Guten Abend,

meine Sicherheitssoftware "Avira AntiVir Personal" verweigert mir das öffnen von Outlook mit dem Hinweis, dass in der Outlook EXE das unerwünschte Programm "TR/Patched.57393" gefunden wurde.
Im Netz habe ich nichts über dieses Programm gefunden.
Nach Deaktivieren von AntiVir verhält sich mein Outlook anscheinend normal.
Was soll ich tun?
Kann ich noch Online-Banken?

Viele Grüsse und schon einmal Danke für eine eventuelle Antwort.

Tobias

Hallo und

Das wird wahrscheinlich ein Fehlalarm sein. Komplett den Virenscanner deaktivieren braucht man deswegen aber nicht, man kann auch bestimmte Dateien/Prozesse auf die Ignorierliste des Scanners setzen.


Bitte routinemäßig einen Vollscan mit Malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Danach OTL:

Systemscan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

• Doppelklick auf die OTL.exe
• Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
• Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
• Unter Extra Registry, wähle bitte Use SafeList
• Klicke nun auf Run Scan links oben
• Wenn der Scan beendet wurde werden 2 Logfiles erstellt
• Poste die Logfiles hier in den Thread.

Hi Arne,
vielen vielen Dank für Deine Hilfe!!!!!!!
Hier die Log-Datei:

Malwarebytes' Anti-Malware 1.46
Malwarebytes

Datenbank Version: 5067

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

07.11.2010 21:07:54
mbam-log-2010-11-07 (21-07-54).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|H:\|)
Durchsuchte Objekte: 409820
Laufzeit: 1 Stunde(n), 14 Minute(n), 58 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 2
Infizierte Verzeichnisse: 0
Infizierte Dateien: 6

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\Programme\Gemeinsame Dateien\Autodesk Shared\GIS\ImportExport\5.0\msvcirt.dll (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Programme\Gemeinsame Dateien\Autodesk Shared\GIS\ImportExport\5.0\msvcp60.dll (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Programme\Gemeinsame Dateien\Autodesk Shared\GIS\ImportExport\5.0\msvcrt.dll (Malware.Packer.Gen) -> Quarantined and deleted successfully.
D:\fr-041_debris.exe (Malware.Packer.Krunchy) -> Quarantined and deleted successfully.
C:\Programme\libmmd.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Programme\model.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.


Gruss Tobias









Und hier das 1. Logfile OTL (sehr gross, aber ich hau es mal vollständig rein, hoffentlich ist das richtig):

OTL Logfile:
OTL EXTRAS Logfile:

OTL logfile created on: 07.11.2010 21:15:26 - Run 1
OTL by OldTimer - Version 3.2.17.3     Folder = C:\Dokumente und Einstellungen\Administrator.VBARCHITEKTEN\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 79,00% Memory free
7,00 Gb Paging File | 6,00 Gb Available in Paging File | 91,00% Paging File free
Paging file location(s): C:\pagefile.sys 4092 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 51,97 Gb Total Space | 13,03 Gb Free Space | 25,07% Space Free | Partition Type: NTFS
Drive D: | 149,95 Gb Total Space | 109,94 Gb Free Space | 73,32% Space Free | Partition Type: NTFS
Drive H: | 30,96 Gb Total Space | 17,45 Gb Free Space | 56,35% Space Free | Partition Type: NTFS
 
Computer Name: TOBI-NEU | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Dokumente und Einstellungen\Administrator.VBARCHITEKTEN\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Programme\Skype\Toolbars\Shared\SkypeNames2.exe (Skype Technologies S.A.)
PRC - C:\WINDOWS\system32\M-AudioTaskBarIcon.exe (Avid Technology, Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Gemeinsame Dateien\Autodesk Shared\Service\AdskScSrv.exe (Autodesk)
PRC - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe (Nero AG)
PRC - C:\Programme\WinZip\WZQKPICK.EXE (WinZip Computing, Inc.)
PRC - C:\Programme\Adobe\Acrobat 5.0\Distillr\AcroTray.exe (Adobe Systems Inc.)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Dokumente und Einstellungen\Administrator.VBARCHITEKTEN\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (HidServ) -- C:\WINDOWS\System32\hidserv.dll File not found
SRV - (Automatisches LiveUpdate - Scheduler) -- C:\Programme\Symantec\LiveUpdate\ALUSchedulerSvc.exe File not found
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (Autodesk Licensing Service) -- C:\Programme\Gemeinsame Dateien\Autodesk Shared\Service\AdskScSrv.exe (Autodesk)
SRV - (mi-raysat_3dsMax2008_32) -- C:\Programme\Autodesk\3ds Max 2008\mentalray\satellite\raysat_3dsMax2008_32server.exe ()
SRV - (mi-raysat_3dsmax9_32) mental ray 3.5 Satellite (32-bit) -- C:\Programme\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe ()
 
 
========== Driver Services (SafeList) ==========
 
DRV - (DS1410D) -- C:\WINDOWS\System32\drivers\ds1410d.sys File not found
DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (HDAudBus) -- C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows (R) Server 2003 DDK provider)
DRV - (MAUSBRI) -- C:\WINDOWS\system32\drivers\mausbftu.sys (Avid Technology, Inc.)
DRV - (hardlock) -- C:\WINDOWS\system32\drivers\hardlock.sys (Aladdin Knowledge Systems)
DRV - (Haspnt) -- C:\WINDOWS\system32\drivers\Haspnt.sys (Aladdin Knowledge Systems)
DRV - (pfc) -- C:\WINDOWS\system32\drivers\pfc.sys (Padus, Inc.)
DRV - (snapman) -- C:\WINDOWS\system32\DRIVERS\snapman.sys (Acronis)
DRV - (hwinterface) -- C:\WINDOWS\system32\drivers\hwinterface.sys (Logix4u)
DRV - (nv) -- C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (RTL8023xp) -- C:\WINDOWS\system32\drivers\Rtnicxp.sys (Realtek Semiconductor Corporation                           )
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\system32\drivers\RtkHDAud.Sys (Realtek Semiconductor Corp.)
DRV - (nvcap) nVidia WDM Video Capture (universal) -- C:\WINDOWS\system32\drivers\NVCAP.SYS (NVIDIA Corporation)
DRV - (NVXBAR) -- C:\WINDOWS\system32\drivers\NVXBAR.SYS (NVIDIA Corporation)
DRV - (HdAudAddService) -- C:\WINDOWS\system32\drivers\Hdaudio.sys (Windows (R) Server 2003 DDK provider)
DRV - (MTsensor) -- C:\WINDOWS\system32\drivers\ASACPI.sys ()
DRV - (MagixASIODrv) -- C:\Programme\Magix\Sequoia7\mxasio.sys (MAGIX AG)
DRV - (ASAPIW2k) -- C:\WINDOWS\system32\drivers\asapiW2k.sys (Pinnacle Systems GmbH)
DRV - (Sentinel) -- C:\WINDOWS\System32\Drivers\SENTINEL.SYS (Rainbow Technologies, Inc.)
DRV - (Sntnlusb) -- C:\WINDOWS\system32\drivers\SNTNLUSB.SYS (Rainbow Technologies Inc.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
O1 HOSTS File: ([2006.02.28 13:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (EWPBrowseObject Class) - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Programme\Canon\Easy-WebPrint\EWPBrowseLoader.dll ()
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (CNisExtBho Class) - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Programme\Gemeinsame Dateien\Symantec Shared\AdBlocking\NISShExt.dll File not found
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll (Google Inc.)
O2 - BHO: (CNavExtBho Class) - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programme\Norton Internet Security\Norton AntiVirus\NavShExt.dll File not found
O3 - HKLM\..\Toolbar: (Easy-WebPrint) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programme\Canon\Easy-WebPrint\Toolband.dll ()
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\ShellBrowser: (Norton AntiVirus) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programme\Norton Internet Security\Norton AntiVirus\NavShExt.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Internet Security) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - C:\Programme\Gemeinsame Dateien\Symantec Shared\AdBlocking\NISShExt.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (Norton AntiVirus) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programme\Norton Internet Security\Norton AntiVirus\NavShExt.dll File not found
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [Easy-PrintToolBox] C:\Programme\Canon\Easy-PrintToolBox\BJPSMAIN.EXE (CANON INC.)
O4 - HKLM..\Run: [High Definition Audio Property Page Shortcut] C:\WINDOWS\System32\HdAShCut.exe (Windows (R) Server 2003 DDK provider)
O4 - HKLM..\Run: [ Malwarebytes Anti-Malware  (reboot)] C:\Programme\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [M-Audio Taskbar Icon] C:\WINDOWS\system32\M-AudioTaskBarIcon.exe (Avid Technology, Inc.)
O4 - HKLM..\Run: [NeroFilterCheck] c:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe ()
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre6\bin\jusched.exe File not found
O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] c:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe (Nero AG)
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Acrobat Assistant.lnk = C:\Programme\Adobe\Acrobat 5.0\Distillr\AcroTray.exe (Adobe Systems Inc.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Gamma Loader.exe.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\WinZip Quick Pick.lnk = C:\Programme\WinZip\WZQKPICK.EXE (WinZip Computing, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWelcomeScreen = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre6\bin\npjpi160_21.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} https://components.viewpoint.com/adobe/MTSInstallers/MetaStream3.cab?url=hxxp://www.ub.uni-bielefeld.de/help/rundgang/pagetoworlddsl.html (MetaStreamCtl Class)
O16 - DPF: {402EE96E-2CE8-482D-ADA5-CECEEA07E16D} hxxp://www.turntool.com/ViewerInstall.exe (TurnTool Scene)
O16 - DPF: {86A88967-7A20-11D2-8EDA-00600818EDB1} hxxp://www.parallelgraphics.com/l2/bin/cortvrml.cab (ParallelGraphics Cortona Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = VBarchitekten.local
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Administrator.VBARCHITEKTEN\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Administrator.VBARCHITEKTEN\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007.11.13 12:41:00 | 041,617,336 | ---- | M] () - C:\AutoCAD_CD.zip -- [ NTFS ]
O32 - AutoRun File - [2007.02.05 23:09:00 | 000,000,000 | ---D | M] - C:\autodesk -- [ NTFS ]
O32 - AutoRun File - [2006.08.20 14:51:22 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.11.07 21:13:28 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Administrator.VBARCHITEKTEN\Desktop\OTL.exe
[2010.11.07 19:47:39 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator.VBARCHITEKTEN\Anwendungsdaten\Malwarebytes
[2010.11.07 19:47:33 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010.11.07 19:47:31 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010.11.07 19:47:31 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2010.11.07 19:47:31 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2010.10.23 20:49:11 | 000,974,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mfc42.dll
[2010.10.23 20:49:11 | 000,953,856 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mfc40u.dll
[2010.10.23 20:49:04 | 000,617,472 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\comctl32.dll
[2004.12.06 03:12:24 | 000,131,072 | ---- | C] (Info-ZIP) -- C:\Programme\zip32.dll
[2004.12.06 03:12:24 | 000,036,864 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\zlibdll.dll
[2004.12.06 03:12:22 | 000,272,896 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\viz.dll
[2004.12.06 03:12:22 | 000,151,552 | ---- | C] (Info-ZIP) -- C:\Programme\unzip32.dll
[2004.12.06 03:12:22 | 000,016,896 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\UIControls.dll
[2004.12.06 03:12:22 | 000,010,752 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\undomgr.dll
[2004.12.06 03:12:22 | 000,010,240 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\UndoBody.dll
[2004.12.06 03:12:22 | 000,007,168 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\viewfile.dll
[2004.12.06 03:12:18 | 000,028,727 | ---- | C] (Autodesk, Inc.) -- C:\Programme\texture7.dll
[2004.12.06 03:12:18 | 000,006,144 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\tessint.dll
[2004.12.06 03:12:06 | 001,238,016 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\Rm.dll
[2004.12.06 03:12:06 | 001,167,360 | ---- | C] (Havok) -- C:\Programme\rct_preview.dll
[2004.12.06 03:12:06 | 000,557,568 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\splash.dll
[2004.12.06 03:12:06 | 000,240,640 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\res3.dll
[2004.12.06 03:12:06 | 000,159,744 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\SendDmp.exe
[2004.12.06 03:12:06 | 000,120,320 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\senddmpRes.dll
[2004.12.06 03:12:06 | 000,110,592 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\res2.dll
[2004.12.06 03:12:06 | 000,096,256 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\Poly.dll
[2004.12.06 03:12:06 | 000,078,336 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\res1.dll
[2004.12.06 03:12:06 | 000,062,464 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\rtmax.dll
[2004.12.06 03:12:06 | 000,047,616 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\res5.dll
[2004.12.06 03:12:06 | 000,041,472 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\res6.dll
[2004.12.06 03:12:06 | 000,038,400 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\res4.dll
[2004.12.06 03:12:06 | 000,019,456 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\res7.dll
[2004.12.06 03:12:06 | 000,012,800 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\preminfo.dll
[2004.12.06 03:12:06 | 000,012,288 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\RenderUtil.dll
[2004.12.06 03:12:06 | 000,010,240 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\SaveFile.dll
[2004.12.06 03:12:06 | 000,008,704 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\resmgr.dll
[2004.12.06 03:12:06 | 000,007,680 | ---- | C] (Havok) -- C:\Programme\rct_registry.dll
[2004.12.06 03:12:06 | 000,006,144 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\res8.dll
[2004.12.06 03:12:06 | 000,006,144 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\res10.dll
[2004.12.06 03:12:02 | 000,974,848 | ---- | C] (Microsoft Corporation) -- C:\Programme\mfc70.dll
[2004.12.06 03:12:02 | 000,681,472 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\mesh.dll
[2004.12.06 03:12:02 | 000,649,728 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\MNMath.dll
[2004.12.06 03:12:02 | 000,499,712 | ---- | C] (Microsoft Corporation) -- C:\Programme\msvcp71.dll
[2004.12.06 03:12:02 | 000,495,376 | ---- | C] (Microsoft Corporation) -- C:\Programme\msxml.dll
[2004.12.06 03:12:02 | 000,487,424 | ---- | C] (Microsoft Corporation) -- C:\Programme\msvcp70.dll
[2004.12.06 03:12:02 | 000,348,160 | ---- | C] (Microsoft Corporation) -- C:\Programme\msvcr71.dll
[2004.12.06 03:12:02 | 000,344,064 | ---- | C] (Microsoft Corporation) -- C:\Programme\msvcr70.dll
[2004.12.06 03:12:02 | 000,226,304 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\Paramblk2.dll
[2004.12.06 03:12:02 | 000,090,112 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\oglgfx.drv
[2004.12.06 03:12:02 | 000,083,968 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\ParticleFlow.dll
[2004.12.06 03:12:02 | 000,072,192 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\MenuMan.dll
[2004.12.06 03:12:02 | 000,063,488 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\menus.dll
[2004.12.06 03:12:02 | 000,054,784 | ---- | C] (Microsoft Corporation) -- C:\Programme\msvci70.dll
[2004.12.06 03:12:02 | 000,045,568 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\ParamRollup.dll
[2004.12.06 03:12:02 | 000,032,819 | ---- | C] (Autodesk, Inc.) -- C:\Programme\mtl7.dll
[2004.12.06 03:12:02 | 000,029,696 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\particle.dll
[2004.12.06 03:12:02 | 000,010,240 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\nulgfx.drv
[2004.12.06 03:12:02 | 000,003,072 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\minidumpVer.dll
[2004.12.06 03:12:00 | 005,127,168 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\Maxscrpt.dll
[2004.12.06 03:12:00 | 003,592,192 | ---- | C] (mental images GmbH) -- C:\Programme\libray.dll
[2004.12.06 03:12:00 | 001,030,514 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\MaxSave.dll
[2004.12.06 03:12:00 | 000,132,608 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\lprd.dll
[2004.12.06 03:12:00 | 000,111,104 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\MaxNetWorker.dll
[2004.12.06 03:12:00 | 000,105,472 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\MaxFind.exe
[2004.12.06 03:12:00 | 000,103,424 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\maxnet.dll
[2004.12.06 03:12:00 | 000,097,280 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\lsrd.dll
[2004.12.06 03:12:00 | 000,093,184 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\lpwrt.dll
[2004.12.06 03:12:00 | 000,068,096 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\ManipSys.dll
[2004.12.06 03:12:00 | 000,059,904 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\max.task
[2004.12.06 03:12:00 | 000,055,808 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\MAXComponents.dll
[2004.12.06 03:12:00 | 000,035,840 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\maxutil.dll
[2004.12.06 03:12:00 | 000,013,824 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\maxzip.exe
[2004.12.06 03:12:00 | 000,012,288 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\maxunzip.exe
[2004.12.06 03:11:58 | 004,853,760 | ---- | C] (ITI) -- C:\Programme\libiges.dll
[2004.12.06 03:11:58 | 001,785,856 | ---- | C] (ITI) -- C:\Programme\libgdx.dll
[2004.12.06 03:11:58 | 001,622,016 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\libDLresmgt.dll
[2004.12.06 03:11:58 | 000,843,776 | ---- | C] (ITI) -- C:\Programme\libpdx.dll
[2004.12.06 03:11:58 | 000,770,048 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\libDLbase.dll
[2004.12.06 03:11:58 | 000,454,656 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\libDLprimitives.dll
[2004.12.06 03:11:58 | 000,352,256 | ---- | C] (Autodesk, Inc.) -- C:\Programme\liblint.dll
[2004.12.06 03:11:58 | 000,141,824 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\IGame.dll
[2004.12.06 03:11:58 | 000,097,280 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\libDLcomponentManager.dll
[2004.12.06 03:11:58 | 000,074,752 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\imageViewers.dll
[2004.12.06 03:11:58 | 000,065,024 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\libDLltutility.dll
[2004.12.06 03:11:58 | 000,057,344 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\libDLltgeometry.dll
[2004.12.06 03:11:58 | 000,035,448 | ---- | C] (Autodesk Inc.) -- C:\Programme\ieproxy16.dll
[2004.12.06 03:11:58 | 000,023,552 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\libDLmaxmgr.dll
[2004.12.06 03:11:58 | 000,005,632 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\libDLltutilityRes.dll
[2004.12.06 03:11:58 | 000,003,584 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\libDLltgeometryRes.dll
[2004.12.06 03:11:56 | 002,896,896 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\gmi.dll
[2004.12.06 03:11:56 | 001,645,320 | ---- | C] (Microsoft Corporation) -- C:\Programme\GdiPlus.dll
[2004.12.06 03:11:56 | 001,399,296 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\edmodel.dll
[2004.12.06 03:11:56 | 001,196,085 | ---- | C] (Autodesk, Inc.) -- C:\Programme\heidi7.dll
[2004.12.06 03:11:56 | 000,281,208 | ---- | C] (Autodesk, Inc.) -- C:\Programme\Ereg.dll
[2004.12.06 03:11:56 | 000,106,496 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\geom.dll
[2004.12.06 03:11:56 | 000,085,504 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\hrigfx.drv
[2004.12.06 03:11:56 | 000,045,568 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\geomimp.dll
[2004.12.06 03:11:56 | 000,036,352 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\expr.dll
[2004.12.06 03:11:56 | 000,027,648 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\gfx.dll
[2004.12.06 03:11:56 | 000,026,624 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\gcomm2.dll
[2004.12.06 03:11:56 | 000,023,040 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\flt.dll
[2004.12.06 03:11:56 | 000,018,008 | ---- | C] (Autodesk, Inc.) -- C:\Programme\EregRes.dll
[2004.12.06 03:11:56 | 000,011,776 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\gup.dll
[2004.12.06 03:11:56 | 000,009,728 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\helpsys.dll
[2004.12.06 03:11:54 | 005,270,528 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\core.dll
[2004.12.06 03:11:54 | 000,837,632 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\d3dgfx.drv
[2004.12.06 03:11:54 | 000,534,016 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\d3d81gfx.drv
[2004.12.06 03:11:54 | 000,486,400 | ---- | C] (Microsoft Corporation) -- C:\Programme\dbghelp.dll
[2004.12.06 03:11:54 | 000,226,816 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\bmm.dll
[2004.12.06 03:11:54 | 000,139,264 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\composite.dll
[2004.12.06 03:11:54 | 000,094,208 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\CustDlg.dll
[2004.12.06 03:11:54 | 000,084,992 | ---- | C] (Microsoft Corporation) -- C:\Programme\Atl70.dll
[2004.12.06 03:11:54 | 000,017,920 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\DbxHost.dll
[2004.12.06 03:11:54 | 000,016,384 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\cfgmgr.dll
[2004.12.06 03:11:50 | 003,604,480 | ---- | C] (ATI Research Silicon Valley Inc.) -- C:\Programme\Ashli.dll
[2004.12.06 03:11:50 | 001,878,548 | ---- | C] (Autodesk, Inc.) -- C:\Programme\adlmdll.dll
[2004.12.06 03:11:50 | 000,349,392 | ---- | C] (Lassalle Technologies) -- C:\Programme\addflow4.ocx
[2004.12.06 03:11:50 | 000,300,032 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\Amodeler.dll
[2004.12.06 03:11:50 | 000,223,864 | ---- | C] (Autodesk, Inc.) -- C:\Programme\acismobj16.dbx
[2004.12.06 03:11:50 | 000,104,448 | ---- | C] (Microsoft Corporation) -- C:\Programme\apphelp.dll
[2004.12.06 03:11:50 | 000,083,032 | ---- | C] (Autodesk, Inc.) -- C:\Programme\adlmres.dll
[2004.12.06 03:11:48 | 005,149,696 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\3dsmax.exe
[2004.12.06 03:11:48 | 000,130,560 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\3dsmaxcmd.exe
[2004.12.06 03:11:48 | 000,033,280 | ---- | C] (Discreet, a division of Autodesk, Inc.) -- C:\Programme\acap.dll
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2010.11.07 21:13:57 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Administrator.VBARCHITEKTEN\Desktop\OTL.exe
[2010.11.07 21:08:01 | 000,054,016 | ---- | M] () -- C:\WINDOWS\System32\drivers\jpfqkg.sys
[2010.11.07 21:00:01 | 000,001,088 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010.11.07 20:52:00 | 000,001,268 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-440697230-2017256689-3412847667-500UA.job
[2010.11.07 19:47:35 | 000,000,676 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.11.07 19:40:24 | 000,080,944 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2010.11.07 19:40:19 | 000,001,170 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010.11.07 19:40:19 | 000,001,084 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010.11.07 19:35:05 | 000,001,044 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2010.11.07 19:34:43 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.11.07 19:34:41 | 3354,644,480 | -HS- | M] () -- C:\hiberfil.sys
[2010.11.04 21:52:00 | 000,001,216 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-440697230-2017256689-3412847667-500Core.job
[2010.11.04 19:49:03 | 000,126,856 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys
[2010.11.04 19:49:03 | 000,060,936 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntflt.sys
[2010.10.31 12:38:00 | 000,458,904 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2010.10.31 12:38:00 | 000,441,112 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010.10.31 12:38:00 | 000,084,746 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2010.10.31 12:38:00 | 000,071,430 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010.10.24 21:00:47 | 001,507,910 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator.VBARCHITEKTEN\Desktop\Chalet.zip
[2010.10.24 11:09:41 | 000,002,526 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator.VBARCHITEKTEN\Desktop\Google Chrome.lnk
[2010.10.24 10:57:33 | 000,213,672 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010.10.24 01:20:10 | 000,001,393 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010.11.07 21:08:01 | 000,054,016 | ---- | C] () -- C:\WINDOWS\System32\drivers\jpfqkg.sys
[2010.11.07 19:47:35 | 000,000,676 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.10.24 21:00:47 | 001,507,910 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator.VBARCHITEKTEN\Desktop\Chalet.zip
[2010.05.05 17:37:18 | 000,000,000 | ---- | C] () -- C:\WINDOWS\WinInit.ini
[2009.10.01 09:36:07 | 000,000,000 | ---- | C] () -- C:\WINDOWS\webica.ini
[2009.07.12 20:43:30 | 000,000,568 | ---- | C] () -- C:\WINDOWS\Sequoia.INI
[2009.07.12 18:13:00 | 000,000,082 | ---- | C] () -- C:\WINDOWS\magix.ini
[2009.07.12 18:12:38 | 000,166,400 | ---- | C] () -- C:\WINDOWS\System32\wkwin32.DLL
[2009.07.12 18:12:38 | 000,000,887 | ---- | C] () -- C:\WINDOWS\mgxoschk.ini
[2008.04.01 20:48:48 | 000,000,231 | ---- | C] () -- C:\WINDOWS\System32\3dsmax.ini
[2008.04.01 20:48:48 | 000,000,043 | ---- | C] () -- C:\WINDOWS\System32\InstallSettings.ini
[2007.02.06 16:46:47 | 000,000,129 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator.VBARCHITEKTEN\Anwendungsdaten\WorkingFolders.xml
[2007.02.05 20:55:21 | 000,000,160 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator.VBARCHITEKTEN\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2006.10.03 22:33:59 | 000,000,383 | ---- | C] () -- C:\WINDOWS\System32\haspdos.sys
[2006.09.25 18:36:23 | 000,000,265 | ---- | C] () -- C:\Programme\d3dgfx.ini
[2006.09.20 20:44:21 | 000,000,151 | ---- | C] () -- C:\WINDOWS\PhotoSnapViewer.INI
[2006.09.18 12:25:47 | 000,001,376 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\QTSBandwidthCache
[2006.09.18 09:19:43 | 000,000,403 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2006.09.18 09:03:44 | 000,210,944 | ---- | C] () -- C:\WINDOWS\System32\Msvcrt10.dll
[2006.09.18 09:03:16 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\adistres.dll
[2006.09.16 18:35:15 | 000,000,064 | ---- | C] () -- C:\Programme\maxscrpt.dsk
[2006.09.16 18:32:37 | 000,000,000 | ---- | C] () -- C:\Programme\RtDxStdMtl2.log
[2006.09.16 18:19:33 | 000,009,885 | ---- | C] () -- C:\Programme\3dsmax.ini
[2006.09.16 18:19:33 | 000,000,298 | ---- | C] () -- C:\Programme\plugin.ini
[2006.09.12 16:28:19 | 000,084,992 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator.VBARCHITEKTEN\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006.09.12 15:15:38 | 000,037,888 | ---- | C] () -- C:\WINDOWS\System32\setupnt.dll
[2006.09.08 08:11:41 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2006.09.08 08:05:57 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2006.08.20 23:36:40 | 000,005,810 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASACPI.sys
[2006.08.20 23:36:40 | 000,002,480 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2006.08.20 23:36:34 | 000,755,200 | ---- | C] () -- C:\WINDOWS\System32\ir50_32.dll
[2006.08.20 23:36:34 | 000,338,432 | ---- | C] () -- C:\WINDOWS\System32\ir41_qcx.dll
[2006.08.20 23:36:34 | 000,200,192 | ---- | C] () -- C:\WINDOWS\System32\ir50_qc.dll
[2006.08.20 23:36:34 | 000,183,808 | ---- | C] () -- C:\WINDOWS\System32\ir50_qcx.dll
[2006.08.20 23:36:34 | 000,120,320 | ---- | C] () -- C:\WINDOWS\System32\ir41_qc.dll
[2006.08.20 15:46:11 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2006.08.20 15:15:58 | 000,135,168 | ---- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll
[2006.08.20 14:53:44 | 000,000,849 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2006.07.27 03:05:58 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2006.06.21 11:33:40 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\DivXWMPExtType.dll
[2006.06.01 10:22:00 | 001,662,976 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2006.06.01 10:22:00 | 001,470,464 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2006.06.01 10:22:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2006.06.01 10:22:00 | 000,581,632 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll
[2006.06.01 10:22:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2006.06.01 10:22:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2006.06.01 10:22:00 | 000,196,608 | ---- | C] () -- C:\WINDOWS\System32\nvapi.dll
[2004.12.08 16:26:32 | 000,636,424 | R--- | C] () -- C:\Programme\Readme.rtf
[2004.12.06 03:12:06 | 000,581,632 | ---- | C] () -- C:\Programme\splash.fla
[2004.12.06 03:12:06 | 000,133,930 | ---- | C] () -- C:\Programme\splash.swf
[2004.12.06 03:12:06 | 000,027,533 | ---- | C] () -- C:\Programme\splash.cfg
[2004.12.06 03:12:00 | 000,072,082 | ---- | C] () -- C:\Programme\maxscrpt.lcl
[2004.12.06 03:12:00 | 000,004,883 | ---- | C] () -- C:\Programme\max.tres
[2004.12.06 03:12:00 | 000,004,096 | ---- | C] () -- C:\Programme\MaxIges.msx
[2004.12.06 03:11:58 | 000,078,968 | ---- | C] () -- C:\Programme\iejfifrd80.dll
[2004.12.06 03:11:58 | 000,066,680 | ---- | C] () -- C:\Programme\iepngrd80.dll
[2004.12.06 03:11:58 | 000,054,904 | ---- | C] () -- C:\Programme\iejfifwr80.dll
[2004.12.06 03:11:58 | 000,054,392 | ---- | C] () -- C:\Programme\iepngwr80.dll
[2004.12.06 03:11:58 | 000,030,840 | ---- | C] () -- C:\Programme\ietiffrd80.dll
[2004.12.06 03:11:58 | 000,030,328 | ---- | C] () -- C:\Programme\ietiffwr80.dll
[2004.12.06 03:11:58 | 000,023,672 | ---- | C] () -- C:\Programme\iepictrd80.dll
[2004.12.06 03:11:58 | 000,023,160 | ---- | C] () -- C:\Programme\iespotrd80.dll
[2004.12.06 03:11:58 | 000,023,160 | ---- | C] () -- C:\Programme\ierlcrw80.dll
[2004.12.06 03:11:58 | 000,022,528 | ---- | C] () -- C:\Programme\IgesTrans.msx
[2004.12.06 03:11:58 | 000,019,576 | ---- | C] () -- C:\Programme\ieig4rd80.dll
[2004.12.06 03:11:58 | 000,019,064 | ---- | C] () -- C:\Programme\ieigsrd80.dll
[2004.12.06 03:11:58 | 000,018,432 | ---- | C] () -- C:\Programme\IgesLog.msx
[2004.12.06 03:11:58 | 000,017,528 | ---- | C] () -- C:\Programme\ietgard80.dll
[2004.12.06 03:11:58 | 000,016,504 | ---- | C] () -- C:\Programme\ieflicwr80.dll
[2004.12.06 03:11:58 | 000,014,456 | ---- | C] () -- C:\Programme\iepcxrd80.dll
[2004.12.06 03:11:58 | 000,013,432 | ---- | C] () -- C:\Programme\ietgawr80.dll
[2004.12.06 03:11:58 | 000,012,920 | ---- | C] () -- C:\Programme\iepcxwr80.dll
[2004.12.06 03:11:56 | 000,398,456 | ---- | C] () -- C:\Programme\ie80.dll
[2004.12.06 03:11:56 | 000,015,480 | ---- | C] () -- C:\Programme\ieflicrd80.dll
[2004.12.06 03:11:56 | 000,014,968 | ---- | C] () -- C:\Programme\iebmprd80.dll
[2004.12.06 03:11:56 | 000,013,432 | ---- | C] () -- C:\Programme\iecalsrd80.dll
[2004.12.06 03:11:56 | 000,013,432 | ---- | C] () -- C:\Programme\iebmpwr80.dll
[2004.12.06 03:11:56 | 000,012,920 | ---- | C] () -- C:\Programme\iecalswr80.dll
[2004.12.06 03:11:56 | 000,000,610 | ---- | C] () -- C:\Programme\hotkeyMap.html
[2004.12.06 03:11:54 | 000,069,632 | ---- | C] () -- C:\Programme\CdaLCDlg.dll
[2004.12.06 03:11:54 | 000,002,048 | ---- | C] () -- C:\Programme\DxTrans.msx
[2004.12.06 03:11:54 | 000,001,753 | ---- | C] () -- C:\Programme\B2A7B000plu250.cfg
[2004.12.06 03:11:54 | 000,000,148 | ---- | C] () -- C:\Programme\CrashHandler.ini
[2004.12.06 03:11:50 | 000,281,088 | ---- | C] () -- C:\Programme\AdskScInst.dll
[2004.12.06 03:11:50 | 000,032,447 | ---- | C] () -- C:\Programme\AdlmLog.xml
[2003.12.22 14:40:06 | 001,663,068 | ---- | C] () -- C:\WINDOWS\System32\libmmd.dll
[2002.03.20 21:01:06 | 000,006,688 | ---- | C] () -- C:\WINDOWS\System32\Digita.sys
[2002.03.20 21:00:20 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\TransportUSB.dll
[2002.03.20 21:00:20 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\TransportSerial.dll
[2002.03.20 21:00:18 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\TransportIrDA.dll
[2002.03.20 21:00:18 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\TransportIrCOMM.dll

< End of report >
         

--- --- ---

--- --- ---




Hier das zweite OTL-Logfile:OTL EXTRAS Logfile:

OTL Extras logfile created on: 07.11.2010 21:15:31 - Run 1
OTL by OldTimer - Version 3.2.17.3     Folder = C:\Dokumente und Einstellungen\Administrator.VBARCHITEKTEN\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 79,00% Memory free
7,00 Gb Paging File | 6,00 Gb Available in Paging File | 91,00% Paging File free
Paging file location(s): C:\pagefile.sys 4092 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 51,97 Gb Total Space | 13,03 Gb Free Space | 25,07% Space Free | Partition Type: NTFS
Drive D: | 149,95 Gb Total Space | 109,94 Gb Free Space | 73,32% Space Free | Partition Type: NTFS
Drive H: | 30,96 Gb Total Space | 17,45 Gb Free Space | 56,35% Space Free | Partition Type: NTFS
 
Computer Name: TOBI-NEU | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Programme\Microsoft Office\Office\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Programme\Microsoft Office\Office\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\AuthorizedApplications]
"Enabled" = 1
"AllowUserPrefMerge" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\AuthorizedApplications\List]
"%ProgramFiles%\Microsoft ActiveSync\CeAppMgr.exe:LocalSubnet:Enabled:ActiveSync Application Manager" = %ProgramFiles%\Microsoft ActiveSync\CeAppMgr.exe:LocalSubnet:Enabled:ActiveSync Application Manager -- File not found
"%ProgramFiles%\Microsoft ActiveSync\WCESMgr.exe:LocalSubnet:Enabled:ActiveSync Application" = %ProgramFiles%\Microsoft ActiveSync\WCESMgr.exe:LocalSubnet:Enabled:ActiveSync Application -- File not found
"%ProgramFiles%\Microsoft ActiveSync\WCESComm.exe:LocalSubnet:Enabled:ActiveSync Connection Manager" = %ProgramFiles%\Microsoft ActiveSync\WCESComm.exe:LocalSubnet:Enabled:ActiveSync Connection Manager -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\GloballyOpenPorts]
"Enabled" = 1
"AllowUserPrefMerge" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\GloballyOpenPorts\List]
"135:TCP:*:Enabled:Offer Remote Assistance - Port" = 135:TCP:*:Enabled:Offer Remote Assistance - Port
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Services]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Services\FileAndPrint]
"Enabled" = 1
"RemoteAddresses" = LocalSubnet
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Services\RemoteDesktop]
"Enabled" = 1
"RemoteAddresses" = *
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\AuthorizedApplications]
"AllowUserPrefMerge" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\GloballyOpenPorts]
"AllowUserPrefMerge" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Programme\3dsmax.exe" = C:\Programme\3dsmax.exe:*:Enabled:3ds max 7 -- (Discreet, a division of Autodesk, Inc.)
"C:\Programme\backburner 2\monitor.exe" = C:\Programme\backburner 2\monitor.exe:*:Enabled:backburner 2.3 Warteschlangenüberwachung -- (Discreet, a division of Autodesk, Inc.)
"C:\Programme\backburner 2\manager.exe" = C:\Programme\backburner 2\manager.exe:*:Enabled:backburner 2.3 manager -- (Discreet, a division of Autodesk, Inc.)
"C:\Programme\backburner 2\server.exe" = C:\Programme\backburner 2\server.exe:*:Enabled:backburner 2.3 server -- (Discreet, a division of Autodesk, Inc.)
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\backburner 2\manager.exe" = C:\Programme\backburner 2\manager.exe:*:Enabled:backburner Manager Application -- (Discreet, a division of Autodesk, Inc.)
"C:\Programme\backburner 2\server.exe" = C:\Programme\backburner 2\server.exe:*:Enabled:backburner Server Application -- (Discreet, a division of Autodesk, Inc.)
"C:\Programme\backburner 2\monitor.exe" = C:\Programme\backburner 2\monitor.exe:*:Enabled:backburner Monitor Application -- (Discreet, a division of Autodesk, Inc.)
"C:\Programme\Nero\Nero 7\Nero Home\NeroHome.exe" = C:\Programme\Nero\Nero 7\Nero Home\NeroHome.exe:*:Disabled:Nero Home -- (Nero AG)
"C:\Programme\Microsoft ActiveSync\wcescomm.exe" = C:\Programme\Microsoft ActiveSync\wcescomm.exe:*:Enabled:ActiveSync Connection Manager -- File not found
"C:\Programme\Microsoft ActiveSync\WcesMgr.exe" = C:\Programme\Microsoft ActiveSync\WcesMgr.exe:*:Enabled:ActiveSync Application -- File not found
"C:\Programme\Autodesk\3ds Max 9\3dsmax.exe" = C:\Programme\Autodesk\3ds Max 9\3dsmax.exe:*:Enabled:Autodesk 3ds Max 9 32-bit -- (Autodesk, Inc.)
"C:\Programme\Autodesk\Backburner\monitor.exe" = C:\Programme\Autodesk\Backburner\monitor.exe:*:Enabled:backburner 2.3 monitor -- (Autodesk, Inc.)
"C:\Programme\Autodesk\Backburner\manager.exe" = C:\Programme\Autodesk\Backburner\manager.exe:*:Enabled:backburner 2.3 manager -- (Autodesk, Inc.)
"C:\Programme\Autodesk\Backburner\server.exe" = C:\Programme\Autodesk\Backburner\server.exe:*:Enabled:backburner 2.3 server -- (Autodesk, Inc.)
"C:\Programme\Autodesk\3ds Max 2008\3dsmax.exe" = C:\Programme\Autodesk\3ds Max 2008\3dsmax.exe:*:Enabled:Autodesk 3ds Max 2008 32-bit -- (Autodesk, Inc.)
"C:\Programme_Netz\WS_FTP\WS_FTP95.exe" = C:\Programme_Netz\WS_FTP\WS_FTP95.exe:*:Enabled:WS_FTP 95 -- (Ipswitch, Inc. 81 Hartwell Ave. Lexington, MA)
"C:\Programme\Next Limit\Maxwell 2\maxwell.exe" = C:\Programme\Next Limit\Maxwell 2\maxwell.exe:*:Enabled:maxwell -- ()
"C:\Programme\Google\Google Earth\client\googleearth.exe" = C:\Programme\Google\Google Earth\client\googleearth.exe:*:Enabled:Google Earth -- (Google)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00030407-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Small Business
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP4300" = Canon iP4300
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{21BD4FE3-703C-400E-9397-B3575B32E7D2}" = MainConcept MainActor v5.2
"{26A24AE4-039D-4CA4-87B4-2F83216014FF}" = Java(TM) 6 Update 21
"{2CA6B50B-EA91-43AF-9347-6E85F16D0329}" = BS Contact VRML/X3D
"{2CD6BBA0-17C8-4789-9B9B-B36F7E815F6A}" = DWG TrueView 2007
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java(TM) 6 Update 5
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{38EC4486-44FF-0407-8FFF-87DA9DCBC06B}" = Autodesk 3ds Max 2008 32-Bit Hilfe
"{3AD21E47-B172-4A88-9821-21A1C5E031BE}" = Fast Track Ultra
"{3C106CBD-3E5A-4275-94F9-23FFE687D090}" = Autodesk 3ds Max 2008 32-bit Architectural Materials Library
"{3D347E6D-5A03-0407-B5BA-6A771885F379}" = Backburner
"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5545EEE1-FA36-4F76-B6BE-5696E7F4E2D6}" = VBA (2627.01)
"{5545EEE4-FA36-4F76-B6BE-5696E7F4E2D6}" = VBA (2701.01)
"{5783F2D7-6000-0407-0002-0060B0CE6BBA}" = AutoCAD Civil 3D 2008 - Deutsch
"{679035C8-CEB8-0407-847A-5FB3FFADC0EB}" = Autodesk 3ds Max 2008 32-Bit Vault 2008 Plug-In
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{6A79DE96-0FA4-42E7-A92D-FE43E208995A}" = Zusätzliche 3dsmax 7-Maps und -Materialien
"{72019134-3A61-4C39-A540-245600C4CDFA}" = Turbo Squid Tentacles 3ds Max 2008
"{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX
"{7C8B5E63-821A-4DFB-BDFA-19854D88EC5C}" = 3dsmax ancillary install
"{8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38}" = Microsoft .NET Framework 2.0 Language Pack - DEU
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel(R) Graphics Media Accelerator Driver
"{8F138633-8894-4807-9070-FF90606819FB}" = 3ds max 7
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A346205-EA92-4406-B1AB-50379DA3F057}" = Autodesk DWF Viewer 7
"{9C43A0AF-8602-4BA3-B7B7-F785DF499D33}" = PFTrack
"{9E491AB7-4589-48CA-9CBB-874CB2788391}" = Studio 9
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB2037C6-FE46-0407-B1B2-4D62FBB1E57A}" = Autodesk 3ds Max 2008 32-Bit Videos
"{AC76BA86-7AD7-1031-7B44-A91000000001}" = Adobe Reader 9.1 - Deutsch
"{B023185F-F1EF-4F97-B0BD-AE6D802226D1}" = NVIDIA WDM Drivers
"{B357C4B4-9024-4B64-9B3F-A6729031C3DD}" = SketchUp 5
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{BEDDE28A-99D9-425D-870B-A4E43BED5C99}" = 3ds max 7-Referenzdateien
"{BF658A51-6D4F-0407-8D40-D183692B995D}" = Autodesk 3ds Max 2008 32-Bit
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C4A0C307-053A-4335-8B28-60E901DB1031}" = Nero 7 Essentials
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D1B7094B-8CAC-0407-9EE6-D1576ED35208}" = Autodesk 3ds Max 2008 32-Bit Vault 5 Plug-In
"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9 Series
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E55B00B0-9DBF-4EE1-AC1D-5DEBE12BD097}" = Autodesk Vault 2008
"{E96D4088-AAC5-0407-9E39-EC0E387897B4}" = Autodesk 3ds Max 9 32-Bit
"{EDC8D89C-DC3D-0407-ABE7-97D281C0A13A}" = Autodesk 3ds Max 2008 32-bit Additional Maps and Material Libraries
"{F07B861C-72B9-40A4-8B1A-AAED4C06A7E8}" = QuickTime
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"Adobe Acrobat 5.0" = Adobe Acrobat 5.0
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Photoshop 6.0" = Adobe Photoshop 6.0
"AutoCAD Civil 3D 2008 - Deutsch" = AutoCAD Civil 3D 2008 - Deutsch
"Autodesk Student Community Download Tool_is1" = Autodesk Student Community Download Tool
"Autodesk Vault 2008" = Autodesk Vault 2008
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"BS Contact" = BS Contact
"Canon iP4300 Benutzerregistrierung" = Canon iP4300 Benutzerregistrierung
"Canon Setup Utility 2.3" = Canon Setup Utility 2.3
"DiskDirector" = Acronis Disk Director
"Easy-PrintToolBox" = Canon Utilities Easy-PrintToolBox
"Easy-WebPrint" = Easy-WebPrint
"FBX Plugin 2006.08 for Max 9.0" = FBX Plugin 2006.08 for Max 9.0
"FBX Plugin 2006.11.1 for Max 2008" = FBX Plugin 2006.11.1 for Max 2008
"Google Updater" = Google Updater
"Hollywood FX 5" = Pinnacle Hollywood FX 5
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{21BD4FE3-703C-400E-9397-B3575B32E7D2}" = MainConcept MainActor v5.2
"Magix Sequoia v7.22" = Magix Sequoia v7.22
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Maxwell 2" = Maxwell 2
"MediaNavigation.CDLabelPrint" = CD-LabelPrint
"MetaFrame Presentation Server Web Client for Win32" = MetaFrame Presentation Server Web Client for Win32
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 2.0 Language Pack - DEU" = Microsoft .NET Framework 2.0 Language Pack - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA Drivers" = NVIDIA Drivers
"Project2 Screensaver" = Project2 Screensaver
"Rainbow Sentinel Driver" = Sentinel System Driver
"SnagIt6" = SnagIt 6
"ViewpointMediaPlayer" = Viewpoint Media Player
"WIC" = Windows Imaging Component
"Windows Media Encoder 9" = Windows Media Encoder 9 Series
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinZip" = WinZip
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"ZKB Onlinebank Java" = ZKB Onlinebank Java
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"BS Editor" = BS Editor
"Google Chrome" = Google Chrome
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 07.11.2010 13:57:40 | Computer Name = TOBI-NEU | Source = RaySat_3dsmax2008_32 Server | ID = 131074
Description = 
 
Error - 07.11.2010 13:57:40 | Computer Name = TOBI-NEU | Source = RaySat_3dsmax9_32 Server | ID = 131074
Description = 
 
Error - 07.11.2010 13:57:42 | Computer Name = TOBI-NEU | Source = Userenv | ID = 1054
Description = Der Domänencontrollername für das Computernetzwerk konnte nicht ermittelt
 werden. (Die angegebene Domäne ist nicht vorhanden oder es konnte keine Verbindung
 hergestellt werden. ). Die Verarbeitung der Gruppenrichtlinie wurde abgebrochen.
 
Error - 07.11.2010 13:57:42 | Computer Name = TOBI-NEU | Source = AutoEnrollment | ID = 15
Description = Die automatische Zertifikatregistrierung für "lokaler Computer" konnte
 keine Verbindung zum Active Directory (0x8007054b) herstellen. Die angegebene Domäne
 ist nicht vorhanden oder es konnte keine Verbindung hergestellt werden.   Die Registrierung
 wird nicht durchgeführt.
 
Error - 07.11.2010 14:01:42 | Computer Name = TOBI-NEU | Source = Userenv | ID = 1054
Description = Der Domänencontrollername für das Computernetzwerk konnte nicht ermittelt
 werden. (Die angegebene Domäne ist nicht vorhanden oder es konnte keine Verbindung
 hergestellt werden. ). Die Verarbeitung der Gruppenrichtlinie wurde abgebrochen.
 
Error - 07.11.2010 14:34:54 | Computer Name = TOBI-NEU | Source = RaySat_3dsmax2008_32 Server | ID = 131074
Description = 
 
Error - 07.11.2010 14:34:54 | Computer Name = TOBI-NEU | Source = RaySat_3dsmax9_32 Server | ID = 131074
Description = 
 
Error - 07.11.2010 14:34:57 | Computer Name = TOBI-NEU | Source = Userenv | ID = 1054
Description = Der Domänencontrollername für das Computernetzwerk konnte nicht ermittelt
 werden. (Die angegebene Domäne ist nicht vorhanden oder es konnte keine Verbindung
 hergestellt werden. ). Die Verarbeitung der Gruppenrichtlinie wurde abgebrochen.
 
Error - 07.11.2010 14:34:57 | Computer Name = TOBI-NEU | Source = AutoEnrollment | ID = 15
Description = Die automatische Zertifikatregistrierung für "lokaler Computer" konnte
 keine Verbindung zum Active Directory (0x8007054b) herstellen. Die angegebene Domäne
 ist nicht vorhanden oder es konnte keine Verbindung hergestellt werden.   Die Registrierung
 wird nicht durchgeführt.
 
Error - 07.11.2010 14:40:17 | Computer Name = TOBI-NEU | Source = Userenv | ID = 1054
Description = Der Domänencontrollername für das Computernetzwerk konnte nicht ermittelt
 werden. (Die angegebene Domäne ist nicht vorhanden oder es konnte keine Verbindung
 hergestellt werden. ). Die Verarbeitung der Gruppenrichtlinie wurde abgebrochen.
 
[ System Events ]
Error - 07.11.2010 12:49:39 | Computer Name = TOBI-NEU | Source = NETLOGON | ID = 5719
Description = Es steht kein Domänencontroller für die Domäne VBARCHITEKTEN aus folgendem
 Grund zur  Verfügung:   %%1311.    Stellen Sie sicher, dass der Computer mit dem Netzwerk
 verbunden ist, und  versuchen Sie es erneut. Wenden Sie sich an den Domänenadministrator,
 wenn  das Problem weiterhin besteht.
 
Error - 07.11.2010 12:49:47 | Computer Name = TOBI-NEU | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Automatisches LiveUpdate - Scheduler" wurde aufgrund folgenden
 Fehlers nicht gestartet:   %%3
 
Error - 07.11.2010 12:49:47 | Computer Name = TOBI-NEU | Source = Service Control Manager | ID = 7000
Description = Der Dienst "DS1410D" wurde aufgrund folgenden Fehlers nicht gestartet:
   %%2
 
Error - 07.11.2010 13:57:20 | Computer Name = TOBI-NEU | Source = Dhcp | ID = 1002
Description = Die IP-Adresslease 192.168.1.2 für die Netzwerkkarte mit der Netzwerkadresse
 0017316AB57B wurde durch  den DHCP-Server 192.168.1.1 abgelehnt (der DHCP-Server 
hat eine DHCPNACK-Meldung gesendet).
 
Error - 07.11.2010 13:57:43 | Computer Name = TOBI-NEU | Source = NETLOGON | ID = 5719
Description = Es steht kein Domänencontroller für die Domäne VBARCHITEKTEN aus folgendem
 Grund zur  Verfügung:   %%1311.    Stellen Sie sicher, dass der Computer mit dem Netzwerk
 verbunden ist, und  versuchen Sie es erneut. Wenden Sie sich an den Domänenadministrator,
 wenn  das Problem weiterhin besteht.
 
Error - 07.11.2010 13:57:43 | Computer Name = TOBI-NEU | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Automatisches LiveUpdate - Scheduler" wurde aufgrund folgenden
 Fehlers nicht gestartet:   %%3
 
Error - 07.11.2010 13:57:43 | Computer Name = TOBI-NEU | Source = Service Control Manager | ID = 7000
Description = Der Dienst "DS1410D" wurde aufgrund folgenden Fehlers nicht gestartet:
   %%2
 
Error - 07.11.2010 14:34:55 | Computer Name = TOBI-NEU | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Automatisches LiveUpdate - Scheduler" wurde aufgrund folgenden
 Fehlers nicht gestartet:   %%3
 
Error - 07.11.2010 14:34:55 | Computer Name = TOBI-NEU | Source = Service Control Manager | ID = 7000
Description = Der Dienst "DS1410D" wurde aufgrund folgenden Fehlers nicht gestartet:
   %%2
 
Error - 07.11.2010 14:34:56 | Computer Name = TOBI-NEU | Source = NETLOGON | ID = 5719
Description = Es steht kein Domänencontroller für die Domäne VBARCHITEKTEN aus folgendem
 Grund zur  Verfügung:   %%1311.    Stellen Sie sicher, dass der Computer mit dem Netzwerk
 verbunden ist, und  versuchen Sie es erneut. Wenden Sie sich an den Domänenadministrator,
 wenn  das Problem weiterhin besteht.
 
 
< End of report >
         

--- --- ---

Lieber Gruss und vielen Dank

Tobias

D:\fr-041_debris.exe (Malware.Packer.Krunchy) -> Quarantined and deleted successfully.

Wasndas hier?