------        d-----w-        c:\dokumente und einstellungen\XXX\Lokale Einstellungen\Anwendungsdaten\Songbird2

2011-04-17 23:27 . 2011-04-17 23:27        --------        d-----w-        c:\dokumente und einstellungen\XXX\Anwendungsdaten\Songbird2

2011-04-17 15:55 . 2011-04-21 08:49        --------        d-----w-        c:\programme\ICQ Away Reader

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-04-17 23:22 . 2006-11-17 12:20        850152        ----a-w-        c:\windows\system32\SpoonUninstall.exe

2011-04-06 14:20 . 2011-04-06 14:20        91424        ----a-w-        c:\windows\system32\dnssd.dll

2011-04-06 14:20 . 2011-04-06 14:20        107808        ----a-w-        c:\windows\system32\dns-sd.exe

2011-03-17 15:47 . 2009-12-04 17:11        137656        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2011-02-18 15:36 . 2009-04-03 22:09        4184352        ----a-w-        c:\windows\system32\usbaaplrc.dll

2011-02-18 15:36 . 2007-12-27 13:49        41984        ----a-w-        c:\windows\system32\drivers\usbaapl.sys

2010-09-19 20:19 . 2010-09-19 20:19        58652        ----a-w-        c:\programme\AMVapp-uninst.exe

2011-04-29 17:34 . 2011-03-27 11:47        142296        ----a-w-        c:\programme\mozilla firefox\components\browsercomps.dll

2008-08-23 05:56        635848        --sha-w-        c:\windows\NiwradSoft Shell Pack\Backup\iexplore.exe

2008-04-14 06:52        60416        --sha-w-        c:\windows\NiwradSoft Shell Pack\Backup\msimn.exe

2006-05-03 10:06        163328        --sh--r-        c:\windows\system32\flvDX.dll

2004-01-25 16:18        70656        --sha-w-        c:\windows\system32\i420vfw.dll

2007-02-21 11:47        31232        --sh--r-        c:\windows\system32\msfDX.dll

2008-03-16 13:30        216064        --sh--r-        c:\windows\system32\nbDX.dll

2005-02-28 11:16        240128        --sha-r-        c:\windows\system32\x.264.exe

.

.

------- Sigcheck -------

.

[7] 2008-04-14 06:52 . D0DE8A2EC95184E5193BB4B3112E29DF . 846848 . . [2001.12.4414.700] . . c:\windows\NiwradSoft Shell Pack\Backup\comres.dll

[-] 2008-04-14 06:52 . 4CC2423E2A3DBEA7964F5F3B7077347A . 1548800 . . [2001.12.4414.700] . . c:\windows\ServicePackFiles\i386\comres.dll

[-] 2008-04-14 06:52 . 4CC2423E2A3DBEA7964F5F3B7077347A . 1548800 . . [2001.12.4414.700] . . c:\windows\system32\comres.dll

[7] 2006-02-28 12:00 . 4B9D9E2708019763C5A72DA776DB1158 . 846848 . . [2001.12.4414.258] . . c:\windows\$NtServicePackUninstall$\comres.dll

.

[7] 2008-04-14 . F09A527B422E25C478E38CAA0E44417A . 513024 . . [5.1.2600.5512] . . c:\windows\NiwradSoft Shell Pack\Backup\winlogon.exe

[-] 2008-04-14 . AD37DF3FB8F168E42C09B77B487F6812 . 552448 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\winlogon.exe

[-] 2008-04-14 . AD37DF3FB8F168E42C09B77B487F6812 . 552448 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe

[7] 2006-02-28 . 2B6A0BAF33A9918F09442D873848FF72 . 507392 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\winlogon.exe

.

[7] 2010-09-10 . FC277C347BBAAE912A5B0748B3504483 . 5958656 . . [8.00.6001.23067] . . c:\windows\$hf_mig$\KB2360131-IE8\SP3QFE\mshtml.dll

[7] 2010-05-06 . A0091E83B21A4C2627D1DD1A64C1B4B9 . 5953024 . . [8.00.6001.23019] . . c:\windows\$hf_mig$\KB982381-IE8\SP3QFE\mshtml.dll

[7] 2009-07-19 . 165056346E0A00566A442287DAA7575F . 5938176 . . [8.00.6001.22902] . . c:\windows\$hf_mig$\KB972260-IE8\SP3QFE\mshtml.dll

[7] 2008-08-27 . 4872C0DA25F551A3E869501833754494 . 3593216 . . [7.00.6000.16735] . . c:\windows\NiwradSoft Shell Pack\Backup\mshtml.dll

[-] 2008-08-27 . 3E01CE0ACDFCE760363CF0A85BDE7EF5 . 3753472 . . [7.00.6000.16735] . . c:\windows\ServicePackFiles\i386\mshtml.dll

[-] 2008-08-27 . 3E01CE0ACDFCE760363CF0A85BDE7EF5 . 3753472 . . [7.00.6000.16735] . . c:\windows\system32\mshtml.dll

[-] 2008-08-27 . 3E01CE0ACDFCE760363CF0A85BDE7EF5 . 3753472 . . [7.00.6000.16735] . . c:\windows\system32\dllcache\mshtml.dll

[7] 2008-08-26 . 21B2247D24C8A61C12CD3BE8F3C30AC8 . 3594752 . . [7.00.6000.20900] . . c:\windows\$hf_mig$\KB956390-IE7\SP2QFE\mshtml.dll

[-] 2008-06-23 . 209A03C0EEF909DFCDCBB56C2BBF91CD . 3594240 . . [7.00.6000.20861] . . c:\windows\$hf_mig$\KB953838-IE7\SP2QFE\mshtml.dll

[-] 2008-04-23 . 60942CB0B5CADF130FC1795F5FEEE8F5 . 3593728 . . [7.00.6000.20815] . . c:\windows\$hf_mig$\KB950759-IE7\SP2QFE\mshtml.dll

[7] 2008-04-14 . 72AE55A9FFBC60650339CB12E35C7DD5 . 3066880 . . [6.00.2900.5512] . . c:\windows\ie7\mshtml.dll

[7] 2007-08-13 . C6EC2493346ED8888A549F59210A8ED3 . 3578368 . . [7.00.5730.13] . . c:\windows\ie7updates\KB956390-IE7\mshtml.dll

[7] 2007-08-13 . C6EC2493346ED8888A549F59210A8ED3 . 3578368 . . [7.00.5730.13] . . c:\windows\ie7updates\KB953838-IE7\mshtml.dll

[-] 2007-07-18 . E8EC18571090C12A013B83BA363364A4 . 3583488 . . [7.00.6000.16525] . . c:\windows\ie7updates\KB950759-IE7\mshtml.dll

[-] 2007-07-18 . B91AB1E55D77740D500BE0C4B2861844 . 3584000 . . [7.00.6000.20641] . . c:\windows\$hf_mig$\KB937143-IE7\SP2QFE\mshtml.dll

[-] 2007-05-08 . 07ABB2A695B8F91F7A12BE2BDD3E5932 . 3584000 . . [7.00.6000.20591] . . c:\windows\$hf_mig$\KB933566-IE7\SP2QFE\mshtml.dll

[-] 2007-05-08 . CD2DFBDD8C553443DE0EC55552A512C4 . 3583488 . . [7.00.6000.16481] . . c:\windows\ie7updates\KB937143-IE7\mshtml.dll

[-] 2006-11-07 . CBF04597F9CF7739E572276A2698FDD3 . 3577856 . . [7.00.5730.11] . . c:\windows\ie7updates\KB933566-IE7\mshtml.dll

[7] 2006-02-28 . 3910C7977DF6C8BCB604350173066D79 . 3070464 . . [6.00.2900.2853] . . c:\windows\$NtServicePackUninstall$\mshtml.dll

[7] 2006-02-28 . 3910C7977DF6C8BCB604350173066D79 . 3070464 . . [6.00.2900.2853] . . c:\windows\I386\MSHTML.DLL

[7] 2006-02-20 . 01432C2102578F0AB9ADDFEC91043D06 . 3073024 . . [6.00.2900.2853] . . c:\windows\$hf_mig$\KB911164\SP2QFE\mshtml.dll

[-] 2005-11-23 . 8ABDBAE6032562F17DCF962847ABB811 . 3016192 . . [6.00.2900.2802] . . c:\windows\$hf_mig$\KB905915\SP2QFE\mshtml.dll

[-] 2005-10-05 . 8898B48E79C56605393FDB7F3A033036 . 3015680 . . [6.00.2900.2769] . . c:\windows\$hf_mig$\KB896688\SP2QFE\mshtml.dll

[-] 2005-07-20 . 2068C163B1FE8BF48FC6174234D0F237 . 3014144 . . [6.00.2900.2722] . . c:\windows\$hf_mig$\KB896727\SP2QFE\mshtml.dll

[-] 2005-05-02 . 083EFE3B8E19213B6C6DAAB6F2F83954 . 3012608 . . [6.00.2900.2668] . . c:\windows\$hf_mig$\KB883939\SP2QFE\mshtml.dll

[-] 2005-03-09 . 243340D137D0B54CC5B440D7E4880B63 . 3011072 . . [6.00.2900.2627] . . c:\windows\$hf_mig$\KB890923\SP2QFE\mshtml.dll

[-] 2005-01-27 . 19F79F718CABBFC3DAD25D7914D5601B . 3008000 . . [6.00.2900.2604] . . c:\windows\$hf_mig$\KB867282\SP2QFE\mshtml.dll

[-] 2004-09-29 . EF245F9603EF899E9A5B3A2D107BC32E . 3004928 . . [6.00.2900.2524] . . c:\windows\$hf_mig$\KB834707\SP2QFE\mshtml.dll

.

[7] 2008-04-14 . B0050CC5340E3A0760DD8B417FF7AEBD . 580096 . . [5.1.2600.5512] . . c:\windows\NiwradSoft Shell Pack\Backup\user32.dll

[-] 2008-04-14 . C268AE6C540CC43F2264C8CB7A9A4243 . 580096 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\user32.dll

[-] 2008-04-14 . C268AE6C540CC43F2264C8CB7A9A4243 . 580096 . . [5.1.2600.5512] . . c:\windows\system32\user32.dll

[-] 2007-03-08 . 78785EFF8CB90CEC1862A4CCFD9A3C3A . 579584 . . [5.1.2600.3099] . . c:\windows\$hf_mig$\KB925902\SP2QFE\user32.dll

[7] 2006-02-28 . 56785FD5236D7B22CF471A6DA9DB46D8 . 578560 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\user32.dll

[-] 2005-03-02 . 4C90159A69A5FD3EB39C71411F28FCFF . 578560 . . [5.1.2600.2622] . . c:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll

.

[7] 2010-09-10 . 7B7028B726053782DD9B98B729515567 . 919552 . . [8.00.6001.23060] . . c:\windows\$hf_mig$\KB2360131-IE8\SP3QFE\wininet.dll

[7] 2010-05-06 . B5B9887088B8168D52CB28020CF05498 . 919040 . . [8.00.6001.23014] . . c:\windows\$hf_mig$\KB982381-IE8\SP3QFE\wininet.dll

[7] 2009-07-03 . 3B6D4582FADA3948593C56F96964FEFA . 915456 . . [8.00.6001.22896] . . c:\windows\$hf_mig$\KB972260-IE8\SP3QFE\wininet.dll

[7] 2008-08-26 . E1F83BCC84D6223965D35AB06B63BBEB . 827904 . . [7.00.6000.20900] . . c:\windows\$hf_mig$\KB956390-IE7\SP2QFE\wininet.dll

[7] 2008-08-26 . B905F284F45675F3019413DFF055C666 . 826368 . . [7.00.6000.16735] . . c:\windows\NiwradSoft Shell Pack\Backup\wininet.dll

[-] 2008-08-26 . E051262031DFDD84C766526EE5A08EDD . 892928 . . [7.00.6000.16735] . . c:\windows\ServicePackFiles\i386\wininet.dll

[-] 2008-08-26 . E051262031DFDD84C766526EE5A08EDD . 892928 . . [7.00.6000.16735] . . c:\windows\system32\wininet.dll

[-] 2008-08-26 . E051262031DFDD84C766526EE5A08EDD . 892928 . . [7.00.6000.16735] . . c:\windows\system32\dllcache\wininet.dll

[-] 2008-06-23 . 4F08E6D8C9DDA8ED4346A1857849ADB3 . 827904 . . [7.00.6000.20861] . . c:\windows\$hf_mig$\KB953838-IE7\SP2QFE\wininet.dll

[-] 2008-04-23 . 751EFBEC900CC4E4B41DB6E522B67D41 . 827392 . . [7.00.6000.20815] . . c:\windows\$hf_mig$\KB950759-IE7\SP2QFE\wininet.dll

[7] 2008-04-14 . B4AEE98A48917B274FACFB78BBE0BC84 . 671744 . . [6.00.2900.5512] . . c:\windows\ie7\wininet.dll

[7] 2007-08-13 . A4A0FC92358F39538A6494C42EF99FE9 . 818688 . . [7.00.5730.13] . . c:\windows\ie7updates\KB956390-IE7\wininet.dll

[7] 2007-08-13 . A4A0FC92358F39538A6494C42EF99FE9 . 818688 . . [7.00.5730.13] . . c:\windows\ie7updates\KB953838-IE7\wininet.dll

[-] 2007-06-27 . 17D39B59E2E3740058AE3FBCD432CEDE . 824320 . . [7.00.6000.20627] . . c:\windows\$hf_mig$\KB937143-IE7\SP2QFE\wininet.dll

[-] 2007-06-27 . 0D58CEBD30684B481C8DF3DA69375410 . 823808 . . [7.00.6000.16512] . . c:\windows\ie7updates\KB950759-IE7\wininet.dll

[-] 2007-04-25 . 26DB81279FED58D5199235C26D4836E2 . 823808 . . [7.00.6000.20583] . . c:\windows\$hf_mig$\KB933566-IE7\SP2QFE\wininet.dll

[-] 2007-04-25 . 4E9436B0301B0451ED2FB29364AB090F . 822784 . . [7.00.6000.16473] . . c:\windows\ie7updates\KB937143-IE7\wininet.dll

[-] 2006-11-07 . 92995334F993E6E49C25C6D02EC04401 . 818688 . . [7.00.5730.11] . . c:\windows\ie7updates\KB933566-IE7\wininet.dll

[7] 2006-02-28 . B1A1DA99C4A6EBFD59F86A453BF02F39 . 662016 . . [6.00.2900.2180] . . c:\windows\$NtServicePackUninstall$\wininet.dll

[-] 2005-10-21 . F3118DF4ABD118B11326D1C7A0093867 . 667136 . . [6.00.2900.2781] . . c:\windows\$hf_mig$\KB905915\SP2QFE\wininet.dll

[-] 2005-09-02 . C9ABC4AE17820BFEE9A4307B8A4E6DE9 . 666112 . . [6.00.2900.2753] . . c:\windows\$hf_mig$\KB896688\SP2QFE\wininet.dll

[-] 2005-07-03 . E992695B2D5628154B65FE8DFB0F3CCA . 665088 . . [6.00.2900.2713] . . c:\windows\$hf_mig$\KB896727\SP2QFE\wininet.dll

[-] 2005-05-02 . 8C907B730E9CFCFDF0157F3EA20D4424 . 664576 . . [6.00.2900.2668] . . c:\windows\$hf_mig$\KB883939\SP2QFE\wininet.dll

[-] 2005-03-10 . 235D1D42C2D23FA1BC8A9EDB267FFE86 . 663552 . . [6.00.2900.2627] . . c:\windows\$hf_mig$\KB890923\SP2QFE\wininet.dll

[-] 2005-01-27 . D9460271895ADBB382769AF1FC701169 . 663552 . . [6.00.2900.2598] . . c:\windows\$hf_mig$\KB867282\SP2QFE\wininet.dll

[-] 2004-09-29 . 1C035CB755ED9204176668209A3B498D . 662528 . . [6.00.2900.2518] . . c:\windows\$hf_mig$\KB834707\SP2QFE\wininet.dll

.

[-] 2008-04-14 . C4F91B363B29E589E84E6D9D41A92952 . 1544192 . . [6.00.2900.5512] . . c:\windows\explorer.exe

[7] 2008-04-14 . 418045A93CD87A352098AB7DABE1B53E . 1036800 . . [6.00.2900.5512] . . c:\windows\NiwradSoft Shell Pack\Backup\explorer.exe

[-] 2008-04-14 . C4F91B363B29E589E84E6D9D41A92952 . 1544192 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\explorer.exe

[7] 2006-02-28 . 22FE1BE02EADDE1632E478E4125639E0 . 1035264 . . [6.00.2900.2180] . . c:\windows\$NtServicePackUninstall$\explorer.exe

.

[-] 2008-04-14 . B4E7A9D7524304DC390E19ED7E1D7EE3 . 283136 . . [5.1.2600.5512] . . c:\windows\regedit.exe

[7] 2008-04-14 . AD9226BF3CED13636083BB9C76E9D2A2 . 153600 . . [5.1.2600.5512] . . c:\windows\NiwradSoft Shell Pack\Backup\regedit.exe

[-] 2008-04-14 . B4E7A9D7524304DC390E19ED7E1D7EE3 . 283136 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\regedit.exe

[7] 2006-02-28 . 8193CE5FB09E83F2699FD65BBCBE2FD2 . 153600 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\regedit.exe

[7] 2006-02-28 . 8193CE5FB09E83F2699FD65BBCBE2FD2 . 153600 . . [5.1.2600.2180] . . c:\windows\I386\REGEDIT.EXE

.

[7] 2008-04-14 . 01B4E6E990B6C5EA8856D96C7FD044B2 . 15360 . . [5.1.2600.5512] . . c:\windows\NiwradSoft Shell Pack\Backup\ctfmon.exe

[-] 2008-04-14 . 6BB3F4E4B01913F1764CC137E841B520 . 40448 . . [5.1.2600.5512] . . c:\windows\system32\ctfmon.exe

[7] 2006-02-28 . 7CE20569925DF6789C31799F0C538F29 . 15360 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ctfmon.exe

.

[7] 2008-04-14 . 0DAF0705D7B39C94E287913226688804 . 348672 . . [5.1.2600.5512] . . c:\windows\NiwradSoft Shell Pack\Backup\hnetcfg.dll

[-] 2008-04-14 . 0F68637BB752D674D110928CD31B7292 . 373248 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\hnetcfg.dll

[-] 2008-04-14 . 0F68637BB752D674D110928CD31B7292 . 373248 . . [5.1.2600.5512] . . c:\windows\system32\hnetcfg.dll

[7] 2006-02-28 . AE93E415220A4C0112768A0DEE36D28D . 348672 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\hnetcfg.dll

.

[7] 2008-08-23 . E8305C30D35E85D6657ED3E9934CB302 . 635848 . . [7.00.6000.20900] . . c:\windows\$hf_mig$\KB956390-IE7\SP2QFE\iexplore.exe

[7] 2008-08-23 . 1F03216084447F990AE797317D0A6E70 . 635848 . . [7.00.6000.16735] . . c:\windows\NiwradSoft Shell Pack\Backup\iexplore.exe

[-] 2008-08-23 . CE9F56D1CD1F4601B69C9A401CB2627C . 508360 . . [7.00.6000.16735] . . c:\windows\ServicePackFiles\i386\iexplore.exe

[-] 2008-08-23 . CE9F56D1CD1F4601B69C9A401CB2627C . 508360 . . [7.00.6000.16735] . . c:\windows\system32\dllcache\iexplore.exe

[-] 2008-06-23 . C52A9EF571E91535EB78DB4B8B95EA07 . 625664 . . [7.00.6000.20861] . . c:\windows\$hf_mig$\KB953838-IE7\SP2QFE\iexplore.exe

[-] 2008-04-22 . 197B7E4030CFBD8D2979D375E1787AA2 . 625664 . . [7.00.6000.20815] . . c:\windows\$hf_mig$\KB950759-IE7\SP2QFE\iexplore.exe

[7] 2008-04-14 . 3BFE49B4CDFAC83B0F3C79412895A179 . 93184 . . [6.00.2900.5512] . . c:\windows\ie7\iexplore.exe

[7] 2007-08-13 . DE49B348A18369B4626FBA1D49B07FB4 . 622080 . . [7.00.5730.13] . . c:\windows\ie7updates\KB956390-IE7\iexplore.exe

[7] 2007-08-13 . DE49B348A18369B4626FBA1D49B07FB4 . 622080 . . [7.00.5730.13] . . c:\windows\ie7updates\KB953838-IE7\iexplore.exe

[-] 2007-06-27 . BD8502DFD53FC24FB8D6929DC46B8C2C . 625152 . . [7.00.6000.20627] . . c:\windows\$hf_mig$\KB937143-IE7\SP2QFE\iexplore.exe

[-] 2007-06-27 . 275CEE268B9E5D82474C43D5D249D111 . 625152 . . [7.00.6000.16512] . . c:\windows\ie7updates\KB950759-IE7\iexplore.exe

[-] 2007-04-24 . 9B3516C1F30DA17ADD3818573047D63C . 625152 . . [7.00.6000.20583] . . c:\windows\$hf_mig$\KB933566-IE7\SP2QFE\iexplore.exe

[-] 2007-04-24 . 10BDB55982586A432A3951EB19A26009 . 625152 . . [7.00.6000.16473] . . c:\windows\ie7updates\KB937143-IE7\iexplore.exe

[-] 2006-10-17 . 5334D4461AA92A7B008755FE6D13C5F2 . 622080 . . [7.00.5730.11] . . c:\windows\ie7updates\KB933566-IE7\iexplore.exe

[7] 2006-02-28 . B39A6AF04A431E317C85BF061719E705 . 93184 . . [6.00.2900.2180] . . c:\windows\$NtServicePackUninstall$\iexplore.exe

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1ED16E0A-E8C4-40A0-8BC2-79485D21F796}]

2011-04-14 04:37        252832        ----a-w-        c:\programme\Mein Gutscheincode Finder\Internet Explorer\x86\ConversionOneIE.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RocketDock"="c:\programme\RocketDock\RocketDock.exe" [2007-09-02 495616]

"WMPNSCFG"="c:\programme\Windows Media Player\WMPNSCFG.exe" [2006-11-03 204288]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"VTTimer"="VTTimer.exe" [2008-05-16 94208]

"VTTrayp"="VTtrayp.exe" [2008-07-08 204800]

"SoundMan"="SOUNDMAN.EXE" [2007-04-16 577536]

"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2010-11-07 281768]

"EvtMgr6"="c:\programme\Logitech\SetPointP\SetPoint.exe" [2010-10-28 1352272]

"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2010-10-29 249064]

"icPlus"="c:\programme\icPlus\icPlus.exe" [2011-02-23 548864]

"iTunesHelper"="c:\programme\iTunes\iTunesHelper.exe" [2011-04-14 421160]

"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]

"Adobe ARM"="c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 40448]

.

c:\dokumente und einstellungen\XXX\Startmen\Programme\Autostart\

Allzeit Atomzeit.lnk - c:\programme\Allzeit Atomzeit\Atomzeit.exe [2007-4-16 77824]

Stickies.lnk - c:\programme\Stickies\stickies.exe [2008-1-16 1101824]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"MemCheckBoxInRunDlg"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]

2010-10-28 10:13        64592        ----a-w-        c:\programme\Gemeinsame Dateien\LogiShrd\Bluetooth\LBTWLgn.dll

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute        REG_MULTI_SZ           autocheck autochk *\0sprestrt\0OODBS

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

.

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^XXX^Startmenü^Programme^Autostart^Logitech . Produktregistrierung.lnk]

path=c:\dokumente und einstellungen\XXX\Startmenü\Programme\Autostart\Logitech . Produktregistrierung.lnk

backup=c:\windows\pss\Logitech . Produktregistrierung.lnkStartup

.

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^XXX^Startmenü^Programme^Autostart^thunderbird.lnk]

path=c:\dokumente und einstellungen\XXX\Startmenü\Programme\Autostart\thunderbird.lnk

backup=c:\windows\pss\thunderbird.lnkStartup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2010-11-10 10:49        932288        ----a-w-        c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]

2010-12-14 16:17        47904        ----a-w-        c:\programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleSyncNotifier.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]

2010-04-01 09:16        357696        ----a-w-        c:\programme\DAEMON Tools Lite\DTLite.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]

2008-04-13 21:13        208952        ----a-w-        c:\windows\ime\imjp8_1\imjpmig.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

2011-04-14 09:32        421160        ----a-w-        c:\programme\iTunes\iTunesHelper.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]

2008-04-13 21:13        59392        ----a-w-        c:\windows\system32\IME\PINTLGNT\IMSCINST.EXE

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]

2008-04-13 21:13        455168        ----a-w-        c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]

2008-04-13 21:13        455168        ----a-w-        c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2010-11-29 16:38        421888        ----a-w-        c:\programme\QuickTime\QTTask.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSS2009 Browser Monitor]

2010-06-22 13:11        49664        ----a-w-        c:\programme\Steganos Privacy Suite 11\SteganosBrowserMonitor.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSS2009 File Redirection Starter]

2010-06-22 13:07        17408        ----a-w-        c:\programme\Steganos Privacy Suite 11\fredirstarter.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSS2009 HotKeys]

2010-06-22 13:11        80896        ----a-w-        c:\programme\Steganos Privacy Suite 11\SteganosHotKeyService.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\THGuard]

2010-08-22 13:56        1046688        ----a-w-        c:\programme\TrojanHunter 5.0\THGuard.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant]

2010-07-04 19:51        17408        ----a-w-        c:\programme\Unlocker\UnlockerAssistant.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]

2006-11-03 07:56        204288        ----a-w-        c:\programme\Windows Media Player\wmpnscfg.exe

.

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"ctfmon.exe"=c:\windows\system32\ctfmon.exe

"Steam"="c:\games\steam\steam.exe" -silent

"UpdateStar"=c:\dokumente und einstellungen\XXX\Anwendungsdaten\UpdateStar\UpdateStar.exe -A

"WMPNSCFG"=c:\programme\Windows Media Player\WMPNSCFG.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"VTTrayp"=VTtrayp.exe

"Sony Ericsson PC Suite"="c:\programme\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions

"iTunesHelper"="c:\programme\iTunes\iTunesHelper.exe"

"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 9.0\Reader\Reader_sl.exe"

"Adobe ARM"="c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe"

"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"FirewallOverride"=dword:00000001

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"c:\\WINDOWS\\system32\\sessmgr.exe"=

"c:\\WINDOWS\\system32\\fxsclnt.exe"=

"c:\\Programme\\NetMeeting\\Conf.exe"=

"c:\\Programme\\Mozilla Firefox\\firefox.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Programme\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=

"c:\\Programme\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Programme\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Programme\\Java\\jre6\\launch4j-tmp\\JDownloader.exe"=

"c:\\WINDOWS\\system32\\java.exe"=

"c:\\Programme\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=

"c:\\Games\\Steam\\Steam.exe"=

"c:\\Games\\Steam\\steamapps\\pr3d4t0r1991\\condition zero\\hl.exe"=

"c:\\Programme\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Programme\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Programme\\Opera\\opera.exe"=

"c:\\Games\\Steam\\steamapps\\pr3d4t0r1991\\counter-strike\\hl.exe"=

"c:\\Programme\\Bonjour\\mDNSResponder.exe"=

"c:\\Programme\\iTunes\\iTunes.exe"=

"c:\\Programme\\ICQ7.5\\ICQ.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"50525:TCP"= 50525:TCP:BitComet 50525 TCP

"50525:UDP"= 50525:UDP:BitComet 50525 UDP

"55232:TCP"= 55232:TCP:*:Disabled:SolidNetworkManager

"55232:UDP"= 55232:UDP:*:Disabled:SolidNetworkManager

"1038:TCP"= 1038:TCP:Akamai NetSession Interface

"5000:UDP"= 5000:UDP:Akamai NetSession Interface

.

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [15.11.2006 16:43 691696]

R0 ViBus;ViBus;c:\windows\system32\drivers\ViBus.sys [11.11.2007 15:32 16896]

R0 ViPrt;VIA SATA IDE Device Driver;c:\windows\system32\drivers\ViPrt.sys [11.11.2007 15:32 52224]

R1 SLEE_17_DRIVER;Steganos Live Encryption Engine 17 [Driver];c:\windows\system32\drivers\SleeN17.sys [17.02.2010 16:00 94560]

R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe -k Akamai [28.02.2006 14:00 14336]

R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [04.12.2009 19:11 136360]

R2 HssWd;Hotspot Shield Monitoring Service;c:\programme\Hotspot Shield\bin\hsswd.exe -product HSS --> c:\programme\Hotspot Shield\bin\hsswd.exe -product HSS [?]

R2 LBeepKE;Logitech Beep Suppression Driver;c:\windows\system32\drivers\LBeepKE.sys [20.01.2011 15:14 10448]

R2 Start BT in service;Start BT in service;c:\programme\IVT Corporation\BlueSoleil\StartSkysolSvc.exe [27.12.2007 16:39 51816]

R3 uscbs109;uscbs109;c:\windows\system32\drivers\uscbs109.sys [22.03.2005 8672]

R3 uscsc109;uscsc109;c:\windows\system32\drivers\uscsc109.sys [22.03.2005 102336]

S1 SSHDRV79;SSHDRV79;\??\c:\windows\system32\drivers\SSHDRV79.sys --> c:\windows\system32\drivers\SSHDRV79.sys [?]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.03.2010 14:16 130384]

S2 SVKP;SVKP; [x]

S3 ATE_PROCMON;ATE_PROCMON;\??\c:\programme\Anti Trojan Elite\ATEPMon.sys --> c:\programme\Anti Trojan Elite\ATEPMon.sys [?]

S3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [17.01.2011 14:56 13192]

S3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [17.01.2011 14:56 8456]

S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance; [x]

S3 Lavasoft Kernexplorer;Lavasoft helper driver;\??\c:\programme\Lavasoft\Ad-Aware\KernExplorer.sys --> c:\programme\Lavasoft\Ad-Aware\KernExplorer.sys [?]

S3 MaplomL;MaplomL; [x]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.03.2010 14:16 753504]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

Akamai        REG_MULTI_SZ           Akamai

.

Inhalt des "geplante Tasks" Ordners

.

2011-04-29 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\programme\Apple Software Update\SoftwareUpdate.exe [2009-10-22 09:50]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.google.de/

mWindow Title = Microsoft Internet Explorer

uInternet Settings,ProxyOverride = *.local

IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\programme\ICQ7.5\ICQ.exe

FF - ProfilePath - c:\dokumente und einstellungen\XXX\Anwendungsdaten\Mozilla\Firefox\Profiles\ny4sv4r7.default\

FF - prefs.js: browser.search.defaulturl - hxxp://www.google.de/search?q=

FF - prefs.js: browser.search.selectedEngine - Wikipedia (de)

FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/

FF - user.js: network.http.max-persistent-connections-per-server - 4

FF - user.js: nglayout.initialpaint.delay - 600

FF - user.js: content.notify.interval - 600000

FF - user.js: content.max.tokenizing.time - 1800000

FF - user.js: content.switch.threshold - 600000

FF - user.js: network.http.max-connections-per-server - 8

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

ShellExecuteHooks-{88485281-8b4b-4f8d-9ede-82e29a064277} - (no file)

MSConfigStartUp-Adobe Reader Speed Launcher - c:\programme\Adobe\Reader 9.0\Reader\Reader_sl.exe

MSConfigStartUp-DivXUpdate - c:\programme\DivX\DivX Update\DivXUpdate.exe

MSConfigStartUp-Mal Updater 2 - c:\programme\Mal Updater 2\MalUpdater.exe

AddRemove-{C1080852-065E-4991-9260-F3756E3CC182} - c:\dokumente und einstellungen\XXX\Lokale Einstellungen\Anwendungsdaten\{DE032019-B933-4DF4-9174-48C52613DA13}\CursorFX_setup.exe

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2011-05-11 17:30

Windows 5.1.2600 Service Pack 3 NTFS

.

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteinträge... 

.

Scanne versteckte Dateien... 

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 0

.

**************************************************************************

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\S-1-5-21-1985613394-3781928092-3764147744-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]

@Denied: (Full) (LocalSystem)

@SACL=

"{20D04FE0-3AEA-1069-A2D8-08002B30309D}"="c:\\WINDOWS\\System32\\shell32.dll,15"

"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="c:\\WINDOWS\\system32\\SHELL32.dll,17"

"{208D2C60-3AEA-1069-A2D7-08002B30309D}"="c:\\WINDOWS\\system32\\SHELL32.dll,17"

"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="c:\\WINDOWS\\system32\\shell32.dll,22"

"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="c:\\WINDOWS\\system32\\shell32.dll,23"

"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="c:\\WINDOWS\\system32\\shell32.dll,24"

"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="c:\\WINDOWS\\system32\\shell32.dll,-175"

"{21EC2020-3AEA-1069-A2DD-08002B30309D}"="c:\\WINDOWS\\System32\\shell32.dll,-137"

"{2227A280-3AEA-1069-A2DE-08002B30309D}"="c:\\WINDOWS\\System32\\shell32.dll,-138"

"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="c:\\WINDOWS\\system32\\shell32.dll,38"

"AudioCD"="c:\\WINDOWS\\System32\\shell32.dll,40"

"{FBF23B42-E3F0-101B-8488-00AA003E56F8}"="c:\\WINDOWS\\system32\\shell32.dll,220"

"{450D8FBA-AD25-11D0-98A8-0800361B1103}"="c:\\WINDOWS\\system32\\mydocs.dll,0"

"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="c:\\WINDOWS\\system32\\main.cpl,10"

"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="c:\\WINDOWS\\system32\\wiashext.dll,0"

"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="c:\\WINDOWS\\system32\\mstask.dll,-100"

"{88C6C381-2E85-11D0-94DE-444553540000}"="c:\\WINDOWS\\System32\\occache.dll,0"

"{BDEADF00-C265-11d0-BCED-00A0C90AB50F}"="c:\\Programme\\COMMON~1\\MICROS~1\\WEBFOL~1\\MSONSEXT.DLL,0"

"{FF393560-C2A7-11CF-BFF4-444553540000}"="c:\\WINDOWS\\System32\\shdocvw.dll,-20785"

"{F5175861-2688-11d0-9C5E-00AA00A45957}"="c:\\WINDOWS\\System32\\webcheck.dll,0"

"{85BBD920-42A0-1069-A2E4-08002B30309D}"="c:\\WINDOWS\\system32\\syncui.dll,0"

.

[HKEY_USERS\S-1-5-21-1985613394-3781928092-3764147744-1006\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{B2B4686B-2CD7-5F26-F7F4-38E29B1E616C}*]

@Allowed: (Read) (RestrictedCode)

@Allowed: (Read) (RestrictedCode)

"abijmkaaehgpbecjnhocdnhimlbekhgnll"=hex:61,61,00,00

"bbijmkaaehgpbecjnhncndfeomjjcfnmomff"=hex:61,61,00,00

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10o_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10o_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•Ñw*]

"5E7CEC10DF0760D4F8DAFB12FDC06CCD"="02:\\Software\\Adobe\\FeatureSubscriptions\\DVAAdobeDocMeta\\{01CEC7E5-70FD-4D06-8FAD-BF21DF0CC6DC}\\Registered"

.

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]

"OODEFRAG10.00.00.01WORKSTATION"="FCCFE551B82F0A35E2E794DA68A18D01D0B16430B1162B6D970BC3ED0EBFF5B2C6AAE7EB94FDD7FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79335D575E7D6A3B98085D575E7D6A3B9808A2D97226D213B555BB230F374CA448C1BBAACD3F14A9BBADB2D64E84E4DA17AB6FD0D37B3D41CD3FC20DDB32D1067752E09F81A819621CCA1334B932A68AD13BB508CEE24E3EA6940CF93A999FDA60FC5D25480A2F7F069BE61509E72C4A3D119D819B13CC9877673D9B3CDD825DEE23A8EDAB5D8690F0DA9B4B65CAAC99FD61294F9F79155CAF820F6423579B51FE4BD2ED6F01A3A6486635ED2DE0337AAA04724876E3D52136D74F8EE7BD5D79E49FFDDF85386056EA42CB56F11799F3D0F425886F09917B617BDE14B5AE0F1FE46D60BE98A868BA2B948AA278BA958F70D4016F8A7F9E0880A734B6EB2CCD0EB8A7434D035DBC70D02930B43B81ABDD7DE5DB1F0145A7E654B757FA1D1A88170F620710D7C3B299176D90B3E60234F0DE111C003C3A2DBB8F2E652792C283908A591CD0D830F25BAB769188DC36DE5EF0E2BEBBD9A27FAD5E2F10C8C753D55040E8099C805679DF3379AF62B300ACC00589D4C22EA6C6E8DB021D2F6BDE6C36BA94E7C37A5297D544D1F933B4217338DDDA02473ED1FC1C9A96E5EF60D706A07880685C27A2736CE87E14B05C415DE6B34DFD41C596F27C1E7C57E03F9AB6746A78CBBE1CA803DBA0A235D55C6CE6F2B27C966CB148C8C0DFE772A05361661BF6E8E888212C155B5F8427DF9B11E287FA2A2AC5A6A0F624CCB24C0E1CD05081F764299AB2574AAA8B0FCA51B283F6D3A1392E927939C766C6598E4DCC6C85173CA08B9A0236968980D113EFEFFA9D88AC312A58B5945A4CA17D76C5CC9D6851057621F172BE43BF0DFE87C6D212A3DD99BE3C631996219C28E2D5A5B8B231A8896612CC1D45EC1573EDC22413C8AA0E57B0124216086223947290DB605C6C99F211171D4E8405D7EA9AF3989903A8584BFB72C8549439AF1ABA229D4530F826DE3B7F97879ACFDA20A160FA0307E77E4BB7340EAD4D15155E6A956020A78AD05FCF2DB57C8A657230475C66228186C7A5A0C2EB30A538AC77588D635C2029A27BDC96B3963A34782F7255387C8075FD1A96A0829F773AD0757BBE25195B312A2C93C414F0747B4A24AE4892C978FA71DB9CDFB4717D04615872F16A2BFD5275DF4B589ADC67D04A89A8CB5C7941307392DB2B2B50D956C293FC86BA19928F9AF8FB02D1DDA59B5D4E35843FAB9303DA5B9E3D4E1B90C2DA92016BE11F05C1B24D450886AE261BED554BAEA838123603C55666CF6409B096B107A6F1AAA7135AA66744493AC1DDE9F60599CA26BEDE49D5150A2272105966C03CD1BCE1300431434A27"

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

.

- - - - - - - > 'winlogon.exe'(2016)

c:\windows\system32\SETUPAPI.dll

c:\windows\system32\sfc_os.dll

c:\programme\gemeinsame dateien\logishrd\bluetooth\LBTWlgn.dll

c:\windows\system32\COMRes.dll

c:\windows\system32\cscui.dll

.

- - - - - - - > 'lsass.exe'(248)

c:\windows\system32\setupapi.dll

.

- - - - - - - > 'explorer.exe'(1760)

c:\programme\RocketDock\RocketDock.dll

c:\windows\system32\COMRes.dll

c:\windows\System32\cscui.dll

c:\programme\Windows Media Player\wmpband.dll

c:\windows\system32\LINKINFO.dll

c:\windows\system32\ntshrui.dll

c:\windows\system32\SETUPAPI.dll

c:\windows\system32\NETSHELL.dll

c:\windows\system32\credui.dll

c:\windows\system32\stobject.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\programme\Avira\AntiVir Desktop\avguard.exe

c:\programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\programme\Avira\AntiVir Desktop\avshadow.exe

c:\programme\IVT Corporation\BlueSoleil\BTNtService.exe

c:\programme\Bonjour\mDNSResponder.exe

c:\programme\Hotspot Shield\bin\openvpnas.exe

c:\programme\Hotspot Shield\HssWPR\hsssrv.exe

c:\programme\Hotspot Shield\bin\hsswd.exe

c:\programme\Java\jre6\bin\jqs.exe

c:\programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe

c:\programme\CDBurnerXP\NMSAccessU.exe

c:\windows\system32\HPZipm12.exe

c:\programme\CyberLink\Shared Files\RichVideo.exe

c:\windows\system32\wscntfy.exe

c:\windows\system32\wbem\wmiapsrv.exe

c:\windows\system32\VTTimer.exe

c:\windows\system32\VTtrayp.exe

c:\windows\SOUNDMAN.EXE

c:\programme\Gemeinsame Dateien\LogiShrd\KHAL3\KHALMNPR.EXE

c:\programme\iPod\bin\iPodService.exe

c:\programme\icPlus\Plugins\ICQSpamblocker\ICQSpamblocker.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2011-05-11  17:44:31 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2011-05-11 15:44

.

Vor Suchlauf: 11 Verzeichnis(se), 145.270.165.504 Bytes frei

Nach Suchlauf: 17 Verzeichnis(se), 145.229.074.432 Bytes frei

.

WindowsXP-KB310994-SP2-Home-BootDisk-DEU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="NEU" /execute

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /execute /fastdetect

.

Current=1 Default=1 Failed=0 LastKnownGood=6 Sets=1,2,3,4,5,6

- - End Of File - - 74DED5158EE73DB6492F0212ADB4DE91

SPTD ?

SPTD ist ein Treiber der u.a. von Daemon-Tools für virtuelle CD- und DVD-Laufwerke installiert wird.

Combofix - Scripten

1. Starte das Notepad (Start / Ausführen / notepad[Enter])

2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein.

Code:

Regnull::

[HKEY_USERS\S-1-5-21-1985613394-3781928092-3764147744-1006\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{B2B4686B-2CD7-5F26-F7F4-38E29B1E616C}*]
 

Driver::

MaplomL

SVKP

3. Speichere im Notepad als CFScript.txt auf dem Desktop.

4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall.
(Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !)

5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.

http://users.pandora.be/bluepatchy/m...s/CFScript.gif

6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien:
Combofix.txt

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Erledigt. Konnte allerdings keinen Unterschied zum vorherigen CF Durchlauf erkennen. Aber sieh selbst:

Code:

ComboFix 11-05-11.01 - XXX 11.05.2011  22:23:30.2.2 - x86

Microsoft Windows XP Home Edition  5.1.2600.3.1252.49.1031.18.958.409 [GMT 2:00]

ausgeführt von:: c:\dokumente und einstellungen\XXX\Desktop\cofi.exe

Benutzte Befehlsschalter :: c:\dokumente und einstellungen\XXX\Desktop\CFScript.txt

AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}

AV: Avira AntiVir PersonalEdition Classic *Disabled/Updated* {84C966AC-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Disabled/Updated* {85399A1C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Disabled/Updated* {853E4984-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {00000000-0000-0000-0000-000000000000}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {00000246-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {80722100-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {84C1BDDC-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {84C3D054-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {84C576D4-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {84CC4914-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {84CC7054-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {84D69C1C-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {84E75AA4-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {84F4DDDC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {84FBCB64-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8500F51C-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8516156C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85165B9C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {851915BC-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {851ABA5C-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {851C48C4-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {851DD7A4-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {851E45E4-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {851E4ACC-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {851E89A4-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {851EBA5C-FFA4-0115-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {851EDDDC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {851F14D4-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {851F3C44-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {851F77E4-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8520172C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8520397C-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85205714-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8520636C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85210724-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85210794-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85211764-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85217BB4-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8521E924-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8521EA5C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8521EC34-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85220DDC-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8522377C-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852248FC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852255BC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8522C60C-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8522CC44-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852364AC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852364DC-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85236DDC-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8523CA1C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852419B4-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85242B44-FFA4-00FE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85248C1C-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852493E4-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8524EC1C-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8525381C-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85258394-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85258DDC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8525C594-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85260DB4-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8526B94C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85270924-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852759A4-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85275AAC-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85276DDC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8527760C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852787E4-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8527ADDC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8527CB5C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8527E50C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85281054-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85282054-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85283DDC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8528478C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8528ABD4-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8528C3DC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8528CA94-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8528CDDC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8528EDDC-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85295BF4-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85299614-FFA4-00EF-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852A5C1C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852AAB64-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852B43F4-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852B6A1C-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852B7354-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852B7DDC-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852B82B4-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852BDA84-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852BF5A4-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852C1054-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852C39D4-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852C529C-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852C7DDC-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852CBA5C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852CDDDC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852CFC1C-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852D232C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852D338C-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852D48AC-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852D4A34-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852D6244-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852D660C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852DD054-FFA4-00C9-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852E47C4-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852EC574-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852F5C1C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852F6DDC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {852FB714-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {853027EC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85304C24-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8530A714-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8530D73C-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8530EDDC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8531E2DC-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8532740C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8532DDDC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {853384EC-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8533D464-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {853406BC-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8534098C-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85343A84-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85344924-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85346DDC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8536ADDC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8536E3D4-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85377B84-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {853786F4-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {853794A4-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8537C404-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8537D4AC-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8537F89C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {853808D4-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8538990C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8538E7E4-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85390C1C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {853992D4-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8539945C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {853994DC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8539B6D4-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8539CCE4-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {853A1584-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {853A1C1C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {853A22EC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {853AD704-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {853B3914-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {853BD70C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {853BE15C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {853BE9F4-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {853C3C44-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {853C7C1C-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {853D21F4-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {853D7B64-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {853DCA74-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8540662C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8540A054-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8541A54C-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8541B90C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8541D5FC-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8545C434-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85460054-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85460574-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {854773A4-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85477C2C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85485894-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8548BBB4-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {854923CC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {854A4DDC-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {854A58CC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {854A973C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {854B94CC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {854BD564-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {854D46FC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {854E2DDC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85509804-FFA4-0107-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8550AA4C-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85510834-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8553BC1C-FFA4-00EF-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8557F23C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8559689C-FFA4-00F5-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85597054-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {855B1514-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {855BF9C4-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {855C6A6C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {855CB994-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {855CFDDC-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {855D2554-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {85620A5C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {856B890C-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {BADB0D00-FFA4-00DE-0D24-347CA8A3377C}

AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {BADB0D00-FFA4-00F5-0D24-347CA8A3377C}

AV: BitDefender Antivirus *Disabled/Updated* {6C4BB89C-B0ED-4F41-A29C-4373888923BB}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

.

(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

-------\Legacy_SVKP

-------\Service_MaplomL

-------\Service_SVKP

.

.

(((((((((((((((((((((((   Dateien erstellt von 2011-04-11 bis 2011-05-11  ))))))))))))))))))))))))))))))

.

.

2011-05-11 14:13 . 2011-05-11 14:13        --------        d-----w-        C:\_OTL

2011-05-10 19:25 . 2011-05-10 19:26        --------        d-----w-        c:\programme\TagRunner

2011-05-10 19:11 . 2011-05-10 19:11        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\RapidSolution

2011-05-09 16:20 . 2011-05-09 16:20        --------        d-----w-        c:\dokumente und einstellungen\XXX\Lokale Einstellungen\Anwendungsdaten\Secunia PSI

2011-05-09 16:20 . 2011-05-09 16:20        --------        d-----w-        c:\programme\Secunia

2011-05-09 15:57 . 2011-05-09 15:57        --------        d-----w-        c:\programme\Mein Gutscheincode Finder

2011-05-09 15:52 . 2011-05-09 15:54        --------        d-----w-        c:\programme\ICQ7.5

2011-05-08 19:17 . 2011-05-08 19:17        --------        d-----w-        c:\dokumente und einstellungen\XXX\Lokale Einstellungen\Anwendungsdaten\Temp

2011-05-03 18:47 . 2011-05-03 18:56        --------        d-----w-        c:\programme\YouFreeTV

2011-04-28 09:42 . 2011-04-28 09:42        --------        d-----w-        c:\windows\USB Vibration

2011-04-28 09:42 . 2002-08-02 00:20        151552        ----a-w-        c:\programme\Gemeinsame Dateien\InstallShield\Professional\RunTime\0700\Intel32\iuser.dll

2011-04-28 09:42 . 2011-04-28 09:42        270468        ----a-w-        c:\programme\Gemeinsame Dateien\InstallShield\Professional\RunTime\0700\Intel32\Setup.dll

2011-04-28 09:42 . 2011-04-28 09:42        159876        ----a-w-        c:\programme\Gemeinsame Dateien\InstallShield\Professional\RunTime\0700\Intel32\IGdi.dll

2011-04-28 09:42 . 2002-08-05 08:46        57344        ----a-w-        c:\programme\Gemeinsame Dateien\InstallShield\Professional\RunTime\0700\Intel32\ctor.dll

2011-04-28 09:42 . 2002-08-02 01:10        5632        ----a-w-        c:\programme\Gemeinsame Dateien\InstallShield\Professional\RunTime\0700\Intel32\DotNetInstaller.exe

2011-04-28 09:42 . 2002-08-02 00:20        634880        ----a-w-        c:\programme\Gemeinsame Dateien\InstallShield\Professional\RunTime\0700\Intel32\iKernel.dll

2011-04-28 09:42 . 2002-08-02 00:20        237568        ----a-w-        c:\programme\Gemeinsame Dateien\InstallShield\Professional\RunTime\0700\Intel32\iscript.dll

2011-04-28 09:42 . 2011-04-28 09:42        --------        d-----w-        c:\programme\USB Vibration

2011-04-26 12:45 . 2011-04-26 12:45        --------        d-----w-        c:\programme\iPod

2011-04-26 12:40 . 2011-04-26 12:40        --------        d-----w-        c:\programme\Bonjour

2011-04-25 12:54 . 2011-04-28 20:30        --------        d-----w-        c:\dokumente und einstellungen\XXX\Anwendungsdaten\vlc

2011-04-24 16:38 . 2011-05-01 23:43        --------        d-----w-        c:\programme\Xpadder

2011-04-24 15:08 . 2011-04-24 16:42        --------        d-----w-        c:\programme\Recettear

2011-04-17 23:27 . 2011-04-17 23:27        --------        d-----w-        c:\dokumente und einstellungen\XXX\Lokale Einstellungen\Anwendungsdaten\Songbird2

2011-04-17 23:27 . 2011-04-17 23:27        --------        d-----w-        c:\dokumente und einstellungen\XXX\Anwendungsdaten\Songbird2

2011-04-17 15:55 . 2011-04-21 08:49        --------        d-----w-        c:\programme\ICQ Away Reader

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-04-17 23:22 . 2006-11-17 12:20        850152        ----a-w-        c:\windows\system32\SpoonUninstall.exe

2011-04-06 14:20 . 2011-04-06 14:20        91424        ----a-w-        c:\windows\system32\dnssd.dll

2011-04-06 14:20 . 2011-04-06 14:20        107808        ----a-w-        c:\windows\system32\dns-sd.exe

2011-03-17 15:47 . 2009-12-04 17:11        137656        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2011-02-18 15:36 . 2009-04-03 22:09        4184352        ----a-w-        c:\windows\system32\usbaaplrc.dll

2011-02-18 15:36 . 2007-12-27 13:49        41984        ----a-w-        c:\windows\system32\drivers\usbaapl.sys

2010-09-19 20:19 . 2010-09-19 20:19        58652        ----a-w-        c:\programme\AMVapp-uninst.exe

2011-04-29 17:34 . 2011-03-27 11:47        142296        ----a-w-        c:\programme\mozilla firefox\components\browsercomps.dll

2008-08-23 05:56        635848        --sha-w-        c:\windows\NiwradSoft Shell Pack\Backup\iexplore.exe

2008-04-14 06:52        60416        --sha-w-        c:\windows\NiwradSoft Shell Pack\Backup\msimn.exe

2006-05-03 10:06        163328        --sh--r-        c:\windows\system32\flvDX.dll

2004-01-25 16:18        70656        --sha-w-        c:\windows\system32\i420vfw.dll

2007-02-21 11:47        31232        --sh--r-        c:\windows\system32\msfDX.dll

2008-03-16 13:30        216064        --sh--r-        c:\windows\system32\nbDX.dll

2005-02-28 11:16        240128        --sha-r-        c:\windows\system32\x.264.exe

.

.

------- Sigcheck -------

.

[7] 2008-04-14 06:52 . D0DE8A2EC95184E5193BB4B3112E29DF . 846848 . . [2001.12.4414.700] . . c:\windows\NiwradSoft Shell Pack\Backup\comres.dll

[-] 2008-04-14 06:52 . 4CC2423E2A3DBEA7964F5F3B7077347A . 1548800 . . [2001.12.4414.700] . . c:\windows\ServicePackFiles\i386\comres.dll

[-] 2008-04-14 06:52 . 4CC2423E2A3DBEA7964F5F3B7077347A . 1548800 . . [2001.12.4414.700] . . c:\windows\system32\comres.dll

[7] 2006-02-28 12:00 . 4B9D9E2708019763C5A72DA776DB1158 . 846848 . . [2001.12.4414.258] . . c:\windows\$NtServicePackUninstall$\comres.dll

.

[7] 2008-04-14 . F09A527B422E25C478E38CAA0E44417A . 513024 . . [5.1.2600.5512] . . c:\windows\NiwradSoft Shell Pack\Backup\winlogon.exe

[-] 2008-04-14 . AD37DF3FB8F168E42C09B77B487F6812 . 552448 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\winlogon.exe

[-] 2008-04-14 . AD37DF3FB8F168E42C09B77B487F6812 . 552448 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe

[7] 2006-02-28 . 2B6A0BAF33A9918F09442D873848FF72 . 507392 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\winlogon.exe

.

[7] 2010-09-10 . FC277C347BBAAE912A5B0748B3504483 . 5958656 . . [8.00.6001.23067] . . c:\windows\$hf_mig$\KB2360131-IE8\SP3QFE\mshtml.dll

[7] 2010-05-06 . A0091E83B21A4C2627D1DD1A64C1B4B9 . 5953024 . . [8.00.6001.23019] . . c:\windows\$hf_mig$\KB982381-IE8\SP3QFE\mshtml.dll

[7] 2009-07-19 . 165056346E0A00566A442287DAA7575F . 5938176 . . [8.00.6001.22902] . . c:\windows\$hf_mig$\KB972260-IE8\SP3QFE\mshtml.dll

[7] 2008-08-27 . 4872C0DA25F551A3E869501833754494 . 3593216 . . [7.00.6000.16735] . . c:\windows\NiwradSoft Shell Pack\Backup\mshtml.dll

[-] 2008-08-27 . 3E01CE0ACDFCE760363CF0A85BDE7EF5 . 3753472 . . [7.00.6000.16735] . . c:\windows\ServicePackFiles\i386\mshtml.dll

[-] 2008-08-27 . 3E01CE0ACDFCE760363CF0A85BDE7EF5 . 3753472 . . [7.00.6000.16735] . . c:\windows\system32\mshtml.dll

[-] 2008-08-27 . 3E01CE0ACDFCE760363CF0A85BDE7EF5 . 3753472 . . [7.00.6000.16735] . . c:\windows\system32\dllcache\mshtml.dll

[7] 2008-08-26 . 21B2247D24C8A61C12CD3BE8F3C30AC8 . 3594752 . . [7.00.6000.20900] . . c:\windows\$hf_mig$\KB956390-IE7\SP2QFE\mshtml.dll

[-] 2008-06-23 . 209A03C0EEF909DFCDCBB56C2BBF91CD . 3594240 . . [7.00.6000.20861] . . c:\windows\$hf_mig$\KB953838-IE7\SP2QFE\mshtml.dll

[-] 2008-04-23 . 60942CB0B5CADF130FC1795F5FEEE8F5 . 3593728 . . [7.00.6000.20815] . . c:\windows\$hf_mig$\KB950759-IE7\SP2QFE\mshtml.dll

[7] 2008-04-14 . 72AE55A9FFBC60650339CB12E35C7DD5 . 3066880 . . [6.00.2900.5512] . . c:\windows\ie7\mshtml.dll

[7] 2007-08-13 . C6EC2493346ED8888A549F59210A8ED3 . 3578368 . . [7.00.5730.13] . . c:\windows\ie7updates\KB956390-IE7\mshtml.dll

[7] 2007-08-13 . C6EC2493346ED8888A549F59210A8ED3 . 3578368 . . [7.00.5730.13] . . c:\windows\ie7updates\KB953838-IE7\mshtml.dll

[-] 2007-07-18 . E8EC18571090C12A013B83BA363364A4 . 3583488 . . [7.00.6000.16525] . . c:\windows\ie7updates\KB950759-IE7\mshtml.dll

[-] 2007-07-18 . B91AB1E55D77740D500BE0C4B2861844 . 3584000 . . [7.00.6000.20641] . . c:\windows\$hf_mig$\KB937143-IE7\SP2QFE\mshtml.dll

[-] 2007-05-08 . 07ABB2A695B8F91F7A12BE2BDD3E5932 . 3584000 . . [7.00.6000.20591] . . c:\windows\$hf_mig$\KB933566-IE7\SP2QFE\mshtml.dll

[-] 2007-05-08 . CD2DFBDD8C553443DE0EC55552A512C4 . 3583488 . . [7.00.6000.16481] . . c:\windows\ie7updates\KB937143-IE7\mshtml.dll

[-] 2006-11-07 . CBF04597F9CF7739E572276A2698FDD3 . 3577856 . . [7.00.5730.11] . . c:\windows\ie7updates\KB933566-IE7\mshtml.dll

[7] 2006-02-28 . 3910C7977DF6C8BCB604350173066D79 . 3070464 . . [6.00.2900.2853] . . c:\windows\$NtServicePackUninstall$\mshtml.dll

[7] 2006-02-28 . 3910C7977DF6C8BCB604350173066D79 . 3070464 . . [6.00.2900.2853] . . c:\windows\I386\MSHTML.DLL

[7] 2006-02-20 . 01432C2102578F0AB9ADDFEC91043D06 . 3073024 . . [6.00.2900.2853] . . c:\windows\$hf_mig$\KB911164\SP2QFE\mshtml.dll

[-] 2005-11-23 . 8ABDBAE6032562F17DCF962847ABB811 . 3016192 . . [6.00.2900.2802] . . c:\windows\$hf_mig$\KB905915\SP2QFE\mshtml.dll

[-] 2005-10-05 . 8898B48E79C56605393FDB7F3A033036 . 3015680 . . [6.00.2900.2769] . . c:\windows\$hf_mig$\KB896688\SP2QFE\mshtml.dll

[-] 2005-07-20 . 2068C163B1FE8BF48FC6174234D0F237 . 3014144 . . [6.00.2900.2722] . . c:\windows\$hf_mig$\KB896727\SP2QFE\mshtml.dll

[-] 2005-05-02 . 083EFE3B8E19213B6C6DAAB6F2F83954 . 3012608 . . [6.00.2900.2668] . . c:\windows\$hf_mig$\KB883939\SP2QFE\mshtml.dll

[-] 2005-03-09 . 243340D137D0B54CC5B440D7E4880B63 . 3011072 . . [6.00.2900.2627] . . c:\windows\$hf_mig$\KB890923\SP2QFE\mshtml.dll

[-] 2005-01-27 . 19F79F718CABBFC3DAD25D7914D5601B . 3008000 . . [6.00.2900.2604] . . c:\windows\$hf_mig$\KB867282\SP2QFE\mshtml.dll

[-] 2004-09-29 . EF245F9603EF899E9A5B3A2D107BC32E . 3004928 . . [6.00.2900.2524] . . c:\windows\$hf_mig$\KB834707\SP2QFE\mshtml.dll

.

[7] 2008-04-14 . B0050CC5340E3A0760DD8B417FF7AEBD . 580096 . . [5.1.2600.5512] . . c:\windows\NiwradSoft Shell Pack\Backup\user32.dll

[-] 2008-04-14 . C268AE6C540CC43F2264C8CB7A9A4243 . 580096 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\user32.dll

[-] 2008-04-14 . C268AE6C540CC43F2264C8CB7A9A4243 . 580096 . . [5.1.2600.5512] . . c:\windows\system32\user32.dll

[-] 2007-03-08 . 78785EFF8CB90CEC1862A4CCFD9A3C3A . 579584 . . [5.1.2600.3099] . . c:\windows\$hf_mig$\KB925902\SP2QFE\user32.dll

[7] 2006-02-28 . 56785FD5236D7B22CF471A6DA9DB46D8 . 578560 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\user32.dll

[-] 2005-03-02 . 4C90159A69A5FD3EB39C71411F28FCFF . 578560 . . [5.1.2600.2622] . . c:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll

.

[7] 2010-09-10 . 7B7028B726053782DD9B98B729515567 . 919552 . . [8.00.6001.23060] . . c:\windows\$hf_mig$\KB2360131-IE8\SP3QFE\wininet.dll

[7] 2010-05-06 . B5B9887088B8168D52CB28020CF05498 . 919040 . . [8.00.6001.23014] . . c:\windows\$hf_mig$\KB982381-IE8\SP3QFE\wininet.dll

[7] 2009-07-03 . 3B6D4582FADA3948593C56F96964FEFA . 915456 . . [8.00.6001.22896] . . c:\windows\$hf_mig$\KB972260-IE8\SP3QFE\wininet.dll

[7] 2008-08-26 . E1F83BCC84D6223965D35AB06B63BBEB . 827904 . . [7.00.6000.20900] . . c:\windows\$hf_mig$\KB956390-IE7\SP2QFE\wininet.dll

[7] 2008-08-26 . B905F284F45675F3019413DFF055C666 . 826368 . . [7.00.6000.16735] . . c:\windows\NiwradSoft Shell Pack\Backup\wininet.dll

[-] 2008-08-26 . E051262031DFDD84C766526EE5A08EDD . 892928 . . [7.00.6000.16735] . . c:\windows\ServicePackFiles\i386\wininet.dll

[-] 2008-08-26 . E051262031DFDD84C766526EE5A08EDD . 892928 . . [7.00.6000.16735] . . c:\windows\system32\wininet.dll

[-] 2008-08-26 . E051262031DFDD84C766526EE5A08EDD . 892928 . . [7.00.6000.16735] . . c:\windows\system32\dllcache\wininet.dll

[-] 2008-06-23 . 4F08E6D8C9DDA8ED4346A1857849ADB3 . 827904 . . [7.00.6000.20861] . . c:\windows\$hf_mig$\KB953838-IE7\SP2QFE\wininet.dll

[-] 2008-04-23 . 751EFBEC900CC4E4B41DB6E522B67D41 . 827392 . . [7.00.6000.20815] . . c:\windows\$hf_mig$\KB950759-IE7\SP2QFE\wininet.dll

[7] 2008-04-14 . B4AEE98A48917B274FACFB78BBE0BC84 . 671744 . . [6.00.2900.5512] . . c:\windows\ie7\wininet.dll

[7] 2007-08-13 . A4A0FC92358F39538A6494C42EF99FE9 . 818688 . . [7.00.5730.13] . . c:\windows\ie7updates\KB956390-IE7\wininet.dll

[7] 2007-08-13 . A4A0FC92358F39538A6494C42EF99FE9 . 818688 . . [7.00.5730.13] . . c:\windows\ie7updates\KB953838-IE7\wininet.dll

[-] 2007-06-27 . 17D39B59E2E3740058AE3FBCD432CEDE . 824320 . . [7.00.6000.20627] . . c:\windows\$hf_mig$\KB937143-IE7\SP2QFE\wininet.dll

[-] 2007-06-27 . 0D58CEBD30684B481C8DF3DA69375410 . 823808 . . [7.00.6000.16512] . . c:\windows\ie7updates\KB950759-IE7\wininet.dll

[-] 2007-04-25 . 26DB81279FED58D5199235C26D4836E2 . 823808 . . [7.00.6000.20583] . . c:\windows\$hf_mig$\KB933566-IE7\SP2QFE\wininet.dll

[-] 2007-04-25 . 4E9436B0301B0451ED2FB29364AB090F . 822784 . . [7.00.6000.16473] . . c:\windows\ie7updates\KB937143-IE7\wininet.dll

[-] 2006-11-07 . 92995334F993E6E49C25C6D02EC04401 . 818688 . . [7.00.5730.11] . . c:\windows\ie7updates\KB933566-IE7\wininet.dll

[7] 2006-02-28 . B1A1DA99C4A6EBFD59F86A453BF02F39 . 662016 . . [6.00.2900.2180] . . c:\windows\$NtServicePackUninstall$\wininet.dll

[-] 2005-10-21 . F3118DF4ABD118B11326D1C7A0093867 . 667136 . . [6.00.2900.2781] . . c:\windows\$hf_mig$\KB905915\SP2QFE\wininet.dll

[-] 2005-09-02 . C9ABC4AE17820BFEE9A4307B8A4E6DE9 . 666112 . . [6.00.2900.2753] . . c:\windows\$hf_mig$\KB896688\SP2QFE\wininet.dll

[-] 2005-07-03 . E992695B2D5628154B65FE8DFB0F3CCA . 665088 . . [6.00.2900.2713] . . c:\windows\$hf_mig$\KB896727\SP2QFE\wininet.dll

[-] 2005-05-02 . 8C907B730E9CFCFDF0157F3EA20D4424 . 664576 . . [6.00.2900.2668] . . c:\windows\$hf_mig$\KB883939\SP2QFE\wininet.dll

[-] 2005-03-10 . 235D1D42C2D23FA1BC8A9EDB267FFE86 . 663552 . . [6.00.2900.2627] . . c:\windows\$hf_mig$\KB890923\SP2QFE\wininet.dll

[-] 2005-01-27 . D9460271895ADBB382769AF1FC701169 . 663552 . . [6.00.2900.2598] . . c:\windows\$hf_mig$\KB867282\SP2QFE\wininet.dll

[-] 2004-09-29 . 1C035CB755ED9204176668209A3B498D . 662528 . . [6.00.2900.2518] . . c:\windows\$hf_mig$\KB834707\SP2QFE\wininet.dll

.

[-] 2008-04-14 . C4F91B363B29E589E84E6D9D41A92952 . 1544192 . . [6.00.2900.5512] . . c:\windows\explorer.exe

[7] 2008-04-14 . 418045A93CD87A352098AB7DABE1B53E . 1036800 . . [6.00.2900.5512] . . c:\windows\NiwradSoft Shell Pack\Backup\explorer.exe

[-] 2008-04-14 . C4F91B363B29E589E84E6D9D41A92952 . 1544192 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\explorer.exe

[7] 2006-02-28 . 22FE1BE02EADDE1632E478E4125639E0 . 1035264 . . [6.00.2900.2180] . . c:\windows\$NtServicePackUninstall$\explorer.exe

.

[-] 2008-04-14 . B4E7A9D7524304DC390E19ED7E1D7EE3 . 283136 . . [5.1.2600.5512] . . c:\windows\regedit.exe

[7] 2008-04-14 . AD9226BF3CED13636083BB9C76E9D2A2 . 153600 . . [5.1.2600.5512] . . c:\windows\NiwradSoft Shell Pack\Backup\regedit.exe

[-] 2008-04-14 . B4E7A9D7524304DC390E19ED7E1D7EE3 . 283136 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\regedit.exe

[7] 2006-02-28 . 8193CE5FB09E83F2699FD65BBCBE2FD2 . 153600 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\regedit.exe

[7] 2006-02-28 . 8193CE5FB09E83F2699FD65BBCBE2FD2 . 153600 . . [5.1.2600.2180] . . c:\windows\I386\REGEDIT.EXE

.

[7] 2008-04-14 . 01B4E6E990B6C5EA8856D96C7FD044B2 . 15360 . . [5.1.2600.5512] . . c:\windows\NiwradSoft Shell Pack\Backup\ctfmon.exe

[-] 2008-04-14 . 6BB3F4E4B01913F1764CC137E841B520 . 40448 . . [5.1.2600.5512] . . c:\windows\system32\ctfmon.exe

[7] 2006-02-28 . 7CE20569925DF6789C31799F0C538F29 . 15360 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ctfmon.exe

.

[7] 2008-04-14 . 0DAF0705D7B39C94E287913226688804 . 348672 . . [5.1.2600.5512] . . c:\windows\NiwradSoft Shell Pack\Backup\hnetcfg.dll

[-] 2008-04-14 . 0F68637BB752D674D110928CD31B7292 . 373248 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\hnetcfg.dll

[-] 2008-04-14 . 0F68637BB752D674D110928CD31B7292 . 373248 . . [5.1.2600.5512] . . c:\windows\system32\hnetcfg.dll

[7] 2006-02-28 . AE93E415220A4C0112768A0DEE36D28D . 348672 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\hnetcfg.dll

.

[7] 2008-08-23 . E8305C30D35E85D6657ED3E9934CB302 . 635848 . . [7.00.6000.20900] . . c:\windows\$hf_mig$\KB956390-IE7\SP2QFE\iexplore.exe

[7] 2008-08-23 . 1F03216084447F990AE797317D0A6E70 . 635848 . . [7.00.6000.16735] . . c:\windows\NiwradSoft Shell Pack\Backup\iexplore.exe

[-] 2008-08-23 . CE9F56D1CD1F4601B69C9A401CB2627C . 508360 . . [7.00.6000.16735] . . c:\windows\ServicePackFiles\i386\iexplore.exe

[-] 2008-08-23 . CE9F56D1CD1F4601B69C9A401CB2627C . 508360 . . [7.00.6000.16735] . . c:\windows\system32\dllcache\iexplore.exe

[-] 2008-06-23 . C52A9EF571E91535EB78DB4B8B95EA07 . 625664 . . [7.00.6000.20861] . . c:\windows\$hf_mig$\KB953838-IE7\SP2QFE\iexplore.exe

[-] 2008-04-22 . 197B7E4030CFBD8D2979D375E1787AA2 . 625664 . . [7.00.6000.20815] . . c:\windows\$hf_mig$\KB950759-IE7\SP2QFE\iexplore.exe

[7] 2008-04-14 . 3BFE49B4CDFAC83B0F3C79412895A179 . 93184 . . [6.00.2900.5512] . . c:\windows\ie7\iexplore.exe

[7] 2007-08-13 . DE49B348A18369B4626FBA1D49B07FB4 . 622080 . . [7.00.5730.13] . . c:\windows\ie7updates\KB956390-IE7\iexplore.exe

[7] 2007-08-13 . DE49B348A18369B4626FBA1D49B07FB4 . 622080 . . [7.00.5730.13] . . c:\windows\ie7updates\KB953838-IE7\iexplore.exe

[-] 2007-06-27 . BD8502DFD53FC24FB8D6929DC46B8C2C . 625152 . . [7.00.6000.20627] . . c:\windows\$hf_mig$\KB937143-IE7\SP2QFE\iexplore.exe

[-] 2007-06-27 . 275CEE268B9E5D82474C43D5D249D111 . 625152 . . [7.00.6000.16512] . . c:\windows\ie7updates\KB950759-IE7\iexplore.exe

[-] 2007-04-24 . 9B3516C1F30DA17ADD3818573047D63C . 625152 . . [7.00.6000.20583] . . c:\windows\$hf_mig$\KB933566-IE7\SP2QFE\iexplore.exe

[-] 2007-04-24 . 10BDB55982586A432A3951EB19A26009 . 625152 . . [7.00.6000.16473] . . c:\windows\ie7updates\KB937143-IE7\iexplore.exe

[-] 2006-10-17 . 5334D4461AA92A7B008755FE6D13C5F2 . 622080 . . [7.00.5730.11] . . c:\windows\ie7updates\KB933566-IE7\iexplore.exe

[7] 2006-02-28 . B39A6AF04A431E317C85BF061719E705 . 93184 . . [6.00.2900.2180] . . c:\windows\$NtServicePackUninstall$\iexplore.exe

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1ED16E0A-E8C4-40A0-8BC2-79485D21F796}]

2011-04-14 04:37        252832        ----a-w-        c:\programme\Mein Gutscheincode Finder\Internet Explorer\x86\ConversionOneIE.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RocketDock"="c:\programme\RocketDock\RocketDock.exe" [2007-09-02 495616]

"WMPNSCFG"="c:\programme\Windows Media Player\WMPNSCFG.exe" [2006-11-03 204288]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"VTTimer"="VTTimer.exe" [2008-05-16 94208]

"VTTrayp"="VTtrayp.exe" [2008-07-08 204800]

"SoundMan"="SOUNDMAN.EXE" [2007-04-16 577536]

"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2010-11-07 281768]

"EvtMgr6"="c:\programme\Logitech\SetPointP\SetPoint.exe" [2010-10-28 1352272]

"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2010-10-29 249064]

"icPlus"="c:\programme\icPlus\icPlus.exe" [2011-02-23 548864]

"iTunesHelper"="c:\programme\iTunes\iTunesHelper.exe" [2011-04-14 421160]

"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]

"Adobe ARM"="c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 40448]

.

c:\dokumente und einstellungen\XXX\Startmen\Programme\Autostart\

Allzeit Atomzeit.lnk - c:\programme\Allzeit Atomzeit\Atomzeit.exe [2007-4-16 77824]

Stickies.lnk - c:\programme\Stickies\stickies.exe [2008-1-16 1101824]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"MemCheckBoxInRunDlg"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]

2010-10-28 10:13        64592        ----a-w-        c:\programme\Gemeinsame Dateien\LogiShrd\Bluetooth\LBTWLgn.dll

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute        REG_MULTI_SZ           autocheck autochk *\0sprestrt\0OODBS

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

.

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^XXX^Startmenü^Programme^Autostart^Logitech . Produktregistrierung.lnk]

path=c:\dokumente und einstellungen\XXX\Startmenü\Programme\Autostart\Logitech . Produktregistrierung.lnk

backup=c:\windows\pss\Logitech . Produktregistrierung.lnkStartup

.

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^XXX^Startmenü^Programme^Autostart^thunderbird.lnk]

path=c:\dokumente und einstellungen\XXX\Startmenü\Programme\Autostart\thunderbird.lnk

backup=c:\windows\pss\thunderbird.lnkStartup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2010-11-10 10:49        932288        ----a-w-        c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]

2010-12-14 16:17        47904        ----a-w-        c:\programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleSyncNotifier.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]

2010-04-01 09:16        357696        ----a-w-        c:\programme\DAEMON Tools Lite\DTLite.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]

2008-04-13 21:13        208952        ----a-w-        c:\windows\ime\imjp8_1\imjpmig.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

2011-04-14 09:32        421160        ----a-w-        c:\programme\iTunes\iTunesHelper.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]

2008-04-13 21:13        59392        ----a-w-        c:\windows\system32\IME\PINTLGNT\IMSCINST.EXE

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]

2008-04-13 21:13        455168        ----a-w-        c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]

2008-04-13 21:13        455168        ----a-w-        c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2010-11-29 16:38        421888        ----a-w-        c:\programme\QuickTime\QTTask.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSS2009 Browser Monitor]

2010-06-22 13:11        49664        ----a-w-        c:\programme\Steganos Privacy Suite 11\SteganosBrowserMonitor.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSS2009 File Redirection Starter]

2010-06-22 13:07        17408        ----a-w-        c:\programme\Steganos Privacy Suite 11\fredirstarter.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSS2009 HotKeys]

2010-06-22 13:11        80896        ----a-w-        c:\programme\Steganos Privacy Suite 11\SteganosHotKeyService.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\THGuard]

2010-08-22 13:56        1046688        ----a-w-        c:\programme\TrojanHunter 5.0\THGuard.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant]

2010-07-04 19:51        17408        ----a-w-        c:\programme\Unlocker\UnlockerAssistant.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]

2006-11-03 07:56        204288        ----a-w-        c:\programme\Windows Media Player\wmpnscfg.exe

.

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"ctfmon.exe"=c:\windows\system32\ctfmon.exe

"Steam"="c:\games\steam\steam.exe" -silent

"UpdateStar"=c:\dokumente und einstellungen\XXX\Anwendungsdaten\UpdateStar\UpdateStar.exe -A

"WMPNSCFG"=c:\programme\Windows Media Player\WMPNSCFG.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"VTTrayp"=VTtrayp.exe

"Sony Ericsson PC Suite"="c:\programme\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions

"iTunesHelper"="c:\programme\iTunes\iTunesHelper.exe"

"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 9.0\Reader\Reader_sl.exe"

"Adobe ARM"="c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe"

"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"FirewallOverride"=dword:00000001

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"c:\\WINDOWS\\system32\\sessmgr.exe"=

"c:\\WINDOWS\\system32\\fxsclnt.exe"=

"c:\\Programme\\NetMeeting\\Conf.exe"=

"c:\\Programme\\Mozilla Firefox\\firefox.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Programme\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=

"c:\\Programme\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Programme\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Programme\\Java\\jre6\\launch4j-tmp\\JDownloader.exe"=

"c:\\WINDOWS\\system32\\java.exe"=

"c:\\Programme\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=

"c:\\Games\\Steam\\Steam.exe"=

"c:\\Games\\Steam\\steamapps\\pr3d4t0r1991\\condition zero\\hl.exe"=

"c:\\Programme\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Programme\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Programme\\Opera\\opera.exe"=

"c:\\Games\\Steam\\steamapps\\pr3d4t0r1991\\counter-strike\\hl.exe"=

"c:\\Programme\\Bonjour\\mDNSResponder.exe"=

"c:\\Programme\\iTunes\\iTunes.exe"=

"c:\\Programme\\ICQ7.5\\ICQ.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"50525:TCP"= 50525:TCP:BitComet 50525 TCP

"50525:UDP"= 50525:UDP:BitComet 50525 UDP

"55232:TCP"= 55232:TCP:*:Disabled:SolidNetworkManager

"55232:UDP"= 55232:UDP:*:Disabled:SolidNetworkManager

"1038:TCP"= 1038:TCP:Akamai NetSession Interface

"5000:UDP"= 5000:UDP:Akamai NetSession Interface

.

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [15.11.2006 16:43 691696]

R0 ViBus;ViBus;c:\windows\system32\drivers\ViBus.sys [11.11.2007 15:32 16896]

R0 ViPrt;VIA SATA IDE Device Driver;c:\windows\system32\drivers\ViPrt.sys [11.11.2007 15:32 52224]

R1 SLEE_17_DRIVER;Steganos Live Encryption Engine 17 [Driver];c:\windows\system32\drivers\SleeN17.sys [17.02.2010 16:00 94560]

R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe -k Akamai [28.02.2006 14:00 14336]

R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [04.12.2009 19:11 136360]

R2 HssWd;Hotspot Shield Monitoring Service;c:\programme\Hotspot Shield\bin\hsswd.exe -product HSS --> c:\programme\Hotspot Shield\bin\hsswd.exe -product HSS [?]

R2 LBeepKE;Logitech Beep Suppression Driver;c:\windows\system32\drivers\LBeepKE.sys [20.01.2011 15:14 10448]

R2 Start BT in service;Start BT in service;c:\programme\IVT Corporation\BlueSoleil\StartSkysolSvc.exe [27.12.2007 16:39 51816]

R3 uscbs109;uscbs109;c:\windows\system32\drivers\uscbs109.sys [22.03.2005 8672]

R3 uscsc109;uscsc109;c:\windows\system32\drivers\uscsc109.sys [22.03.2005 102336]

S1 SSHDRV79;SSHDRV79;\??\c:\windows\system32\drivers\SSHDRV79.sys --> c:\windows\system32\drivers\SSHDRV79.sys [?]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.03.2010 14:16 130384]

S3 ATE_PROCMON;ATE_PROCMON;\??\c:\programme\Anti Trojan Elite\ATEPMon.sys --> c:\programme\Anti Trojan Elite\ATEPMon.sys [?]

S3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [17.01.2011 14:56 13192]

S3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [17.01.2011 14:56 8456]

S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance; [x]

S3 Lavasoft Kernexplorer;Lavasoft helper driver;\??\c:\programme\Lavasoft\Ad-Aware\KernExplorer.sys --> c:\programme\Lavasoft\Ad-Aware\KernExplorer.sys [?]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.03.2010 14:16 753504]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

Akamai        REG_MULTI_SZ           Akamai

.

Inhalt des "geplante Tasks" Ordners

.

2011-04-29 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\programme\Apple Software Update\SoftwareUpdate.exe [2009-10-22 09:50]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.google.de/

mWindow Title = Microsoft Internet Explorer

uInternet Settings,ProxyOverride = *.local

IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\programme\ICQ7.5\ICQ.exe

FF - ProfilePath - c:\dokumente und einstellungen\XXX\Anwendungsdaten\Mozilla\Firefox\Profiles\ny4sv4r7.default\

FF - prefs.js: browser.search.defaulturl - hxxp://www.google.de/search?q=

FF - prefs.js: browser.search.selectedEngine - Wikipedia (de)

FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/

FF - user.js: network.http.max-persistent-connections-per-server - 4

FF - user.js: nglayout.initialpaint.delay - 600

FF - user.js: content.notify.interval - 600000

FF - user.js: content.max.tokenizing.time - 1800000

FF - user.js: content.switch.threshold - 600000

FF - user.js: network.http.max-connections-per-server - 8

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2011-05-11 22:37

Windows 5.1.2600 Service Pack 3 NTFS

.

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteinträge... 

.

Scanne versteckte Dateien... 

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 0

.

**************************************************************************

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\S-1-5-21-1985613394-3781928092-3764147744-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]

@Denied: (Full) (LocalSystem)

@SACL=

"{20D04FE0-3AEA-1069-A2D8-08002B30309D}"="c:\\WINDOWS\\System32\\shell32.dll,15"

"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="c:\\WINDOWS\\system32\\SHELL32.dll,17"

"{208D2C60-3AEA-1069-A2D7-08002B30309D}"="c:\\WINDOWS\\system32\\SHELL32.dll,17"

"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="c:\\WINDOWS\\system32\\shell32.dll,22"

"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="c:\\WINDOWS\\system32\\shell32.dll,23"

"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="c:\\WINDOWS\\system32\\shell32.dll,24"

"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="c:\\WINDOWS\\system32\\shell32.dll,-175"

"{21EC2020-3AEA-1069-A2DD-08002B30309D}"="c:\\WINDOWS\\System32\\shell32.dll,-137"

"{2227A280-3AEA-1069-A2DE-08002B30309D}"="c:\\WINDOWS\\System32\\shell32.dll,-138"

"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="c:\\WINDOWS\\system32\\shell32.dll,38"

"AudioCD"="c:\\WINDOWS\\System32\\shell32.dll,40"

"{FBF23B42-E3F0-101B-8488-00AA003E56F8}"="c:\\WINDOWS\\system32\\shell32.dll,220"

"{450D8FBA-AD25-11D0-98A8-0800361B1103}"="c:\\WINDOWS\\system32\\mydocs.dll,0"

"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="c:\\WINDOWS\\system32\\main.cpl,10"

"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="c:\\WINDOWS\\system32\\wiashext.dll,0"

"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="c:\\WINDOWS\\system32\\mstask.dll,-100"

"{88C6C381-2E85-11D0-94DE-444553540000}"="c:\\WINDOWS\\System32\\occache.dll,0"

"{BDEADF00-C265-11d0-BCED-00A0C90AB50F}"="c:\\Programme\\COMMON~1\\MICROS~1\\WEBFOL~1\\MSONSEXT.DLL,0"

"{FF393560-C2A7-11CF-BFF4-444553540000}"="c:\\WINDOWS\\System32\\shdocvw.dll,-20785"

"{F5175861-2688-11d0-9C5E-00AA00A45957}"="c:\\WINDOWS\\System32\\webcheck.dll,0"

"{85BBD920-42A0-1069-A2E4-08002B30309D}"="c:\\WINDOWS\\system32\\syncui.dll,0"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10o_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10o_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•Ñw*]

"5E7CEC10DF0760D4F8DAFB12FDC06CCD"="02:\\Software\\Adobe\\FeatureSubscriptions\\DVAAdobeDocMeta\\{01CEC7E5-70FD-4D06-8FAD-BF21DF0CC6DC}\\Registered"

.

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]

"OODEFRAG10.00.00.01WORKSTATION"="FCCFE551B82F0A35E2E794DA68A18D01D0B16430B1162B6D970BC3ED0EBFF5B2C6AAE7EB94FDD7FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79335D575E7D6A3B98085D575E7D6A3B9808A2D97226D213B555BB230F374CA448C1BBAACD3F14A9BBADB2D64E84E4DA17AB6FD0D37B3D41CD3FC20DDB32D1067752E09F81A819621CCA1334B932A68AD13BB508CEE24E3EA6940CF93A999FDA60FC5D25480A2F7F069BE61509E72C4A3D119D819B13CC9877673D9B3CDD825DEE23A8EDAB5D8690F0DA9B4B65CAAC99FD61294F9F79155CAF820F6423579B51FE4BD2ED6F01A3A6486635ED2DE0337AAA04724876E3D52136D74F8EE7BD5D79E49FFDDF85386056EA42CB56F11799F3D0F425886F09917B617BDE14B5AE0F1FE46D60BE98A868BA2B948AA278BA958F70D4016F8A7F9E0880A734B6EB2CCD0EB8A7434D035DBC70D02930B43B81ABDD7DE5DB1F0145A7E654B757FA1D1A88170F620710D7C3B299176D90B3E60234F0DE111C003C3A2DBB8F2E652792C283908A591CD0D830F25BAB769188DC36DE5EF0E2BEBBD9A27FAD5E2F10C8C753D55040E8099C805679DF3379AF62B300ACC00589D4C22EA6C6E8DB021D2F6BDE6C36BA94E7C37A5297D544D1F933B4217338DDDA02473ED1FC1C9A96E5EF60D706A07880685C27A2736CE87E14B05C415DE6B34DFD41C596F27C1E7C57E03F9AB6746A78CBBE1CA803DBA0A235D55C6CE6F2B27C966CB148C8C0DFE772A05361661BF6E8E888212C155B5F8427DF9B11E287FA2A2AC5A6A0F624CCB24C0E1CD05081F764299AB2574AAA8B0FCA51B283F6D3A1392E927939C766C6598E4DCC6C85173CA08B9A0236968980D113EFEFFA9D88AC312A58B5945A4CA17D76C5CC9D6851057621F172BE43BF0DFE87C6D212A3DD99BE3C631996219C28E2D5A5B8B231A8896612CC1D45EC1573EDC22413C8AA0E57B0124216086223947290DB605C6C99F211171D4E8405D7EA9AF3989903A8584BFB72C8549439AF1ABA229D4530F826DE3B7F97879ACFDA20A160FA0307E77E4BB7340EAD4D15155E6A956020A78AD05FCF2DB57C8A657230475C66228186C7A5A0C2EB30A538AC77588D635C2029A27BDC96B3963A34782F7255387C8075FD1A96A0829F773AD0757BBE25195B312A2C93C414F0747B4A24AE4892C978FA71DB9CDFB4717D04615872F16A2BFD5275DF4B589ADC67D04A89A8CB5C7941307392DB2B2B50D956C293FC86BA19928F9AF8FB02D1DDA59B5D4E35843FAB9303DA5B9E3D4E1B90C2DA92016BE11F05C1B24D450886AE261BED554BAEA838123603C55666CF6409B096B107A6F1AAA7135AA66744493AC1DDE9F60599CA26BEDE49D5150A2272105966C03CD1BCE1300431434A27"

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

.

- - - - - - - > 'winlogon.exe'(1632)

c:\windows\system32\SETUPAPI.dll

c:\windows\system32\sfc_os.dll

c:\programme\gemeinsame dateien\logishrd\bluetooth\LBTWlgn.dll

c:\windows\system32\COMRes.dll

c:\windows\system32\cscui.dll

.

- - - - - - - > 'lsass.exe'(1776)

c:\windows\system32\setupapi.dll

.

- - - - - - - > 'explorer.exe'(2980)

c:\programme\RocketDock\RocketDock.dll

c:\windows\system32\COMRes.dll

c:\windows\System32\cscui.dll

c:\programme\Windows Media Player\wmpband.dll

c:\windows\system32\LINKINFO.dll

c:\windows\system32\ntshrui.dll

c:\windows\system32\SETUPAPI.dll

c:\windows\system32\NETSHELL.dll

c:\windows\system32\credui.dll

c:\windows\system32\stobject.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\programme\Avira\AntiVir Desktop\avguard.exe

c:\programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\programme\IVT Corporation\BlueSoleil\BTNtService.exe

c:\programme\Bonjour\mDNSResponder.exe

c:\programme\Avira\AntiVir Desktop\avshadow.exe

c:\programme\Hotspot Shield\bin\openvpnas.exe

c:\programme\Hotspot Shield\HssWPR\hsssrv.exe

c:\programme\Hotspot Shield\bin\hsswd.exe

c:\programme\Java\jre6\bin\jqs.exe

c:\programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe

c:\programme\CDBurnerXP\NMSAccessU.exe

c:\windows\system32\HPZipm12.exe

c:\programme\CyberLink\Shared Files\RichVideo.exe

c:\windows\system32\wbem\wmiapsrv.exe

c:\windows\system32\wscntfy.exe

c:\windows\system32\VTTimer.exe

c:\windows\system32\VTtrayp.exe

c:\windows\SOUNDMAN.EXE

c:\programme\Gemeinsame Dateien\LogiShrd\KHAL3\KHALMNPR.EXE

c:\programme\iPod\bin\iPodService.exe

c:\programme\icPlus\Plugins\ICQSpamblocker\ICQSpamblocker.exe

c:\programme\Mozilla Firefox\firefox.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2011-05-11  22:45:21 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2011-05-11 20:45

ComboFix2.txt  2011-05-11 15:44

.

Vor Suchlauf: 16 Verzeichnis(se), 145.200.746.496 Bytes frei

Nach Suchlauf: 17 Verzeichnis(se), 145.065.230.336 Bytes frei

.

Current=1 Default=1 Failed=0 LastKnownGood=6 Sets=1,2,3,4,5,6

- - End Of File - - 8C12A4CBCCBB1E9A3F6C463E96BFEFD0