Trojaner-Board - SpyEyes-Trojaner gefunden (Antivir läßt sich nicht mehr updaten)

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - SpyEyes-Trojaner gefunden (Antivir läßt sich nicht mehr updaten) (https://www.trojaner-board.de/99522-spyeyes-trojaner-gefunden-antivir-laesst-mehr-updaten.html)

SpyEyes-Trojaner gefunden (Antivir läßt sich nicht mehr updaten)

Hallo,

vor kurzem ist mir aufgefallen, dass sich antivir nicht mehr updaten läßt.
Ich habe dann u.a. eine antivir-rescue-disk gebootet und den spyeyes-trojaner gefunden und deleted. Alle caches (Java, Temp, Temporäre Internetdateien sind geleert).
Danach habe ich malwarebytes laufen lassen (2.Log) und noch einen Adware-agent gefunden.

Antivir kann ich immer noch nicht updaten. Wenn ich Gmer laufen lassen möchte, stürzt der Rechner ab. Über eure Hilfe würde ich mich sehr freuen.

Der antivir - Log:

Zitat:

Avira / Linux Version 1.9.152.0
Copyright (c) 2010 by Avira GmbH
All rights reserved.
engine set: 8.2.4.242
VDF Version: 7.11.8.107
Scan start time: Mon May 23 23:16:35 2011
configuration file: /etc/avira/scancl.conf

ALERT: [Java/Dldr.Arch.A] /media/Devices/sda1/Documents and Settings/Martin/Application Data/Sun/Java/Deployment/cache/6.0/12/3cc664c-6c7ae634 <<< Contains signature of the Java virus JAVA/Dldr.Arch.A [renamed]

ALERT: [TR/Spy.SpyEyes.gwd] /media/Devices/sda1/Documents and Settings/Martin/Application Data/Sun/Java/Deployment/cache/6.0/56/30b8cfb8-638ae732 <<< Is the Trojan horse TR/Spy.SpyEyes.gwd [renamed]

ALERT: [TR/Spy.SpyEyes.gwd] /media/Devices/sda1/Documents and Settings/Martin/Local Settings/Temp/0.501756909366432.exe <<< Is the Trojan horse TR/Spy.SpyEyes.gwd [renamed]

WARNING: [Unexpected end of file] /media/Devices/sda1/Documents and Settings/Martin/Local Settings/Temporary Internet Files/Content.IE5/0B0LGVCJ/profile_data_1[1].zip

WARNING: [Unexpected end of file] /media/Devices/sda1/Documents and Settings/Martin/Local Settings/Temporary Internet Files/Content.IE5/0B0LGVCJ/theme[2].zip

WARNING: [Unexpected end of file] /media/Devices/sda1/Documents and Settings/Martin/Local Settings/Temporary Internet Files/Content.IE5/8167CPO7/images[1].zip

WARNING: [Unexpected end of file] /media/Devices/sda1/Documents and Settings/Martin/Local Settings/Temporary Internet Files/Content.IE5/Q54PEJS1/theme[1].zip

WARNING: [Unexpected end of file] /media/Devices/sda1/Documents and Settings/Martin/Local Settings/Temporary Internet Files/Content.IE5/Q54PEJS1/theme[2].zip

WARNING: [Unexpected end of file] /media/Devices/sda1/Documents and Settings/Martin/Local Settings/Temporary Internet Files/Content.IE5/Q54PEJS1/theme[3].zip

WARNING: [Unexpected end of file] /media/Devices/sda1/Documents and Settings/Martin/Local Settings/Temporary Internet Files/Content.IE5/Q54PEJS1/theme[4].zip

WARNING: [Unexpected end of file] /media/Devices/sda1/Documents and Settings/Martin/Local Settings/Temporary Internet Files/Content.IE5/Q54PEJS1/profile_data_1[1].zip

WARNING: [Unexpected end of file] /media/Devices/sda1/Documents and Settings/Martin/Local Settings/Temporary Internet Files/Content.IE5/Q54PEJS1/forms_data_1[1].zip

WARNING: [Unexpected end of file] /media/Devices/sda1/Documents and Settings/Martin/Local Settings/Temporary Internet Files/Content.IE5/Q54PEJS1/forms_data_1[2].zip

WARNING: [The files in archive are multiple volume] /media/Devices/sda1/Documents and Settings/Martin/My Documents/Downloads/UnitySetup-3.0.0.exe --> ProgramFilesDir/ICSharpCode.SharpZipLib.dll

WARNING: [The files in archive are multiple volume] /media/Devices/sda1/Documents and Settings/Martin/My Documents/Downloads/UnitySetup-3.0.0.exe --> ProgramFilesDir/ICSharpCode.SharpZipLib.dll

WARNING: [The files in archive are multiple volume] /media/Devices/sda1/Documents and Settings/Martin/My Documents/Downloads/UnitySetup-3.0.0.exe --> ProgramFilesDir/ICSharpCode.SharpZipLib.dll

WARNING: [Unexpected end of file] /media/Devices/sda1/Documents and Settings/Martin/My Documents/Downloads/ct1013.zip.001

WARNING: [A malformed archive header was detected] /media/Devices/sda1/Documents and Settings/Martin/My Documents/Downloads/ct1013.zip.002

WARNING: [Unexpected end of file] /media/Devices/sda1/Program Files/SpeedFan/uninstall.exe

WARNING: [Unexpected end of file] /media/Devices/sda1/WINDOWS/system32/Macromed/Flash/uninstall_activeX.exe

WARNING: [File is encrypted] /media/Devices/sda5/Downloads/34d7dea57db8e5cca607c8b636a2ec82.rar

WARNING: [The files in archive are multiple volume] /media/Devices/sda5/Downloads/UnitySetup-2.6.1.exe --> ProgramFilesDir/ICSharpCode.SharpZipLib.dll

WARNING: [The files in archive are multiple volume] /media/Devices/sda5/Downloads/fbnames/facebook-names-unique.txt.bz2

WARNING: [Bad compressed data] /media/Devices/sda5/WinLite.iso --> Programme_zum_installieren/LibO_3.3.0_Win_x86_install_multi.exe --> ProgramFilesDir/libreoffice1.cab --> standard4.bau

WARNING: [Bad compressed data] /media/Devices/sda5/WinLite.iso --> Programme_zum_installieren/LibO_3.3.0_Win_x86_install_multi.exe --> ProgramFilesDir/libreoffice1.cab --> template4.bau

Statistics :
Directories............... : 37776
Archives.................. : 9137
Files..................... : 2823426
Infected.............. : 3
Renamed........... : 3
Warnings.............. : 31
Suspicious............ : 0
Infections................ : 3

Dann habe ich malwarebytes laufen lassen:

Folgender Log:

Zitat:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6658

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

24.05.2011 10:19:53
mbam-log-2011-05-24 (10-19-53).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|F:\|G:\|)
Durchsuchte Objekte: 350156
Laufzeit: 48 Minute(n), 42 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
f:\system volume information\_restore{b83da741-c247-48bc-b6d4-9fbfead0d7f8}\RP242\A0127966.exe (Adware.Agent) -> Quarantined and deleted successfully.

Gibt es noch weitere Logs von Malwarebytes? Wenn ja bitte alle posten, die in Malwarebytes im Reiter Logdateien sichtbar sind.

Hallo,

ich hatte im safe-mode als admin auch nochmal einen Suchlauf gemacht und das kam raus:

Alle anderen log-Dateien (ich habe malwarebytes einige male laufen lassen) sind leer bzw. ohne Funde.

Code:

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org
 

Database version: 6658
 

Windows 5.1.2600 Service Pack 3 (Safe Mode)

Internet Explorer 6.0.2900.5512
 

5/24/2011 2:23:10 AM

mbam-log-2011-05-24 (02-23-10).txt
 

Scan type: Full scan (C:\|F:\|G:\|)

Objects scanned: 348717

Time elapsed: 28 minute(s), 48 second(s)
 

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1
 

Memory Processes Infected:

(No malicious items detected)
 

Memory Modules Infected:

(No malicious items detected)
 

Registry Keys Infected:

(No malicious items detected)
 

Registry Values Infected:

(No malicious items detected)
 

Registry Data Items Infected:

(No malicious items detected)
 

Folders Infected:

(No malicious items detected)
 

Files Infected:

f:\Desktop\audioconvertersetup.exe (Adware.Agent) -> Quarantined and deleted successfully.

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den Inhalt in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox.

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

/md5start

wininit.exe

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Code:

OTL logfile created on: 24.05.2011 23:50:16 - Run 2

OTL by OldTimer - Version 3.2.23.0     Folder = C:\Documents and Settings\meinname\Desktop

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 6.0.2900.5512)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

 

3,18 Gb Total Physical Memory | 2,61 Gb Available Physical Memory | 82,00% Memory free

5,02 Gb Paging File | 4,42 Gb Available in Paging File | 87,91% Paging File free

Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 48,83 Gb Total Space | 4,44 Gb Free Space | 9,09% Space Free | Partition Type: NTFS

Drive E: | 1,84 Gb Total Space | 0,38 Gb Free Space | 20,83% Space Free | Partition Type: FAT32

Drive F: | 416,64 Gb Total Space | 400,50 Gb Free Space | 96,13% Space Free | Partition Type: NTFS

Drive G: | 297,45 Mb Total Space | 297,41 Mb Free Space | 99,99% Space Free | Partition Type: FAT32

 

Computer Name: COMPUTER1 | User Name: Administrator | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2011.05.24 23:01:14 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\meinname\Desktop\OTL.exe

PRC - [2011.05.14 16:01:13 | 001,779,792 | ---- | M] (COMODO) -- C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe

PRC - [2010.04.01 13:33:15 | 000,267,432 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe

PRC - [2010.03.02 11:28:23 | 000,282,792 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

PRC - [2010.02.24 10:28:01 | 000,135,336 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe

PRC - [2010.01.14 22:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

PRC - [2009.12.20 00:00:00 | 006,095,504 | ---- | M] (MySQL AB) -- C:\xampp\mysql\bin\mysqld.exe

PRC - [2009.12.20 00:00:00 | 000,029,416 | ---- | M] (Apache Software Foundation) -- C:\xampp\apache\bin\httpd.exe

PRC - [2009.11.12 14:48:56 | 000,071,096 | ---- | M] () -- C:\Program Files\CDBurnerXP\NMSAccessU.exe

PRC - [2008.04.14 06:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

 

 
 ========== Modules (SafeList) ==========

 

MOD - [2011.05.24 23:01:14 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\meinname\Desktop\OTL.exe

MOD - [2011.05.14 16:05:35 | 000,284,744 | ---- | M] (COMODO) -- C:\WINDOWS\system32\guard32.dll

MOD - [2008.04.14 06:42:52 | 001,054,208 | R--- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - File not found [Auto | Stopped] --  -- (XAMPP)

SRV - File not found [On_Demand | Stopped] --  -- (TipCtrl)

SRV - [2011.05.18 02:04:35 | 003,275,864 | ---- | M] () [Auto | Running] -- c:\Program Files\Common Files\Akamai\netsession_win_8832f4b.dll -- (Akamai)

SRV - [2011.05.14 16:01:13 | 001,779,792 | ---- | M] (COMODO) [Auto | Running] -- C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe -- (cmdAgent)

SRV - [2010.04.01 13:33:15 | 000,267,432 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2010.02.24 10:28:01 | 000,135,336 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2009.12.20 00:00:00 | 006,095,504 | ---- | M] (MySQL AB) [Auto | Running] -- C:\xampp\mysql\bin\mysqld.exe -- (MySQL)

SRV - [2009.12.20 00:00:00 | 000,029,416 | ---- | M] (Apache Software Foundation) [Auto | Running] -- C:\xampp\apache\bin\httpd.exe -- (Apache2.2)

SRV - [2009.12.06 23:26:17 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)

SRV - [2009.11.12 14:48:56 | 000,071,096 | ---- | M] () [Auto | Running] -- C:\Program Files\CDBurnerXP\NMSAccessU.exe -- (NMSAccessU)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - [2011.05.14 16:05:32 | 000,097,504 | ---- | M] (COMODO) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\inspect.sys -- (Inspect)

DRV - [2011.05.14 16:05:31 | 000,029,400 | ---- | M] (COMODO) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\cmdhlp.sys -- (cmdHlp)

DRV - [2011.05.14 16:05:30 | 000,242,472 | ---- | M] (COMODO) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\cmdGuard.sys -- (cmdGuard)

DRV - [2010.12.18 13:03:56 | 000,021,696 | ---- | M] (Almico Software) [Kernel | Boot | Running] -- C:\WINDOWS\system32\speedfan.sys -- (speedfan)

DRV - [2010.03.01 10:05:19 | 000,124,784 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)

DRV - [2010.02.16 14:24:01 | 000,060,936 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2010.02.09 22:59:25 | 000,717,296 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)

DRV - [2009.12.10 13:16:04 | 000,476,544 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\rt73.sys -- (RT73)

DRV - [2009.11.12 14:48:56 | 000,007,168 | ---- | M] () [File_System | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\StarOpen.sys -- (StarOpen)

DRV - [2009.11.04 18:15:30 | 004,423,168 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)

DRV - [2009.08.19 02:05:56 | 000,100,368 | ---- | M] (ATI Research Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AtiHdmi.sys -- (AtiHdmiService)

DRV - [2009.07.18 07:18:44 | 000,093,096 | R--- | M] (JMicron Technology Corp.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\jraid.sys -- (JRAID)

DRV - [2009.05.11 12:49:19 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio)

DRV - [2009.05.11 10:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2008.10.31 12:38:00 | 004,942,336 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)

DRV - [2008.10.30 15:14:20 | 000,117,888 | R--- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)

DRV - [2008.10.30 01:05:58 | 000,031,896 | ---- | M] (DemoForge, LLC) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\dfmirage.sys -- (dfmirage)

DRV - [2008.07.30 16:44:44 | 000,619,136 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\rt2870.sys -- (rt2870)

DRV - [2001.08.17 15:51:32 | 000,018,688 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\irsir.sys -- (irsir)

DRV - [1996.04.03 21:33:26 | 000,005,248 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\system32\giveio.sys -- (giveio)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

 

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22

FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0

 

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.17\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.05.24 01:15:27 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.17\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.04.29 21:49:11 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 4.0b12\extensions\\Components: C:\Program Files\Mozilla Firefox 4.0 Beta 11\components [2011.03.13 01:23:57 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 4.0b12\extensions\\Plugins: C:\Program Files\Mozilla Firefox 4.0 Beta 11\plugins

 

[2011.05.24 01:15:32 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions

[2011.05.24 01:15:32 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\7mq58obb.default\extensions

[2011.05.24 11:41:31 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions

[2010.11.24 18:27:12 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

[2010.04.23 18:55:13 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF

[2010.09.15 05:50:38 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

[2010.05.25 18:09:48 | 000,063,488 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npwachk.dll

[2011.04.09 03:46:41 | 000,001,392 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom-de.xml

[2011.04.09 03:46:41 | 000,002,344 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-de.xml

[2011.04.09 03:46:41 | 000,006,805 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\leo_ende_de.xml

[2011.04.09 03:46:41 | 000,001,178 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-de.xml

[2011.04.09 03:46:41 | 000,001,105 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2007.08.11 08:58:33 | 000,000,768 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: 127.0.0.1         mpa.one.microsoft.com

O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [COMODO Internet Security] C:\Program Files\COMODO\COMODO Internet Security\cfp.exe (COMODO)

O4 - HKLM..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe (Brother Industries, Ltd.)

O4 - HKLM..\Run: [JMB36X IDE Setup] C:\WINDOWS\RaidTool\xInsIDE.exe ()

O4 - HKLM..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl05a\BrStDvPt.exe (Brother Industories, Ltd.)

O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)

O4 - HKCU..\RunOnce: [scan_after_setup] c:\program files\avira\antivir desktop\avcenter.exe (Avira GmbH)

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255

O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe (ICQ, LLC.)

O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe (ICQ, LLC.)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)

O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)

O20 - AppInit_DLLs: (C:\WINDOWS\system32\guard32.dll) - C:\WINDOWS\system32\guard32.dll (COMODO)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)

O24 - Desktop BackupWallPaper: 

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009.12.06 03:56:03 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *) -  File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

NetSvcs: 6to4 -  File not found

NetSvcs: Ias -  File not found

NetSvcs: Iprip -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: WmdmPmSp -  File not found

 

MsConfig - Services: "WMPNetworkSvc"

MsConfig - State: "system.ini" - 0

MsConfig - State: "win.ini" - 0

MsConfig - State: "bootini" - 0

MsConfig - State: "services" - 2

MsConfig - State: "startup" - 0

 

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: sermouse.sys - Driver

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: vga.sys - Driver

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

 

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: sermouse.sys - Driver

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: vga.sys - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

 

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM

ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vector Graphics Rendering (VML)

ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4

ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML Data Binding for Java

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe

ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Advanced Authoring

ActiveX: {4395D8A7-19B8-34B4-10D9-A60A0111307F} - Internet Explorer

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT

ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4b218e3e-bc98-4770-93d3-2731b9329278} - %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection MarketplaceLinkInstall 896 %systemroot%\inf\ie.inf

ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7

ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Sicherheitsupdate für Windows XP (KB923789)

ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - %SystemRoot%\system32\ie4uinit.exe

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {A9B4B5A5-2F94-153C-1B34-499A1E337ED3} - NetShow

ActiveX: {ACC563BC-4266-43f0-B6ED-9D38C4202C7E} - 

ActiveX: {B4DA0E23-6F62-0669-DEAD-B3AD498C7378} - Dynamic HTML Data Binding for Java

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Task Scheduler

ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1

ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

 

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)

Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)

Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)

Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)

Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)

Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)

Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()

Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()

Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)

Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

Drivers32: vidc.tscc - C:\WINDOWS\System32\tsccvid.dll (TechSmith Corporation)

Drivers32: vidc.yv12 - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point (17746534284132352)

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2011.05.24 11:33:20 | 000,000,000 | ---D | C] -- C:\Program Files\Sophos

[2011.05.24 11:33:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Sophos

[2011.05.24 10:51:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Avira

[2011.05.24 10:51:22 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\ssmdrv.sys

[2011.05.24 10:51:20 | 000,124,784 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys

[2011.05.24 10:51:20 | 000,060,936 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntflt.sys

[2011.05.24 10:51:20 | 000,045,416 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntdd.sys

[2011.05.24 10:51:20 | 000,022,360 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntmgr.sys

[2011.05.24 10:51:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Avira

[2011.05.24 01:42:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\ivdf_fusebundle_nt_en

[2011.05.24 01:16:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\Downloads

[2011.05.24 01:15:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla

[2011.05.24 01:15:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Mozilla

[2011.05.24 01:09:11 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Malwarebytes

[2011.05.24 00:51:01 | 000,000,000 | ---D | C] -- C:\Program Files\Avira

[2011.05.18 18:16:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\avira_antivir_antirootkit_en

[2011.05.18 16:00:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\FlashDevelop

[2011.05.18 14:23:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\avira_antivir_personal_de

[2011.05.18 13:16:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\Adobe

[2011.05.18 13:16:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Adobe

[2011.05.18 13:08:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\vdf_fusebundle

[2011.05.18 12:54:51 | 000,000,000 | --SD | C] -- C:\Documents and Settings\Administrator\Application Data\Microsoft

[2011.05.18 12:54:51 | 000,000,000 | --SD | C] -- C:\Documents and Settings\Administrator\Cookies

[2011.05.18 12:54:51 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Administrator\Start Menu\Programs\Startup

[2011.05.18 12:54:51 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Administrator\Start Menu

[2011.05.18 12:54:51 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Administrator\SendTo

[2011.05.18 12:54:51 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Administrator\Application Data

[2011.05.18 12:54:51 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories

[2011.05.18 12:54:51 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Administrator\Local Settings

[2011.05.18 12:54:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Templates

[2011.05.18 12:54:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Recent

[2011.05.18 12:54:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\PrintHood

[2011.05.18 12:54:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\NetHood

[2011.05.18 12:54:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents

[2011.05.18 12:54:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft

[2011.05.18 12:54:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Macromedia

[2011.05.18 12:54:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Favorites

[2011.05.18 12:54:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop

[2011.05.18 12:54:45 | 000,000,000 | -HSD | C] -- C:\WINDOWS\CSC

[2011.05.18 02:29:09 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\NtmsData

[2011.05.12 16:43:51 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe Download Assistant

[2011.05.05 16:56:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Brother

[2011.05.05 16:56:03 | 000,055,296 | ---- | C] (Brother Industries,Ltd.) -- C:\WINDOWS\System32\brinsstr.dll

[2011.05.05 16:56:02 | 000,188,416 | ---- | C] (brother) -- C:\WINDOWS\System32\PDRVINST.DLL

[2011.05.05 16:56:02 | 000,081,920 | ---- | C] (brother) -- C:\WINDOWS\System32\BrWebIns.dll

[2011.05.05 16:56:02 | 000,065,536 | ---- | C] (brother) -- C:\WINDOWS\System32\BRWEBUP.EXE

[2011.05.05 16:56:02 | 000,000,000 | ---D | C] -- C:\Program Files\Brother

[2011.05.05 16:56:01 | 000,147,456 | ---- | C] (Brother Industries,Ltd.) -- C:\WINDOWS\brunin03.dll

[2011.05.05 16:56:01 | 000,000,000 | ---D | C] -- C:\Brother

[2011.05.05 16:55:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Brother

[2011.05.04 17:46:53 | 000,000,000 | ---D | C] -- C:\Program Files\Inkscape

[2011.04.29 20:38:05 | 000,000,000 | ---D | C] -- C:\Program Files\TourDeFlex

[2011.04.28 12:01:24 | 000,000,000 | ---D | C] -- C:\Program Files\mp3DirectCut

[2010.11.22 17:54:01 | 000,091,913 | ---- | C] (FlashDevelop.org) -- C:\Program Files\Uninstall.exe

[2010.10.07 21:57:36 | 000,362,496 | ---- | C] (FlashDevelop.org) -- C:\Program Files\FlashDevelop.exe

[2010.10.07 21:57:28 | 001,350,144 | ---- | C] (FlashDevelop.org) -- C:\Program Files\PluginCore.dll

[2010.10.04 08:27:22 | 000,520,704 | ---- | C] (scite.net.ru) -- C:\Program Files\SciLexer.dll

[2010.10.04 08:27:22 | 000,106,496 | ---- | C] (Galos) -- C:\Program Files\Scripting.dll

[2010.10.04 08:27:22 | 000,097,280 | ---- | C] (FlashDevelop.org) -- C:\Program Files\SwfOp.dll

[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2011.05.24 23:31:26 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2011.05.24 21:26:15 | 000,001,194 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1645522239-115176313-1417001333-1003UA.job

[2011.05.24 12:26:00 | 000,001,142 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1645522239-115176313-1417001333-1003Core.job

[2011.05.24 12:04:38 | 000,302,080 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\yyh0jcpd.exe

[2011.05.24 10:51:31 | 000,001,707 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Avira AntiVir Control Center.lnk

[2011.05.24 01:39:18 | 046,753,958 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\ivdf_fusebundle_nt_en.zip

[2011.05.24 01:08:39 | 000,000,104 | ---- | M] () -- C:\Documents and Settings\Administrator\My Documents\My Computer.lnk

[2011.05.23 20:57:04 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2011.05.18 18:13:54 | 000,089,324 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\avira_antivir_antirootkit_en.zip

[2011.05.18 16:01:21 | 000,000,087 | ---- | M] () -- C:\Documents and Settings\Administrator\mm.cfg

[2011.05.18 14:11:55 | 057,679,123 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\avira_antivir_personal_de.zip

[2011.05.18 13:06:14 | 043,859,754 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\vdf_fusebundle.zip

[2011.05.18 12:54:53 | 000,000,440 | RHS- | M] () -- C:\Documents and Settings\Administrator\ntuser.pol

[2011.05.18 02:17:48 | 052,718,176 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\avira_antivir_personal_de(1).exe

[2011.05.18 02:00:00 | 000,000,344 | ---- | M] () -- C:\WINDOWS\tasks\AdobeAAMUpdater-1.0-COMPUTER1-meinname.job

[2011.05.14 16:05:35 | 000,284,744 | ---- | M] (COMODO) -- C:\WINDOWS\System32\guard32.dll

[2011.05.14 16:05:32 | 000,097,504 | ---- | M] (COMODO) -- C:\WINDOWS\System32\drivers\inspect.sys

[2011.05.14 16:05:31 | 000,029,400 | ---- | M] (COMODO) -- C:\WINDOWS\System32\drivers\cmdhlp.sys

[2011.05.14 16:05:31 | 000,017,416 | ---- | M] (COMODO) -- C:\WINDOWS\System32\drivers\cmderd.sys

[2011.05.14 16:05:30 | 000,242,472 | ---- | M] (COMODO) -- C:\WINDOWS\System32\drivers\cmdGuard.sys

[2011.05.12 16:43:51 | 000,000,790 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Download Assistant.lnk

[2011.05.05 17:30:08 | 000,000,468 | ---- | M] () -- C:\WINDOWS\BRWMARK.INI

[2011.05.05 17:26:00 | 000,000,027 | ---- | M] () -- C:\WINDOWS\BRPP2KA.INI

[2011.05.05 16:56:44 | 000,001,728 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Status Monitor.lnk

[2011.05.05 16:56:16 | 000,000,050 | ---- | M] () -- C:\WINDOWS\System32\bridf05a.dat

[2011.05.04 17:48:24 | 000,000,682 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Inkscape.lnk

[2011.05.04 01:19:54 | 000,000,693 | -H-- | M] () -- C:\Documents and Settings\All Users\Documents\os604495.bin

[2011.04.29 20:38:10 | 000,000,650 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\TourDeFlex.lnk

[2011.04.25 18:53:38 | 000,002,267 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Skype.lnk

[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2011.05.24 16:18:09 | 000,302,080 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\yyh0jcpd.exe

[2011.05.24 10:51:31 | 000,001,707 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Avira AntiVir Control Center.lnk

[2011.05.24 01:41:06 | 046,753,958 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\ivdf_fusebundle_nt_en.zip

[2011.05.24 01:08:39 | 000,000,104 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\My Computer.lnk

[2011.05.18 18:16:08 | 000,089,324 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\avira_antivir_antirootkit_en.zip

[2011.05.18 16:00:47 | 000,000,087 | ---- | C] () -- C:\Documents and Settings\Administrator\mm.cfg

[2011.05.18 14:07:41 | 057,679,123 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\avira_antivir_personal_de.zip

[2011.05.18 13:08:42 | 043,859,754 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\vdf_fusebundle.zip

[2011.05.18 12:54:53 | 000,000,440 | RHS- | C] () -- C:\Documents and Settings\Administrator\ntuser.pol

[2011.05.18 12:54:51 | 000,001,599 | ---- | C] () -- C:\Documents and Settings\Administrator\Start Menu\Programs\Remote Assistance.lnk

[2011.05.18 12:54:51 | 000,000,792 | ---- | C] () -- C:\Documents and Settings\Administrator\Start Menu\Programs\Windows Media Player.lnk

[2011.05.18 02:14:14 | 052,718,176 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\avira_antivir_personal_de(1).exe

[2011.05.12 16:43:51 | 000,000,796 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Download Assistant.lnk

[2011.05.12 16:43:51 | 000,000,790 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Adobe Download Assistant.lnk

[2011.05.05 16:56:44 | 000,001,728 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Status Monitor.lnk

[2011.05.05 16:56:16 | 000,000,050 | ---- | C] () -- C:\WINDOWS\System32\bridf05a.dat

[2011.05.05 16:56:01 | 000,006,224 | ---- | C] () -- C:\WINDOWS\CVRPAGE.bmp

[2011.05.04 17:48:32 | 000,000,720 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Inkscape.lnk

[2011.05.04 17:48:21 | 000,000,682 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Inkscape.lnk

[2011.05.04 01:09:57 | 000,000,693 | -H-- | C] () -- C:\Documents and Settings\All Users\Documents\os604495.bin

[2011.04.29 20:38:10 | 000,000,656 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\TourDeFlex.lnk

[2011.04.29 20:38:10 | 000,000,650 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\TourDeFlex.lnk

[2011.02.18 16:26:02 | 000,165,376 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll

[2010.10.04 08:27:22 | 000,145,920 | ---- | C] () -- C:\Program Files\Aga.dll

[2010.10.04 08:27:22 | 000,002,401 | ---- | C] () -- C:\Program Files\FirstRun.fdb

[2010.10.04 08:27:22 | 000,000,255 | ---- | C] () -- C:\Program Files\FlashDevelop.exe.config

[2010.03.10 16:50:28 | 000,004,096 | ---- | C] () -- C:\WINDOWS\d3dx.dat

[2010.02.09 23:18:19 | 000,007,168 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys

[2010.01.28 02:21:58 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI

[2009.12.20 22:14:21 | 000,000,468 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI

[2009.12.20 22:14:21 | 000,000,027 | ---- | C] () -- C:\WINDOWS\BRPP2KA.INI

[2009.12.20 22:14:20 | 000,000,030 | ---- | C] () -- C:\WINDOWS\System32\brss01a.ini

[2009.12.09 21:00:41 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat

[2009.12.06 23:02:09 | 000,000,000 | ---- | C] () -- C:\WINDOWS\ativpsrm.bin

[2009.12.06 23:02:03 | 000,887,724 | ---- | C] () -- C:\WINDOWS\System32\ativva6x.dat

[2009.12.06 23:02:03 | 000,294,912 | ---- | C] () -- C:\WINDOWS\System32\ATIODE.exe

[2009.12.06 23:02:03 | 000,195,855 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.dat

[2009.12.06 23:02:03 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\ATIODCLI.exe

[2009.12.06 23:02:03 | 000,000,003 | ---- | C] () -- C:\WINDOWS\System32\ativva5x.dat

[2009.12.06 20:51:28 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat

[2009.12.06 20:33:57 | 000,014,640 | ---- | C] () -- C:\WINDOWS\System32\RaCoInst.dat

[2009.12.06 11:45:41 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI

[2009.12.06 11:44:39 | 003,448,160 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2009.12.06 03:57:18 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat

[2009.12.06 03:53:52 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat

[2008.04.14 06:55:28 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin

[2006.12.31 08:57:08 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat

[2001.08.23 13:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin

[2001.08.23 13:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat

[2001.08.23 13:00:00 | 000,392,626 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat

[2001.08.23 13:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat

[2001.08.23 13:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat

[2001.08.23 13:00:00 | 000,058,800 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat

[2001.08.23 13:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin

[2001.08.23 13:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat

[2001.08.23 13:00:00 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat

[2001.08.23 13:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat

[1996.04.03 21:33:26 | 000,005,248 | ---- | C] () -- C:\WINDOWS\System32\giveio.sys

 
 ========== LOP Check ==========

 

[2009.12.06 20:33:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Allnet Driver

[2010.02.09 23:18:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Canneverbe Limited

[2010.11.25 00:56:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\RalinkRT7x Driver

[2010.06.08 01:59:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\regid.1986-12.com.adobe

[2011.04.03 15:01:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TechSmith

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 

 
 < %ALLUSERSPROFILE%\Application Data\*. >

[2010.06.08 01:56:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Adobe

[2009.12.06 20:33:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Allnet Driver

[2010.06.08 01:58:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ALM

[2009.12.07 14:16:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ATI

[2011.05.24 10:51:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Avira

[2011.05.05 16:55:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Brother

[2010.02.09 23:18:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Canneverbe Limited

[2011.01.17 20:30:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Comodo

[2010.04.15 19:55:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\FLEXnet

[2010.11.11 01:18:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes

[2010.09.07 01:17:16 | 000,000,000 | --SD | M] -- C:\Documents and Settings\All Users\Application Data\Microsoft

[2010.02.09 22:48:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Nero

[2010.11.25 00:56:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\RalinkRT7x Driver

[2010.06.08 01:59:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\regid.1986-12.com.adobe

[2009.12.09 20:56:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Skype

[2010.04.23 18:55:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Sun

[2011.04.03 15:01:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TechSmith

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

[2010.03.01 23:44:10 | 000,033,568 | ---- | M] (Sun Microsystems, Inc.) -- C:\Documents and Settings\All Users\Application Data\Adobe\CS5\jre\bin\java-rmi.exe

[2010.03.01 23:44:10 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Documents and Settings\All Users\Application Data\Adobe\CS5\jre\bin\java.exe

[2010.03.01 23:44:10 | 000,059,168 | ---- | M] (Sun Microsystems, Inc.) -- C:\Documents and Settings\All Users\Application Data\Adobe\CS5\jre\bin\javacpl.exe

[2010.03.01 23:44:10 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Documents and Settings\All Users\Application Data\Adobe\CS5\jre\bin\javaw.exe

[2010.03.01 23:44:10 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Documents and Settings\All Users\Application Data\Adobe\CS5\jre\bin\javaws.exe

[2010.03.01 23:44:12 | 000,079,648 | ---- | M] (Sun Microsystems, Inc.) -- C:\Documents and Settings\All Users\Application Data\Adobe\CS5\jre\bin\jbroker.exe

[2010.03.01 23:44:12 | 000,023,328 | ---- | M] (Sun Microsystems, Inc.) -- C:\Documents and Settings\All Users\Application Data\Adobe\CS5\jre\bin\jp2launcher.exe

[2010.03.01 23:44:12 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Documents and Settings\All Users\Application Data\Adobe\CS5\jre\bin\jqs.exe

[2010.03.01 23:44:12 | 000,055,072 | ---- | M] (Sun Microsystems, Inc.) -- C:\Documents and Settings\All Users\Application Data\Adobe\CS5\jre\bin\jqsnotify.exe

[2010.03.01 23:44:12 | 000,386,872 | ---- | M] (Sun Microsystems, Inc.) -- C:\Documents and Settings\All Users\Application Data\Adobe\CS5\jre\bin\jucheck.exe

[2010.03.01 23:44:12 | 000,055,072 | ---- | M] (Sun Microsystems, Inc.) -- C:\Documents and Settings\All Users\Application Data\Adobe\CS5\jre\bin\jureg.exe

[2010.03.01 23:44:14 | 000,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\Documents and Settings\All Users\Application Data\Adobe\CS5\jre\bin\jusched.exe

[2010.03.01 23:44:14 | 000,033,568 | ---- | M] (Sun Microsystems, Inc.) -- C:\Documents and Settings\All Users\Application Data\Adobe\CS5\jre\bin\keytool.exe

[2010.03.01 23:44:14 | 000,033,568 | ---- | M] (Sun Microsystems, Inc.) -- C:\Documents and Settings\All Users\Application Data\Adobe\CS5\jre\bin\kinit.exe

[2010.03.01 23:44:14 | 000,033,568 | ---- | M] (Sun Microsystems, Inc.) -- C:\Documents and Settings\All Users\Application Data\Adobe\CS5\jre\bin\klist.exe

[2010.03.01 23:44:14 | 000,033,568 | ---- | M] (Sun Microsystems, Inc.) -- C:\Documents and Settings\All Users\Application Data\Adobe\CS5\jre\bin\ktab.exe

[2010.03.01 23:44:14 | 000,033,568 | ---- | M] (Sun Microsystems, Inc.) -- C:\Documents and Settings\All Users\Application Data\Adobe\CS5\jre\bin\orbd.exe

[2010.03.01 23:44:14 | 000,033,568 | ---- | M] (Sun Microsystems, Inc.) -- C:\Documents and Settings\All Users\Application Data\Adobe\CS5\jre\bin\pack200.exe

[2010.03.01 23:44:14 | 000,033,568 | ---- | M] (Sun Microsystems, Inc.) -- C:\Documents and Settings\All Users\Application Data\Adobe\CS5\jre\bin\policytool.exe

[2010.03.01 23:44:14 | 000,033,568 | ---- | M] (Sun Microsystems, Inc.) -- C:\Documents and Settings\All Users\Application Data\Adobe\CS5\jre\bin\rmid.exe

[2010.03.01 23:44:14 | 000,033,568 | ---- | M] (Sun Microsystems, Inc.) -- C:\Documents and Settings\All Users\Application Data\Adobe\CS5\jre\bin\rmiregistry.exe

[2010.03.01 23:44:14 | 000,033,568 | ---- | M] (Sun Microsystems, Inc.) -- C:\Documents and Settings\All Users\Application Data\Adobe\CS5\jre\bin\servertool.exe

[2010.03.01 23:44:14 | 000,030,496 | ---- | M] (Sun Microsystems, Inc.) -- C:\Documents and Settings\All Users\Application Data\Adobe\CS5\jre\bin\ssvagent.exe

[2010.03.01 23:44:14 | 000,033,568 | ---- | M] (Sun Microsystems, Inc.) -- C:\Documents and Settings\All Users\Application Data\Adobe\CS5\jre\bin\tnameserv.exe

[2010.03.01 23:44:14 | 000,132,896 | ---- | M] (Sun Microsystems, Inc.) -- C:\Documents and Settings\All Users\Application Data\Adobe\CS5\jre\bin\unpack200.exe

[2008.07.10 20:34:16 | 000,528,384 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\Allnet Driver\Wireless LAN USB Adapter\Driver\RaInst.exe

[2011.05.24 01:15:59 | 007,734,208 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe

[2009.12.10 13:15:54 | 000,533,792 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\RalinkRT7x Driver\Hama Wireless LAN Adapter\Driver\RaInst.exe

 

Invalid Environment Variable: APPDATA

 

Invalid Environment Variable: APPDATA

 
 < %SYSTEMDRIVE%\*.exe >

 

 
 < MD5 for: AGP440.SYS  >

[2008.04.14 06:51:44 | 020,056,462 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2008.04.14 06:51:44 | 020,056,462 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys

[2008.04.14 01:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\dllcache\atapi.sys

[2008.04.14 01:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys

[2008.04.14 01:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\ReinstallBackups\0006\DriverFiles\i386\atapi.sys

[2008.04.14 01:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\ReinstallBackups\0007\DriverFiles\i386\atapi.sys

 
 < MD5 for: EVENTLOG.DLL  >

[2009.12.20 00:00:00 | 000,037,520 | ---- | M] (perl.org) MD5=2852D57385C4709EAAE2F9DB01AD3672 -- C:\xampp\perl\site\lib\auto\Win32\EventLog\EventLog.dll

[2008.04.14 06:41:54 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\system32\dllcache\eventlog.dll

[2008.04.14 06:41:54 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\system32\eventlog.dll

 
 < MD5 for: NETLOGON.DLL  >

[2008.04.14 06:42:02 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\system32\dllcache\netlogon.dll

[2008.04.14 06:42:02 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\system32\netlogon.dll

 
 < MD5 for: SCECLI.DLL  >

[2008.04.14 06:42:06 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\system32\dllcache\scecli.dll

[2008.04.14 06:42:06 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\system32\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2008.04.14 06:42:10 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=B26B135FF1B9F60C9388B4A7D16F600B -- C:\WINDOWS\system32\dllcache\user32.dll

[2008.04.14 06:42:10 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=B26B135FF1B9F60C9388B4A7D16F600B -- C:\WINDOWS\system32\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2008.04.14 06:42:40 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\system32\dllcache\userinit.exe

[2008.04.14 06:42:40 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\system32\userinit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2008.04.14 06:42:40 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\system32\dllcache\winlogon.exe

[2008.04.14 06:42:40 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\system32\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2001.08.23 13:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys

[2001.08.23 13:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

[2010.02.09 22:59:25 | 000,717,296 | ---- | M] () Unable to obtain MD5 -- C:\WINDOWS\system32\drivers\sptd.sys

 
 < %systemroot%\System32\config\*.sav >

[2009.12.06 11:44:06 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav

[2009.12.06 11:44:06 | 001,089,536 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav

[2009.12.06 11:44:06 | 000,929,792 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >

[2009.11.04 17:45:14 | 000,479,232 | ---- | M] (Advanced Micro Devices, Inc.) Unable to obtain MD5 -- C:\WINDOWS\system32\ATIDEMGX.dll

[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]
 

< End of report >

Bitte Comodo IS deinstallieren und die Windows-Firewall einschalten. Suites und PFWs sind in den allermeisten Fällen kontraproduktiv und kein Sicherheitsgewinn.

Zitat:

Internet Explorer (Version = 6.0.2900.5512)

Besser ist es auf die Aktualität der Programme bzw. des Systems zu achten. IE6 ist ein zehn Jahre alter Browser, sowas geht garnicht mehr! Auch wenn du einen anderen Browser zum Surfen verwendest, sollte der IE so aktuell wie möglich sein.

Um die Updates kümmern wir uns aber später. Deinstallier erst mal Comodo und mach danach ein frisches OTL-Log.

Alles klar. Ich habe auch gleich nochmal eine paar Programme deinstalliert, deren trial-version abgelaufen ist.

Code:

OTL logfile created on: 25.05.2011 14:04:41 - Run 4

OTL by OldTimer - Version 3.2.23.0     Folder = C:\Documents and Settings\meinname\Desktop

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 6.0.2900.5512)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

 

3,18 Gb Total Physical Memory | 2,62 Gb Available Physical Memory | 82,34% Memory free

5,02 Gb Paging File | 4,46 Gb Available in Paging File | 88,84% Paging File free

Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 48,83 Gb Total Space | 6,75 Gb Free Space | 13,82% Space Free | Partition Type: NTFS

Drive E: | 1,84 Gb Total Space | 0,23 Gb Free Space | 12,68% Space Free | Partition Type: FAT32

Drive F: | 416,64 Gb Total Space | 400,50 Gb Free Space | 96,13% Space Free | Partition Type: NTFS

Drive G: | 297,45 Mb Total Space | 297,38 Mb Free Space | 99,98% Space Free | Partition Type: FAT32

 

Computer Name: COMPUTER1 | User Name: Administrator | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2011.05.24 23:01:14 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\meinname\Desktop\OTL.exe

PRC - [2010.04.01 13:33:15 | 000,267,432 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe

PRC - [2010.03.02 11:28:23 | 000,282,792 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

PRC - [2010.02.24 10:28:01 | 000,135,336 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe

PRC - [2010.01.14 22:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

PRC - [2009.12.20 00:00:00 | 006,095,504 | ---- | M] (MySQL AB) -- C:\xampp\mysql\bin\mysqld.exe

PRC - [2009.12.20 00:00:00 | 000,029,416 | ---- | M] (Apache Software Foundation) -- C:\xampp\apache\bin\httpd.exe

PRC - [2009.11.12 14:48:56 | 000,071,096 | ---- | M] () -- C:\Program Files\CDBurnerXP\NMSAccessU.exe

PRC - [2008.04.14 06:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

 

 
 ========== Modules (SafeList) ==========

 

MOD - [2011.05.24 23:01:14 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\meinname\Desktop\OTL.exe

MOD - [2008.04.14 06:42:52 | 001,054,208 | R--- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - File not found [Auto | Stopped] --  -- (XAMPP)

SRV - File not found [On_Demand | Stopped] --  -- (TipCtrl)

SRV - [2011.05.18 02:04:35 | 003,275,864 | ---- | M] () [Auto | Running] -- c:\Program Files\Common Files\Akamai\netsession_win_8832f4b.dll -- (Akamai)

SRV - [2010.04.01 13:33:15 | 000,267,432 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2010.02.24 10:28:01 | 000,135,336 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2009.12.20 00:00:00 | 006,095,504 | ---- | M] (MySQL AB) [Auto | Running] -- C:\xampp\mysql\bin\mysqld.exe -- (MySQL)

SRV - [2009.12.20 00:00:00 | 000,029,416 | ---- | M] (Apache Software Foundation) [Auto | Running] -- C:\xampp\apache\bin\httpd.exe -- (Apache2.2)

SRV - [2009.11.12 14:48:56 | 000,071,096 | ---- | M] () [Auto | Running] -- C:\Program Files\CDBurnerXP\NMSAccessU.exe -- (NMSAccessU)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - [2010.12.18 13:03:56 | 000,021,696 | ---- | M] (Almico Software) [Kernel | Boot | Running] -- C:\WINDOWS\system32\speedfan.sys -- (speedfan)

DRV - [2010.03.01 10:05:19 | 000,124,784 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)

DRV - [2010.02.16 14:24:01 | 000,060,936 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2010.02.09 22:59:25 | 000,717,296 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)

DRV - [2009.12.10 13:16:04 | 000,476,544 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\rt73.sys -- (RT73)

DRV - [2009.11.12 14:48:56 | 000,007,168 | ---- | M] () [File_System | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\StarOpen.sys -- (StarOpen)

DRV - [2009.11.04 18:15:30 | 004,423,168 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)

DRV - [2009.08.19 02:05:56 | 000,100,368 | ---- | M] (ATI Research Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AtiHdmi.sys -- (AtiHdmiService)

DRV - [2009.07.18 07:18:44 | 000,093,096 | R--- | M] (JMicron Technology Corp.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\jraid.sys -- (JRAID)

DRV - [2009.05.11 12:49:19 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio)

DRV - [2009.05.11 10:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2008.10.31 12:38:00 | 004,942,336 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)

DRV - [2008.10.30 15:14:20 | 000,117,888 | R--- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)

DRV - [2008.10.30 01:05:58 | 000,031,896 | ---- | M] (DemoForge, LLC) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\dfmirage.sys -- (dfmirage)

DRV - [2008.07.30 16:44:44 | 000,619,136 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\rt2870.sys -- (rt2870)

DRV - [2001.08.17 15:51:32 | 000,018,688 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\irsir.sys -- (irsir)

DRV - [1996.04.03 21:33:26 | 000,005,248 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\system32\giveio.sys -- (giveio)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

 

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22

FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0

 

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.17\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.05.24 01:15:27 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.17\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.04.29 21:49:11 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 4.0b12\extensions\\Components: C:\Program Files\Mozilla Firefox 4.0 Beta 11\components [2011.03.13 01:23:57 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 4.0b12\extensions\\Plugins: C:\Program Files\Mozilla Firefox 4.0 Beta 11\plugins

 

[2011.05.24 01:15:32 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions

[2011.05.24 01:15:32 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\7mq58obb.default\extensions

[2011.05.24 11:41:31 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions

[2010.11.24 18:27:12 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

[2010.04.23 18:55:13 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF

[2010.09.15 05:50:38 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

[2010.05.25 18:09:48 | 000,063,488 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npwachk.dll

[2011.04.09 03:46:41 | 000,001,392 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom-de.xml

[2011.04.09 03:46:41 | 000,002,344 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-de.xml

[2011.04.09 03:46:41 | 000,006,805 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\leo_ende_de.xml

[2011.04.09 03:46:41 | 000,001,178 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-de.xml

[2011.04.09 03:46:41 | 000,001,105 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2007.08.11 08:58:33 | 000,000,768 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: 127.0.0.1         mpa.one.microsoft.com

O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe (Brother Industries, Ltd.)

O4 - HKLM..\Run: [JMB36X IDE Setup] C:\WINDOWS\RaidTool\xInsIDE.exe ()

O4 - HKLM..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl05a\BrStDvPt.exe (Brother Industories, Ltd.)

O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)

O4 - HKCU..\RunOnce: [scan_after_setup] c:\program files\avira\antivir desktop\avcenter.exe (Avira GmbH)

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)

O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)

O24 - Desktop BackupWallPaper: 

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009.12.06 03:56:03 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *) -  File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

NetSvcs: 6to4 -  File not found

NetSvcs: Ias -  File not found

NetSvcs: Iprip -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: WmdmPmSp -  File not found

 

MsConfig - Services: "WMPNetworkSvc"

MsConfig - State: "system.ini" - 0

MsConfig - State: "win.ini" - 0

MsConfig - State: "bootini" - 0

MsConfig - State: "services" - 2

MsConfig - State: "startup" - 0

 

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: sermouse.sys - Driver

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: vga.sys - Driver

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

 

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: sermouse.sys - Driver

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: vga.sys - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

 

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM

ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vector Graphics Rendering (VML)

ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4

ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML Data Binding for Java

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe

ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Advanced Authoring

ActiveX: {4395D8A7-19B8-34B4-10D9-A60A0111307F} - Internet Explorer

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT

ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4b218e3e-bc98-4770-93d3-2731b9329278} - %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection MarketplaceLinkInstall 896 %systemroot%\inf\ie.inf

ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7

ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Sicherheitsupdate für Windows XP (KB923789)

ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - %SystemRoot%\system32\ie4uinit.exe

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {A9B4B5A5-2F94-153C-1B34-499A1E337ED3} - NetShow

ActiveX: {ACC563BC-4266-43f0-B6ED-9D38C4202C7E} - 

ActiveX: {B4DA0E23-6F62-0669-DEAD-B3AD498C7378} - Dynamic HTML Data Binding for Java

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Task Scheduler

ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1

ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

 

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)

Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)

Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)

Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)

Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)

Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)

Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()

Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()

Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)

Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

Drivers32: vidc.tscc - C:\WINDOWS\System32\tsccvid.dll (TechSmith Corporation)

Drivers32: vidc.yv12 - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point (16902109354000384)

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2011.05.25 10:53:36 | 000,000,000 | -HSD | C] -- C:\Config.Msi

[2011.05.25 10:49:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\AdobeTemp

[2011.05.24 11:33:20 | 000,000,000 | ---D | C] -- C:\Program Files\Sophos

[2011.05.24 11:33:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Sophos

[2011.05.24 10:51:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Avira

[2011.05.24 10:51:22 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\ssmdrv.sys

[2011.05.24 10:51:20 | 000,124,784 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys

[2011.05.24 10:51:20 | 000,060,936 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntflt.sys

[2011.05.24 10:51:20 | 000,045,416 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntdd.sys

[2011.05.24 10:51:20 | 000,022,360 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntmgr.sys

[2011.05.24 10:51:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Avira

[2011.05.24 01:42:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\ivdf_fusebundle_nt_en

[2011.05.24 01:16:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\Downloads

[2011.05.24 01:15:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla

[2011.05.24 01:15:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Mozilla

[2011.05.24 01:09:11 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Malwarebytes

[2011.05.24 00:51:01 | 000,000,000 | ---D | C] -- C:\Program Files\Avira

[2011.05.18 18:16:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\avira_antivir_antirootkit_en

[2011.05.18 16:00:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\FlashDevelop

[2011.05.18 14:23:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\avira_antivir_personal_de

[2011.05.18 13:16:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\Adobe

[2011.05.18 13:16:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Adobe

[2011.05.18 13:08:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\vdf_fusebundle

[2011.05.18 12:54:51 | 000,000,000 | --SD | C] -- C:\Documents and Settings\Administrator\Application Data\Microsoft

[2011.05.18 12:54:51 | 000,000,000 | --SD | C] -- C:\Documents and Settings\Administrator\Cookies

[2011.05.18 12:54:51 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Administrator\Start Menu\Programs\Startup

[2011.05.18 12:54:51 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Administrator\Start Menu

[2011.05.18 12:54:51 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Administrator\SendTo

[2011.05.18 12:54:51 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Administrator\Application Data

[2011.05.18 12:54:51 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories

[2011.05.18 12:54:51 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Administrator\Local Settings

[2011.05.18 12:54:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Templates

[2011.05.18 12:54:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Recent

[2011.05.18 12:54:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\PrintHood

[2011.05.18 12:54:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\NetHood

[2011.05.18 12:54:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents

[2011.05.18 12:54:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft

[2011.05.18 12:54:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Macromedia

[2011.05.18 12:54:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Favorites

[2011.05.18 12:54:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop

[2011.05.18 12:54:45 | 000,000,000 | -HSD | C] -- C:\WINDOWS\CSC

[2011.05.18 02:29:09 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\NtmsData

[2011.05.12 16:43:51 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe Download Assistant

[2011.05.05 16:56:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Brother

[2011.05.05 16:56:03 | 000,055,296 | ---- | C] (Brother Industries,Ltd.) -- C:\WINDOWS\System32\brinsstr.dll

[2011.05.05 16:56:02 | 000,188,416 | ---- | C] (brother) -- C:\WINDOWS\System32\PDRVINST.DLL

[2011.05.05 16:56:02 | 000,081,920 | ---- | C] (brother) -- C:\WINDOWS\System32\BrWebIns.dll

[2011.05.05 16:56:02 | 000,065,536 | ---- | C] (brother) -- C:\WINDOWS\System32\BRWEBUP.EXE

[2011.05.05 16:56:02 | 000,000,000 | ---D | C] -- C:\Program Files\Brother

[2011.05.05 16:56:01 | 000,147,456 | ---- | C] (Brother Industries,Ltd.) -- C:\WINDOWS\brunin03.dll

[2011.05.05 16:56:01 | 000,000,000 | ---D | C] -- C:\Brother

[2011.05.05 16:55:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Brother

[2011.05.04 17:46:53 | 000,000,000 | ---D | C] -- C:\Program Files\Inkscape

[2011.04.29 20:38:05 | 000,000,000 | ---D | C] -- C:\Program Files\TourDeFlex

[2011.04.28 12:01:24 | 000,000,000 | ---D | C] -- C:\Program Files\mp3DirectCut

[2010.11.22 17:54:01 | 000,091,913 | ---- | C] (FlashDevelop.org) -- C:\Program Files\Uninstall.exe

[2010.10.07 21:57:36 | 000,362,496 | ---- | C] (FlashDevelop.org) -- C:\Program Files\FlashDevelop.exe

[2010.10.07 21:57:28 | 001,350,144 | ---- | C] (FlashDevelop.org) -- C:\Program Files\PluginCore.dll

[2010.10.04 08:27:22 | 000,520,704 | ---- | C] (scite.net.ru) -- C:\Program Files\SciLexer.dll

[2010.10.04 08:27:22 | 000,106,496 | ---- | C] (Galos) -- C:\Program Files\Scripting.dll

[2010.10.04 08:27:22 | 000,097,280 | ---- | C] (FlashDevelop.org) -- C:\Program Files\SwfOp.dll

[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2011.05.25 13:26:10 | 000,001,194 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1645522239-115176313-1417001333-1003UA.job

[2011.05.25 12:26:00 | 000,001,142 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1645522239-115176313-1417001333-1003Core.job

[2011.05.25 12:09:50 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2011.05.25 12:07:15 | 000,001,658 | ---- | M] () -- C:\WINDOWS\System32\.ini

[2011.05.24 12:04:38 | 000,302,080 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\yyh0jcpd.exe

[2011.05.24 10:51:31 | 000,001,707 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Avira AntiVir Control Center.lnk

[2011.05.24 01:39:18 | 046,753,958 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\ivdf_fusebundle_nt_en.zip

[2011.05.24 01:08:39 | 000,000,104 | ---- | M] () -- C:\Documents and Settings\Administrator\My Documents\My Computer.lnk

[2011.05.23 20:57:04 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2011.05.18 18:13:54 | 000,089,324 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\avira_antivir_antirootkit_en.zip

[2011.05.18 16:01:21 | 000,000,087 | ---- | M] () -- C:\Documents and Settings\Administrator\mm.cfg

[2011.05.18 14:11:55 | 057,679,123 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\avira_antivir_personal_de.zip

[2011.05.18 13:06:14 | 043,859,754 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\vdf_fusebundle.zip

[2011.05.18 12:54:53 | 000,000,440 | RHS- | M] () -- C:\Documents and Settings\Administrator\ntuser.pol

[2011.05.18 02:17:48 | 052,718,176 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\avira_antivir_personal_de(1).exe

[2011.05.12 16:43:51 | 000,000,790 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Download Assistant.lnk

[2011.05.05 17:30:08 | 000,000,468 | ---- | M] () -- C:\WINDOWS\BRWMARK.INI

[2011.05.05 17:26:00 | 000,000,027 | ---- | M] () -- C:\WINDOWS\BRPP2KA.INI

[2011.05.05 16:56:44 | 000,001,728 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Status Monitor.lnk

[2011.05.05 16:56:16 | 000,000,050 | ---- | M] () -- C:\WINDOWS\System32\bridf05a.dat

[2011.05.04 17:48:24 | 000,000,682 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Inkscape.lnk

[2011.05.04 01:19:54 | 000,000,693 | -H-- | M] () -- C:\Documents and Settings\All Users\Documents\os604495.bin

[2011.04.29 20:38:10 | 000,000,650 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\TourDeFlex.lnk

[2011.04.25 18:53:38 | 000,002,267 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Skype.lnk

[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2011.05.25 12:07:15 | 000,001,658 | ---- | C] () -- C:\WINDOWS\System32\.ini

[2011.05.24 16:18:09 | 000,302,080 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\yyh0jcpd.exe

[2011.05.24 10:51:31 | 000,001,707 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Avira AntiVir Control Center.lnk

[2011.05.24 01:41:06 | 046,753,958 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\ivdf_fusebundle_nt_en.zip

[2011.05.24 01:08:39 | 000,000,104 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\My Computer.lnk

[2011.05.18 18:16:08 | 000,089,324 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\avira_antivir_antirootkit_en.zip

[2011.05.18 16:00:47 | 000,000,087 | ---- | C] () -- C:\Documents and Settings\Administrator\mm.cfg

[2011.05.18 14:07:41 | 057,679,123 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\avira_antivir_personal_de.zip

[2011.05.18 13:08:42 | 043,859,754 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\vdf_fusebundle.zip

[2011.05.18 12:54:53 | 000,000,440 | RHS- | C] () -- C:\Documents and Settings\Administrator\ntuser.pol

[2011.05.18 12:54:51 | 000,001,599 | ---- | C] () -- C:\Documents and Settings\Administrator\Start Menu\Programs\Remote Assistance.lnk

[2011.05.18 12:54:51 | 000,000,792 | ---- | C] () -- C:\Documents and Settings\Administrator\Start Menu\Programs\Windows Media Player.lnk

[2011.05.18 02:14:14 | 052,718,176 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\avira_antivir_personal_de(1).exe

[2011.05.12 16:43:51 | 000,000,796 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Download Assistant.lnk

[2011.05.12 16:43:51 | 000,000,790 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Adobe Download Assistant.lnk

[2011.05.05 16:56:44 | 000,001,728 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Status Monitor.lnk

[2011.05.05 16:56:16 | 000,000,050 | ---- | C] () -- C:\WINDOWS\System32\bridf05a.dat

[2011.05.05 16:56:01 | 000,006,224 | ---- | C] () -- C:\WINDOWS\CVRPAGE.bmp

[2011.05.04 17:48:32 | 000,000,720 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Inkscape.lnk

[2011.05.04 17:48:21 | 000,000,682 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Inkscape.lnk

[2011.05.04 01:09:57 | 000,000,693 | -H-- | C] () -- C:\Documents and Settings\All Users\Documents\os604495.bin

[2011.04.29 20:38:10 | 000,000,656 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\TourDeFlex.lnk

[2011.04.29 20:38:10 | 000,000,650 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\TourDeFlex.lnk

[2011.02.18 16:26:02 | 000,165,376 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll

[2010.10.04 08:27:22 | 000,145,920 | ---- | C] () -- C:\Program Files\Aga.dll

[2010.10.04 08:27:22 | 000,002,401 | ---- | C] () -- C:\Program Files\FirstRun.fdb

[2010.10.04 08:27:22 | 000,000,255 | ---- | C] () -- C:\Program Files\FlashDevelop.exe.config

[2010.03.10 16:50:28 | 000,004,096 | ---- | C] () -- C:\WINDOWS\d3dx.dat

[2010.02.09 23:18:19 | 000,007,168 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys

[2010.01.28 02:21:58 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI

[2009.12.20 22:14:21 | 000,000,468 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI

[2009.12.20 22:14:21 | 000,000,027 | ---- | C] () -- C:\WINDOWS\BRPP2KA.INI

[2009.12.20 22:14:20 | 000,000,030 | ---- | C] () -- C:\WINDOWS\System32\brss01a.ini

[2009.12.09 21:00:41 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat

[2009.12.06 23:02:09 | 000,000,000 | ---- | C] () -- C:\WINDOWS\ativpsrm.bin

[2009.12.06 23:02:03 | 000,887,724 | ---- | C] () -- C:\WINDOWS\System32\ativva6x.dat

[2009.12.06 23:02:03 | 000,294,912 | ---- | C] () -- C:\WINDOWS\System32\ATIODE.exe

[2009.12.06 23:02:03 | 000,195,855 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.dat

[2009.12.06 23:02:03 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\ATIODCLI.exe

[2009.12.06 23:02:03 | 000,000,003 | ---- | C] () -- C:\WINDOWS\System32\ativva5x.dat

[2009.12.06 20:51:28 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat

[2009.12.06 20:33:57 | 000,014,640 | ---- | C] () -- C:\WINDOWS\System32\RaCoInst.dat

[2009.12.06 11:45:41 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI

[2009.12.06 11:44:39 | 003,448,160 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2009.12.06 03:57:18 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat

[2009.12.06 03:53:52 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat

[2008.04.14 06:55:28 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin

[2006.12.31 08:57:08 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat

[2001.08.23 13:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin

[2001.08.23 13:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat

[2001.08.23 13:00:00 | 000,392,626 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat

[2001.08.23 13:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat

[2001.08.23 13:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat

[2001.08.23 13:00:00 | 000,058,800 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat

[2001.08.23 13:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin

[2001.08.23 13:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat

[2001.08.23 13:00:00 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat

[2001.08.23 13:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat

[1996.04.03 21:33:26 | 000,005,248 | ---- | C] () -- C:\WINDOWS\System32\giveio.sys

 
 ========== LOP Check ==========

 

[2009.12.06 20:33:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Allnet Driver

[2010.02.09 23:18:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Canneverbe Limited

[2010.11.25 00:56:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\RalinkRT7x Driver

[2010.06.08 01:59:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\regid.1986-12.com.adobe

[2011.04.03 15:01:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TechSmith

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 

 
 < %ALLUSERSPROFILE%\Application Data\*. >

[2011.05.25 11:48:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Adobe

[2009.12.06 20:33:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Allnet Driver

[2009.12.07 14:16:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ATI

[2011.05.24 10:51:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Avira

[2011.05.05 16:55:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Brother

[2010.02.09 23:18:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Canneverbe Limited

[2011.01.17 20:30:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Comodo

[2010.04.15 19:55:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\FLEXnet

[2010.11.11 01:18:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes

[2010.09.07 01:17:16 | 000,000,000 | --SD | M] -- C:\Documents and Settings\All Users\Application Data\Microsoft

[2010.02.09 22:48:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Nero

[2010.11.25 00:56:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\RalinkRT7x Driver

[2010.06.08 01:59:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\regid.1986-12.com.adobe

[2009.12.09 20:56:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Skype

[2010.04.23 18:55:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Sun

[2011.04.03 15:01:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TechSmith

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

[2008.07.10 20:34:16 | 000,528,384 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\Allnet Driver\Wireless LAN USB Adapter\Driver\RaInst.exe

[2011.05.24 01:15:59 | 007,734,208 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe

[2009.12.10 13:15:54 | 000,533,792 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\RalinkRT7x Driver\Hama Wireless LAN Adapter\Driver\RaInst.exe

 

Invalid Environment Variable: APPDATA

 

Invalid Environment Variable: APPDATA

 
 < %SYSTEMDRIVE%\*.exe >

 

 
 < MD5 for: AGP440.SYS  >

[2008.04.14 06:51:44 | 020,056,462 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2008.04.14 06:51:44 | 020,056,462 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys

[2008.04.14 01:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\dllcache\atapi.sys

[2008.04.14 01:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys

[2008.04.14 01:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\ReinstallBackups\0006\DriverFiles\i386\atapi.sys

[2008.04.14 01:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\ReinstallBackups\0007\DriverFiles\i386\atapi.sys

 
 < MD5 for: EVENTLOG.DLL  >

[2009.12.20 00:00:00 | 000,037,520 | ---- | M] (perl.org) MD5=2852D57385C4709EAAE2F9DB01AD3672 -- C:\xampp\perl\site\lib\auto\Win32\EventLog\EventLog.dll

[2008.04.14 06:41:54 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\system32\dllcache\eventlog.dll

[2008.04.14 06:41:54 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\system32\eventlog.dll

 
 < MD5 for: NETLOGON.DLL  >

[2008.04.14 06:42:02 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\system32\dllcache\netlogon.dll

[2008.04.14 06:42:02 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\system32\netlogon.dll

 
 < MD5 for: SCECLI.DLL  >

[2008.04.14 06:42:06 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\system32\dllcache\scecli.dll

[2008.04.14 06:42:06 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\system32\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2008.04.14 06:42:10 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=B26B135FF1B9F60C9388B4A7D16F600B -- C:\WINDOWS\system32\dllcache\user32.dll

[2008.04.14 06:42:10 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=B26B135FF1B9F60C9388B4A7D16F600B -- C:\WINDOWS\system32\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2008.04.14 06:42:40 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\system32\dllcache\userinit.exe

[2008.04.14 06:42:40 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\system32\userinit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2008.04.14 06:42:40 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\system32\dllcache\winlogon.exe

[2008.04.14 06:42:40 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\system32\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2001.08.23 13:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys

[2001.08.23 13:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

[2010.02.09 22:59:25 | 000,717,296 | ---- | M] () Unable to obtain MD5 -- C:\WINDOWS\system32\drivers\sptd.sys

 
 < %systemroot%\System32\config\*.sav >

[2009.12.06 11:44:06 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav

[2009.12.06 11:44:06 | 001,089,536 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav

[2009.12.06 11:44:06 | 000,929,792 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >

[2009.11.04 17:45:14 | 000,479,232 | ---- | M] (Advanced Micro Devices, Inc.) Unable to obtain MD5 -- C:\WINDOWS\system32\ATIDEMGX.dll

[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]
 

< End of report >

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

:OTL

[2011.05.04 01:09:57 | 000,000,693 | -H-- | C] () -- C:\Documents and Settings\All Users\Documents\os604495.bin

:Commands

[purity]

[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Code:

========== OTL ==========

C:\Documents and Settings\All Users\Documents\os604495.bin moved successfully.

========== COMMANDS ==========

C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

 

OTL by OldTimer - Version 3.2.23.0 log created on 05252011_154345

Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - also beide Haken setzen, auf Start scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

http://www.trojaner-board.de/attachm...rnen-start.png

Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Vista und 7 User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

Mach ich. Antivir läßt sich übrigens wieder updaten.

Code:

2011/05/25 16:21:33.0156 1248        TDSS rootkit removing tool 2.5.3.0 May 25 2011 07:09:24

2011/05/25 16:21:33.0218 1248        ================================================================================

2011/05/25 16:21:33.0218 1248        SystemInfo:

2011/05/25 16:21:33.0218 1248        

2011/05/25 16:21:33.0218 1248        OS Version: 5.1.2600 ServicePack: 3.0

2011/05/25 16:21:33.0218 1248        Product type: Workstation

2011/05/25 16:21:33.0218 1248        ComputerName: COMPUTER1

2011/05/25 16:21:33.0218 1248        UserName: Martin

2011/05/25 16:21:33.0218 1248        Windows directory: C:\WINDOWS

2011/05/25 16:21:33.0218 1248        System windows directory: C:\WINDOWS

2011/05/25 16:21:33.0218 1248        Processor architecture: Intel x86

2011/05/25 16:21:33.0218 1248        Number of processors: 4

2011/05/25 16:21:33.0218 1248        Page size: 0x1000

2011/05/25 16:21:33.0218 1248        Boot type: Normal boot

2011/05/25 16:21:33.0218 1248        ================================================================================

2011/05/25 16:21:34.0640 1248        Initialize success

2011/05/25 16:21:48.0734 4068        ================================================================================

2011/05/25 16:21:48.0734 4068        Scan started

2011/05/25 16:21:48.0734 4068        Mode: Manual; 

2011/05/25 16:21:48.0734 4068        ================================================================================

2011/05/25 16:21:49.0609 4068        ACPI            (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys

2011/05/25 16:21:49.0921 4068        ACPIEC          (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys

2011/05/25 16:21:50.0468 4068        aec             (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys

2011/05/25 16:21:50.0843 4068        AFD             (322d0e36693d6e24a2398bee62a268cd) C:\WINDOWS\System32\drivers\afd.sys

2011/05/25 16:21:52.0000 4068        Arp1394         (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys

2011/05/25 16:21:52.0968 4068        AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys

2011/05/25 16:21:53.0171 4068        atapi           (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys

2011/05/25 16:21:55.0140 4068        ati2mtag        (3a1f64d8b1b6c6387c8c682c30843a38) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys

2011/05/25 16:21:55.0375 4068        AtiHdmiService  (fac04a8e09c8d70594382656d99772a3) C:\WINDOWS\system32\drivers\AtiHdmi.sys

2011/05/25 16:21:55.0546 4068        Atmarpc         (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys

2011/05/25 16:21:55.0734 4068        audstub         (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys

2011/05/25 16:21:55.0828 4068        avgio           (0b497c79824f8e1bf22fa6aacd3de3a0) C:\Program Files\Avira\AntiVir Desktop\avgio.sys

2011/05/25 16:21:56.0015 4068        avgntflt        (a88d29d928ad2b830e87b53e3f9bc182) C:\WINDOWS\system32\DRIVERS\avgntflt.sys

2011/05/25 16:21:56.0218 4068        avipbb          (524b9e78e396c00968c5629ed5bbfab0) C:\WINDOWS\system32\DRIVERS\avipbb.sys

2011/05/25 16:21:56.0406 4068        Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys

2011/05/25 16:21:56.0578 4068        BrScnUsb        (92a964547b96d697e5e9ed43b4297f5a) C:\WINDOWS\system32\Drivers\BrScnUsb.sys

2011/05/25 16:21:56.0765 4068        cbidf2k         (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys

2011/05/25 16:21:56.0953 4068        CCDECODE        (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys

2011/05/25 16:21:57.0296 4068        Cdaudio         (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys

2011/05/25 16:21:57.0500 4068        Cdfs            (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys

2011/05/25 16:21:57.0671 4068        Cdrom           (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys

2011/05/25 16:21:58.0687 4068        dfmirage        (d8cd6a2a94f545858eec6117f0d5dff4) C:\WINDOWS\system32\DRIVERS\dfmirage.sys

2011/05/25 16:21:58.0875 4068        Disk            (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys

2011/05/25 16:21:59.0296 4068        dmboot          (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys

2011/05/25 16:21:59.0750 4068        dmio            (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys

2011/05/25 16:21:59.0921 4068        dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys

2011/05/25 16:22:00.0125 4068        DMusic          (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys

2011/05/25 16:22:00.0468 4068        drmkaud         (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys

2011/05/25 16:22:00.0687 4068        Fastfat         (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys

2011/05/25 16:22:00.0875 4068        Fdc             (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys

2011/05/25 16:22:01.0062 4068        Fips            (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys

2011/05/25 16:22:01.0234 4068        Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys

2011/05/25 16:22:01.0437 4068        FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys

2011/05/25 16:22:01.0609 4068        Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys

2011/05/25 16:22:01.0812 4068        Ftdisk          (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys

2011/05/25 16:22:01.0968 4068        giveio          (77ebf3e9386daa51551af429052d88d0) C:\WINDOWS\system32\giveio.sys

2011/05/25 16:22:02.0203 4068        Gpc             (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys

2011/05/25 16:22:02.0421 4068        HDAudBus        (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys

2011/05/25 16:22:02.0609 4068        hidusb          (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys

2011/05/25 16:22:03.0031 4068        HTTP            (f6aacf5bce2893e0c1754afeb672e5c9) C:\WINDOWS\system32\Drivers\HTTP.sys

2011/05/25 16:22:03.0546 4068        i8042prt        (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\drivers\i8042prt.sys

2011/05/25 16:22:03.0750 4068        Imapi           (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys

2011/05/25 16:22:05.0656 4068        IntcAzAudAddService (19d3781892a3794672cd1962f3d8d3b8) C:\WINDOWS\system32\drivers\RtkHDAud.sys

2011/05/25 16:22:06.0000 4068        intelppm        (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys

2011/05/25 16:22:06.0187 4068        Ip6Fw           (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys

2011/05/25 16:22:06.0375 4068        IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys

2011/05/25 16:22:06.0546 4068        IpInIp          (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys

2011/05/25 16:22:06.0781 4068        IpNat           (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys

2011/05/25 16:22:06.0953 4068        IPSec           (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys

2011/05/25 16:22:07.0187 4068        irda            (aca5e7b54409f9cb5eed97ed0c81120e) C:\WINDOWS\system32\DRIVERS\irda.sys

2011/05/25 16:22:07.0406 4068        IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys

2011/05/25 16:22:07.0578 4068        irsir           (0501f0b9ab08425f8c0eacbdcc04aa32) C:\WINDOWS\system32\DRIVERS\irsir.sys

2011/05/25 16:22:07.0765 4068        isapnp          (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys

2011/05/25 16:22:07.0968 4068        JRAID           (dc8e2779cdf0348a35aaffa3a1bde0c9) C:\WINDOWS\system32\DRIVERS\jraid.sys

2011/05/25 16:22:08.0156 4068        Kbdclass        (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys

2011/05/25 16:22:08.0328 4068        kbdhid          (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys

2011/05/25 16:22:08.0562 4068        kmixer          (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys

2011/05/25 16:22:08.0812 4068        KSecDD          (1705745d900dabf2d89f90ebaddc7517) C:\WINDOWS\system32\drivers\KSecDD.sys

2011/05/25 16:22:09.0468 4068        mnmdd           (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys

2011/05/25 16:22:09.0640 4068        Modem           (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys

2011/05/25 16:22:09.0828 4068        Mouclass        (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys

2011/05/25 16:22:10.0015 4068        mouhid          (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys

2011/05/25 16:22:10.0187 4068        MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys

2011/05/25 16:22:10.0578 4068        MRxDAV          (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys

2011/05/25 16:22:10.0890 4068        MRxSmb          (68755f0ff16070178b54674fe5b847b0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys

2011/05/25 16:22:11.0125 4068        Msfs            (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys

2011/05/25 16:22:11.0312 4068        MSKSSRV         (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys

2011/05/25 16:22:11.0468 4068        MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys

2011/05/25 16:22:11.0640 4068        MSPQM           (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys

2011/05/25 16:22:11.0812 4068        mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys

2011/05/25 16:22:12.0000 4068        MSTEE           (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys

2011/05/25 16:22:12.0218 4068        Mup             (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys

2011/05/25 16:22:12.0421 4068        NABTSFEC        (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys

2011/05/25 16:22:12.0671 4068        NDIS            (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys

2011/05/25 16:22:12.0843 4068        NdisIP          (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys

2011/05/25 16:22:13.0031 4068        NdisTapi        (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys

2011/05/25 16:22:13.0203 4068        Ndisuio         (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys

2011/05/25 16:22:13.0406 4068        NdisWan         (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys

2011/05/25 16:22:13.0609 4068        NDProxy         (6215023940cfd3702b46abc304e1d45a) C:\WINDOWS\system32\drivers\NDProxy.sys

2011/05/25 16:22:13.0796 4068        NetBIOS         (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys

2011/05/25 16:22:14.0015 4068        NetBT           (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys

2011/05/25 16:22:14.0250 4068        NIC1394         (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys

2011/05/25 16:22:14.0421 4068        Npfs            (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys

2011/05/25 16:22:14.0765 4068        Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys

2011/05/25 16:22:15.0046 4068        Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys

2011/05/25 16:22:15.0218 4068        NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys

2011/05/25 16:22:15.0406 4068        NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys

2011/05/25 16:22:15.0593 4068        ohci1394        (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys

2011/05/25 16:22:15.0796 4068        Parport         (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\drivers\Parport.sys

2011/05/25 16:22:15.0984 4068        PartMgr         (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys

2011/05/25 16:22:16.0156 4068        ParVdm          (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys

2011/05/25 16:22:16.0343 4068        PCI             (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys

2011/05/25 16:22:16.0718 4068        PCIIde          (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys

2011/05/25 16:22:16.0921 4068        Pcmcia          (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys

2011/05/25 16:22:18.0187 4068        PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys

2011/05/25 16:22:18.0390 4068        PSched          (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys

2011/05/25 16:22:18.0578 4068        Ptilink         (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys

2011/05/25 16:22:18.0765 4068        PxHelp20        (153d02480a0a2f45785522e814c634b6) C:\WINDOWS\system32\Drivers\PxHelp20.sys

2011/05/25 16:22:19.0718 4068        RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys

2011/05/25 16:22:19.0906 4068        Rasirda         (0207d26ddf796a193ccd9f83047bb5fc) C:\WINDOWS\system32\DRIVERS\rasirda.sys

2011/05/25 16:22:20.0093 4068        Rasl2tp         (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys

2011/05/25 16:22:20.0281 4068        RasPppoe        (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys

2011/05/25 16:22:20.0468 4068        Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys

2011/05/25 16:22:20.0703 4068        Rdbss           (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys

2011/05/25 16:22:20.0875 4068        RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys

2011/05/25 16:22:21.0093 4068        rdpdr           (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys

2011/05/25 16:22:21.0359 4068        RDPWD           (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys

2011/05/25 16:22:21.0593 4068        redbook         (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys

2011/05/25 16:22:21.0984 4068        rt2870          (5532f69d0a845ffe9d70b9e0392fe50a) C:\WINDOWS\system32\DRIVERS\rt2870.sys

2011/05/25 16:22:22.0515 4068        RT73            (4ef3f74439aa644bcd8ddc0ed88a5d01) C:\WINDOWS\system32\DRIVERS\rt73.sys

2011/05/25 16:22:22.0875 4068        RTLE8023xp      (839141088ad7ee90f5b441b2d1afd22c) C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys

2011/05/25 16:22:23.0093 4068        Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys

2011/05/25 16:22:23.0265 4068        serenum         (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys

2011/05/25 16:22:23.0453 4068        Serial          (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys

2011/05/25 16:22:23.0640 4068        Sfloppy         (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys

2011/05/25 16:22:23.0984 4068        SLIP            (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys

2011/05/25 16:22:24.0312 4068        speedfan        (9f70cd5edcc4efc48ae21e04fb03be9d) C:\WINDOWS\system32\speedfan.sys

2011/05/25 16:22:24.0531 4068        splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys

2011/05/25 16:22:24.0937 4068        sptd            (71e276f6d189413266ea22171806597b) C:\WINDOWS\system32\Drivers\sptd.sys

2011/05/25 16:22:24.0937 4068        Suspicious file (NoAccess): C:\WINDOWS\system32\Drivers\sptd.sys. md5: 71e276f6d189413266ea22171806597b

2011/05/25 16:22:24.0937 4068        sptd - detected LockedFile.Multi.Generic (1)

2011/05/25 16:22:25.0109 4068        sr              (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys

2011/05/25 16:22:25.0375 4068        Srv             (5252605079810904e31c332e241cd59b) C:\WINDOWS\system32\DRIVERS\srv.sys

2011/05/25 16:22:25.0625 4068        ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys

2011/05/25 16:22:25.0812 4068        StarOpen        (f92254b0bcfcd10caac7bccc7cb7f467) C:\WINDOWS\system32\drivers\StarOpen.sys

2011/05/25 16:22:26.0000 4068        streamip        (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys

2011/05/25 16:22:26.0156 4068        swenum          (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys

2011/05/25 16:22:26.0343 4068        swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys

2011/05/25 16:22:27.0187 4068        sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys

2011/05/25 16:22:27.0500 4068        Tcpip           (93ea8d04ec73a85db02eb8805988f733) C:\WINDOWS\system32\DRIVERS\tcpip.sys

2011/05/25 16:22:27.0781 4068        TDPIPE          (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys

2011/05/25 16:22:27.0968 4068        TDTCP           (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys

2011/05/25 16:22:28.0171 4068        TermDD          (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys

2011/05/25 16:22:28.0562 4068        Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys

2011/05/25 16:22:29.0046 4068        Update          (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys

2011/05/25 16:22:29.0359 4068        usbaudio        (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys

2011/05/25 16:22:29.0562 4068        usbccgp         (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys

2011/05/25 16:22:29.0750 4068        usbehci         (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys

2011/05/25 16:22:29.0937 4068        usbhub          (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys

2011/05/25 16:22:30.0140 4068        usbprint        (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys

2011/05/25 16:22:30.0343 4068        USBSTOR         (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

2011/05/25 16:22:30.0562 4068        usbvideo        (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINDOWS\system32\Drivers\usbvideo.sys

2011/05/25 16:22:30.0781 4068        VgaSave         (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys

2011/05/25 16:22:31.0140 4068        VolSnap         (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys

2011/05/25 16:22:31.0312 4068        Wanarp          (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys

2011/05/25 16:22:31.0671 4068        wdmaud          (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys

2011/05/25 16:22:31.0906 4068        WSTCODEC        (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS

2011/05/25 16:22:31.0937 4068        MBR (0x1B8)     (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0

2011/05/25 16:22:32.0109 4068        MBR (0x1B8)     (43e336b3bf81392b7debdaf9cb3affdb) \Device\Harddisk1\DR6

2011/05/25 16:22:32.0375 4068        ================================================================================

2011/05/25 16:22:32.0375 4068        Scan finished

2011/05/25 16:22:32.0375 4068        ================================================================================

2011/05/25 16:22:32.0375 0220        Detected object count: 1

2011/05/25 16:22:32.0375 0220        Actual detected object count: 1

2011/05/25 16:23:10.0453 0220        LockedFile.Multi.Generic(sptd) - User select action: Skip

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.

http://saved.im/mtm0nzyzmzd5/cofi.jpg

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Combofix Logfile:

Code:

ComboFix 11-05-24.06 - Martin 25.05.2011  17:55:05.1.4 - x86

Microsoft Windows XP Professional  5.1.2600.3.1252.1.1033.18.3255.2842 [GMT 2:00]

Running from: c:\documents and settings\Martin\Desktop\cofi.exe

AV: AntiVir Desktop *Enabled/Outdated* {AD166499-45F9-482A-A743-FDD3350758C7}

.

.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\program files\Uninstall.exe

.

.

(((((((((((((((((((((((((   Files Created from 2011-04-25 to 2011-05-25  )))))))))))))))))))))))))))))))

.

.

2011-05-25 13:43 . 2011-05-25 13:43        --------        d-----w-        C:\_OTL

2011-05-25 08:49 . 2011-05-25 09:01        --------        d-----w-        c:\documents and settings\All Users\AdobeTemp

2011-05-24 10:16 . 2011-05-24 10:16        --------        d-----w-        c:\documents and settings\Martin\Application Data\Avira

2011-05-24 09:33 . 2011-05-24 09:33        --------        d-----w-        c:\program files\Sophos

2011-05-24 08:51 . 2011-05-24 08:51        --------        d-----w-        c:\documents and settings\All Users\Application Data\Avira

2011-05-24 08:51 . 2010-03-01 08:05        124784        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2011-05-24 08:51 . 2010-02-16 12:24        60936        ----a-w-        c:\windows\system32\drivers\avgntflt.sys

2011-05-24 08:51 . 2009-05-11 10:49        45416        ----a-w-        c:\windows\system32\drivers\avgntdd.sys

2011-05-24 08:51 . 2009-05-11 10:49        22360        ----a-w-        c:\windows\system32\drivers\avgntmgr.sys

2011-05-23 22:51 . 2011-05-23 22:51        --------        d-----w-        c:\program files\Avira

2011-05-18 10:54 . 2011-05-18 14:00        --------        d-----w-        c:\documents and settings\Administrator

2011-05-18 00:29 . 2011-05-18 16:58        --------        d-----w-        c:\windows\system32\NtmsData

2011-05-12 14:43 . 2011-05-12 14:43        --------        d-----w-        c:\documents and settings\Martin\Application Data\com.adobe.downloadassistant.AdobeDownloadAssistant

2011-05-12 14:43 . 2011-05-12 14:43        --------        d-----w-        c:\program files\Adobe Download Assistant

2011-05-05 14:56 . 2005-05-09 09:38        55296        ------w-        c:\windows\system32\brinsstr.dll

2011-05-05 14:56 . 2011-05-05 14:56        --------        d-----w-        c:\program files\Brother

2011-05-05 14:56 . 2004-12-02 23:26        188416        ------w-        c:\windows\system32\PDRVINST.DLL

2011-05-05 14:56 . 2003-07-02 23:08        65536        ------w-        c:\windows\system32\BRWEBUP.EXE

2011-05-05 14:56 . 2002-10-30 23:09        81920        ------w-        c:\windows\system32\BrWebIns.dll

2011-05-05 14:56 . 2000-01-28 10:19        513536        ------w-        c:\program files\Common Files\InstallShield\WebUpdate\IFTW.EXE

2011-05-05 14:56 . 2000-01-28 10:19        331776        ------w-        c:\program files\Common Files\InstallShield\WebUpdate\WebUpdate.exe

2011-05-05 14:56 . 2000-01-28 10:19        24576        ------w-        c:\program files\Common Files\InstallShield\WebUpdate\RasThunk.dll

2011-05-05 14:56 . 2000-01-28 10:19        132096        ------w-        c:\program files\Common Files\InstallShield\WebUpdate\ISiteLite.dll

2011-05-05 14:56 . 2011-05-05 14:56        --------        d-----w-        C:\Brother

2011-05-05 14:56 . 2004-12-10 14:35        147456        ------w-        c:\windows\brunin03.dll

2011-05-05 14:55 . 2011-05-05 14:55        --------        d-----w-        c:\documents and settings\All Users\Application Data\Brother

2011-05-05 14:55 . 2011-05-05 14:55        282756        ----a-w-        c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\setup.dll

2011-05-05 14:55 . 2011-05-05 14:55        163972        ----a-w-        c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iGdi.dll

2011-05-05 14:55 . 2002-12-05 12:12        692224        ----a-w-        c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iKernel.dll

2011-05-05 14:55 . 2002-12-05 12:10        155648        ----a-w-        c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iuser.dll

2011-05-05 14:55 . 2002-12-02 13:22        5632        ----a-w-        c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\DotNetInstaller.exe

2011-05-05 14:55 . 2002-12-02 11:33        57344        ----a-w-        c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\ctor.dll

2011-05-05 14:55 . 2002-12-02 11:33        237568        ----a-w-        c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iscript.dll

2011-05-04 15:49 . 2011-05-04 15:49        --------        d-----w-        c:\documents and settings\Martin\Application Data\inkscape

2011-05-04 15:46 . 2011-05-04 15:48        --------        d-----w-        c:\program files\Inkscape

2011-04-29 18:38 . 2011-04-29 18:38        --------        d-----w-        c:\documents and settings\Martin\Application Data\TourDeFlex.E7BED6E5DDA59983786DD72EBFA46B1598278E07.1

2011-04-29 18:38 . 2011-04-29 18:38        --------        d-----w-        c:\program files\TourDeFlex

2011-04-28 10:01 . 2011-04-28 10:02        --------        d-----w-        c:\program files\mp3DirectCut

.

.

.

((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-10-07 19:57 . 2010-10-07 19:57        362496        ----a-w-        c:\program files\FlashDevelop.exe

2010-10-07 19:57 . 2010-10-07 19:57        1350144        ----a-w-        c:\program files\PluginCore.dll

2010-10-04 06:27 . 2010-10-04 06:27        97280        ----a-w-        c:\program files\SwfOp.dll

2010-10-04 06:27 . 2010-10-04 06:27        520704        ----a-w-        c:\program files\SciLexer.dll

2010-10-04 06:27 . 2010-10-04 06:27        145920        ----a-w-        c:\program files\Aga.dll

2010-10-04 06:27 . 2010-10-04 06:27        106496        ----a-w-        c:\program files\Scripting.dll

.

.

------- Sigcheck -------

Note: Unsigned files aren't necessarily malware.

.

[-] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\atapi.sys

[-] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\system32\drivers\atapi.sys

[-] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\system32\ReinstallBackups\0006\DriverFiles\i386\atapi.sys

[-] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\system32\ReinstallBackups\0007\DriverFiles\i386\atapi.sys

.

[-] 2008-04-13 . B153AFFAC761E7F5FCFA822B9C4E97BC . 14336 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\asyncmac.sys

[-] 2008-04-13 . B153AFFAC761E7F5FCFA822B9C4E97BC . 14336 . . [5.1.2600.5512] . . c:\windows\system32\drivers\asyncmac.sys

.

[-] 2001-08-23 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\windows\system32\dllcache\beep.sys

[-] 2001-08-23 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\windows\system32\drivers\beep.sys

.

[-] 2008-04-13 . 463C1EC80CD17420A542B7F36A36F128 . 24576 . . [5.1.2600.5512] . . c:\windows\system32\drivers\kbdclass.sys

.

[-] 2008-04-13 . 1DF7F42665C94B825322FAE71721130D . 182656 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ndis.sys

[-] 2008-04-13 . 1DF7F42665C94B825322FAE71721130D . 182656 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ndis.sys

.

[-] 2008-04-13 . 78A08DD6A8D65E697C18E1DB01C5CDCA . 574976 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ntfs.sys

[-] 2008-04-13 . 78A08DD6A8D65E697C18E1DB01C5CDCA . 574976 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ntfs.sys

.

[-] 2001-08-23 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\windows\system32\dllcache\null.sys

[-] 2001-08-23 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\windows\system32\drivers\null.sys

.

[-] 2008-04-13 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\tcpip.sys

[-] 2008-04-13 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\system32\drivers\tcpip.sys

.

[-] 2008-04-14 . A06CE3399D16DB864F55FAEB1F1927A9 . 77824 . . [5.1.2600.5512] . . c:\windows\system32\browser.dll

[-] 2008-04-14 . A06CE3399D16DB864F55FAEB1F1927A9 . 77824 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\browser.dll

.

[-] 2008-04-14 . BF2466B3E18E970D8A976FB95FC1CA85 . 13312 . . [5.1.2600.5512] . . c:\windows\system32\lsass.exe

[-] 2008-04-14 . BF2466B3E18E970D8A976FB95FC1CA85 . 13312 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\lsass.exe

.

[-] 2008-04-14 . 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE . 198144 . . [5.1.2600.5512] . . c:\windows\system32\netman.dll

[-] 2008-04-14 . 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE . 198144 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\netman.dll

.

[-] 2008-04-14 04:41 . 1280A158C722FA95A80FB7AEBE78FA7D . 792064 . . [2001.12.4414.700] . . c:\windows\system32\comres.dll

[-] 2008-04-14 04:41 . 1280A158C722FA95A80FB7AEBE78FA7D . 792064 . . [2001.12.4414.700] . . c:\windows\system32\dllcache\comres.dll

.

[-] 2008-04-14 . 574738F61FCA2935F5265DC4E5691314 . 409088 . . [6.7.2600.5512] . . c:\windows\system32\qmgr.dll

[-] 2008-04-14 . 574738F61FCA2935F5265DC4E5691314 . 409088 . . [6.7.2600.5512] . . c:\windows\system32\dllcache\qmgr.dll

.

[-] 2008-04-14 . 2589FE6015A316C0F5D5112B4DA7B509 . 399360 . . [5.1.2600.5512] . . c:\windows\system32\rpcss.dll

[-] 2008-04-14 . 2589FE6015A316C0F5D5112B4DA7B509 . 399360 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\rpcss.dll

.

[-] 2008-04-14 . 0E776ED5F7CC9F94299E70461B7B8185 . 108544 . . [5.1.2600.5512] . . c:\windows\system32\services.exe

[-] 2008-04-14 . 0E776ED5F7CC9F94299E70461B7B8185 . 108544 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\services.exe

.

[-] 2008-04-14 . D8E14A61ACC1D4A6CD0D38AEBAC7FA3B . 57856 . . [5.1.2600.5512] . . c:\windows\system32\spoolsv.exe

[-] 2008-04-14 . D8E14A61ACC1D4A6CD0D38AEBAC7FA3B . 57856 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\spoolsv.exe

.

[-] 2008-04-14 . ED0EF0A136DEC83DF69F04118870003E . 507904 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe

[-] 2008-04-14 . ED0EF0A136DEC83DF69F04118870003E . 507904 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\winlogon.exe

.

[-] 2008-04-14 . ED7262E52C31CF1625B65039102BC16C . 111104 . . [5.4.3790.5512] . . c:\windows\system32\wuauclt.exe

[-] 2008-04-14 . ED7262E52C31CF1625B65039102BC16C . 111104 . . [5.4.3790.5512] . . c:\windows\system32\dllcache\wuauclt.exe

.

[-] 2008-04-14 . BD38D1EBE24A46BD3EDA059560AFBA12 . 1054208 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll

[-] 2008-04-14 . 06F247492BC786CE5C24A23E178C711A . 617472 . . [5.82] . . c:\windows\system32\comctl32.dll

[-] 2008-04-14 . 06F247492BC786CE5C24A23E178C711A . 617472 . . [5.82] . . c:\windows\system32\dllcache\comctl32.dll

[-] 2007-02-18 . AEF3D788DBF40C7C4D204EA45EB0C505 . 921088 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll

.

[-] 2008-04-14 . 3D4E199942E29207970E04315D02AD3B . 62464 . . [5.1.2600.5512] . . c:\windows\system32\cryptsvc.dll

[-] 2008-04-14 . 3D4E199942E29207970E04315D02AD3B . 62464 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\cryptsvc.dll

.

[-] 2008-04-14 04:41 . 19A799805B24990867B00C120D300C3A . 246272 . . [2001.12.4414.701] . . c:\windows\system32\es.dll

[-] 2008-04-14 04:41 . 19A799805B24990867B00C120D300C3A . 246272 . . [2001.12.4414.701] . . c:\windows\system32\dllcache\es.dll

.

[-] 2008-04-14 . 0DA85218E92526972A821587E6A8BF8F . 110080 . . [5.1.2600.5512] . . c:\windows\system32\imm32.dll

[-] 2008-04-14 . 0DA85218E92526972A821587E6A8BF8F . 110080 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\imm32.dll

.

[-] 2008-04-14 . C24B983D211C34DA8FCC1AC38477971D . 989696 . . [5.1.2600.5512] . . c:\windows\system32\kernel32.dll

[-] 2008-04-14 . C24B983D211C34DA8FCC1AC38477971D . 989696 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\kernel32.dll

.

[-] 2008-04-14 . 2DC5A8019E2387987905F77C664E4BE2 . 19968 . . [5.1.2600.5512] . . c:\windows\system32\linkinfo.dll

[-] 2008-04-14 . 2DC5A8019E2387987905F77C664E4BE2 . 19968 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\linkinfo.dll

.

[-] 2008-04-14 . 012DF358CEBAA23ACB26D82077820817 . 22016 . . [5.1.2600.5512] . . c:\windows\system32\lpk.dll

[-] 2008-04-14 . 012DF358CEBAA23ACB26D82077820817 . 22016 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\lpk.dll

.

[-] 2008-04-14 . A706E122B398FE1AB85CB9B75D044223 . 3066880 . . [6.00.2900.5512] . . c:\windows\system32\mshtml.dll

[-] 2008-04-14 . A706E122B398FE1AB85CB9B75D044223 . 3066880 . . [6.00.2900.5512] . . c:\windows\system32\dllcache\mshtml.dll

.

[-] 2008-04-14 . D7075E95AA599EE77B7A89D39296BD3D . 343040 . . [7.0.2600.5512] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.5512_x-ww_3fd60d63\msvcrt.dll

[-] 2008-04-14 . 355EDBB4D412B01F1740C17E3F50FA00 . 343040 . . [7.0.2600.5512] . . c:\windows\system32\msvcrt.dll

[-] 2008-04-14 . 355EDBB4D412B01F1740C17E3F50FA00 . 343040 . . [7.0.2600.5512] . . c:\windows\system32\dllcache\msvcrt.dll

[-] 2007-02-18 . 4200BE3808F6406DBE45A7B88DAE5035 . 322560 . . [7.0.2600.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a\msvcrt.dll

.

[-] 2008-04-14 . B4138E99236F0F57D4CF49BAE98A0746 . 245248 . . [5.1.2600.5512] . . c:\windows\system32\mswsock.dll

[-] 2008-04-14 . B4138E99236F0F57D4CF49BAE98A0746 . 245248 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\mswsock.dll

.

[-] 2008-04-14 . 1B7F071C51B77C272875C3A23E1E4550 . 407040 . . [5.1.2600.5512] . . c:\windows\system32\netlogon.dll

[-] 2008-04-14 . 1B7F071C51B77C272875C3A23E1E4550 . 407040 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\netlogon.dll

.

[-] 2008-04-14 . 50A166237A0FA771261275A405646CC0 . 17408 . . [6.00.2900.5512] . . c:\windows\system32\powrprof.dll

[-] 2008-04-14 . 50A166237A0FA771261275A405646CC0 . 17408 . . [6.00.2900.5512] . . c:\windows\system32\dllcache\powrprof.dll

.

[-] 2008-04-14 . A86BB5E61BF3E39B62AB4C7E7085A084 . 181248 . . [5.1.2600.5512] . . c:\windows\system32\scecli.dll

[-] 2008-04-14 . A86BB5E61BF3E39B62AB4C7E7085A084 . 181248 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\scecli.dll

.

[-] 2008-04-14 . 96E1C926F22EE1BFBAE82901A35F6BF3 . 5120 . . [5.1.2600.5512] . . c:\windows\system32\sfc.dll

[-] 2008-04-14 . 96E1C926F22EE1BFBAE82901A35F6BF3 . 5120 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\sfc.dll

.

[-] 2008-04-14 . 27C6D03BCDB8CFEB96B716F3D8BE3E18 . 14336 . . [5.1.2600.5512] . . c:\windows\system32\svchost.exe

[-] 2008-04-14 . 27C6D03BCDB8CFEB96B716F3D8BE3E18 . 14336 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\svchost.exe

.

[-] 2008-04-14 . 3CB78C17BB664637787C9A1C98F79C38 . 249856 . . [5.1.2600.5512] . . c:\windows\system32\tapisrv.dll

[-] 2008-04-14 . 3CB78C17BB664637787C9A1C98F79C38 . 249856 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\tapisrv.dll

.

[-] 2008-04-14 . B26B135FF1B9F60C9388B4A7D16F600B . 578560 . . [5.1.2600.5512] . . c:\windows\system32\user32.dll

[-] 2008-04-14 . B26B135FF1B9F60C9388B4A7D16F600B . 578560 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\user32.dll

.

[-] 2008-04-14 . A93AEE1928A9D7CE3E16D24EC7380F89 . 26112 . . [5.1.2600.5512] . . c:\windows\system32\userinit.exe

[-] 2008-04-14 . A93AEE1928A9D7CE3E16D24EC7380F89 . 26112 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\userinit.exe

.

[-] 2008-04-14 . 7A4F775ABB2F1C97DEF3E73AFA2FAEDD . 666112 . . [6.00.2900.5512] . . c:\windows\system32\wininet.dll

[-] 2008-04-14 . 7A4F775ABB2F1C97DEF3E73AFA2FAEDD . 666112 . . [6.00.2900.5512] . . c:\windows\system32\dllcache\wininet.dll

.

[-] 2008-04-14 . 2CCC474EB85CEAA3E1FA1726580A3E5A . 82432 . . [5.1.2600.5512] . . c:\windows\system32\ws2_32.dll

[-] 2008-04-14 . 2CCC474EB85CEAA3E1FA1726580A3E5A . 82432 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ws2_32.dll

.

[-] 2008-04-14 . 9789E95E1D88EEB4B922BF3EA7779C28 . 19968 . . [5.1.2600.5512] . . c:\windows\system32\ws2help.dll

[-] 2008-04-14 . 9789E95E1D88EEB4B922BF3EA7779C28 . 19968 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ws2help.dll

.

[-] 2008-04-14 . 12896823FB95BFB3DC9B46BCAEDC9923 . 1033728 . . [6.00.2900.5512] . . c:\windows\explorer.exe

[-] 2008-04-14 . 12896823FB95BFB3DC9B46BCAEDC9923 . 1033728 . . [6.00.2900.5512] . . c:\windows\system32\dllcache\explorer.exe

.

[-] 2008-04-14 . 058710B720282CA82B909912D3EF28DB . 146432 . . [5.1.2600.5512] . . c:\windows\regedit.exe

[-] 2008-04-14 . 058710B720282CA82B909912D3EF28DB . 146432 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\regedit.exe

.

[-] 2008-04-14 . ECCE74BC6168375016450A86A164D976 . 1287168 . . [5.1.2600.5512] . . c:\windows\system32\ole32.dll

[-] 2008-04-14 . ECCE74BC6168375016450A86A164D976 . 1287168 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ole32.dll

.

[-] 2008-04-14 . 7D7D8501F3CB45D0408CDEFA08CDAEFF . 406016 . . [1.0420.2600.5512] . . c:\windows\system32\usp10.dll

[-] 2008-04-14 . 7D7D8501F3CB45D0408CDEFA08CDAEFF . 406016 . . [1.0420.2600.5512] . . c:\windows\system32\dllcache\usp10.dll

.

[-] 2008-04-14 . 3805DF0AC4296A34BA4BF93B346CC378 . 171008 . . [5.1.2600.5512] . . c:\windows\system32\srsvc.dll

[-] 2008-04-14 . 3805DF0AC4296A34BA4BF93B346CC378 . 171008 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\srsvc.dll

.

[-] 2008-04-14 . F92E1076C42FCD6DB3D72D8CFE9816D5 . 13824 . . [5.1.2600.5512] . . c:\windows\system32\wscntfy.exe

[-] 2008-04-14 . F92E1076C42FCD6DB3D72D8CFE9816D5 . 13824 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\wscntfy.exe

.

[-] 2008-04-14 . 295D21F14C335B53CB8154E5B1F892B9 . 129024 . . [5.1.2600.5512] . . c:\windows\system32\xmlprov.dll

[-] 2008-04-14 . 295D21F14C335B53CB8154E5B1F892B9 . 129024 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\xmlprov.dll

.

[-] 2008-04-14 . 6D4FEB43EE538FC5428CC7F0565AA656 . 56320 . . [5.1.2600.5512] . . c:\windows\system32\eventlog.dll

[-] 2008-04-14 . 6D4FEB43EE538FC5428CC7F0565AA656 . 56320 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\eventlog.dll

.

[-] 2008-04-14 . 9DD07AF82244867CA36681EA2D29CE79 . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll

[-] 2008-04-14 . 9DD07AF82244867CA36681EA2D29CE79 . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\sfcfiles.dll

.

[-] 2008-04-14 . 5F1D5F88303D4A4DBC8E5F97BA967CC3 . 15360 . . [5.1.2600.5512] . . c:\windows\system32\ctfmon.exe

[-] 2008-04-14 . 5F1D5F88303D4A4DBC8E5F97BA967CC3 . 15360 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ctfmon.exe

.

[-] 2008-04-14 . 1926899BF9FFE2602B63074971700412 . 135168 . . [6.00.2900.5512] . . c:\windows\system32\shsvcs.dll

[-] 2008-04-14 . 1926899BF9FFE2602B63074971700412 . 135168 . . [6.00.2900.5512] . . c:\windows\system32\dllcache\shsvcs.dll

.

[-] 2008-04-14 . 5B19B557B0C188210A56A6B699D90B8F . 59904 . . [5.1.2600.5512] . . c:\windows\system32\regsvc.dll

[-] 2008-04-14 . 5B19B557B0C188210A56A6B699D90B8F . 59904 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\regsvc.dll

.

[-] 2008-04-14 . 0A9A7365A1CA4319AA7C1D6CD8E4EAFA . 192512 . . [5.1.2600.5512] . . c:\windows\system32\schedsvc.dll

[-] 2008-04-14 . 0A9A7365A1CA4319AA7C1D6CD8E4EAFA . 192512 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\schedsvc.dll

.

[-] 2008-04-14 . 0A5679B3714EDAB99E357057EE88FCA6 . 71680 . . [5.1.2600.5512] . . c:\windows\system32\ssdpsrv.dll

[-] 2008-04-14 . 0A5679B3714EDAB99E357057EE88FCA6 . 71680 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ssdpsrv.dll

.

[-] 2008-04-14 . FF3477C03BE7201C294C35F684B3479F . 295424 . . [5.1.2600.5512] . . c:\windows\system32\termsrv.dll

[-] 2008-04-14 . FF3477C03BE7201C294C35F684B3479F . 295424 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\termsrv.dll

.

[-] 2008-04-14 . 3CB32D3B8CBE79899D63280BB7A83CD9 . 344064 . . [5.1.2600.5512] . . c:\windows\system32\hnetcfg.dll

[-] 2008-04-14 . 3CB32D3B8CBE79899D63280BB7A83CD9 . 344064 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\hnetcfg.dll

.

[-] 2008-04-14 . D8849F77C0B66226335A59D26CB4EDC6 . 167936 . . [5.1.2600.5512] . . c:\windows\system32\appmgmts.dll

[-] 2008-04-14 . D8849F77C0B66226335A59D26CB4EDC6 . 167936 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\appmgmts.dll

.

[-] 2001-08-23 . 9859C0F6936E723E4892D7141B1327D5 . 11648 . . [5.1.2600.0] . . c:\windows\system32\drivers\acpiec.sys

.

[-] 2008-04-13 21:09 . 8BED39E3C35D6A489438B8141717A557 . 142592 . . [5.1.2601.3142] . . c:\windows\system32\dllcache\aec.sys

[-] 2008-04-13 21:09 . 8BED39E3C35D6A489438B8141717A557 . 142592 . . [5.1.2601.3142] . . c:\windows\system32\drivers\aec.sys

.

[-] 2008-04-13 . 3BB22519A194418D5FEC05D800A19AD0 . 36608 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ip6fw.sys

[-] 2008-04-13 . 3BB22519A194418D5FEC05D800A19AD0 . 36608 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ip6fw.sys

.

[-] 2008-04-14 04:41 . CDDD4416B2B4C7295FE3FDB6DDE57E4E . 927504 . . [4.1.0.61] . . c:\windows\system32\mfc40u.dll

[-] 2008-04-14 04:41 . CDDD4416B2B4C7295FE3FDB6DDE57E4E . 927504 . . [4.1.0.61] . . c:\windows\system32\dllcache\mfc40u.dll

.

[-] 2008-04-14 . 986B1FF5814366D71E0AC5755C88F2D3 . 33792 . . [5.1.2600.5512] . . c:\windows\system32\msgsvc.dll

[-] 2008-04-14 . 986B1FF5814366D71E0AC5755C88F2D3 . 33792 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\msgsvc.dll

.

[-] 2008-04-14 04:42 . C7E39EA41233E9F5B86C8DA3A9F1E4A8 . 52224 . . [9.0.1.56] . . c:\windows\$NtUninstallWMFDist11$\mspmsnsv.dll

[-] 2006-10-18 20:47 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . c:\windows\system32\mspmsnsv.dll

[-] 2006-10-18 20:47 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . c:\windows\system32\dllcache\mspmsnsv.dll

.

[-] 2008-04-14 . 7F653A89F6E89E3AE0D49830EECE35D4 . 2023936 . . [5.1.2600.5512] . . c:\windows\system32\ntkrnlpa.exe

.

[-] 2008-04-14 04:42 . 156F64A3345BD23C600655FB4D10BC08 . 435200 . . [5.1.2400.5512] . . c:\windows\system32\ntmssvc.dll

[-] 2008-04-14 04:42 . 156F64A3345BD23C600655FB4D10BC08 . 435200 . . [5.1.2400.5512] . . c:\windows\system32\dllcache\ntmssvc.dll

.

[-] 2008-04-14 . 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 . 185856 . . [5.1.2600.5512] . . c:\windows\system32\upnphost.dll

[-] 2008-04-14 . 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 . 185856 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\upnphost.dll

.

[-] 2008-04-14 . 4D83ED8BDDEC431FC8AD907B47CFB6E3 . 367616 . . [5.3.2600.5512] . . c:\windows\system32\dsound.dll

[-] 2008-04-14 . 4D83ED8BDDEC431FC8AD907B47CFB6E3 . 367616 . . [5.3.2600.5512] . . c:\windows\system32\dllcache\dsound.dll

.

[-] 2008-04-14 . 0607CBC6FA20114CB491EFE4B2F9EFAD . 1689088 . . [5.03.2600.5512] . . c:\windows\system32\d3d9.dll

[-] 2008-04-14 . 0607CBC6FA20114CB491EFE4B2F9EFAD . 1689088 . . [5.03.2600.5512] . . c:\windows\system32\dllcache\d3d9.dll

.

[-] 2008-04-14 . A340CD71EB535A3DD751B5F28723E50C . 279552 . . [5.03.2600.5512] . . c:\windows\system32\ddraw.dll

[-] 2008-04-14 . A340CD71EB535A3DD751B5F28723E50C . 279552 . . [5.03.2600.5512] . . c:\windows\system32\dllcache\ddraw.dll

.

[-] 2008-04-14 04:42 . 5652F6CE1D9E9D8068B9D29BC21B5409 . 84992 . . [5.1.2600.5512] . . c:\windows\system32\olepro32.dll

[-] 2008-04-14 04:42 . 5652F6CE1D9E9D8068B9D29BC21B5409 . 84992 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\olepro32.dll

.

[-] 2008-04-14 . DBE2B62353660ECCA0D75EA307A717E9 . 39936 . . [5.1.2600.5512] . . c:\windows\system32\perfctrs.dll

[-] 2008-04-14 . DBE2B62353660ECCA0D75EA307A717E9 . 39936 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\perfctrs.dll

.

[-] 2008-04-14 . C7CE131408739B0B3A318BE2D0032719 . 18944 . . [5.1.2600.5512] . . c:\windows\system32\version.dll

[-] 2008-04-14 . C7CE131408739B0B3A318BE2D0032719 . 18944 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\version.dll

.

[-] 2008-04-14 . 55794B97A7FAABD2910873C85274F409 . 93184 . . [6.00.2900.5512] . . c:\windows\system32\dllcache\iexplore.exe

.

[-] 2008-04-13 . 40F8880122A030A7E9E1FEDEA833B33D . 2145280 . . [5.1.2600.5512] . . c:\windows\system32\ntoskrnl.exe

.

[-] 2008-04-14 . 3805DF0AC4296A34BA4BF93B346CC378 . 171008 . . [5.1.2600.5512] . . c:\windows\system32\srsvc.dll

[-] 2008-04-14 . 3805DF0AC4296A34BA4BF93B346CC378 . 171008 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\srsvc.dll

.

[-] 2008-04-14 . 54AF4B1D5459500EF0937F6D33B1914F . 175104 . . [5.1.2600.5512] . . c:\windows\system32\w32time.dll

[-] 2008-04-14 . 54AF4B1D5459500EF0937F6D33B1914F . 175104 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\w32time.dll

.

[-] 2008-04-14 . 8BAD69CBAC032D4BBACFCE0306174C30 . 333824 . . [5.1.2600.5512] . . c:\windows\system32\wiaservc.dll

[-] 2008-04-14 . 8BAD69CBAC032D4BBACFCE0306174C30 . 333824 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\wiaservc.dll

.

[-] 2008-04-14 . 5C12660A97822F6E61576943B49AAAD6 . 18944 . . [5.1.2600.5512] . . c:\windows\system32\midimap.dll

[-] 2008-04-14 . 5C12660A97822F6E61576943B49AAAD6 . 18944 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\midimap.dll

.

[-] 2008-04-14 . 6F9BEF24C578D5D6740E080BEDD6A448 . 7680 . . [5.1.2600.5512] . . c:\windows\system32\rasadhlp.dll

[-] 2008-04-14 . 6F9BEF24C578D5D6740E080BEDD6A448 . 7680 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\rasadhlp.dll

.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2007-03-20 36864]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-11-04 98304]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]

"RTHDCPL"="RTHDCPL.EXE" [2008-10-28 17331200]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

"SetDefPrt"="c:\program files\Brother\Brmfl05a\BrStDvPt.exe" [2005-01-26 49152]

.

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Status Monitor.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Status Monitor.lnk

backup=c:\windows\pss\Status Monitor.lnkCommon Startup

.

[HKLM\~\startupfolder\C:^Documents and Settings^Martin^Start Menu^Programs^Startup^OpenOffice.org 3.2.lnk]

path=c:\documents and settings\Martin\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk

backup=c:\windows\pss\OpenOffice.org 3.2.lnkStartup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avgnt]

2010-03-02 09:28        282792        ----a-w-        c:\program files\Avira\AntiVir Desktop\avgnt.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ControlCenter2.0]

2005-07-19 10:36        933888        ------w-        c:\program files\Brother\ControlCenter2\brctrcen.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]

2011-02-18 15:16        136176        ----atw-        c:\documents and settings\Martin\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"WMPNetworkSvc"=3 (0x3)

"Apache2.2"=2 (0x2)

"AntiVirService"=2 (0x2)

"AntiVirSchedulerService"=2 (0x2)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

.

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [2/9/2010 10:59 PM 717296]

R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe -k Akamai [4/14/2008 6:42 AM 14336]

R3 dfmirage;dfmirage;c:\windows\system32\drivers\dfmirage.sys [10/30/2008 1:05 AM 31896]

S2 XAMPP;XAMPP Service;c:\xampp\service.exe --> c:\xampp\service.exe [?]

S3 AsrCDDrv;AsrCDDrv;\??\c:\windows\system32\Drivers\AsrCDDrv.sys --> c:\windows\system32\Drivers\AsrCDDrv.sys [?]

S3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\DRIVERS\ManyCam.sys --> c:\windows\system32\DRIVERS\ManyCam.sys [?]

S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\19.tmp --> c:\windows\system32\19.tmp [?]

S3 TipCtrl;TipCtrl;"c:\program files\uTIPu\TipCtrl.exe" --> c:\program files\uTIPu\TipCtrl.exe [?]

S4 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [5/24/2011 10:51 AM 135336]

S4 Apache2.2;Apache2.2;c:\xampp\apache\bin\httpd.exe [4/25/2011 1:29 AM 29416]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

Akamai        REG_MULTI_SZ           Akamai

.

Contents of the 'Scheduled Tasks' folder

.

2011-05-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1645522239-115176313-1417001333-1003Core.job

- c:\documents and settings\Martin\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-02-18 15:16]

.

2011-05-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1645522239-115176313-1417001333-1003UA.job

- c:\documents and settings\Martin\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-02-18 15:16]

.

.

------- Supplementary Scan -------

.

FF - ProfilePath - c:\documents and settings\Martin\Application Data\Mozilla\Firefox\Profiles\dccp4xul.default\

FF - prefs.js: browser.search.selectedEngine - LEO Eng-Deu

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/

FF - prefs.js: keyword.URL - hxxp://vshare.toolbarhome.com/search.aspx?srch=ku&q=

.

- - - - ORPHANS REMOVED - - - -

.

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

HKCU-Run-AdobeBridge - (no file)

AddRemove-FlashDevelop - c:\program files\Uninstall.exe

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2011-05-25 17:59

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...  

.

scanning hidden autostart entries ... 

.

scanning hidden files ...  

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MEMSWEEP2]

"ImagePath"="\??\c:\windows\system32\19.tmp"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'winlogon.exe'(852)

c:\windows\system32\Ati2evxx.dll

.

Completion time: 2011-05-25  18:01:34

ComboFix-quarantined-files.txt  2011-05-25 16:01

.

Pre-Run: 7.280.852.992 bytes free

Post-Run: 10.607.783.936 bytes free

.

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

.

- - End Of File - - 9907A540DB6BC0FEA0DDEE5C73901AFC

--- --- ---

Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.

Doppelklick auf die MBRCheck.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Das Tool braucht nur wenige Sekunden.
Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.

Poste mir bitte den Inhalt des .txt Dokumentes

GMER ist unter dem admin-modus abgestürzt.

Osam-log:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 12:18:58 on 26.05.2011
 

OS: Windows XP Professional Service Pack 3 (Build 2600)

Default Browser: Mozilla Corporation Firefox 3.6.17
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Boot Execute]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Session Manager )-----

"BootExecute" - "Microsoft Corporation" - C:\WINDOWS\system32\autochk.exe
 

[Common]

-----( %SystemRoot%\Tasks )-----

"GoogleUpdateTaskUserS-1-5-21-1645522239-115176313-1417001333-1003Core.job" - "Google Inc." - C:\Documents and Settings\Martin\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

"GoogleUpdateTaskUserS-1-5-21-1645522239-115176313-1417001333-1003UA.job" - "Google Inc." - C:\Documents and Settings\Martin\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

-----( HKLM\SOFTWARE\Microsoft\Windows Scripting Host\Locations )-----

"CScript" - "Microsoft Corporation" - C:\WINDOWS\System32\cscript.exe

"WScript" - "Microsoft Corporation" - C:\WINDOWS\System32\wscript.exe
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"access.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\access.cpl

"ALSNDMGR.CPL" - "Realtek Semiconductor Corp." - C:\WINDOWS\system32\ALSNDMGR.CPL

"appwiz.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\appwiz.cpl

"bthprops.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\bthprops.cpl

"desk.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\desk.cpl

"firewall.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\firewall.cpl

"hdwwiz.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\hdwwiz.cpl

"inetcpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\inetcpl.cpl

"intl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\intl.cpl

"irprops.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\irprops.cpl

"javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl

"joy.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\joy.cpl

"main.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\main.cpl

"mmsys.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\mmsys.cpl

"ncpa.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\ncpa.cpl

"netsetup.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\netsetup.cpl

"nusrmgr.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\nusrmgr.cpl

"nwc.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\nwc.cpl

"odbccp32.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\odbccp32.cpl

"powercfg.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\powercfg.cpl

"RTSndMgr.CPL" - "Realtek Semiconductor Corp." - C:\WINDOWS\system32\RTSndMgr.CPL

"sysdm.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\sysdm.cpl

"telephon.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\telephon.cpl

"timedate.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\timedate.cpl

"wscui.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\wscui.cpl

"wuaucpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\wuaucpl.cpl

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"Avira AntiVir Personal" - "Avira GmbH" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl

"Avira AntiVir Personal - Free Antivirus " - "Avira GmbH" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl

"Internet Connection Firewall" - "Microsoft Corporation" - C:\WINDOWS\system32\Firewall.cpl

"NetSetupWizard" - "Microsoft Corporation" - C:\WINDOWS\system32\NetSetup.cpl

"Speech" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Speech\sapi.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"1394 ARP Client Protocol" (Arp1394) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\arp1394.sys

"1394 Net Driver" (NIC1394) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\nic1394.sys

"adfs" (adfs) - ? - C:\WINDOWS\system32\drivers\adfs.sys  (File not found)

"AFD" (AFD) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\afd.sys

"AsrCDDrv" (AsrCDDrv) - ? - C:\WINDOWS\system32\Drivers\AsrCDDrv.sys  (File not found)

"ATI Function Driver for High Definition Audio Service" (AtiHdmiService) - "ATI Research Inc." - C:\WINDOWS\System32\drivers\AtiHdmi.sys

"ati2mtag" (ati2mtag) - "ATI Technologies Inc." - C:\WINDOWS\System32\DRIVERS\ati2mtag.sys

"ATM ARP Client Protocol" (Atmarpc) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\atmarpc.sys

"Audio Stub Driver" (audstub) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\audstub.sys

"avgio" (avgio) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avgio.sys

"avgntflt" (avgntflt) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avgntflt.sys

"avipbb" (avipbb) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avipbb.sys

"BDA IPSink" (streamip) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\StreamIP.sys

"BDA Slip De-Framer" (SLIP) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\SLIP.sys

"Beep" (Beep) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Beep.sys

"Brother USB Still Image driver" (BrScnUsb) - "Brother Industries Ltd." - C:\WINDOWS\System32\Drivers\BrScnUsb.sys

"catchme" (catchme) - ? - C:\DOCUME~1\Martin\LOCALS~1\Temp\catchme.sys  (File not found)

"CD-Burning Filter Driver" (Imapi) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\imapi.sys

"CD-ROM Driver" (Cdrom) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\cdrom.sys

"Cdaudio" (Cdaudio) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Cdaudio.sys

"Cdfs" (Cdfs) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Cdfs.sys

"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys  (File not found)

"Closed Caption Decoder" (CCDECODE) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\CCDECODE.sys

"dfmirage" (dfmirage) - "DemoForge, LLC" - C:\WINDOWS\System32\DRIVERS\dfmirage.sys

"Digital CD Audio Playback Filter Driver" (redbook) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\redbook.sys

"Direct Parallel" (Raspti) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\raspti.sys

"Direct Parallel Link Driver" (Ptilink) - "Parallel Technologies, Inc." - C:\WINDOWS\System32\DRIVERS\ptilink.sys

"Disk Driver" (Disk) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\disk.sys

"dmload" (dmload) - "Microsoft Corp., Veritas Software." - C:\WINDOWS\System32\drivers\dmload.sys

"Fastfat" (Fastfat) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Fastfat.sys

"Fdc" (Fdc) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Fdc.sys

"Fips" (Fips) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Fips.sys

"Flpydisk" (Flpydisk) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Flpydisk.sys

"FltMgr" (FltMgr) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\fltMgr.sys

"Fs_Rec" (Fs_Rec) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Fs_Rec.sys

"Generic Packet Classifier" (Gpc) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\msgpc.sys

"giveio" (giveio) - ? - C:\WINDOWS\System32\giveio.sys  (File found, but it contains no detailed information)

"GMSIPCI" (GMSIPCI) - ? - D:\INSTALL\GMSIPCI.SYS  (File not found)

"HTTP" (HTTP) - "Microsoft Corporation" - C:\WINDOWS\System32\Drivers\HTTP.sys

"i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys  (File not found)

"i8042prt" (i8042prt) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\i8042prt.sys

"Intel Processor Driver" (intelppm) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\intelppm.sys

"IP in IP Tunnel Driver" (IpInIp) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\ipinip.sys

"IP Network Address Translator" (IpNat) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\ipnat.sys

"IP Traffic Filter Driver" (IpFilterDriver) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\ipfltdrv.sys

"IPSEC driver" (IPSec) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\ipsec.sys

"IPv6 Windows Firewall Driver" (Ip6Fw) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\Ip6Fw.sys

"IPX Traffic Filter Driver" (NwlnkFlt) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\nwlnkflt.sys

"IPX Traffic Forwarder Driver" (NwlnkFwd) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\nwlnkfwd.sys

"IR Enumerator Service" (IRENUM) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\irenum.sys

"IrDA Protocol" (irda) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\irda.sys

"JRAID" (JRAID) - "JMicron Technology Corp." - C:\WINDOWS\System32\DRIVERS\jraid.sys

"Keyboard Class Driver" (Kbdclass) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\kbdclass.sys

"Keyboard HID Driver" (kbdhid) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\kbdhid.sys

"KSecDD" (KSecDD) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\KSecDD.sys

"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)

"Logical Disk Manager Driver" (dmio) - "Microsoft Corp., Veritas Software" - C:\WINDOWS\System32\drivers\dmio.sys

"ManyCam Virtual Webcam, WDM Video Capture Driver" (ManyCam) - ? - C:\WINDOWS\System32\DRIVERS\ManyCam.sys  (File not found)

"MEMSWEEP2" (MEMSWEEP2) - ? - C:\WINDOWS\system32\19.tmp  (File not found)

"Microcode Update Driver" (Update) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\update.sys

"Microsoft ACPI Driver" (ACPI) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\ACPI.sys

"Microsoft HID Class Driver" (hidusb) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\hidusb.sys

"Microsoft Kernel Acoustic Echo Canceller" (aec) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\aec.sys

"Microsoft Kernel Audio Splitter" (splitter) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\splitter.sys

"Microsoft Kernel DLS Syntheiszer" (DMusic) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\DMusic.sys

"Microsoft Kernel DRM Audio Descrambler" (drmkaud) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\drmkaud.sys

"Microsoft Kernel GS Wavetable Synthesizer" (swmidi) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\swmidi.sys

"Microsoft Kernel System Audio Device" (sysaudio) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\sysaudio.sys

"Microsoft Kernel Wave Audio Mixer" (kmixer) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\kmixer.sys

"Microsoft Serial Infrared Driver" (irsir) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\irsir.sys

"Microsoft Streaming Clock Proxy" (MSPCLOCK) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\MSPCLOCK.sys

"Microsoft Streaming Quality Manager Proxy" (MSPQM) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\MSPQM.sys

"Microsoft Streaming Service Proxy" (MSKSSRV) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\MSKSSRV.sys

"Microsoft Streaming Tee/Sink-to-Sink Converter" (MSTEE) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\MSTEE.sys

"Microsoft System Management BIOS Driver" (mssmbios) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\mssmbios.sys

"Microsoft TV/Video Connection" (NdisIP) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\NdisIP.sys

"Microsoft UAA Bus Driver for High Definition Audio" (HDAudBus) - "Windows (R) Server 2003 DDK provider" - C:\WINDOWS\System32\DRIVERS\HDAudBus.sys

"Microsoft USB 2.0 Enhanced Host Controller Miniport Driver" (usbehci) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\usbehci.sys

"Microsoft USB Generic Parent Driver" (usbccgp) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\usbccgp.sys

"Microsoft USB PRINTER Class" (usbprint) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\usbprint.sys

"Microsoft USB Standard Hub Driver" (usbhub) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\usbhub.sys

"Microsoft WINMM WDM Audio Compatibility Driver" (wdmaud) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\wdmaud.sys

"mnmdd" (mnmdd) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\mnmdd.sys

"Modem" (Modem) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Modem.sys

"MountMgr" (MountMgr) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\MountMgr.sys

"Mouse Class Driver" (Mouclass) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\mouclass.sys

"Mouse HID Driver" (mouhid) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\mouhid.sys

"MRXSMB" (MRxSmb) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\mrxsmb.sys

"Msfs" (Msfs) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Msfs.sys

"Mup" (Mup) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Mup.sys

"NABTS/FEC VBI Codec" (NABTSFEC) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\NABTSFEC.sys

"NDIS System Driver" (NDIS) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\NDIS.sys

"NDIS Usermode I/O Protocol" (Ndisuio) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\ndisuio.sys

"NDProxy" (NDProxy) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\NDProxy.sys

"NetBIOS Interface" (NetBIOS) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\netbios.sys

"NetBios over Tcpip" (NetBT) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\netbt.sys

"Npfs" (Npfs) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Npfs.sys

"Ntfs" (Ntfs) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Ntfs.sys

"Null" (Null) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Null.sys

"Parport" (Parport) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Parport.sys

"PartMgr" (PartMgr) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\PartMgr.sys

"ParVdm" (ParVdm) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\ParVdm.sys

"PCI Bus Driver" (PCI) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\pci.sys

"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)

"PCIIde" (PCIIde) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\pciide.sys

"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)

"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)

"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)

"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)

"PnP ISA/EISA Bus Driver" (isapnp) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\isapnp.sys

"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\PxHelp20.sys

"QoS Packet Scheduler" (PSched) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\psched.sys

"Ralink 802.11n USB Wireless LAN Card Driver" (rt2870) - "Ralink Technology, Corp." - C:\WINDOWS\System32\DRIVERS\rt2870.sys

"RAS Asynchronous Media Driver" (AsyncMac) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\asyncmac.sys

"Rdbss" (Rdbss) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\rdbss.sys

"RDPCDD" (RDPCDD) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\RDPCDD.sys

"RDPWD" (RDPWD) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\RDPWD.sys

"Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver" (RTLE8023xp) - "Realtek Semiconductor Corporation                           " - C:\WINDOWS\System32\DRIVERS\Rtenicxp.sys

"Remote Access Auto Connection Driver" (RasAcd) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\rasacd.sys

"Remote Access IP ARP Driver" (Wanarp) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\wanarp.sys

"Remote Access NDIS TAPI Driver" (NdisTapi) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\ndistapi.sys

"Remote Access NDIS WAN Driver" (NdisWan) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\ndiswan.sys

"Remote Access PPPOE Driver" (RasPppoe) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\raspppoe.sys

"RT73 USB Wireless LAN Card Driver" (RT73) - "Ralink Technology, Corp." - C:\WINDOWS\System32\DRIVERS\rt73.sys

"Secdrv" (Secdrv) - "Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K." - C:\WINDOWS\System32\DRIVERS\secdrv.sys

"Serenum Filter Driver" (serenum) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\serenum.sys

"Serial port driver" (Serial) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\serial.sys

"Service for Realtek HD Audio (WDM)" (IntcAzAudAddService) - "Realtek Semiconductor Corp." - C:\WINDOWS\System32\drivers\RtkHDAud.sys

"Sfloppy" (Sfloppy) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Sfloppy.sys

"Software Bus Driver" (swenum) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\swenum.sys

"speedfan" (speedfan) - "Almico Software" - C:\WINDOWS\System32\speedfan.sys

"sptd" (sptd) - "Duplex Secure Ltd." - C:\WINDOWS\System32\Drivers\sptd.sys  (File is exclusively opened, access blocked)

"Srv" (Srv) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\srv.sys

"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\ssmdrv.sys

"Standard IDE/ESDI Hard Disk Controller" (atapi) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\atapi.sys

"StarOpen" (StarOpen) - ? - C:\WINDOWS\system32\drivers\StarOpen.sys  (File found, but it contains no detailed information)

"System Restore Filter Driver" (sr) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\sr.sys

"TCP/IP Protocol Driver" (Tcpip) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\tcpip.sys

"TDPIPE" (TDPIPE) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\TDPIPE.sys

"TDTCP" (TDTCP) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\TDTCP.sys

"Terminal Device Driver" (TermDD) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\termdd.sys

"Terminal Server Device Redirector Driver" (rdpdr) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\rdpdr.sys

"USB Audio Driver (WDM)" (usbaudio) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\usbaudio.sys

"USB Mass Storage Driver" (USBSTOR) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS

"USB Video Device (WDM)" (usbvideo) - "Microsoft Corporation" - C:\WINDOWS\System32\Drivers\usbvideo.sys

"VgaSave" (VgaSave) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\vga.sys

"VIA OHCI Compliant IEEE 1394 Host Controller" (ohci1394) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\ohci1394.sys

"VolSnap" (VolSnap) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\VolSnap.sys

"Volume Manager Driver" (Ftdisk) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\ftdisk.sys

"WAN Miniport (IrDA)" (Rasirda) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\rasirda.sys

"WAN Miniport (L2TP)" (Rasl2tp) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\rasl2tp.sys

"WAN Miniport (PPTP)" (PptpMiniport) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\raspptp.sys

"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)

"WebDav Client Redirector" (MRxDAV) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\mrxdav.sys

"World Standard Teletext Codec" (WSTCODEC) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\WSTCODEC.SYS
 

[Explorer]

-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----

{7790769C-0471-11d2-AF11-00C04FA35D02} "Address Book 6" - "Microsoft Corporation" - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS "Browser Customizations" - "Microsoft Corporation" - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

>{26923b43-4d38-484f-9b9e-de460746276c} "Internet Explorer" - "Microsoft Corporation" - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE

{4b218e3e-bc98-4770-93d3-2731b9329278} "Internet Explorer" - "Microsoft Corporation" - %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection MarketplaceLinkInstall 896 %systemroot%\inf\ie.inf

{89820200-ECBD-11cf-8B85-00AA005B4383} "Internet Explorer 6" - "Microsoft Corporation" - %SystemRoot%\system32\ie4uinit.exe

{44BBA840-CC51-11CF-AAFA-00AA00B6015C} "Microsoft Outlook Express 6" - "Microsoft Corporation" - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

>{22d6f312-b0f6-11d0-94ab-0080c74c7e95} "Microsoft Windows Media Player" - "Microsoft Corporation" - C:\WINDOWS\inf\unregmp2.exe /ShowWMP

{6BF52A52-394A-11d3-B153-00C04F79FAA6} "Microsoft Windows Media Player" - "Microsoft Corporation" - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp11.inf,PerUserStub

{44BBA842-CC51-11CF-AAFA-00AA00B6015B} "NetMeeting 3.01" - "Microsoft Corporation" - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT

>{881dd1c5-3dcf-431b-b061-f3f88e8be88a} "Outlook Express" - "Microsoft Corporation" - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install

{2C7339CF-2B09-4501-B3F3-F3508C9228ED} "Themes Setup" - "Microsoft Corporation" - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

{89820200-ECBD-11cf-8B85-00AA005B4340} "Windows Desktop Update" - "Microsoft Corporation" - regsvr32.exe /s /n /i:U shell32.dll

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll

{0D2E74C4-3C34-11d2-A27E-00C04FC30871} "{0D2E74C4-3C34-11d2-A27E-00C04FC30871}" - "Microsoft Corporation" - C:\WINDOWS\system32\SHELL32.dll

{24F14F01-7B1C-11d1-838f-0000F80461CF} "{24F14F01-7B1C-11d1-838f-0000F80461CF}" - "Microsoft Corporation" - C:\WINDOWS\system32\SHELL32.dll

{24F14F02-7B1C-11d1-838f-0000F80461CF} "{24F14F02-7B1C-11d1-838f-0000F80461CF}" - "Microsoft Corporation" - C:\WINDOWS\system32\SHELL32.dll

{66742402-F9B9-11D1-A202-0000F81FEDEE} "{66742402-F9B9-11D1-A202-0000F81FEDEE}" - "Microsoft Corporation" - C:\WINDOWS\system32\SHELL32.dll

{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

-----( HKLM\Software\Classes\Protocols\Filter )-----

{32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} "AP Class Install Handler filter" - "Microsoft Corporation" - C:\WINDOWS\system32\urlmon.dll

{8f6b0360-b80d-11d0-a9b3-006097942311} "AP lzdhtml encoding/decoding Filter" - "Microsoft Corporation" - C:\WINDOWS\system32\urlmon.dll

{8f6b0360-b80d-11d0-a9b3-006097942311} "AP lzdhtml encoding/decoding Filter" - "Microsoft Corporation" - C:\WINDOWS\system32\urlmon.dll

{8f6b0360-b80d-11d0-a9b3-006097942311} "AP lzdhtml encoding/decoding Filter" - "Microsoft Corporation" - C:\WINDOWS\system32\urlmon.dll

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{733AC4CB-F1A4-11d0-B951-00A0C90312E1} "WebView MIME Filter" - "Microsoft Corporation" - C:\WINDOWS\system32\SHELL32.dll

-----( HKLM\Software\Classes\Protocols\Handler )-----

{3dd53d40-7b8b-11D0-b013-00aa0059ce02} "CDL: Asychronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\WINDOWS\system32\urlmon.dll

{12D51199-0DB5-46FE-A120-47A3D7D937CC} "DVD: Pluggable Protocol" - "Microsoft Corporation" - C:\WINDOWS\system32\msvidctl.dll

{79eac9e7-baf9-11ce-8c82-00aa004ba90b} "file:, local: Asychronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\WINDOWS\system32\urlmon.dll

{79eac9e7-baf9-11ce-8c82-00aa004ba90b} "file:, local: Asychronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\WINDOWS\system32\urlmon.dll

{79eac9e3-baf9-11ce-8c82-00aa004ba90b} "ftp: Asychronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\WINDOWS\system32\urlmon.dll

{79eac9e4-baf9-11ce-8c82-00aa004ba90b} "gopher: Asychronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\WINDOWS\system32\urlmon.dll

{79eac9e2-baf9-11ce-8c82-00aa004ba90b} "http: Asychronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\WINDOWS\system32\urlmon.dll

{79eac9e5-baf9-11ce-8c82-00aa004ba90b} "https: Asychronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\WINDOWS\system32\urlmon.dll

{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

{05300401-BCBC-11d0-85E3-00C04FD85AB4} "MHTML Asychronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\WINDOWS\system32\inetcomm.dll

{3050F406-98B5-11CF-BB82-00AA00BDCE0B} "Microsoft HTML About Pluggable Protocol" - "Microsoft Corporation" - C:\WINDOWS\system32\mshtml.dll

{3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} "Microsoft HTML Javascript Pluggable Protocol" - "Microsoft Corporation" - C:\WINDOWS\system32\mshtml.dll

{3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} "Microsoft HTML Javascript Pluggable Protocol" - "Microsoft Corporation" - C:\WINDOWS\system32\mshtml.dll

{3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} "Microsoft HTML Mailto Pluggable Protocol" - "Microsoft Corporation" - C:\WINDOWS\system32\mshtml.dll

{3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} "Microsoft HTML Resource Pluggable Protocol" - "Microsoft Corporation" - C:\WINDOWS\system32\mshtml.dll

{76E67A63-06E9-11D2-A840-006008059382} "Microsoft HTML Resource Pluggable Protocol" - "Microsoft Corporation" - C:\WINDOWS\system32\mshtml.dll

{9D148291-B9C8-11D0-A4CC-0000F80149F6} "Microsoft InfoTech Protocols for IE 4.0" - "Microsoft Corporation" - C:\WINDOWS\system32\itss.dll

{9D148291-B9C8-11D0-A4CC-0000F80149F6} "Microsoft InfoTech Protocols for IE 4.0" - "Microsoft Corporation" - C:\WINDOWS\system32\itss.dll

{79eac9e6-baf9-11ce-8c82-00aa004ba90b} "mk: Asychronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\WINDOWS\system32\urlmon.dll

{CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} "TV: Pluggable Protocol" - "Microsoft Corporation" - C:\WINDOWS\system32\msvidctl.dll

{13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} "WiaProtocol Class" - "Microsoft Corporation" - C:\WINDOWS\system32\wiascr.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler )-----

{438755C2-A8BA-11D1-B96B-00A0C90312E1} "Browseui preloader" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll

{8C7461EF-2B13-11d2-BE35-3078302C2030} "Component Categories cache daemon" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----

{AEB6717E-7E19-11d0-97EE-00C04FD91972} "URL Exec Hook" - "Microsoft Corporation" - C:\WINDOWS\system32\shell32.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{01E04581-4EEE-11d0-BFE9-00AA005B4383} "&Address" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll

{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Program Files\7-Zip\7-zip.dll

{7e653215-fa25-46bd-a339-34a2790f3cb7} "Accessible" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll

{88C6C381-2E85-11D0-94DE-444553540000} "ActiveX Cache Folder" - "Microsoft Corporation" - C:\WINDOWS\system32\occache.dll

{A08C11D2-A228-11d0-825B-00AA005B4383} "Address EditBox" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll

{D20EA4E1-3957-11d2-A40B-0C5020524153} "Administrative Tools" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll

{875CB1A1-0F29-45de-A1AE-CFB4950D0B78} "Audio Media Properties Handler" - "Microsoft Corporation" - C:\WINDOWS\system32\shmedia.dll

{91EA3F8B-C99B-11d0-9815-00C04FD91972} "Augmented Shell Folder" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll

{6413BA2C-B461-11d1-A18A-080036B11A03} "Augmented Shell Folder 2" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll

{5F327514-6C5E-4d60-8F16-D07FA08A78ED} "Auto Update Property Sheet Extension" - "Microsoft Corporation" - C:\WINDOWS\system32\wuaucpl.cpl

{87D62D94-71B3-4b9a-9489-5FE6850DC73E} "Avi Properties Handler" - "Microsoft Corporation" - C:\WINDOWS\system32\shmedia.dll

{F61FFEC1-754F-11d0-80CA-00AA005B4383} "BandProxy" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll

{85BBD920-42A0-1069-A2E4-08002B30309D} "Briefcase" - "Microsoft Corporation" - C:\WINDOWS\system32\syncui.dll

{0CD7A5C0-9F37-11CE-AE65-08002B2E1262} "Cabinet File" - "Microsoft Corporation" - C:\WINDOWS\system32\cabview.dll

{67EA19A0-CCEF-11d0-8024-00C04FD75D13} "CDF Extension Copy Hook" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll

{f39a0dc0-9cc8-11d0-a599-00c04fd64433} "Channel" - "Microsoft Corporation" - C:\WINDOWS\system32\cdfview.dll

{f3ba0dc0-9cc8-11d0-a599-00c04fd64435} "Channel Handler Object" - "Microsoft Corporation" - C:\WINDOWS\system32\cdfview.dll

{f3da0dc0-9cc8-11d0-a599-00c04fd64437} "Channel Menu Handler Object" - "Microsoft Corporation" - C:\WINDOWS\system32\cdfview.dll

{f3aa0dc0-9cc8-11d0-a599-00c04fd64434} "Channel Shortcut" - "Microsoft Corporation" - C:\WINDOWS\system32\cdfview.dll

{f3ea0dc0-9cc8-11d0-a599-00c04fd64438} "Channel Shortcut Property Pages" - "Microsoft Corporation" - C:\WINDOWS\system32\cdfview.dll

{7D559C10-9FE9-11d0-93F7-00AA0059CE02} "Code Download Agent" - "Microsoft Corporation" - C:\WINDOWS\system32\webcheck.dll

{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8} "Compatibility Page" - "Microsoft Corporation" - C:\WINDOWS\system32\SlayerXP.dll

{BD472F60-27FA-11cf-B8B4-444553540000} "Compressed (zipped) Folder Right Drag Handler" - "Microsoft Corporation" - C:\WINDOWS\system32\zipfldr.dll

{888DCA60-FC0A-11CF-8F0F-00C04FD7D062} "Compressed (zipped) Folder SendTo Target" - "Microsoft Corporation" - C:\WINDOWS\system32\zipfldr.dll

{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31} "CompressedFolder" - "Microsoft Corporation" - C:\WINDOWS\system32\zipfldr.dll

{E6CC6978-6B6E-11D0-BECA-00C04FD940BE} "ConnectionAgent" - "Microsoft Corporation" - C:\WINDOWS\system32\webcheck.dll

{7444C717-39BF-11D1-8CD9-00C04FC29D45} "CryptPKO Class" - "Microsoft Corporation" - C:\WINDOWS\system32\cryptext.dll

{7444C719-39BF-11D1-8CD9-00C04FC29D45} "CryptSig Class" - "Microsoft Corporation" - C:\WINDOWS\system32\cryptext.dll

{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A} "Custom MRU AutoCompleted List" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll

{CFCCC7A0-A282-11D1-9082-006008059382} "Darwin App Publisher" - "Microsoft Corporation" - C:\WINDOWS\system32\appwiz.cpl

{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6} "DfsShell Class" - "Microsoft Corporation" - C:\WINDOWS\system32\dfsshlex.dll

{62AE1F9A-126A-11D0-A14B-0800361B1103} "Directory Context Menu Verbs" - "Microsoft Corporation" - C:\WINDOWS\system32\dsuiext.dll

{163FDC20-2ABC-11d0-88F0-00A024AB2DBB} "Directory Object Find" - "Microsoft Corporation" - C:\WINDOWS\system32\dsquery.dll

{0D45D530-764B-11d0-A1CA-00AA00C16E65} "Directory Property UI" - "Microsoft Corporation" - C:\WINDOWS\system32\dsuiext.dll

{8A23E65E-31C2-11d0-891C-00A024AB2DBB} "Directory Query UI" - "Microsoft Corporation" - C:\WINDOWS\system32\dsquery.dll

{F020E586-5264-11d1-A532-0000F8757D7E} "Directory Start/Search Find" - "Microsoft Corporation" - C:\WINDOWS\system32\dsquery.dll

{59099400-57FF-11CE-BD94-0020AF85B590} "Disk Copy Extension" - "Microsoft Corporation" - C:\WINDOWS\system32\diskcopy.dll

{42071712-76d4-11d1-8b24-00a0c9068ff3} "Display Adapter CPL Extension" - "Microsoft Corporation" - C:\WINDOWS\system32\deskadp.dll

{42071713-76d4-11d1-8b24-00a0c9068ff3} "Display Monitor CPL Extension" - "Microsoft Corporation" - C:\WINDOWS\system32\deskmon.dll

{42071714-76d4-11d1-8b24-00a0c9068ff3} "Display Panning CPL Extension" - ? - deskpan.dll  (File not found)

{f92e8c40-3d33-11d2-b1aa-080036a75b03} "Display TroubleShoot CPL Extension" - "Microsoft Corporation" - C:\WINDOWS\system32\deskperf.dll

{872A9397-E0D6-4e28-B64D-52B8D0A7EA35} "DisplayCplExt Class" - "Advanced Micro Devices, Inc." - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiamaxx.dll

{22BF0C20-6DA7-11D0-B373-00A0C9034938} "Download Status" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll

{60fd46de-f830-4894-a628-6fa81bc0190d} "DropTarget Object for Photo Printing Wizard" - "Microsoft Corporation" - C:\WINDOWS\system32\photowiz.dll

{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0} "E-mail" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll

{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Encryption Context Menu" - ? -   (File not found | COM-object registry key not found)

{EFA24E64-B078-11d0-89E4-00C04FC9E26E} "Explorer Band" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll

{692F0339-CBAA-47e6-B5B5-3B84DB604E87} "Extensions Manager Folder" - "Microsoft Corporation" - C:\WINDOWS\system32\extmgr.dll

{7A80E4A8-8005-11D2-BCF8-00C04F72C717} "ExtractIcon Class" - "Microsoft Corporation" - C:\WINDOWS\System32\mmcshext.dll

{EFA24E61-B078-11d0-89E4-00C04FC9E26E} "Favorites Band" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll

{BD84B380-8CA2-1069-AB1D-08000948F534} "Fonts" - "Microsoft Corporation" - C:\WINDOWS\system32\fontext.dll

{D20EA4E1-3957-11d2-A40B-0C5020524152} "Fonts" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll

{32714800-2E5F-11d0-8B85-00AA0044F941} "For &People..." - "Microsoft Corporation" - C:\Program Files\Outlook Express\wabfind.dll

{3F30C968-480A-4C6C-862D-EFC0897BB84B} "GDI+ file thumbnail extractor" - "Microsoft Corporation" - C:\WINDOWS\system32\shimgvw.dll

{58f1f272-9240-4f51-b6d4-fd63d1618591} "Get a Passport Wizard" - "Microsoft Corporation" - C:\WINDOWS\system32\netplwiz.dll

{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11} "Global Folder Settings" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll

{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0} "Help and Support" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll

{FF393560-C2A7-11CF-BFF4-444553540000} "History" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll

{EFA24E62-B078-11d0-89E4-00C04FC9E26E} "History Band" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll

{EAB841A0-9550-11cf-8C16-00805F1408F3} "HTML Thumbnail Extractor" - "Microsoft Corporation" - C:\WINDOWS\system32\shimgvw.dll

{88895560-9AA2-1069-930E-00AA0030EBC8} "HyperTerminal Icon Ext" - "Hilgraeve, Inc." - C:\WINDOWS\system32\hticons.dll

{DBCE2480-C732-101B-BE72-BA78E9AD5B27} "ICC Profile" - "Microsoft Corporation" - C:\WINDOWS\system32\icmui.dll

{5DB2625A-54DF-11D0-B6C4-0800091AA605} "ICM Monitor Management" - "Microsoft Corporation" - C:\WINDOWS\System32\icmui.dll

{675F097E-4C4D-11D0-B6C1-0800091AA605} "ICM Printer Management" - "Microsoft Corporation" - C:\WINDOWS\system32\icmui.dll

{176d6597-26d3-11d1-b350-080036a75b03} "ICM Scanner Management" - "Microsoft Corporation" - C:\WINDOWS\system32\icmui.dll

{3028902F-6374-48b2-8DC6-9725E775B926} "IE Microsoft AutoComplete" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll

{30D02401-6A81-11d0-8274-00C04FD5AE38} "IE Search Band" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll

{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC} "IE4 Suite Splash Screen" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll

{169A0691-8DF9-11d1-A1C4-00C04FD75D13} "In-pane search" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll

{0B124F8F-91F0-11D1-B8B5-006008059382} "Installed Apps Enumerator" - "Microsoft Corporation" - C:\WINDOWS\system32\appwiz.cpl

{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0} "Internet" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll

{871C5380-42A0-1069-A2EA-08002B30309D} "Internet Name Space" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll

{FBF23B40-E3F0-101B-8488-00AA003E56F8} "Internet Shortcut" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll

{131A6951-7F78-11D0-A979-00C04FD705A2} "ISFBand OC" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll

{143A62C8-C33B-11D1-84FE-00C04FA34A14} "Microsoft Agent Character Property Sheet Handler" - "Microsoft Corporation" - C:\WINDOWS\msagent\agentpsh.dll

{A5E46E3A-8849-11D1-9D8C-00C04FC99D61} "Microsoft Browser Architecture" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll

{7BA4C742-9E81-11CF-99D3-00AA004AE837} "Microsoft BrowserBand" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll

{7988B573-EC89-11cf-9C00-00AA00A14F56} "Microsoft Disk Quota UI" - "Microsoft Corporation" - C:\WINDOWS\system32\dskquoui.dll

{6A205B57-2567-4A2C-B881-F787FAB579A3} "Microsoft DocProp Inplace Calendar Control" - "Microsoft Corporation" - C:\WINDOWS\system32\docprop2.dll

{0EEA25CC-4362-4A12-850B-86EE61B0D3EB} "Microsoft DocProp Inplace Droplist Combo Control" - "Microsoft Corporation" - C:\WINDOWS\system32\docprop2.dll

{A9CF0EAE-901A-4739-A481-E35B73E47F6D} "Microsoft DocProp Inplace Edit Box Control" - "Microsoft Corporation" - C:\WINDOWS\system32\docprop2.dll

{8EE97210-FD1F-4B19-91DA-67914005F020} "Microsoft DocProp Inplace ML Edit Box Control" - "Microsoft Corporation" - C:\WINDOWS\system32\docprop2.dll

{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33} "Microsoft DocProp Inplace Time Control" - "Microsoft Corporation" - C:\WINDOWS\system32\docprop2.dll

{883373C3-BF89-11D1-BE35-080036B11A03} "Microsoft DocProp Shell Ext" - "Microsoft Corporation" - C:\WINDOWS\system32\docprop2.dll

{63da6ec0-2e98-11cf-8d82-444553540000} "Microsoft FTP Folder" - "Microsoft Corporation" - C:\WINDOWS\system32\msieftp.dll

{00BB2764-6A77-11D0-A535-00C04FD7D062} "Microsoft History AutoComplete List" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll

{5E6AB780-7743-11CF-A12B-00AA004AE837} "Microsoft Internet Toolbar" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll

{00BB2765-6A77-11D0-A535-00C04FD7D062} "Microsoft Multiple AutoComplete List Container" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll

{2206CDB2-19C1-11D1-89E0-00C04FD7A829} "Microsoft OLE DB Service Component Data Links" - "Microsoft Corporation" - C:\Program Files\Common Files\System\Ole DB\oledb32.dll

{03C036F1-A186-11D0-824A-00AA005B4383} "Microsoft Shell Folder AutoComplete List" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll

{3C374A40-BAE4-11CF-BF7D-00AA006946EE} "Microsoft Url History Service" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll

{CFBFAE00-17A6-11D0-99CB-00C04FD64497} "Microsoft Url Search Hook" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll

{A6FD9E45-6E44-43f9-8644-08598F5A74D9} "Midi Properties Handler" - "Microsoft Corporation" - C:\WINDOWS\system32\shmedia.dll

{6756A641-DE71-11d0-831B-00AA005B4383} "MRU AutoComplete List" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll

{00022613-0000-0000-C000-000000000046} "Multimedia File Property Sheet" - "Microsoft Corporation" - C:\WINDOWS\system32\mmsys.cpl

{ECF03A33-103D-11d2-854D-006008059367} "MyDocs Copy Hook" - "Microsoft Corporation" - C:\WINDOWS\system32\mydocs.dll

{ECF03A32-103D-11d2-854D-006008059367} "MyDocs Drop Target" - "Microsoft Corporation" - C:\WINDOWS\system32\mydocs.dll

{4a7ded0a-ad25-11d0-98a8-0800361b1103} "MyDocs menu and properties" - "Microsoft Corporation" - C:\WINDOWS\system32\mydocs.dll

{7007ACC7-3202-11D1-AAD2-00805FC1270E} "Network Connections" - "Microsoft Corporation" - C:\WINDOWS\system32\NETSHELL.dll

{992CFFA0-F557-101A-88EC-00DD010CCC48} "Network Connections" - "Microsoft Corporation" - C:\WINDOWS\system32\NETSHELL.dll

{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E} "Offline Files Folder" - "Microsoft Corporation" - C:\WINDOWS\System32\cscui.dll

{10CFC467-4392-11d2-8DB4-00C04FA31A66} "Offline Files Folder Options" - "Microsoft Corporation" - C:\WINDOWS\System32\cscui.dll

{750fdf0e-2a26-11d1-a3ea-080036587f03} "Offline Files Menu" - "Microsoft Corporation" - C:\WINDOWS\System32\cscui.dll

{3EA48300-8CF6-101B-84FB-666CCB9BCD32} "OLE Docfile Property Page" - "Microsoft Corporation" - C:\WINDOWS\system32\docprop.dll

{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{41E300E0-78B6-11ce-849B-444553540000} "PlusPack CPL Extension" - "Microsoft Corporation" - C:\WINDOWS\system32\themeui.dll

{35786D3C-B075-49b9-88DD-029876E11C01} "Portable Devices" - "Microsoft Corporation" - C:\WINDOWS\system32\wpdshext.dll

{D6791A63-E7E2-4fee-BF52-5DED8E86E9B8} "Portable Devices Menu" - "Microsoft Corporation" - C:\WINDOWS\system32\wpdshext.dll

{640167b4-59b0-47a6-b335-a6b3c0695aea} "Portable Media Devices" - "Microsoft Corporation" - C:\WINDOWS\system32\Audiodev.dll

{D8BD2030-6FC9-11D0-864F-00AA006809D9} "PostAgent" - "Microsoft Corporation" - C:\WINDOWS\system32\webcheck.dll

{9DB7A13C-F208-4981-8353-73CC61AE2783} "Previous Versions" - "Microsoft Corporation" - C:\WINDOWS\system32\twext.dll

{596AB062-B4D2-4215-9F74-E9109B0A8153} "Previous Versions Property Page" - "Microsoft Corporation" - C:\WINDOWS\system32\twext.dll

{add36aa8-751a-4579-a266-d66f5202ccbb} "Print Ordering via the Web" - "Microsoft Corporation" - C:\WINDOWS\system32\netplwiz.dll

{AF4F6510-F982-11d0-8595-00AA004CD6D8} "Registry Tree Options Utility" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll

{F0152790-D56E-4445-850E-4F3117DB740C} "Remote Sessions CPL Extension" - "Microsoft Corporation" - C:\WINDOWS\system32\remotepg.dll

{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0} "Run..." - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll

{3F953603-1008-4f6e-A73A-04AAC7A992F1} "Scanners & Cameras" - "Microsoft Corporation" - C:\WINDOWS\system32\wiashext.dll

{83bbcbf3-b28a-4919-a5aa-73027445d672} "Scanners & Cameras" - "Microsoft Corporation" - C:\WINDOWS\system32\wiashext.dll

{905667aa-acd6-11d2-8080-00805f6596d2} "Scanners & Cameras" - "Microsoft Corporation" - C:\WINDOWS\system32\wiashext.dll

{E211B736-43FD-11D1-9EFB-0000F8757FCD} "Scanners & Cameras" - "Microsoft Corporation" - C:\WINDOWS\system32\wiashext.dll

{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD} "Scanners & Cameras" - "Microsoft Corporation" - C:\WINDOWS\system32\wiashext.dll

{D6277990-4C6A-11CF-8D87-00AA0060F5BF} "Scheduled Tasks" - "Microsoft Corporation" - C:\WINDOWS\system32\mstask.dll

{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF} "Scheduling UI icon handler" - "Microsoft Corporation" - C:\WINDOWS\system32\mstask.dll

{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF} "Scheduling UI property sheet handler" - "Microsoft Corporation" - C:\WINDOWS\system32\mstask.dll

{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0} "Search" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll

{9461b922-3c5a-11d2-bf8b-00c04fb93661} "Search Assistant OC" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll

{1F2E5C40-9550-11CE-99D2-00AA006E086C} "Security Shell Extension" - "Microsoft Corporation" - C:\WINDOWS\system32\rshx32.dll

{4E40F770-369C-11d0-8922-00A024AB2DBB} "Security Shell Extension" - "Microsoft Corporation" - C:\WINDOWS\system32\dssec.dll

{F37C5810-4D3F-11d0-B4BF-00AA00BBB723} "Security Shell Extension" - "Microsoft Corporation" - C:\WINDOWS\system32\rshx32.dll

{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE} "Sendmail service" - "Microsoft Corporation" - C:\WINDOWS\system32\sendmail.dll

{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE} "Sendmail service" - "Microsoft Corporation" - C:\WINDOWS\system32\sendmail.dll

{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0} "Set Program Access and Defaults" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll

{352EC2B7-8B9A-11D1-B8AE-006008059382} "Shell Application Manager" - "Microsoft Corporation" - C:\WINDOWS\system32\appwiz.cpl

{0A89A860-D7B1-11CE-8350-444553540000} "Shell Automation Inproc Service" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll

{00E7B358-F65B-4dcf-83DF-CD026B94BFD4} "Shell Autoplay for Slideshow" - "Microsoft Corporation" - C:\WINDOWS\system32\shimgvw.dll

{ECD4FC4E-521C-11D0-B792-00A0C90312E1} "Shell Band Site Menu" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll

{ECD4FC4C-521C-11D0-B792-00A0C90312E1} "Shell DeskBar" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll

{3CCF8A41-5C85-11d0-9796-00AA00B90ADF} "Shell DeskBarApp" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll

{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} "Shell DocObject Viewer" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll

{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll

{60254CA5-953B-11CF-8C96-00AA00B8708C} "Shell Extension For Windows Script Host" - "Microsoft Corporation" - C:\WINDOWS\system32\wshext.dll

{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shell extensions for file compression" - ? -   (File not found | COM-object registry key not found)

{59be4990-f85c-11ce-aff7-00aa003ca9f6} "Shell extensions for Microsoft Windows Network objects" - "Microsoft Corporation" - C:\WINDOWS\system32\ntlanui2.dll

{40dd6e20-7c17-11ce-a804-00aa003ca9f6} "Shell extensions for sharing" - "Microsoft Corporation" - C:\WINDOWS\system32\ntshrui.dll

{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6} "Shell extensions for sharing" - "Microsoft Corporation" - C:\WINDOWS\system32\ntshrui.dll

{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll

{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178} "Shell Image Data Factory" - "Microsoft Corporation" - C:\WINDOWS\system32\shimgvw.dll

{eb9b1153-3b57-4e68-959a-a3266bc3d7fe} "Shell Image Property Handler" - "Microsoft Corporation" - C:\WINDOWS\system32\shimgvw.dll

{e84fda7c-1d6a-45f6-b725-cb260c236066} "Shell Image Verbs" - "Microsoft Corporation" - C:\WINDOWS\system32\shimgvw.dll

{00BB2763-6A77-11D0-A535-00C04FD7D062} "Shell Microsoft AutoComplete" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll

{9E51E0D0-6E0F-11d2-9601-00C04FA31A86} "Shell properties for a DS object" - "Microsoft Corporation" - C:\WINDOWS\system32\dsquery.dll

{6b33163c-76a5-4b6c-bf21-45de9cd503a1} "Shell Publishing Wizard Object" - "Microsoft Corporation" - C:\WINDOWS\system32\netplwiz.dll

{ECD4FC4D-521C-11D0-B792-00A0C90312E1} "Shell Rebar BandSite" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll

{56117100-C0CD-101B-81E2-00AA004AE837} "Shell Scrap DataHandler" - "Microsoft Corporation" - C:\WINDOWS\system32\shscrap.dll

{21569614-B795-46b1-85F4-E737A8DC09AD} "Shell Search Band" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll

{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll

{5E2121EE-0300-11D4-8D3B-444553540000} "SimpleShlExt Class" - "Advanced Micro Devices, Inc." - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll

{F5175861-2688-11d0-9C5E-00AA00A45957} "Subscription Folder" - "Microsoft Corporation" - C:\WINDOWS\system32\webcheck.dll

{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE} "Subscription Mgr" - "Microsoft Corporation" - C:\WINDOWS\system32\webcheck.dll

{9DBD2C50-62AD-11d0-B806-00C04FD706EC} "Summary Info Thumbnail handler (DOCFILES)" - "Microsoft Corporation" - C:\WINDOWS\system32\shimgvw.dll

{0DF44EAA-FF21-4412-828E-260A8728E7F1} "Taskbar and Start Menu" - "Microsoft Corporation" - C:\WINDOWS\system32\shell32.dll

{7BD29E00-76C1-11CF-9DD0-00A0C9034933} "Temporary Internet Files" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll

{7BD29E01-76C1-11CF-9DD0-00A0C9034933} "Temporary Internet Files" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll

{3DC7A020-0ACD-11CF-A9BB-00AA004AE837} "The Internet" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll

{acf35015-526e-4230-9596-becbe19f0ac9} "Track Popup Bar" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll

{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7} "TrayAgent" - "Microsoft Corporation" - C:\WINDOWS\system32\webcheck.dll

{7376D660-C583-11d0-A3A5-00C04FD706EC} "TridentImageExtractor" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll

{7A9D77BD-5403-11d2-8785-2E0420524153} "User Accounts" - "Microsoft Corporation" - C:\WINDOWS\system32\netplwiz.dll

{DD313E04-FEFF-11d1-8ECD-0000F87A470C} "User Assist" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll

{40C3D757-D6E4-4b49-BB41-0E5BBEA28817} "Video Media Properties Handler" - "Microsoft Corporation" - C:\WINDOWS\system32\shmedia.dll

{c5a40261-cd64-4ccf-84cb-c394da41d590} "Video Thumbnail Extractor" - "Microsoft Corporation" - C:\WINDOWS\system32\shmedia.dll

{E4B29F9D-D390-480b-92FD-7DDB47101D71} "Wav Properties Handler" - "Microsoft Corporation" - C:\WINDOWS\system32\shmedia.dll

{77597368-7b15-11d0-a0c2-080036af3f03} "Web Printer Shell Extension" - "Microsoft Corporation" - C:\WINDOWS\system32\printui.dll

{CC6EEFFB-43F6-46c5-9619-51D571967F7D} "Web Publishing Wizard" - "Microsoft Corporation" - C:\WINDOWS\system32\netplwiz.dll

{07798131-AF23-11d1-9111-00A0C98BA67D} "Web Search" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll

{E6FB5E20-DE35-11CF-9C87-00AA005127ED} "WebCheck" - "Microsoft Corporation" - C:\WINDOWS\system32\webcheck.dll

{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB} "WebCheck SyncMgr Handler" - "Microsoft Corporation" - C:\WINDOWS\system32\webcheck.dll

{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB} "WebCheckChannelAgent" - "Microsoft Corporation" - C:\WINDOWS\system32\webcheck.dll

{08165EA0-E946-11CF-9C87-00AA005127ED} "WebCheckWebCrawler" - "Microsoft Corporation" - C:\WINDOWS\system32\webcheck.dll

{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0} "Windows Security" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll

{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD} "WMP Add To Playlist Launcher" - "Microsoft Corporation" - C:\WINDOWS\system32\wmpshell.dll

{8DD448E6-C188-4aed-AF92-44956194EB1F} "WMP Burn Audio CD Launcher" - "Microsoft Corporation" - C:\WINDOWS\system32\wmpshell.dll

{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C} "WMP Play As Playlist Launcher" - "Microsoft Corporation" - C:\WINDOWS\system32\wmpshell.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad )-----

{7849596a-48ea-486e-8937-a2a3009f31a9} "PostBootReminder object" - "Microsoft Corporation" - C:\WINDOWS\system32\shell32.dll

{fbeb8a05-beee-4442-804e-409d6c4515e9} "ShellFolder for CD Burning" - "Microsoft Corporation" - C:\WINDOWS\system32\SHELL32.dll

{35CEC8A3-2BE6-11D2-8773-92E220524153} "SysTray" - "Microsoft Corporation" - C:\WINDOWS\system32\stobject.dll

{E6FB5E20-DE35-11CF-9C87-00AA005127ED} "WebCheck" - "Microsoft Corporation" - C:\WINDOWS\system32\webcheck.dll

{AAA288BA-9A4C-45B0-95D7-94D524869DB5} "WPDShServiceObj Class" - "Microsoft Corporation" - C:\WINDOWS\system32\WPDShServiceObj.dll
 

[Internet Explorer]

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_22.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_22.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_22.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

"Exec" - "Microsoft Corporation" - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll

{E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
 

[Known DLLs]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs )-----

"advapi32" - "Microsoft Corporation" - C:\WINDOWS\system32\advapi32.dll

"comdlg32" - "Microsoft Corporation" - C:\WINDOWS\system32\comdlg32.dll

"gdi32" - "Microsoft Corporation" - C:\WINDOWS\system32\gdi32.dll

"imagehlp" - "Microsoft Corporation" - C:\WINDOWS\system32\imagehlp.dll

"kernel32" - "Microsoft Corporation" - C:\WINDOWS\system32\kernel32.dll

"lz32" - "Microsoft Corporation" - C:\WINDOWS\system32\lz32.dll

"ole32" - "Microsoft Corporation" - C:\WINDOWS\system32\ole32.dll

"oleaut32" - "Microsoft Corporation" - C:\WINDOWS\system32\oleaut32.dll

"olecli32" - "Microsoft Corporation" - C:\WINDOWS\system32\olecli32.dll

"olecnv32" - "Microsoft Corporation" - C:\WINDOWS\system32\olecnv32.dll

"olesvr32" - "Microsoft Corporation" - C:\WINDOWS\system32\olesvr32.dll

"olethk32" - "Microsoft Corporation" - C:\WINDOWS\system32\olethk32.dll

"rpcrt4" - "Microsoft Corporation" - C:\WINDOWS\system32\rpcrt4.dll

"shell32" - "Microsoft Corporation" - C:\WINDOWS\system32\shell32.dll

"url" - "Microsoft Corporation" - C:\WINDOWS\system32\url.dll

"urlmon" - "Microsoft Corporation" - C:\WINDOWS\system32\urlmon.dll

"user32" - "Microsoft Corporation" - C:\WINDOWS\system32\user32.dll

"version" - "Microsoft Corporation" - C:\WINDOWS\system32\version.dll

"wininet" - "Microsoft Corporation" - C:\WINDOWS\system32\wininet.dll

"wldap32" - "Microsoft Corporation" - C:\WINDOWS\system32\wldap32.dll
 

[LSA Providers]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Lsa )-----

"Authentication packages" - "Microsoft Corporation" - C:\WINDOWS\system32\msv1_0.dll

"Notification packages" - "Microsoft Corporation" - C:\WINDOWS\system32\scecli.dll

"Security Packages" - "Microsoft Corporation" - C:\WINDOWS\system32\kerberos.dll

"Security Packages" - "Microsoft Corporation" - C:\WINDOWS\system32\msv1_0.dll

"Security Packages" - "Microsoft Corporation" - C:\WINDOWS\system32\schannel.dll

"Security Packages" - "Microsoft Corporation" - C:\WINDOWS\system32\wdigest.dll

-----( HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders )-----

"SecurityProviders" - "Microsoft Corporation" - C:\WINDOWS\system32\msapsspc.dll

"SecurityProviders" - "Microsoft Corporation" - C:\WINDOWS\system32\schannel.dll

"SecurityProviders" - "Microsoft Corporation" - C:\WINDOWS\system32\digest.dll

"SecurityProviders" - "Microsoft Corporation" - C:\WINDOWS\system32\msnsspc.dll
 

[Logon]

-----( %AllUsersProfile%\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\Documents and Settings\All Users\Start Menu\Programs\Startup\desktop.ini

-----( %UserProfile%\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\desktop.ini

-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce )-----

"scan_after_setup" - "Avira GmbH" - "c:\program files\avira\antivir desktop\avcenter.exe" /SCANAFTERSETUP="scan setup2date wait newprocess"

-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon )-----

"Shell" - "Microsoft Corporation" - C:\WINDOWS\Explorer.exe

"Userinit" - "Microsoft Corporation" - C:\WINDOWS\system32\userinit.exe

-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----

"StartupPrograms" - "Microsoft Corporation" - C:\WINDOWS\system32\rdpclip.exe

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

"JMB36X IDE Setup" - ? - C:\WINDOWS\RaidTool\xInsIDE.exe  (File found, but it contains no detailed information)

"RTHDCPL" - "Realtek Semiconductor Corp." - RTHDCPL.EXE

"SetDefPrt" - "Brother Industories, Ltd." - C:\Program Files\Brother\Brmfl05a\BrStDvPt.exe

"StartCCC" - "Advanced Micro Devices, Inc." - "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
 

[Network Providers]

-----( HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order )-----

"Microsoft Terminal Services" - "Microsoft Corporation" - C:\WINDOWS\System32\drprov.dll

"Microsoft Windows Network" - "Microsoft Corporation" - C:\WINDOWS\System32\ntlanman.dll

"Web Client Network" - "Microsoft Corporation" - C:\WINDOWS\System32\davclnt.dll
 

[Print Monitors]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----

"BJ Language Monitor" - "Microsoft Corporation" - C:\WINDOWS\system32\cnbjmon.dll

"Local Port" - "Microsoft Corporation" - C:\WINDOWS\system32\localspl.dll

"PJL Language Monitor" - "Microsoft Corporation" - C:\WINDOWS\system32\pjlmon.dll

"Standard TCP/IP Port" - "Microsoft Corporation" - C:\WINDOWS\system32\tcpmon.dll

"USB Monitor" - "Microsoft Corporation" - C:\WINDOWS\system32\usbmon.dll
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

"Akamai NetSession Interface" (Akamai) - ? - c:\program files\common files\akamai\netsession_win_8832f4b.dll  (File found, but it contains no detailed information)

"Application Layer Gateway Service" (ALG) - "Microsoft Corporation" - C:\WINDOWS\System32\alg.exe

"Application Management" (AppMgmt) - "Microsoft Corporation" - C:\WINDOWS\System32\appmgmts.dll

"ASP.NET State Service" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe

"Ati HotKey Poller" (Ati HotKey Poller) - "ATI Technologies Inc." - C:\WINDOWS\system32\Ati2evxx.exe

"Automatic Updates" (wuauserv) - "Microsoft Corporation" - C:\WINDOWS\system32\wuauserv.dll

"Background Intelligent Transfer Service" (BITS) - "Microsoft Corporation" - C:\WINDOWS\system32\qmgr.dll

"BrSplService" (Brother XP spl Service) - "brother Industries Ltd" - C:\WINDOWS\system32\brsvc01a.exe

"ClipBook" (ClipSrv) - "Microsoft Corporation" - C:\WINDOWS\system32\clipsrv.exe

"COM+ Event System" (EventSystem) - "Microsoft Corporation" - C:\WINDOWS\system32\es.dll

"COM+ System Application" (COMSysApp) - "Microsoft Corporation" - C:\WINDOWS\system32\dllhost.exe

"Computer Browser" (Browser) - "Microsoft Corporation" - C:\WINDOWS\System32\browser.dll

"CryptSvc" (CryptSvc) - "Microsoft Corporation" - C:\WINDOWS\System32\cryptsvc.dll

"DCOM Server Process Launcher" (DcomLaunch) - "Microsoft Corporation" - C:\WINDOWS\system32\rpcss.dll

"DHCP Client" (Dhcp) - "Microsoft Corporation" - C:\WINDOWS\System32\dhcpcsvc.dll

"Distributed Link Tracking Client" (TrkWks) - "Microsoft Corporation" - C:\WINDOWS\system32\trkwks.dll

"Distributed Transaction Coordinator" (MSDTC) - "Microsoft Corporation" - C:\WINDOWS\system32\msdtc.exe

"DNS Client" (Dnscache) - "Microsoft Corporation" - C:\WINDOWS\System32\dnsrslvr.dll

"Error Reporting Service" (ERSvc) - "Microsoft Corporation" - C:\WINDOWS\System32\ersvc.dll

"Event Log" (Eventlog) - "Microsoft Corporation" - C:\WINDOWS\system32\services.exe

"Extensible Authentication Protocol Service" (EapHost) - "Microsoft Corporation" - C:\WINDOWS\System32\eapsvc.dll

"Fast User Switching Compatibility" (FastUserSwitchingCompatibility) - "Microsoft Corporation" - C:\WINDOWS\System32\shsvcs.dll

"Health Key and Certificate Management Service" (hkmsvc) - "Microsoft Corporation" - C:\WINDOWS\System32\kmsvc.dll

"Help and Support" (helpsvc) - "Microsoft Corporation" - C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll

"HID Input Service" (HidServ) - "Microsoft Corporation" - C:\WINDOWS\System32\hidserv.dll

"HTTP SSL" (HTTPFilter) - "Microsoft Corporation" - C:\WINDOWS\System32\w3ssl.dll

"IMAPI CD-Burning COM Service" (ImapiService) - "Microsoft Corporation" - C:\WINDOWS\system32\imapi.exe

"Indexing Service" (CiSvc) - "Microsoft Corporation" - C:\WINDOWS\system32\cisvc.exe

"Infrared Monitor" (Irmon) - "Microsoft Corporation" - C:\WINDOWS\System32\irmon.dll

"IPSEC Services" (PolicyAgent) - "Microsoft Corporation" - C:\WINDOWS\system32\lsass.exe

"Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jqs.exe

"Logical Disk Manager" (dmserver) - "Microsoft Corp." - C:\WINDOWS\System32\dmserver.dll

"Logical Disk Manager Administrative Service" (dmadmin) - "Microsoft Corp., Veritas Software" - C:\WINDOWS\System32\dmadmin.exe

"MS Software Shadow Copy Provider" (SwPrv) - "Microsoft Corporation" - C:\WINDOWS\system32\dllhost.exe

"MySQL" (MySQL) - "MySQL AB" - C:\xampp\mysql\bin\mysqld.exe

"Net Logon" (Netlogon) - "Microsoft Corporation" - C:\WINDOWS\system32\lsass.exe

"NetMeeting Remote Desktop Sharing" (mnmsrvc) - "Microsoft Corporation" - C:\WINDOWS\system32\mnmsrvc.exe

"Network Access Protection Agent" (napagent) - "Microsoft Corporation" - C:\WINDOWS\System32\qagentrt.dll

"Network Connections" (Netman) - "Microsoft Corporation" - C:\WINDOWS\System32\netman.dll

"Network Location Awareness (NLA)" (Nla) - "Microsoft Corporation" - C:\WINDOWS\System32\mswsock.dll

"Network Provisioning Service" (xmlprov) - "Microsoft Corporation" - C:\WINDOWS\System32\xmlprov.dll

"NMSAccessU" (NMSAccessU) - ? - C:\Program Files\CDBurnerXP\NMSAccessU.exe  (File found, but it contains no detailed information)

"NT LM Security Support Provider" (NtLmSsp) - "Microsoft Corporation" - C:\WINDOWS\system32\lsass.exe

"Performance Logs and Alerts" (SysmonLog) - "Microsoft Corporation" - C:\WINDOWS\system32\smlogsvc.exe

"Plug and Play" (PlugPlay) - "Microsoft Corporation" - C:\WINDOWS\system32\services.exe

"Portable Media Serial Number Service" (WmdmPmSN) - "Microsoft Corporation" - C:\WINDOWS\system32\MsPMSNSv.dll

"Print Spooler" (Spooler) - "Microsoft Corporation" - C:\WINDOWS\system32\spoolsv.exe

"Protected Storage" (ProtectedStorage) - "Microsoft Corporation" - C:\WINDOWS\system32\lsass.exe

"QoS RSVP" (RSVP) - "Microsoft Corporation" - C:\WINDOWS\system32\rsvp.exe

"Remote Access Auto Connection Manager" (RasAuto) - "Microsoft Corporation" - C:\WINDOWS\System32\rasauto.dll

"Remote Access Connection Manager" (RasMan) - "Microsoft Corporation" - C:\WINDOWS\System32\rasmans.dll

"Remote Desktop Help Session Manager" (RDSessMgr) - "Microsoft Corporation" - C:\WINDOWS\system32\sessmgr.exe

"Remote Procedure Call (RPC)" (RpcSs) - "Microsoft Corporation" - C:\WINDOWS\System32\rpcss.dll

"Remote Procedure Call (RPC) Locator" (RpcLocator) - "Microsoft Corporation" - C:\WINDOWS\system32\locator.exe

"Remote Registry" (RemoteRegistry) - "Microsoft Corporation" - C:\WINDOWS\system32\regsvc.dll

"Removable Storage" (NtmsSvc) - "Microsoft Corporation" - C:\WINDOWS\system32\ntmssvc.dll

"Secondary Logon" (seclogon) - "Microsoft Corporation" - C:\WINDOWS\System32\seclogon.dll

"Security Accounts Manager" (SamSs) - "Microsoft Corporation" - C:\WINDOWS\system32\lsass.exe

"Security Center" (wscsvc) - "Microsoft Corporation" - C:\WINDOWS\system32\wscsvc.dll

"Server" (LanmanServer) - "Microsoft Corporation" - C:\WINDOWS\System32\srvsvc.dll

"Shell Hardware Detection" (ShellHWDetection) - "Microsoft Corporation" - C:\WINDOWS\System32\shsvcs.dll

"Smart Card" (SCardSvr) - "Microsoft Corporation" - C:\WINDOWS\System32\SCardSvr.exe

"SSDP Discovery Service" (SSDPSRV) - "Microsoft Corporation" - C:\WINDOWS\System32\ssdpsrv.dll

"System Event Notification" (SENS) - "Microsoft Corporation" - C:\WINDOWS\system32\sens.dll

"System Restore Service" (srservice) - "Microsoft Corporation" - C:\WINDOWS\system32\srsvc.dll

"Task Scheduler" (Schedule) - "Microsoft Corporation" - C:\WINDOWS\system32\schedsvc.dll

"TCP/IP NetBIOS Helper" (LmHosts) - "Microsoft Corporation" - C:\WINDOWS\System32\lmhsvc.dll

"Telephony" (TapiSrv) - "Microsoft Corporation" - C:\WINDOWS\System32\tapisrv.dll

"Telnet" (TlntSvr) - "Microsoft Corporation" - C:\WINDOWS\system32\tlntsvr.exe

"Terminal Services" (TermService) - "Microsoft Corporation" - C:\WINDOWS\System32\termsrv.dll

"Themes" (Themes) - "Microsoft Corporation" - C:\WINDOWS\System32\shsvcs.dll

"TipCtrl" (TipCtrl) - ? - "C:\Program Files\uTIPu\TipCtrl.exe"  (File not found)

"Uninterruptible Power Supply" (UPS) - "Microsoft Corporation" - C:\WINDOWS\System32\ups.exe

"Universal Plug and Play Device Host" (upnphost) - "Microsoft Corporation" - C:\WINDOWS\System32\upnphost.dll

"Volume Shadow Copy" (VSS) - "Microsoft Corporation" - C:\WINDOWS\System32\vssvc.exe

"WebClient" (WebClient) - "Microsoft Corporation" - C:\WINDOWS\System32\webclnt.dll

"Windows Audio" (AudioSrv) - "Microsoft Corporation" - C:\WINDOWS\System32\audiosrv.dll

"Windows Firewall/Internet Connection Sharing (ICS)" (SharedAccess) - "Microsoft Corporation" - C:\WINDOWS\System32\ipnathlp.dll

"Windows Image Acquisition (WIA)" (stisvc) - "Microsoft Corporation" - C:\WINDOWS\system32\wiaservc.dll

"Windows Installer" (MSIServer) - "Microsoft Corporation" - C:\WINDOWS\system32\msiexec.exe

"Windows Management Instrumentation" (winmgmt) - "Microsoft Corporation" - C:\WINDOWS\system32\wbem\WMIsvc.dll

"Windows Management Instrumentation Driver Extensions" (Wmi) - "Microsoft Corporation" - C:\WINDOWS\System32\advapi32.dll

"Windows Time" (W32Time) - "Microsoft Corporation" - C:\WINDOWS\system32\w32time.dll

"Wired AutoConfig" (Dot3svc) - "Microsoft Corporation" - C:\WINDOWS\System32\dot3svc.dll

"Wireless Zero Configuration" (WZCSVC) - "Microsoft Corporation" - C:\WINDOWS\System32\wzcsvc.dll

"WMI Performance Adapter" (WmiApSrv) - "Microsoft Corporation" - C:\WINDOWS\system32\wbem\wmiapsrv.exe

"Workstation" (lanmanworkstation) - "Microsoft Corporation" - C:\WINDOWS\System32\wkssvc.dll

"XAMPP Service" (XAMPP) - ? - C:\xampp\service.exe  (File not found)
 

[Winlogon]

-----( HKCU\Control Panel\Desktop )-----

"SCRNSAVE.EXE" - "Microsoft Corporation" - C:\WINDOWS\System32\logon.scr

-----( HKCU\Control Panel\IOProcs )-----

"MVB" - ? - mvfs32.dll  (File not found)

-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon )-----

"UIHost" - "Microsoft Corporation" - C:\WINDOWS\system32\logonui.exe

"VmApplet" - "Microsoft Corporation" - C:\WINDOWS\system32\sysdm.cpl

-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions )-----

{B587E2B1-4D59-4e7e-AED9-22B9DF11D053} "802.3 Group Policy" - "Microsoft Corporation" - C:\WINDOWS\system32\dot3gpclnt.dll

{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A} "EFS recovery" - "Microsoft Corporation" - C:\WINDOWS\system32\scecli.dll

{25537BA6-77A8-11D2-9B6C-0000F8080861} "Folder Redirection" - "Microsoft Corporation" - C:\WINDOWS\system32\fdeploy.dll

{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B} "Internet Explorer Branding" - "Microsoft Corporation" - C:\WINDOWS\system32\iedkcs32.dll

{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3} "Internet Explorer Zonemapping" - "Microsoft Corporation" - C:\WINDOWS\system32\iedkcs32.dll

{e437bc1c-aa7d-11d2-a382-00c04f991e27} "IP Security" - "Microsoft Corporation" - C:\WINDOWS\system32\gptext.dll

{3610eda5-77ef-11d2-8dc5-00c04fa31a66} "Microsoft Disk Quota" - "Microsoft Corporation" - C:\WINDOWS\system32\dskquota.dll

{C631DF4C-088F-4156-B058-4375F0853CD8} "Microsoft Offline Files" - "Microsoft Corporation" - C:\WINDOWS\System32\cscui.dll

{426031c0-0b47-4852-b0ca-ac3d37bfcb39} "QoS Packet Scheduler" - "Microsoft Corporation" - C:\WINDOWS\system32\gptext.dll

{42B5FAAE-6536-11d2-AE5A-0000F87571E3} "Scripts" - "Microsoft Corporation" - C:\WINDOWS\system32\gptext.dll

{827D319E-6EAC-11D2-A4EA-00C04F79F83A} "Security" - "Microsoft Corporation" - C:\WINDOWS\system32\scecli.dll

{c6dc5466-785a-11d2-84d0-00c04fb169f7} "Software Installation" - "Microsoft Corporation" - C:\WINDOWS\system32\appmgmts.dll

{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63} "Wireless" - "Microsoft Corporation" - C:\WINDOWS\system32\gptext.dll

-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----

"AtiExtEvent" - "ATI Technologies Inc." - C:\WINDOWS\system32\Ati2evxx.dll

"crypt32chain" - "Microsoft Corporation" - C:\WINDOWS\system32\crypt32.dll

"cryptnet" - "Microsoft Corporation" - C:\WINDOWS\system32\cryptnet.dll

"cscdll" - "Microsoft Corporation" - C:\WINDOWS\system32\cscdll.dll

"dimsntfy" - "Microsoft Corporation" - C:\WINDOWS\System32\dimsntfy.dll

"ScCertProp" - "Microsoft Corporation" - C:\WINDOWS\system32\wlnotify.dll

"Schedule" - "Microsoft Corporation" - C:\WINDOWS\system32\wlnotify.dll

"sclgntfy" - "Microsoft Corporation" - C:\WINDOWS\system32\sclgntfy.dll

"SensLogn" - "Microsoft Corporation" - C:\WINDOWS\system32\WlNotify.dll

"termsrv" - "Microsoft Corporation" - C:\WINDOWS\system32\wlnotify.dll

"wlballoon" - "Microsoft Corporation" - C:\WINDOWS\system32\wlnotify.dll
 

[Winsock Providers]

-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----

"Network Location Awareness (NLA) Namespace" - "Microsoft Corporation" - C:\WINDOWS\System32\mswsock.dll

"NTDS" - "Microsoft Corporation" - C:\WINDOWS\System32\winrnr.dll

"Tcpip" - "Microsoft Corporation" - C:\WINDOWS\System32\mswsock.dll

-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries )-----

"MSAFD Irda [IrDA]" - "Microsoft Corporation" - C:\WINDOWS\system32\mswsock.dll

"MSAFD NetBIOS [\Device\NetBT_Tcpip_{07974B52-E0B2-467B-8F89-1274A6046C9F}] DATAGRAM 6" - "Microsoft Corporation" - C:\WINDOWS\system32\mswsock.dll

"MSAFD NetBIOS [\Device\NetBT_Tcpip_{07974B52-E0B2-467B-8F89-1274A6046C9F}] SEQPACKET 6" - "Microsoft Corporation" - C:\WINDOWS\system32\mswsock.dll

"MSAFD NetBIOS [\Device\NetBT_Tcpip_{0B9C5207-C49E-4934-B94B-7F1A7D231CD7}] DATAGRAM 0" - "Microsoft Corporation" - C:\WINDOWS\system32\mswsock.dll

"MSAFD NetBIOS [\Device\NetBT_Tcpip_{0B9C5207-C49E-4934-B94B-7F1A7D231CD7}] SEQPACKET 0" - "Microsoft Corporation" - C:\WINDOWS\system32\mswsock.dll

"MSAFD NetBIOS [\Device\NetBT_Tcpip_{15F8D7AF-5DE1-44EE-AC27-AF2DDE2BB640}] DATAGRAM 8" - "Microsoft Corporation" - C:\WINDOWS\system32\mswsock.dll

"MSAFD NetBIOS [\Device\NetBT_Tcpip_{15F8D7AF-5DE1-44EE-AC27-AF2DDE2BB640}] SEQPACKET 8" - "Microsoft Corporation" - C:\WINDOWS\system32\mswsock.dll

"MSAFD NetBIOS [\Device\NetBT_Tcpip_{49914E6B-9F49-48B0-A097-5E9E6CC6C641}] DATAGRAM 4" - "Microsoft Corporation" - C:\WINDOWS\system32\mswsock.dll

"MSAFD NetBIOS [\Device\NetBT_Tcpip_{49914E6B-9F49-48B0-A097-5E9E6CC6C641}] SEQPACKET 4" - "Microsoft Corporation" - C:\WINDOWS\system32\mswsock.dll

"MSAFD NetBIOS [\Device\NetBT_Tcpip_{7E62BA3A-6C0C-4009-A4BF-259D6D0C2DE4}] DATAGRAM 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mswsock.dll

"MSAFD NetBIOS [\Device\NetBT_Tcpip_{7E62BA3A-6C0C-4009-A4BF-259D6D0C2DE4}] SEQPACKET 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mswsock.dll

"MSAFD NetBIOS [\Device\NetBT_Tcpip_{811B27A2-641D-43AA-A243-0720A4F061EE}] DATAGRAM 7" - "Microsoft Corporation" - C:\WINDOWS\system32\mswsock.dll

"MSAFD NetBIOS [\Device\NetBT_Tcpip_{811B27A2-641D-43AA-A243-0720A4F061EE}] SEQPACKET 7" - "Microsoft Corporation" - C:\WINDOWS\system32\mswsock.dll

"MSAFD NetBIOS [\Device\NetBT_Tcpip_{83622F88-46EE-4CDC-A746-299ECF62BD50}] DATAGRAM 3" - "Microsoft Corporation" - C:\WINDOWS\system32\mswsock.dll

"MSAFD NetBIOS [\Device\NetBT_Tcpip_{83622F88-46EE-4CDC-A746-299ECF62BD50}] SEQPACKET 3" - "Microsoft Corporation" - C:\WINDOWS\system32\mswsock.dll

"MSAFD NetBIOS [\Device\NetBT_Tcpip_{D22F3642-578E-4DFE-8BE9-91F5450C00DF}] DATAGRAM 5" - "Microsoft Corporation" - C:\WINDOWS\system32\mswsock.dll

"MSAFD NetBIOS [\Device\NetBT_Tcpip_{D22F3642-578E-4DFE-8BE9-91F5450C00DF}] SEQPACKET 5" - "Microsoft Corporation" - C:\WINDOWS\system32\mswsock.dll

"MSAFD NetBIOS [\Device\NetBT_Tcpip_{EEFE1A3A-CBB3-4D5F-9CD2-3259C9E6B366}] DATAGRAM 2" - "Microsoft Corporation" - C:\WINDOWS\system32\mswsock.dll

"MSAFD NetBIOS [\Device\NetBT_Tcpip_{EEFE1A3A-CBB3-4D5F-9CD2-3259C9E6B366}] SEQPACKET 2" - "Microsoft Corporation" - C:\WINDOWS\system32\mswsock.dll

"MSAFD Tcpip [RAW/IP]" - "Microsoft Corporation" - C:\WINDOWS\system32\mswsock.dll

"MSAFD Tcpip [TCP/IP]" - "Microsoft Corporation" - C:\WINDOWS\system32\mswsock.dll

"MSAFD Tcpip [UDP/IP]" - "Microsoft Corporation" - C:\WINDOWS\system32\mswsock.dll

"RSVP TCP Service Provider" - "Microsoft Corporation" - C:\WINDOWS\system32\rsvpsp.dll

"RSVP UDP Service Provider" - "Microsoft Corporation" - C:\WINDOWS\system32\rsvpsp.dll
 

===[ Logfile end ]=========================================[ Logfile end ]===
 

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

MBR-Chech-log

Code:

MBRCheck, version 1.2.3

(c) 2010, AD
 

Command-line:                        

Windows Version:                Windows XP Professional

Windows Information:                Service Pack 3 (build 2600)

Logical Drives Mask:                0x0000007c
 

Kernel Drivers (total 131):

  0x804D7000 \WINDOWS\system32\ntoskrnl.exe

  0x806FF000 \WINDOWS\system32\hal.dll

  0xF7987000 \WINDOWS\system32\KDCOM.DLL

  0xF7897000 \WINDOWS\system32\BOOTVID.dll

  0xF7366000 sphh.sys

  0xF7989000 \WINDOWS\System32\Drivers\WMILIB.SYS

  0xF734E000 \WINDOWS\System32\Drivers\SCSIPORT.SYS

  0xF7320000 ACPI.sys

  0xF730F000 pci.sys

  0xF7487000 ohci1394.sys

  0xF7497000 \WINDOWS\system32\DRIVERS\1394BUS.SYS

  0xF74A7000 isapnp.sys

  0xF7A4F000 pciide.sys

  0xF7707000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS

  0xF74B7000 MountMgr.sys

  0xF72F0000 ftdisk.sys

  0xF798B000 dmload.sys

  0xF72CA000 dmio.sys

  0xF770F000 PartMgr.sys

  0xF74C7000 VolSnap.sys

  0xF72B2000 atapi.sys

  0xF7298000 jraid.sys

  0xF74D7000 disk.sys

  0xF74E7000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS

  0xF7278000 fltMgr.sys

  0xF7266000 sr.sys

  0xF74F7000 PxHelp20.sys

  0xF724F000 KSecDD.sys

  0xF71C2000 Ntfs.sys

  0xF7195000 NDIS.sys

  0xF789B000 speedfan.sys

  0xF717B000 Mup.sys

  0xF7A50000 giveio.sys

  0xF75A7000 \SystemRoot\system32\DRIVERS\intelppm.sys

  0xF652F000 \SystemRoot\system32\DRIVERS\ati2mtag.sys

  0xF651B000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS

  0xF64F3000 \SystemRoot\system32\DRIVERS\HDAudBus.sys

  0xF777F000 \SystemRoot\system32\DRIVERS\usbehci.sys

  0xF64CF000 \SystemRoot\system32\DRIVERS\USBPORT.SYS

  0xF64B2000 \SystemRoot\system32\DRIVERS\Rtenicxp.sys

  0xF75B7000 \SystemRoot\system32\DRIVERS\nic1394.sys

  0xF75C7000 \SystemRoot\system32\DRIVERS\serial.sys

  0xF69BE000 \SystemRoot\system32\DRIVERS\serenum.sys

  0xF75D7000 \SystemRoot\system32\DRIVERS\imapi.sys

  0xF75E7000 \SystemRoot\system32\DRIVERS\cdrom.sys

  0xF75F7000 \SystemRoot\system32\DRIVERS\redbook.sys

  0xF648F000 \SystemRoot\system32\DRIVERS\ks.sys

  0xF7607000 \SystemRoot\system32\DRIVERS\dfmirage.sys

  0xF7B49000 \SystemRoot\system32\DRIVERS\audstub.sys

  0xF7787000 \SystemRoot\system32\DRIVERS\rasirda.sys

  0xF778F000 \SystemRoot\system32\DRIVERS\TDI.SYS

  0xF7617000 \SystemRoot\system32\DRIVERS\rasl2tp.sys

  0xF7943000 \SystemRoot\system32\DRIVERS\ndistapi.sys

  0xF6478000 \SystemRoot\system32\DRIVERS\ndiswan.sys

  0xF6A6E000 \SystemRoot\system32\DRIVERS\raspppoe.sys

  0xF6A5E000 \SystemRoot\system32\DRIVERS\raspptp.sys

  0xF6467000 \SystemRoot\system32\DRIVERS\psched.sys

  0xF6A4E000 \SystemRoot\system32\DRIVERS\msgpc.sys

  0xF7797000 \SystemRoot\system32\DRIVERS\ptilink.sys

  0xF779F000 \SystemRoot\system32\DRIVERS\raspti.sys

  0xF6437000 \SystemRoot\system32\DRIVERS\rdpdr.sys

  0xF6A3E000 \SystemRoot\system32\DRIVERS\termdd.sys

  0xF77A7000 \SystemRoot\system32\DRIVERS\kbdclass.sys

  0xF77AF000 \SystemRoot\system32\DRIVERS\mouclass.sys

  0xF79CD000 \SystemRoot\system32\DRIVERS\swenum.sys

  0xF63D9000 \SystemRoot\system32\DRIVERS\update.sys

  0xF795B000 \SystemRoot\system32\DRIVERS\mssmbios.sys

  0xF6A2E000 \SystemRoot\system32\DRIVERS\usbhub.sys

  0xF79D1000 \SystemRoot\system32\DRIVERS\USBD.SYS

  0xF6A1E000 \SystemRoot\System32\Drivers\NDProxy.SYS

  0xAE499000 \SystemRoot\system32\drivers\AtiHdmi.sys

  0xAE475000 \SystemRoot\system32\drivers\portcls.sys

  0xF69DE000 \SystemRoot\system32\drivers\drmk.sys

  0xADF58000 \SystemRoot\system32\drivers\RtkHDAud.sys

  0xF79DF000 \SystemRoot\System32\Drivers\Fs_Rec.SYS

  0xF7BCA000 \SystemRoot\System32\Drivers\Null.SYS

  0xF79E1000 \SystemRoot\System32\Drivers\Beep.SYS

  0xF7817000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS

  0xF780F000 \SystemRoot\System32\drivers\vga.sys

  0xF79E5000 \SystemRoot\System32\Drivers\mnmdd.SYS

  0xF79E9000 \SystemRoot\System32\DRIVERS\RDPCDD.sys

  0xF7877000 \SystemRoot\System32\Drivers\Msfs.SYS

  0xF781F000 \SystemRoot\System32\Drivers\Npfs.SYS

  0xF69CA000 \SystemRoot\system32\DRIVERS\rasacd.sys

  0xAD9DF000 \SystemRoot\system32\DRIVERS\ipsec.sys

  0xAD986000 \SystemRoot\system32\DRIVERS\tcpip.sys

  0xAD95E000 \SystemRoot\system32\DRIVERS\netbt.sys

  0xAD938000 \SystemRoot\system32\DRIVERS\ipnat.sys

  0xF76B7000 \SystemRoot\system32\DRIVERS\wanarp.sys

  0xAD916000 \SystemRoot\System32\drivers\afd.sys

  0xF76D7000 \SystemRoot\system32\DRIVERS\netbios.sys

  0xF76E7000 \SystemRoot\system32\DRIVERS\arp1394.sys

  0xF7827000 \SystemRoot\system32\DRIVERS\ssmdrv.sys

  0xAD896000 \SystemRoot\system32\DRIVERS\rdbss.sys

  0xAD826000 \SystemRoot\system32\DRIVERS\mrxsmb.sys

  0xF7577000 \SystemRoot\System32\Drivers\Fips.SYS

  0xF776F000 \SystemRoot\system32\DRIVERS\usbccgp.sys

  0xADF54000 \SystemRoot\system32\DRIVERS\hidusb.sys

  0xADF00000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS

  0xAC493000 \SystemRoot\system32\DRIVERS\kbdhid.sys

  0xAC48B000 \SystemRoot\system32\DRIVERS\mouhid.sys

  0xA300F000 \SystemRoot\system32\DRIVERS\avipbb.sys

  0xA787E000 \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys

  0xA2FEB000 \SystemRoot\System32\Drivers\Fastfat.SYS

  0xA2FD3000 \SystemRoot\System32\Drivers\dump_atapi.sys

  0xA32A4000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS

  0xBF800000 \SystemRoot\System32\win32k.sys

  0xA3379000 \SystemRoot\System32\drivers\Dxapi.sys

  0xA40DD000 \SystemRoot\System32\watchdog.sys

  0xBF000000 \SystemRoot\System32\drivers\dxg.sys

  0xAB4FD000 \SystemRoot\System32\drivers\dxgthk.sys

  0xBF012000 \SystemRoot\System32\ati2dvag.dll

  0xBF060000 \SystemRoot\System32\ati2cqag.dll

  0xBF0FC000 \SystemRoot\System32\atikvmag.dll

  0xBF196000 \SystemRoot\System32\atiok3x2.dll

  0xBF1FC000 \SystemRoot\System32\ati3duag.dll

  0xBF557000 \SystemRoot\System32\ativvaxx.dll

  0xBFFA0000 \SystemRoot\System32\ATMFD.DLL

  0xA05AD000 \SystemRoot\system32\DRIVERS\avgntflt.sys

  0xA0597000 \SystemRoot\system32\DRIVERS\irda.sys

  0xAC49B000 \SystemRoot\system32\DRIVERS\ndisuio.sys

  0xA04F2000 \SystemRoot\system32\DRIVERS\mrxdav.sys

  0xA0450000 \SystemRoot\system32\DRIVERS\srv.sys

  0xAA032000 \SystemRoot\system32\DRIVERS\secdrv.sys

  0xA03C3000 \SystemRoot\system32\drivers\wdmaud.sys

  0xAA072000 \SystemRoot\system32\drivers\sysaudio.sys

  0xA003A000 \SystemRoot\System32\Drivers\HTTP.sys

  0x9FFBA000 \SystemRoot\System32\Drivers\Cdfs.SYS

  0x9FDBD000 \SystemRoot\system32\drivers\kmixer.sys

  0xF77EF000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS

  0x7C900000 \WINDOWS\system32\ntdll.dll
 

Processes (total 32):

       0 System Idle Process

       4 System

     756 C:\WINDOWS\system32\smss.exe

     812 csrss.exe

     848 C:\WINDOWS\system32\winlogon.exe

     892 C:\WINDOWS\system32\services.exe

     904 C:\WINDOWS\system32\lsass.exe

    1104 C:\WINDOWS\system32\ati2evxx.exe

    1124 C:\WINDOWS\system32\svchost.exe

    1192 svchost.exe

    1240 C:\WINDOWS\system32\svchost.exe

    1332 svchost.exe

    1360 svchost.exe

    1476 C:\WINDOWS\system32\ati2evxx.exe

    1616 C:\WINDOWS\system32\brsvc01a.exe

    1632 C:\WINDOWS\system32\brss01a.exe

    1640 C:\WINDOWS\system32\spoolsv.exe

    1756 C:\WINDOWS\system32\svchost.exe

    1796 C:\Program Files\Java\jre6\bin\jqs.exe

    1832 C:\xampp\mysql\bin\mysqld.exe

    1856 C:\Program Files\CDBurnerXP\NMSAccessU.exe

    1972 C:\WINDOWS\system32\svchost.exe

     540 C:\WINDOWS\system32\wscntfy.exe

     396 C:\WINDOWS\explorer.exe

    1592 alg.exe

    1868 C:\WINDOWS\RTHDCPL.EXE

    1900 C:\Program Files\Common Files\Java\Java Update\jusched.exe

    1904 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

    2132 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

    3600 C:\WINDOWS\system32\svchost.exe

    3596 C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32Info.exe

    1884 C:\Documents and Settings\Martin\Desktop\MBRCheck.exe
 

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00  (NTFS)

\\.\F: --> \\.\PhysicalDrive0 at offset 0x0000000c`34f34a00  (NTFS)

\\.\G: --> \\.\PhysicalDrive0 at offset 0x00000074`5df7b400  (FAT32)
 

PhysicalDrive0 Model Number: ST3500418AS, Rev: CC37    
 

      Size  Device Name          MBR Status

  --------------------------------------------

    465 GB  \\.\PhysicalDrive0   Windows XP MBR code detected

            SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A
 
 

Done!

Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Leider oder zum Glück weitere Viren gefunden.

Ein Fehler den ich evtl begangen habe: Die Programme lade ich alle
über ein notebook runter um sie dann per usb-stick auf dem
infizierten rechner zu übertragen. Da die Programme teilweise
updates brauchten, bin ich (für 1-2 min.) ohne Schutz ins Internet gegangen, aber ohne den Browser oder sonst etwas zu öffnen.

malwarebytes-log:

Code:

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org
 

Database version: 6683
 

Windows 5.1.2600 Service Pack 3

Internet Explorer 6.0.2900.5512
 

5/26/2011 3:05:49 PM

mbam-log-2011-05-26 (15-05-49).txt
 

Scan type: Full scan (C:\|F:\|G:\|)

Objects scanned: 313513

Time elapsed: 2 hour(s), 16 minute(s), 30 second(s)
 

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0
 

Memory Processes Infected:

(No malicious items detected)
 

Memory Modules Infected:

(No malicious items detected)
 

Registry Keys Infected:

(No malicious items detected)
 

Registry Values Infected:

(No malicious items detected)
 

Registry Data Items Infected:

(No malicious items detected)
 

Folders Infected:

(No malicious items detected)
 

Files Infected:

(No malicious items detected)

Super-Anti-Spyware-log

Code:

SUPERAntiSpyware Scan Log

hxxp://www.superantispyware.com
 

Generated 05/26/2011 at 06:15 PM
 

Application Version : 4.53.1000
 

Core Rules Database Version : 7144

Trace Rules Database Version: 4956
 

Scan type       : Complete Scan

Total Scan Time : 02:37:11
 

Memory items scanned      : 507

Memory threats detected   : 0

Registry items scanned    : 5627

Registry threats detected : 0

File items scanned        : 200521

File threats detected     : 30
 

Adware.Tracking Cookie

        account.goodgamestudios.com [ C:\Documents and Settings\Martin\Application Data\Macromedia\Flash Player\#SharedObjects\CYY4XYQF ]

        adserv.quality-channel.de [ C:\Documents and Settings\Martin\Application Data\Macromedia\Flash Player\#SharedObjects\CYY4XYQF ]

        akamai.smartadserver.com [ C:\Documents and Settings\Martin\Application Data\Macromedia\Flash Player\#SharedObjects\CYY4XYQF ]

        banners.securedataimages.com [ C:\Documents and Settings\Martin\Application Data\Macromedia\Flash Player\#SharedObjects\CYY4XYQF ]

        broadcast.piximedia.fr [ C:\Documents and Settings\Martin\Application Data\Macromedia\Flash Player\#SharedObjects\CYY4XYQF ]

        cdn-www.pornhub.com [ C:\Documents and Settings\Martin\Application Data\Macromedia\Flash Player\#SharedObjects\CYY4XYQF ]

        cdn.eyewonder.com [ C:\Documents and Settings\Martin\Application Data\Macromedia\Flash Player\#SharedObjects\CYY4XYQF ]

        cdn.insights.gravity.com [ C:\Documents and Settings\Martin\Application Data\Macromedia\Flash Player\#SharedObjects\CYY4XYQF ]

        cdn1.eyewonder.com [ C:\Documents and Settings\Martin\Application Data\Macromedia\Flash Player\#SharedObjects\CYY4XYQF ]

        cdn4.specificclick.net [ C:\Documents and Settings\Martin\Application Data\Macromedia\Flash Player\#SharedObjects\CYY4XYQF ]

        cdn5.specificclick.net [ C:\Documents and Settings\Martin\Application Data\Macromedia\Flash Player\#SharedObjects\CYY4XYQF ]

        ec.atdmt.com [ C:\Documents and Settings\Martin\Application Data\Macromedia\Flash Player\#SharedObjects\CYY4XYQF ]

        games.mochimedia.com [ C:\Documents and Settings\Martin\Application Data\Macromedia\Flash Player\#SharedObjects\CYY4XYQF ]

        ia.media-imdb.com [ C:\Documents and Settings\Martin\Application Data\Macromedia\Flash Player\#SharedObjects\CYY4XYQF ]

        iolanda.urban-media-berlin.de [ C:\Documents and Settings\Martin\Application Data\Macromedia\Flash Player\#SharedObjects\CYY4XYQF ]

        macromedia.com [ C:\Documents and Settings\Martin\Application Data\Macromedia\Flash Player\#SharedObjects\CYY4XYQF ]

        media.kelbymediagroup.com [ C:\Documents and Settings\Martin\Application Data\Macromedia\Flash Player\#SharedObjects\CYY4XYQF ]

        media.mtvnservices.com [ C:\Documents and Settings\Martin\Application Data\Macromedia\Flash Player\#SharedObjects\CYY4XYQF ]

        media.scanscout.com [ C:\Documents and Settings\Martin\Application Data\Macromedia\Flash Player\#SharedObjects\CYY4XYQF ]

        media.whosay.com [ C:\Documents and Settings\Martin\Application Data\Macromedia\Flash Player\#SharedObjects\CYY4XYQF ]

        mediadb.kicker.de [ C:\Documents and Settings\Martin\Application Data\Macromedia\Flash Player\#SharedObjects\CYY4XYQF ]

        msnbcmedia.msn.com [ C:\Documents and Settings\Martin\Application Data\Macromedia\Flash Player\#SharedObjects\CYY4XYQF ]

        s0.2mdn.net [ C:\Documents and Settings\Martin\Application Data\Macromedia\Flash Player\#SharedObjects\CYY4XYQF ]

        secure-uk.imrworldwide.com [ C:\Documents and Settings\Martin\Application Data\Macromedia\Flash Player\#SharedObjects\CYY4XYQF ]

        secure-us.imrworldwide.com [ C:\Documents and Settings\Martin\Application Data\Macromedia\Flash Player\#SharedObjects\CYY4XYQF ]

        serving-sys.com [ C:\Documents and Settings\Martin\Application Data\Macromedia\Flash Player\#SharedObjects\CYY4XYQF ]

        swrmediathek.de [ C:\Documents and Settings\Martin\Application Data\Macromedia\Flash Player\#SharedObjects\CYY4XYQF ]

        www.ardmediathek.de [ C:\Documents and Settings\Martin\Application Data\Macromedia\Flash Player\#SharedObjects\CYY4XYQF ]

        www.naiadsystems.com [ C:\Documents and Settings\Martin\Application Data\Macromedia\Flash Player\#SharedObjects\CYY4XYQF ]

        www.secmedia.de [ C:\Documents and Settings\Martin\Application Data\Macromedia\Flash Player\#SharedObjects\CYY4XYQF ]

        
 

Trojan.Agent/Gen-Krpytik

        C:\SYSTEM VOLUME INFORMATION\_RESTORE{B83DA741-C247-48BC-B6D4-9FBFEAD0D7F8}\RP246\A0134399.EXE

ESET-Online-Scanner-log:(meine laienhafte Anmerkung: den Java-cache hatte ich bereits geleert)

Code:

ESETSmartInstaller@High as downloader log:

Can not open internetESETSmartInstaller@High as downloader log:

Can not open internet# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6427

# api_version=3.0.2

# EOSSerial=703000d463dfef489f193f88f8f8eefa

# end=finished

# remove_checked=true

# archives_checked=false

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2011-05-26 08:22:18

# local_time=2011-05-26 10:22:18 (+0100, W. Europe Standard Time)

# country="Germany"

# lang=1033

# osver=5.1.2600 NT Service Pack 3

# compatibility_mode=512 16777215 100 0 0 0 0 0

# compatibility_mode=1797 16774106 100 93 201125 65526325 0 0

# compatibility_mode=3073 16777214 0 7 115189 115194 0 0

# compatibility_mode=8192 67108863 100 0 434 434 0 0

# scanned=171149

# found=2

# cleaned=2

# scan_time=8107

C:\Documents and Settings\Martin\Application Data\Sun\Java\Deployment\cache\6.0\12\3cc664c-6c7ae634.vir        a variant of Java/Exploit.CVE-2010-4452.A trojan (cleaned by deleting - quarantined)        00000000000000000000000000000000        C

C:\Documents and Settings\Martin\Application Data\Sun\Java\Deployment\cache\6.0\56\30b8cfb8-638ae732.vir        a variant of Win32/Kryptik.NDO trojan (cleaned by deleting - quarantined)        00000000000000000000000000000000        C

Sieht ok aus, da wurden nur Cookies und ein paar temp. Überreste gefunden.
Noch Probleme oder weitere Funde in der Zwischenzeit?

Soweit ist alles in Ordnung. Vielen Dank.
Der Rechner kommt mir etwas langsam vor, aber ich muss da ohnehin mal etwas aufräumen.

Zitat:

Der Rechner kommt mir etwas langsam vor, aber ich muss da ohnehin mal etwas aufräumen.

Schau mal hier => http://www.trojaner-board.de/71631-p...samer-tun.html

Dann wären wir durch! :abklatsch:

Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.

Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update

PDF-Reader aktualisieren
Dein Adobe Reader ist nicht aktuell, was ein großes Sicherheitsrisiko darstellt. Du solltest daher besser die alte Version über Systemsteuerung => Software deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst.

Ich empfehle einen alternativen PDF-Reader wie SumatraPDF oder Foxit PDF Reader, beide sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers, hier der direkte Downloadlink:

Mozilla und andere Browser => http://filepony.de/?q=Flash+Player
Internet Explorer => http://fpdownload.adobe.com/get/flas..._player_ax.exe

Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

Werde ich machen. Vielen Dank für die tolle Hilfe.