Liest da jemand meine Mails mit?

dichter84 · 07.07.2011, 13:20

Hi Leute,

ich bin im netz auf dieses Forum gestoßen und erhoffe mir von hier etwas Hilfe...!

Ich hab seit gestern das Problem, dass immer wenn ich eine Mail abschicke, kurz danach eine "failure notice" -Mail von "MAILER-DAEMON@mailout-de.gmx.net" zurückkommt. Die Nachricht die ich abgesendet habe kommt auch bei der entsprechenden Person an. Und die E-Mail-Adresse die da genannt wird zu welcher die Mail nicht zugestellt werden konnte kenn eich nichtmal!!

Ich kopier einfach mal den Text hier rein, evtl. weiss jemand was das zu bedeuten hat?? Sieht für mich fast so aus als ob da jemand die E-Mails die ich verschicke mitliest??

Naja, hier mal der Text...:

Hi. This is the qmail-send program at mailout-de.gmx.net.
I'm afraid I wasn't able to deliver your message to the following addresses.
This is a permanent error; I've given up. Sorry it didn't work out.

<hornywaterfall1985@gmx.de>:
User_inactive_-_User_ist_inaktiv/

--- Below this line is a copy of the message.

Return-Path: <(meine Adresse)>
Received: (qmail 21784 invoked by alias); 7 Jul 2011 00:04:09 -0000
Delivered-To: GMX delivery to (die Adresse zu der ich die Mail tatsächlich schicken wollte)
Received: (qmail invoked by alias); 07 Jul 2011 00:04:08 -0000
Received: from HSI-KBW-46-223-69-182.hsi.kabel-badenwuerttemberg.de (EHLO [192.168.0.191]) [46.223.69.182]
by mail.gmx.net (mp011) with SMTP; 07 Jul 2011 02:04:08 +0200
X-Authenticated: #14460322
X-Provags-ID: V01U2FsdGVkX18JQrpEN5oJVp2ixGy16nHvWlSjfgut7AA4+g7+3U
zc0hfqeh5/Ek8d
Message-ID: <4E14F7F5.6000005@gmx.de>
Date: Thu, 07 Jul 2011 02:04:05 +0200
From: "(mein Name)." <(meine E-Mail-Adresse)>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; de; rv:1.9.2.17) Gecko/20110414 Thunderbird/3.1.10
MIME-Version: 1.0
To: <(die Adresse zu der ich die Mail tatsächlich schicken wollte)>
Subject: Adressen
Content-Type: text/plain; charset=ISO-8859-15; format=flowed
Content-Transfer-Encoding: 8bit
X-GMX-Antivirus: 0 (no virus found)
X-GMX-Antispam: 0 (Mail was not recognized as spam);
Detail=5D7Q89H36p7E+LRCpUWq5zw4kz05Zv5Gaw2BQ2gzNFzYzOxSJlXpadpSdS3giyjx8RG/N
GOfSwNa9druHdFHHmoGe2lGo//ofDmQnvwdfzoZ7OUEcBWKbjSxWYaDuaa09GmNfTCurqkOS3xIz
WQja54Qgkqj49HHLfIE56SSv5vIAfGLdMdf3n8LVfZ3y8agf0vMQe/mQdOZ0AKyQycrKQ==V1;
X-Resent-By: Forwarder <forwarder@gmx.de>
X-Resent-For: (die Adresse zu der ich die Mail tatsächlich schicken wollte)
X-Resent-To: sonnenschein.reisen@gmx.net, hornywaterfall1985@gmx.de

(Hier stand der Text den ich in der E-Mail geschrieben hatte)

Kann jemand was damit anfangen? Ich hatte erst kürzlich ein Virenproblem mit kriminellen Absichten welches ich auch zur Anzeige gebracht habe. Das ganze Trotz Win. 7, Anit Vir Personal, Zone Alarm, und ich öffne auch keine unbekannten Mails.....

naja, wär super wenn mir jemand helfen könnte....!

Gruss

cosinus · 07.07.2011, 13:25

Zitat:

Kann jemand was damit anfangen? Ich hatte erst kürzlich ein Virenproblem mit kriminellen Absichten welches ich auch zur Anzeige gebracht habe. Das ganze Trotz Win. 7, Anit Vir Personal, Zone Alarm, und ich öffne auch keine unbekannten Mails.....

Oje, ZoneAlarm sagt alles

Welche Schädlinge hattest du und wie wurde des System entkeimt? Halbherzig nur mit Virenscanner drüber oder gründlich per format c und Neuinstallation von Windows?

dichter84 · 07.07.2011, 14:58

Was es genau war weiß ich ned, nur irgend wie hat jemand mein Passwort bei ebay geknackt und zusätzlich das von meiner Mail-.Adresse, und hat dann über meinen ebay-Account Computer nach Italien verkauft (welche dann allerdings nie beid en Leuten angekommen sind.....) Hat sogar Fragen der leutre über meine E-Mail-Addy beantwortet......

Das musste ich anzeigen sonst wäre ich der Dumme gewesen...

Allerdings wie der an die Passwörter gekommen ist weiss ich ned. Ich vermute eben einen trojaner oder so.

Gleich nach entdecken wurde der Rechner komplett formatiert. Daten wurden auf einer externen Platte gesichert. Das einzige was ich mir vorstellen kann ist, dass der trojaner da mit auf die externe gewandert ist, oder es ist schon wieder was neues. Würd gern mal wissen wie die immer wieder auf mein System kommen...!?

Kannd as mit ICQ oder Skype zusammenhängen...?

gruß

cosinus · 07.07.2011, 15:00

Bitte routinemäßig einen Vollscan mit Malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

Danach OTL-Custom:

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den Inhalt in die Textbox.

Code:

ATTFilter

netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf .
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

dichter84 · 07.07.2011, 19:39

Ok, alles erledigt... Beim Vollscan kam nix raus.

Hier das Log vom OLT:OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 07.07.2011 17:44:04 - Run 1
OTL by OldTimer - Version 3.2.26.1     Folder = C:\Users\ich\Desktop
 An unknown product Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,98 Gb Total Physical Memory | 1,96 Gb Available Physical Memory | 65,60% Memory free
5,96 Gb Paging File | 4,64 Gb Available in Paging File | 77,75% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 148,37 Gb Total Space | 91,97 Gb Free Space | 61,99% Space Free | Partition Type: NTFS
Drive M: | 100,00 Gb Total Space | 90,00 Gb Free Space | 90,00% Space Free | Partition Type: MFilesFS
 
Computer Name: DICHTER84-NEU | User Name: ich | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2011.07.07 17:41:00 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Users\ich\Desktop\OTL.exe
PRC - [2011.06.29 12:19:54 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.05.29 09:11:28 | 000,449,584 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2011.05.29 09:11:28 | 000,366,640 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2011.05.06 18:15:20 | 000,532,320 | ---- | M] (Spigot, Inc.) -- C:\Programme\Common Files\Spigot\Search Settings\SearchSettings.exe
PRC - [2011.05.06 17:33:00 | 000,393,112 | ---- | M] (Spigot, Inc.) -- C:\Programme\Application Updater\ApplicationUpdater.exe
PRC - [2011.04.27 15:28:21 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2011.03.11 04:37:52 | 000,048,618 | ---- | M] (The Pidgin developer community) -- C:\Programme\Pidgin\pidgin.exe
PRC - [2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2011.02.18 18:30:32 | 002,435,592 | ---- | M] (Check Point Software Technologies LTD) -- C:\Windows\System32\ZoneLabs\vsmon.exe
PRC - [2011.02.18 18:28:38 | 001,043,968 | ---- | M] (Check Point Software Technologies LTD) -- C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
PRC - [2011.02.15 17:25:48 | 000,488,952 | ---- | M] (Check Point Software Technologies) -- C:\Programme\CheckPoint\ZAForceField\ISWSVC.exe
PRC - [2011.02.15 17:25:42 | 000,738,808 | ---- | M] (Check Point Software Technologies) -- C:\Programme\CheckPoint\ZAForceField\ForceField.exe
PRC - [2011.01.17 19:50:34 | 011,322,880 | ---- | M] (OpenOffice.org) -- C:\Programme\OpenOffice.org 3\program\soffice.exe
PRC - [2011.01.17 19:50:34 | 011,314,688 | ---- | M] (OpenOffice.org) -- C:\Programme\OpenOffice.org 3\program\soffice.bin
PRC - [2011.01.10 17:50:46 | 001,028,096 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Common Files\Lenovo\tvt_reg_monitor_svc.exe
PRC - [2011.01.10 15:22:55 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010.12.03 19:19:50 | 000,137,656 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\ZOOM\TpScrex.exe
PRC - [2010.12.03 19:19:32 | 000,258,920 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\HOTKEY\TPONSCR.exe
PRC - [2010.12.03 11:57:38 | 000,099,328 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\HOTKEY\tphkload.exe
PRC - [2010.12.02 13:55:54 | 000,064,440 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\HOTKEY\TPHKSVC.exe
PRC - [2010.11.29 17:32:44 | 000,069,560 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\HOTKEY\TPOSDSVC.exe
PRC - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2010.11.20 14:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2010.11.20 14:17:00 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
PRC - [2010.11.09 22:08:58 | 000,146,000 | ---- | M] (Logitech, Inc.) -- C:\Programme\Common Files\LogiShrd\KHAL3\KHALMNPR.exe
PRC - [2010.10.29 01:32:48 | 001,352,272 | ---- | M] (Logitech, Inc.) -- C:\Programme\Logitech\SetPointP\SetPoint.exe
PRC - [2010.10.14 20:26:06 | 000,128,296 | ---- | M] (Synaptics Incorporated) -- C:\Programme\Synaptics\SynTP\SynTPLpr.exe
PRC - [2010.04.07 15:37:38 | 000,093,032 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\VIRTSCRL\lvvsst.exe
PRC - [2010.04.01 15:50:44 | 000,043,960 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\VIRTSCRL\virtscrl.exe
PRC - [2010.01.14 22:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2009.12.21 07:44:50 | 003,771,704 | ---- | M] (Motive Systems) -- C:\Programme\M-Files\6.0.2325.14\Bin\x86\MFClient.exe
PRC - [2009.12.21 04:40:44 | 009,353,528 | ---- | M] (Motive Systems) -- C:\Programme\M-Files\6.0.2325.14\Bin\x86\MFServer.exe
PRC - [2009.12.21 03:58:48 | 000,998,712 | ---- | M] (Motive Systems) -- C:\Programme\M-Files\6.0.2325.14\Bin\x86\MFStatus.exe
PRC - [2009.12.21 03:50:04 | 000,934,200 | ---- | M] (Motive Systems) -- C:\Programme\M-Files\6.0.2325.14\Bin\x86\MFServerAux.exe
PRC - [2009.12.21 03:38:36 | 000,889,144 | ---- | M] (Motive Systems) -- C:\Programme\M-Files\6.0.2325.14\Bin\x86\MFAUClient.exe
PRC - [2009.12.21 02:33:16 | 000,642,872 | ---- | M] (Motive Systems) -- C:\Programme\M-Files\6.0.2325.14\Bin\x86\MFSetup.exe
PRC - [2009.07.20 00:55:50 | 004,446,752 | ---- | M] () -- C:\Programme\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe
PRC - [2009.07.14 03:14:24 | 000,157,184 | ---- | M] (Microsoft Corporation) -- c:\Programme\Windows Defender\MpCmdRun.exe
PRC - [2008.07.15 18:09:52 | 000,090,112 | ---- | M] (Andrea Electronics Corporation) -- C:\Windows\System32\AEADISRV.EXE
PRC - [2005.07.19 11:16:50 | 000,507,904 | ---- | M] (AVerMedia Technologies, Inc.) -- C:\Programme\AVerTV Hybrid + FM Cardbus\AVerQT.exe
 
 
========== Modules (SafeList) ==========
 
MOD - [2011.07.07 17:41:00 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Users\ich\Desktop\OTL.exe
MOD - [2011.02.15 17:25:56 | 000,640,504 | ---- | M] (Check Point Software Technologies) -- C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
MOD - [2010.11.20 13:55:09 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
MOD - [2010.11.05 03:58:01 | 000,632,656 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
MOD - [2010.11.05 03:58:00 | 000,554,832 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcp80.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2011.06.29 12:19:54 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.05.29 09:11:28 | 000,366,640 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011.05.06 17:33:00 | 000,393,112 | ---- | M] (Spigot, Inc.) [Auto | Running] -- C:\Program Files\Application Updater\ApplicationUpdater.exe -- (Application Updater)
SRV - [2011.04.27 15:28:21 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011.02.18 18:30:32 | 002,435,592 | ---- | M] (Check Point Software Technologies LTD) [Auto | Running] -- C:\Windows\System32\ZoneLabs\vsmon.exe -- (vsmon)
SRV - [2011.02.15 17:25:48 | 000,488,952 | ---- | M] (Check Point Software Technologies) [Auto | Running] -- C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe -- (IswSvc)
SRV - [2011.01.10 17:50:46 | 001,028,096 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe -- (ThinkVantage Registry Monitor Service)
SRV - [2010.12.03 11:57:38 | 000,099,328 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Programme\Lenovo\HOTKEY\tphkload.exe -- (TPHKLOAD)
SRV - [2010.12.02 13:55:54 | 000,064,440 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Programme\Lenovo\HOTKEY\TPHKSVC.exe -- (TPHKSVC)
SRV - [2010.11.24 17:34:24 | 000,045,496 | ---- | M] (Lenovo Group Limited) [Auto | Stopped] -- C:\Programme\Lenovo\HOTKEY\micmute.exe -- (LENOVO.MICMUTE)
SRV - [2010.10.28 12:13:30 | 000,293,456 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Programme\Common Files\LogiShrd\Bluetooth\LBTServ.exe -- (LBTServ)
SRV - [2010.04.07 15:37:38 | 000,093,032 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Programme\Lenovo\VIRTSCRL\lvvsst.exe -- (Lenovo.VIRTSCRLSVC)
SRV - [2009.12.21 07:44:50 | 003,771,704 | ---- | M] (Motive Systems) [Auto | Running] -- C:\Program Files\M-Files\6.0.2325.14\Bin\x86\mfclient.exe -- (MFClient 6.0.2325.14)
SRV - [2009.12.21 04:40:44 | 009,353,528 | ---- | M] (Motive Systems) [Auto | Running] -- C:\Program Files\M-Files\6.0.2325.14\Bin\x86\mfserver.exe -- (MFServer 6.0.2325.14)
SRV - [2009.12.21 03:50:04 | 000,934,200 | ---- | M] (Motive Systems) [Auto | Running] -- C:\Program Files\M-Files\6.0.2325.14\Bin\x86\mfserveraux.exe -- (MFServerAux 6.0.2325.14)
SRV - [2009.12.21 02:33:16 | 000,642,872 | ---- | M] (Motive Systems) [Auto | Running] -- C:\Program Files\M-Files\6.0.2325.14\Bin\x86\mfsetup.exe -- (MFSetup 6.0.2325.14)
SRV - [2009.07.20 00:55:50 | 004,446,752 | ---- | M] () [Auto | Running] -- C:\Program Files\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe -- (NVIDIA Performance Driver Service)
SRV - [2009.07.14 03:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc)
SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2008.07.15 18:09:52 | 000,090,112 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\System32\AEADISRV.EXE -- (AEADIFilters)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2011.06.29 12:19:55 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2011.06.29 12:19:55 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011.05.29 09:11:20 | 000,022,712 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2011.04.11 16:15:50 | 000,033,088 | ---- | M] (Lenovo (United States) Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\psadd.sys -- (psadd)
DRV - [2011.02.15 17:25:36 | 000,026,872 | ---- | M] (Check Point Software Technologies) [Kernel | Auto | Running] -- C:\Programme\CheckPoint\ZAForceField\ISWKL.sys -- (ISWKL)
DRV - [2011.01.13 15:04:50 | 000,122,992 | ---- | M] (Lenovo.) [Kernel | Boot | Running] -- C:\Windows\System32\DRIVERS\Apsx86.sys -- (Shockprf)
DRV - [2011.01.13 15:02:56 | 000,020,592 | ---- | M] (Lenovo.) [Kernel | Boot | Running] -- C:\Windows\System32\DRIVERS\ApsHM86.sys -- (TPDIGIMN)
DRV - [2010.11.20 14:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\vmbus.sys -- (vmbus)
DRV - [2010.11.20 14:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010.11.20 14:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\storvsc.sys -- (storvsc)
DRV - [2010.11.20 12:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010.11.20 11:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010.11.20 11:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\vms3cap.sys -- (s3cap)
DRV - [2010.11.10 03:49:50 | 004,323,040 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvuvc.sys -- (LVUVC) Logitech Webcam 200(UVC)
DRV - [2010.11.10 03:48:12 | 000,283,744 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvrs.sys -- (LVRS)
DRV - [2010.09.07 15:09:06 | 000,013,680 | ---- | M] (Lenovo Group Limited) [Kernel | System | Running] -- C:\Windows\System32\drivers\smiif32.sys -- (lenovo.smi)
DRV - [2010.08.24 19:31:02 | 000,037,328 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV - [2010.08.24 19:30:52 | 000,038,864 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2010.06.17 15:27:02 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2010.05.15 17:30:50 | 000,461,400 | ---- | M] (Check Point Software Technologies LTD) [Kernel | System | Running] -- C:\Windows\System32\drivers\vsdatant.sys -- (Vsdatant)
DRV - [2010.05.02 16:29:55 | 000,108,640 | ---- | M] (Your Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Mach3.sys -- (Mach3)
DRV - [2009.12.21 02:13:02 | 000,073,400 | ---- | M] (Motive Systems) [File_System | On_Demand | Running] -- C:\Programme\M-Files\6.0.2325.14\Bin\x86\MFFSD.sys -- (MFFSD4A88F8ED-C1B6-40FA-9611-8F49CDF70AD6)
DRV - [2009.12.21 02:12:44 | 000,016,312 | ---- | M] (Motive Systems) [Kernel | On_Demand | Running] -- C:\Programme\M-Files\6.0.2325.14\Bin\x86\MFVDD.sys -- (MFVDD1C0F24D2-7FBC-4F4A-83B6-F2B917364180)
DRV - [2009.09.06 01:21:46 | 009,833,032 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2009.07.14 01:45:33 | 000,083,456 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\serial.sys -- (Serial)
DRV - [2009.07.14 00:02:51 | 004,231,168 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\netw5v32.sys -- (netw5v32) Intel(R)
DRV - [2009.07.14 00:02:50 | 000,211,456 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express) Intel(R)
DRV - [2009.07.02 10:16:22 | 000,038,336 | ---- | M] (Lenovo (United States) Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tvti2c.sys -- (TVTI2C)
DRV - [2008.02.15 19:01:18 | 000,046,592 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)
DRV - [2007.07.30 12:54:02 | 000,038,400 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2007.07.30 11:42:58 | 000,043,008 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2006.11.27 18:44:52 | 000,008,192 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)
DRV - [2005.08.26 11:10:02 | 000,509,312 | ---- | M] (AVerMedia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AVerE506.sys -- (AVerE506)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\URLSearchHook: {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Programme\ZoneAlarm-Sicherheit\tbZone.dll (Conduit Ltd.)
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.ask.com?o=101702&l=dis
IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} -  File not found
IE - HKCU\..\URLSearchHook: {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Programme\pdfforge Toolbar\IE\4.4\pdfforgeToolbarIE.dll (Spigot, Inc.)
IE - HKCU\..\URLSearchHook: {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Programme\ZoneAlarm-Sicherheit\tbZone.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@checkpoint.com/FFApi: C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\npFFApi.dll ()
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Program Files\CheckPoint\ZAForceField\TrustChecker [2011.03.15 00:46:38 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 5.0\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2011.07.07 14:07:27 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 5.0\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
 
[2011.03.15 14:18:10 | 000,000,000 | ---D | M] (No name found) -- C:\Users\ich\AppData\Roaming\mozilla\Extensions
[2011.03.15 14:18:10 | 000,000,000 | ---D | M] (No name found) -- C:\Users\ich\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
File not found (No name found) -- 
 
O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (ZoneAlarm Security Engine Registrar) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Programme\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Programme\pdfforge Toolbar\IE\4.4\pdfforgeToolbarIE.dll (Spigot, Inc.)
O2 - BHO: (Foxit PDF Creator Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} -  File not found
O2 - BHO: (ZoneAlarm-Sicherheit Toolbar) - {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Programme\ZoneAlarm-Sicherheit\tbZone.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Programme\pdfforge Toolbar\IE\4.4\pdfforgeToolbarIE.dll (Spigot, Inc.)
O3 - HKLM\..\Toolbar: (Foxit PDF Creator Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} -  File not found
O3 - HKLM\..\Toolbar: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Programme\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O3 - HKLM\..\Toolbar: (ZoneAlarm-Sicherheit Toolbar) - {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Programme\ZoneAlarm-Sicherheit\tbZone.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Foxit PDF Creator Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} -  File not found
O3 - HKCU\..\Toolbar\WebBrowser: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Programme\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O3 - HKCU\..\Toolbar\WebBrowser: (ZoneAlarm-Sicherheit Toolbar) - {FC2B76FC-2132-4D80-A9A3-1F5C6E49066B} - C:\Programme\ZoneAlarm-Sicherheit\tbZone.dll (Conduit Ltd.)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [ApnUpdater]  File not found
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4 - HKLM..\Run: [ISW] C:\Program Files\CheckPoint\ZAForceField\ForceField.exe (Check Point Software Technologies)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [M-Files Status 6.0.2325.14] C:\Program Files\M-Files\6.0.2325.14\Bin\x86\MFStatus.exe (Motive Systems)
O4 - HKLM..\Run: [M-Files Updates 6.0.2325.14] C:\Program Files\M-Files\6.0.2325.14\Bin\x86\MFAUClient.exe (Motive Systems)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\Windows\System32\nwiz.exe ()
O4 - HKLM..\Run: [SearchSettings] C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe (Spigot, Inc.)
O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - Startup: C:\Users\ich\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Programme\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 82.212.62.62 78.42.43.62 192.168.0.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - Winlogon\Notify\LBTWlgn: DllName - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll - c:\Programme\Common Files\LogiShrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: vsmon - C:\Windows\System32\ZoneLabs\vsmon.exe (Check Point Software Technologies LTD)
SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.i420 - C:\Windows\System32\lvcodec2.dll (Logitech Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.07.07 17:40:59 | 000,579,584 | ---- | C] (OldTimer Tools) -- C:\Users\ich\Desktop\OTL.exe
[2011.07.07 16:06:00 | 000,000,000 | ---D | C] -- C:\Users\ich\AppData\Roaming\Malwarebytes
[2011.07.07 16:05:11 | 000,039,984 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2011.07.07 16:05:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011.07.07 16:05:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.07.07 16:05:06 | 000,022,712 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011.07.07 16:05:06 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011.07.07 16:04:28 | 009,435,312 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\ich\Desktop\mbam-setup-1.51.0.1200.exe
[2011.07.07 14:07:26 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Thunderbird
[2011.06.24 17:41:59 | 000,000,000 | ---D | C] -- C:\Users\ich\AppData\Local\Opera
[2011.06.20 17:13:24 | 000,000,000 | ---D | C] -- C:\Users\ich\Desktop\NC-Dateien
[2011.06.18 16:10:59 | 000,000,000 | ---D | C] -- C:\Users\ich\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\3D-M-SOFT
[2011.06.18 16:10:59 | 000,000,000 | ---D | C] -- C:\Program Files\3D-M-SOFT
[2011.06.17 10:18:57 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[7 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.07.07 17:41:00 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Users\ich\Desktop\OTL.exe
[2011.07.07 17:39:21 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.07.07 16:05:11 | 000,001,067 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.07.07 16:04:32 | 009,435,312 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\ich\Desktop\mbam-setup-1.51.0.1200.exe
[2011.07.07 14:08:29 | 000,013,584 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011.07.07 14:08:29 | 000,013,584 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011.07.07 14:07:28 | 000,002,032 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Thunderbird.lnk
[2011.07.07 14:00:45 | 2401,996,800 | -HS- | M] () -- C:\hiberfil.sys
[2011.07.07 13:57:26 | 676,647,004 | ---- | M] () -- C:\Users\ich\Desktop\Thunderbird 3.1.10 (de) - 2011-07-07.pcv
[2011.07.07 13:55:50 | 000,654,166 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.07.07 13:55:50 | 000,616,008 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.07.07 13:55:50 | 000,130,006 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.07.07 13:55:50 | 000,106,388 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.07.07 13:21:03 | 000,000,061 | ---- | M] () -- C:\Windows\wininit.ini
[2011.07.07 12:33:47 | 000,000,466 | ---- | M] () -- C:\Windows\tasks\SystemToolsDailyTest.job
[2011.07.07 12:33:40 | 000,294,872 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011.07.07 03:02:15 | 000,014,608 | ---- | M] () -- C:\Users\ich\Desktop\Seitenwange Portal Loslagerseite V2 geschweißt V1.1.tap
[2011.07.07 03:01:42 | 000,088,267 | ---- | M] () -- C:\Users\ich\Desktop\Seitenwange Portal Loslagerseite V2 geschweißt.job
[2011.07.07 01:52:35 | 001,624,196 | ---- | M] () -- C:\Users\ich\Desktop\galaxy 016.jpg
[2011.07.07 01:51:08 | 001,489,305 | ---- | M] () -- C:\Users\ich\Desktop\galaxy 013.jpg
[2011.07.07 01:50:12 | 001,603,285 | ---- | M] () -- C:\Users\ich\Desktop\galaxy 015.jpg
[2011.07.06 17:29:02 | 000,014,698 | ---- | M] () -- C:\Users\ich\Desktop\Seitenwange Portal Festlagerseite V2 geschweißt V1.1.tab
[2011.07.06 16:54:30 | 000,075,286 | ---- | M] () -- C:\Users\ich\Desktop\Seitenwange Portal Festlagerseite V2 geschweißt.job
[2011.07.06 15:41:55 | 000,014,555 | ---- | M] () -- C:\Users\ich\Desktop\Seitenwange Portal Festlagerseite V2 geschweißt V1.0.tap
[2011.07.05 22:16:11 | 000,347,448 | ---- | M] () -- C:\Users\ich\Desktop\RE-11196.pdf
[2011.07.05 14:31:28 | 000,503,338 | ---- | M] () -- C:\Users\ich\Desktop\anni6pa.jpg
[2011.07.05 02:48:57 | 322,557,763 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2011.07.04 22:13:25 | 000,004,290 | ---- | M] () -- C:\Users\ich\Desktop\Plasma 6.. Nr. 2.tap
[2011.07.04 22:12:40 | 000,012,453 | ---- | M] () -- C:\Users\ich\Desktop\Plasma 6mm V1.1.tap
[2011.07.04 22:12:18 | 000,040,017 | ---- | M] () -- C:\Users\ich\Desktop\Plasma 6mm V1.job
[2011.07.04 22:11:12 | 000,024,490 | ---- | M] () -- C:\Users\ich\Desktop\Plasma 6.. Nr. 2.job
[2011.07.02 13:11:14 | 000,009,456 | ---- | M] () -- C:\Users\ich\Desktop\Plasma 6mm V1.tap
[2011.07.02 00:20:33 | 000,000,000 | ---- | M] () -- C:\Windows\System32\drivers\lvuvc.hs
[2011.07.02 00:17:14 | 000,001,004 | ---- | M] () -- C:\Users\ich\Desktop\Fertigungsdaten.lnk
[2011.06.30 19:59:10 | 000,070,517 | ---- | M] () -- C:\Users\ich\Desktop\annix1gr.jpg
[2011.06.30 17:20:07 | 000,235,786 | ---- | M] () -- C:\Users\ich\Desktop\Bildschirmfoto 2011-06-30 um 17.19.14.png
[2011.06.29 22:53:39 | 000,020,386 | ---- | M] () -- C:\Users\ich\Desktop\Alibre Drawing.pdf
[2011.06.29 19:05:20 | 000,020,135 | ---- | M] () -- C:\Users\ich\Desktop\document.pdf
[2011.06.29 16:57:12 | 000,107,269 | ---- | M] () -- C:\Users\ich\Desktop\bilder.pdf
[2011.06.29 16:33:29 | 000,378,078 | ---- | M] () -- C:\Users\ich\Desktop\Bildschirmfoto 2011-06-29 um 16.32.44.png
[2011.06.29 12:19:55 | 000,138,192 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys
[2011.06.29 12:19:55 | 000,066,616 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys
[2011.06.28 23:56:02 | 000,036,074 | ---- | M] () -- C:\Users\ich\Desktop\obere Platte Schlitten X komplett.job
[2011.06.28 22:48:06 | 000,096,688 | ---- | M] () -- C:\Users\ich\Desktop\Neue Zeichnung (1).dxf
[2011.06.28 22:43:26 | 000,019,850 | ---- | M] () -- C:\Users\ich\Desktop\WST.part
[2011.06.28 22:43:12 | 000,048,071 | ---- | M] () -- C:\Users\ich\Desktop\SSSSS.job
[2011.06.28 17:15:08 | 000,037,918 | ---- | M] () -- C:\Users\ich\Desktop\Blechteile Absaughaube.job
[2011.06.28 17:13:00 | 000,008,106 | ---- | M] () -- C:\Users\ich\Desktop\Blechteile Absaughaube v3.tap
[2011.06.28 16:30:44 | 000,007,232 | ---- | M] () -- C:\Users\ich\Desktop\Blechteile Absaughaube v2.tap
[2011.06.28 01:23:35 | 000,022,806 | ---- | M] () -- C:\Windows\CondaCam12.ini
[2011.06.28 01:09:32 | 000,832,180 | ---- | M] () -- C:\Users\ich\Desktop\Mts-cncDE.pdf
[2011.06.27 23:26:24 | 000,006,930 | ---- | M] () -- C:\Users\ich\Desktop\Blendenbleche Schaltschrank.tap
[2011.06.27 23:26:10 | 000,024,374 | ---- | M] () -- C:\Users\ich\Desktop\Blendenbleche Schaltschrank.job
[2011.06.27 15:49:07 | 000,000,528 | ---- | M] () -- C:\Windows\tasks\PCDoctorBackgroundMonitorTask.job
[2011.06.24 17:41:56 | 000,001,775 | ---- | M] () -- C:\Users\Public\Desktop\Opera.lnk
[2011.06.24 17:34:19 | 000,267,653 | ---- | M] () -- C:\Users\ich\Desktop\Opera Lesezeichen 24.6.2011.adr
[2011.06.24 16:23:13 | 000,000,829 | ---- | M] () -- C:\Users\ich\Desktop\Schaltnocke Y Fase.nc
[2011.06.24 00:35:45 | 000,187,633 | ---- | M] () -- C:\Users\ich\Desktop\Schaltnocke Y.stp
[2011.06.24 00:24:20 | 000,005,609 | ---- | M] () -- C:\Users\ich\Desktop\Schaltnocke Y.nc
[2011.06.23 02:11:13 | 000,098,119 | ---- | M] () -- C:\Users\ich\Desktop\Bildschirmfoto.jpg
[2011.06.18 16:11:25 | 000,000,144 | ---- | M] () -- C:\Windows\SetOpp.loc
[2011.06.18 16:11:00 | 000,001,034 | ---- | M] () -- C:\Users\ich\Desktop\CondaCam12.lnk
[2011.06.17 16:11:48 | 000,114,064 | ---- | M] () -- C:\Users\ich\Desktop\Daten_Hardal.jpg
[7 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.07.07 16:05:11 | 000,001,067 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.07.07 14:07:28 | 000,002,044 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk
[2011.07.07 14:07:28 | 000,002,032 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Thunderbird.lnk
[2011.07.07 13:54:26 | 676,647,004 | ---- | C] () -- C:\Users\ich\Desktop\Thunderbird 3.1.10 (de) - 2011-07-07.pcv
[2011.07.07 13:21:03 | 000,000,061 | ---- | C] () -- C:\Windows\wininit.ini
[2011.07.07 02:27:54 | 000,014,608 | ---- | C] () -- C:\Users\ich\Desktop\Seitenwange Portal Loslagerseite V2 geschweißt V1.1.tap
[2011.07.07 01:52:20 | 001,624,196 | ---- | C] () -- C:\Users\ich\Desktop\galaxy 016.jpg
[2011.07.07 01:50:54 | 001,489,305 | ---- | C] () -- C:\Users\ich\Desktop\galaxy 013.jpg
[2011.07.07 01:49:55 | 001,603,285 | ---- | C] () -- C:\Users\ich\Desktop\galaxy 015.jpg
[2011.07.06 17:29:02 | 000,014,698 | ---- | C] () -- C:\Users\ich\Desktop\Seitenwange Portal Festlagerseite V2 geschweißt V1.1.tab
[2011.07.05 22:16:10 | 000,347,448 | ---- | C] () -- C:\Users\ich\Desktop\RE-11196.pdf
[2011.07.05 18:41:34 | 000,014,555 | ---- | C] () -- C:\Users\ich\Desktop\Seitenwange Portal Festlagerseite V2 geschweißt V1.0.tap
[2011.07.05 17:55:38 | 000,088,267 | ---- | C] () -- C:\Users\ich\Desktop\Seitenwange Portal Loslagerseite V2 geschweißt.job
[2011.07.05 17:38:55 | 000,075,286 | ---- | C] () -- C:\Users\ich\Desktop\Seitenwange Portal Festlagerseite V2 geschweißt.job
[2011.07.05 14:31:02 | 000,503,338 | ---- | C] () -- C:\Users\ich\Desktop\anni6pa.jpg
[2011.07.04 22:12:40 | 000,012,453 | ---- | C] () -- C:\Users\ich\Desktop\Plasma 6mm V1.1.tap
[2011.07.02 02:13:58 | 000,004,290 | ---- | C] () -- C:\Users\ich\Desktop\Plasma 6.. Nr. 2.tap
[2011.07.02 02:13:14 | 000,024,490 | ---- | C] () -- C:\Users\ich\Desktop\Plasma 6.. Nr. 2.job
[2011.07.02 00:39:49 | 000,009,456 | ---- | C] () -- C:\Users\ich\Desktop\Plasma 6mm V1.tap
[2011.07.02 00:32:25 | 000,040,017 | ---- | C] () -- C:\Users\ich\Desktop\Plasma 6mm V1.job
[2011.07.02 00:17:14 | 000,001,004 | ---- | C] () -- C:\Users\ich\Desktop\Fertigungsdaten.lnk
[2011.06.30 19:59:00 | 000,070,517 | ---- | C] () -- C:\Users\ich\Desktop\annix1gr.jpg
[2011.06.30 17:19:39 | 000,235,786 | ---- | C] () -- C:\Users\ich\Desktop\Bildschirmfoto 2011-06-30 um 17.19.14.png
[2011.06.29 17:30:08 | 000,020,386 | ---- | C] () -- C:\Users\ich\Desktop\Alibre Drawing.pdf
[2011.06.29 17:26:50 | 000,020,135 | ---- | C] () -- C:\Users\ich\Desktop\document.pdf
[2011.06.29 16:57:11 | 000,107,269 | ---- | C] () -- C:\Users\ich\Desktop\bilder.pdf
[2011.06.29 16:33:05 | 000,378,078 | ---- | C] () -- C:\Users\ich\Desktop\Bildschirmfoto 2011-06-29 um 16.32.44.png
[2011.06.28 23:21:29 | 000,036,074 | ---- | C] () -- C:\Users\ich\Desktop\obere Platte Schlitten X komplett.job
[2011.06.28 22:48:05 | 000,096,688 | ---- | C] () -- C:\Users\ich\Desktop\Neue Zeichnung (1).dxf
[2011.06.28 22:43:26 | 000,019,850 | ---- | C] () -- C:\Users\ich\Desktop\WST.part
[2011.06.28 22:43:12 | 000,048,071 | ---- | C] () -- C:\Users\ich\Desktop\SSSSS.job
[2011.06.28 17:12:59 | 000,008,106 | ---- | C] () -- C:\Users\ich\Desktop\Blechteile Absaughaube v3.tap
[2011.06.28 01:09:32 | 000,832,180 | ---- | C] () -- C:\Users\ich\Desktop\Mts-cncDE.pdf
[2011.06.27 23:10:26 | 000,006,930 | ---- | C] () -- C:\Users\ich\Desktop\Blendenbleche Schaltschrank.tap
[2011.06.27 23:09:36 | 000,024,374 | ---- | C] () -- C:\Users\ich\Desktop\Blendenbleche Schaltschrank.job
[2011.06.27 16:28:38 | 000,007,232 | ---- | C] () -- C:\Users\ich\Desktop\Blechteile Absaughaube v2.tap
[2011.06.24 17:41:56 | 000,001,787 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk
[2011.06.24 17:41:56 | 000,001,775 | ---- | C] () -- C:\Users\Public\Desktop\Opera.lnk
[2011.06.24 17:34:19 | 000,267,653 | ---- | C] () -- C:\Users\ich\Desktop\Opera Lesezeichen 24.6.2011.adr
[2011.06.24 00:46:18 | 000,000,829 | ---- | C] () -- C:\Users\ich\Desktop\Schaltnocke Y Fase.nc
[2011.06.24 00:35:44 | 000,187,633 | ---- | C] () -- C:\Users\ich\Desktop\Schaltnocke Y.stp
[2011.06.23 17:05:22 | 000,005,609 | ---- | C] () -- C:\Users\ich\Desktop\Schaltnocke Y.nc
[2011.06.23 02:11:03 | 000,098,119 | ---- | C] () -- C:\Users\ich\Desktop\Bildschirmfoto.jpg
[2011.06.22 16:46:22 | 000,037,918 | ---- | C] () -- C:\Users\ich\Desktop\Blechteile Absaughaube.job
[2011.06.18 16:11:00 | 000,001,034 | ---- | C] () -- C:\Users\ich\Desktop\CondaCam12.lnk
[2011.06.17 16:11:48 | 000,114,064 | ---- | C] () -- C:\Users\ich\Desktop\Daten_Hardal.jpg
[2011.06.17 16:11:25 | 000,000,144 | ---- | C] () -- C:\Windows\SetOpp.loc
[2011.03.28 17:43:41 | 000,003,072 | ---- | C] () -- C:\Windows\System32\34CoInstaller.dll
[2011.03.28 17:43:11 | 000,049,152 | ---- | C] () -- C:\Windows\System32\CardID.dll
[2011.03.15 16:14:11 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2011.03.15 14:24:05 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll
[2011.03.15 01:54:14 | 000,000,100 | ---- | C] () -- C:\Windows\1FB169BC-703B-4282-BD96-2CCF743D3814.ini
[2011.03.15 00:40:32 | 000,000,000 | ---- | C] () -- C:\Windows\HPMProp.INI
[2011.03.14 23:56:27 | 000,000,036 | ---- | C] () -- C:\ProgramData\InstallAlibre.config
[2011.03.14 23:18:39 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2011.03.14 22:15:56 | 001,731,104 | ---- | C] () -- C:\Windows\System32\nvwdmcpl.dll
[2011.03.14 22:15:56 | 001,657,376 | ---- | C] () -- C:\Windows\System32\nwiz.exe
[2011.03.14 22:15:56 | 001,514,016 | ---- | C] () -- C:\Windows\System32\nView.dll
[2011.03.14 22:15:56 | 001,108,512 | ---- | C] () -- C:\Windows\System32\nvwimg.dll
[2011.03.14 22:15:56 | 000,473,632 | ---- | C] () -- C:\Windows\System32\nvShell.dll
[2011.03.14 22:15:56 | 000,449,056 | ---- | C] () -- C:\Windows\System32\nvAppBar.exe
[2011.03.14 22:15:56 | 000,267,296 | ---- | C] () -- C:\Windows\System32\nvTaskbar.exe
[2010.11.10 03:45:32 | 000,102,744 | ---- | C] () -- C:\Windows\System32\LogiDPPApp.exe
[2010.11.10 03:45:30 | 010,871,128 | ---- | C] () -- C:\Windows\System32\LogiDPP.dll
[2010.11.10 03:45:20 | 000,316,248 | ---- | C] () -- C:\Windows\System32\DevManagerCore.dll
[2010.11.10 03:31:42 | 000,026,286 | ---- | C] () -- C:\Windows\System32\lvcoinst.ini
[2010.07.16 16:50:36 | 000,022,806 | ---- | C] () -- C:\Windows\CondaCam12.ini
[2009.07.14 10:47:43 | 000,654,166 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2009.07.14 10:47:43 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2009.07.14 10:47:43 | 000,130,006 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2009.07.14 10:47:43 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2009.07.14 06:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 06:33:53 | 000,294,872 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2009.07.14 04:05:48 | 000,616,008 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2009.07.14 04:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2009.07.14 04:05:48 | 000,106,388 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2009.07.14 04:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2009.07.14 04:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2009.07.14 04:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2009.07.14 01:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 01:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
[2009.06.10 23:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
 
========== LOP Check ==========
 
[2011.03.15 14:10:56 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\.algor
[2011.07.07 17:39:31 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\.purple
[2011.07.07 02:32:21 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\Alibre Design
[2011.04.30 01:18:25 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\CadSoft
[2011.03.14 23:00:40 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\CheckPoint
[2011.04.04 13:49:52 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\elsterformular
[2011.03.15 02:21:14 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\Foxit Software
[2011.06.29 16:57:02 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\gtk-2.0
[2011.04.11 17:34:32 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\IrfanView
[2011.03.15 00:22:16 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\Leadertech
[2011.05.12 17:39:35 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\MS-Buchhalter
[2011.03.20 02:19:31 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\OpenOffice.org
[2011.06.24 17:41:59 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\Opera
[2011.06.01 23:48:04 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\PCDr
[2011.07.07 03:02:17 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\SheetCam TNG
[2011.03.15 14:18:09 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\Thunderbird
[2011.06.01 23:39:46 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\Update
[2011.06.27 15:49:07 | 000,000,528 | ---- | M] () -- C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job
[2011.06.09 20:14:15 | 000,032,630 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2011.07.07 12:33:47 | 000,000,466 | ---- | M] () -- C:\Windows\Tasks\SystemToolsDailyTest.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2011.03.15 14:10:56 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\.algor
[2011.07.07 17:39:31 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\.purple
[2011.04.08 23:18:56 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\Adobe
[2011.07.07 02:32:21 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\Alibre Design
[2011.04.20 13:13:57 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\Avira
[2011.04.30 01:18:25 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\CadSoft
[2011.03.14 23:00:40 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\CheckPoint
[2011.04.04 13:49:52 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\elsterformular
[2011.03.15 02:21:14 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\Foxit Software
[2011.06.29 16:57:02 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\gtk-2.0
[2011.03.14 21:58:41 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\Identities
[2011.04.11 17:34:32 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\IrfanView
[2011.03.15 00:22:16 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\Leadertech
[2011.03.15 00:20:25 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\Logishrd
[2011.03.15 00:22:22 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\Logitech
[2011.03.14 23:44:20 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\Macromedia
[2011.07.07 16:06:00 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\Malwarebytes
[2009.07.14 10:56:56 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\Media Center Programs
[2011.06.01 23:35:50 | 000,000,000 | --SD | M] -- C:\Users\ich\AppData\Roaming\Microsoft
[2011.03.15 14:18:10 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\Mozilla
[2011.05.12 17:39:35 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\MS-Buchhalter
[2011.03.20 02:19:31 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\OpenOffice.org
[2011.06.24 17:41:59 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\Opera
[2011.06.01 23:48:04 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\PCDr
[2011.07.07 03:02:17 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\SheetCam TNG
[2011.07.07 17:43:57 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\Skype
[2011.07.07 16:01:39 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\skypePM
[2011.03.15 14:18:09 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\Thunderbird
[2011.06.01 23:39:46 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\Update
[2011.04.05 11:33:51 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\WinRAR
 
< %APPDATA%\*.exe /s >
[2011.03.15 00:22:16 | 000,053,248 | R--- | M] (Acresso Software Inc.) -- C:\Users\ich\AppData\Roaming\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_bc1a57271cf2f285\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_fab873f3e8a3315c\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_df3f92057fcbe7a7\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
 
< MD5 for: IASTORV.SYS  >
[2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys
[2010.11.20 14:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\System32\drivers\iaStorV.sys
[2010.11.20 14:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_668286aa35d55928\iaStorV.sys
[2010.11.20 14:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_b118bc63e60a139a\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\System32\netlogon.dll
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_ffbf212e963c0162\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2010.11.20 14:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\System32\drivers\nvstor.sys
[2010.11.20 14:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_dd659ed032d28a14\nvstor.sys
[2010.11.20 14:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_3be22d131d40bd72\nvstor.sys
[2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\System32\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_3a154c47375d881d\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009.07.14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll
[2010.11.20 14:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\System32\user32.dll
[2010.11.20 14:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\System32\userinit.exe
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\System32\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.10.28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe
[2009.10.28 07:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe
[2010.11.20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\System32\winlogon.exe
[2010.11.20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe
[2009.07.14 03:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
[2010.05.15 17:30:50 | 000,461,400 | ---- | M] (Check Point Software Technologies LTD) Unable to obtain MD5 -- C:\Windows\system32\drivers\vsdatant.sys
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[7 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ]
 
<            >

< End of report >

--- --- ---

Ichs ollte aber evtl. dazu sagen dass ich Thunderbird bereits deinstaliert und neu instaliert habe....

gruss

dichter84 · 07.07.2011, 19:40

Ok, alles erledigt... Beim Vollscan kam nix raus.

Hier das Log vom OLT:OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 07.07.2011 17:44:04 - Run 1
OTL by OldTimer - Version 3.2.26.1     Folder = C:\Users\ich\Desktop
 An unknown product Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,98 Gb Total Physical Memory | 1,96 Gb Available Physical Memory | 65,60% Memory free
5,96 Gb Paging File | 4,64 Gb Available in Paging File | 77,75% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 148,37 Gb Total Space | 91,97 Gb Free Space | 61,99% Space Free | Partition Type: NTFS
Drive M: | 100,00 Gb Total Space | 90,00 Gb Free Space | 90,00% Space Free | Partition Type: MFilesFS
 
Computer Name: DICHTER84-NEU | User Name: ich | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2011.07.07 17:41:00 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Users\ich\Desktop\OTL.exe
PRC - [2011.06.29 12:19:54 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.05.29 09:11:28 | 000,449,584 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2011.05.29 09:11:28 | 000,366,640 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2011.05.06 18:15:20 | 000,532,320 | ---- | M] (Spigot, Inc.) -- C:\Programme\Common Files\Spigot\Search Settings\SearchSettings.exe
PRC - [2011.05.06 17:33:00 | 000,393,112 | ---- | M] (Spigot, Inc.) -- C:\Programme\Application Updater\ApplicationUpdater.exe
PRC - [2011.04.27 15:28:21 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2011.03.11 04:37:52 | 000,048,618 | ---- | M] (The Pidgin developer community) -- C:\Programme\Pidgin\pidgin.exe
PRC - [2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2011.02.18 18:30:32 | 002,435,592 | ---- | M] (Check Point Software Technologies LTD) -- C:\Windows\System32\ZoneLabs\vsmon.exe
PRC - [2011.02.18 18:28:38 | 001,043,968 | ---- | M] (Check Point Software Technologies LTD) -- C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
PRC - [2011.02.15 17:25:48 | 000,488,952 | ---- | M] (Check Point Software Technologies) -- C:\Programme\CheckPoint\ZAForceField\ISWSVC.exe
PRC - [2011.02.15 17:25:42 | 000,738,808 | ---- | M] (Check Point Software Technologies) -- C:\Programme\CheckPoint\ZAForceField\ForceField.exe
PRC - [2011.01.17 19:50:34 | 011,322,880 | ---- | M] (OpenOffice.org) -- C:\Programme\OpenOffice.org 3\program\soffice.exe
PRC - [2011.01.17 19:50:34 | 011,314,688 | ---- | M] (OpenOffice.org) -- C:\Programme\OpenOffice.org 3\program\soffice.bin
PRC - [2011.01.10 17:50:46 | 001,028,096 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Common Files\Lenovo\tvt_reg_monitor_svc.exe
PRC - [2011.01.10 15:22:55 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010.12.03 19:19:50 | 000,137,656 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\ZOOM\TpScrex.exe
PRC - [2010.12.03 19:19:32 | 000,258,920 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\HOTKEY\TPONSCR.exe
PRC - [2010.12.03 11:57:38 | 000,099,328 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\HOTKEY\tphkload.exe
PRC - [2010.12.02 13:55:54 | 000,064,440 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\HOTKEY\TPHKSVC.exe
PRC - [2010.11.29 17:32:44 | 000,069,560 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\HOTKEY\TPOSDSVC.exe
PRC - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2010.11.20 14:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2010.11.20 14:17:00 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
PRC - [2010.11.09 22:08:58 | 000,146,000 | ---- | M] (Logitech, Inc.) -- C:\Programme\Common Files\LogiShrd\KHAL3\KHALMNPR.exe
PRC - [2010.10.29 01:32:48 | 001,352,272 | ---- | M] (Logitech, Inc.) -- C:\Programme\Logitech\SetPointP\SetPoint.exe
PRC - [2010.10.14 20:26:06 | 000,128,296 | ---- | M] (Synaptics Incorporated) -- C:\Programme\Synaptics\SynTP\SynTPLpr.exe
PRC - [2010.04.07 15:37:38 | 000,093,032 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\VIRTSCRL\lvvsst.exe
PRC - [2010.04.01 15:50:44 | 000,043,960 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\VIRTSCRL\virtscrl.exe
PRC - [2010.01.14 22:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2009.12.21 07:44:50 | 003,771,704 | ---- | M] (Motive Systems) -- C:\Programme\M-Files\6.0.2325.14\Bin\x86\MFClient.exe
PRC - [2009.12.21 04:40:44 | 009,353,528 | ---- | M] (Motive Systems) -- C:\Programme\M-Files\6.0.2325.14\Bin\x86\MFServer.exe
PRC - [2009.12.21 03:58:48 | 000,998,712 | ---- | M] (Motive Systems) -- C:\Programme\M-Files\6.0.2325.14\Bin\x86\MFStatus.exe
PRC - [2009.12.21 03:50:04 | 000,934,200 | ---- | M] (Motive Systems) -- C:\Programme\M-Files\6.0.2325.14\Bin\x86\MFServerAux.exe
PRC - [2009.12.21 03:38:36 | 000,889,144 | ---- | M] (Motive Systems) -- C:\Programme\M-Files\6.0.2325.14\Bin\x86\MFAUClient.exe
PRC - [2009.12.21 02:33:16 | 000,642,872 | ---- | M] (Motive Systems) -- C:\Programme\M-Files\6.0.2325.14\Bin\x86\MFSetup.exe
PRC - [2009.07.20 00:55:50 | 004,446,752 | ---- | M] () -- C:\Programme\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe
PRC - [2009.07.14 03:14:24 | 000,157,184 | ---- | M] (Microsoft Corporation) -- c:\Programme\Windows Defender\MpCmdRun.exe
PRC - [2008.07.15 18:09:52 | 000,090,112 | ---- | M] (Andrea Electronics Corporation) -- C:\Windows\System32\AEADISRV.EXE
PRC - [2005.07.19 11:16:50 | 000,507,904 | ---- | M] (AVerMedia Technologies, Inc.) -- C:\Programme\AVerTV Hybrid + FM Cardbus\AVerQT.exe
 
 
========== Modules (SafeList) ==========
 
MOD - [2011.07.07 17:41:00 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Users\ich\Desktop\OTL.exe
MOD - [2011.02.15 17:25:56 | 000,640,504 | ---- | M] (Check Point Software Technologies) -- C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
MOD - [2010.11.20 13:55:09 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
MOD - [2010.11.05 03:58:01 | 000,632,656 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
MOD - [2010.11.05 03:58:00 | 000,554,832 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcp80.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2011.06.29 12:19:54 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.05.29 09:11:28 | 000,366,640 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011.05.06 17:33:00 | 000,393,112 | ---- | M] (Spigot, Inc.) [Auto | Running] -- C:\Program Files\Application Updater\ApplicationUpdater.exe -- (Application Updater)
SRV - [2011.04.27 15:28:21 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011.02.18 18:30:32 | 002,435,592 | ---- | M] (Check Point Software Technologies LTD) [Auto | Running] -- C:\Windows\System32\ZoneLabs\vsmon.exe -- (vsmon)
SRV - [2011.02.15 17:25:48 | 000,488,952 | ---- | M] (Check Point Software Technologies) [Auto | Running] -- C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe -- (IswSvc)
SRV - [2011.01.10 17:50:46 | 001,028,096 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe -- (ThinkVantage Registry Monitor Service)
SRV - [2010.12.03 11:57:38 | 000,099,328 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Programme\Lenovo\HOTKEY\tphkload.exe -- (TPHKLOAD)
SRV - [2010.12.02 13:55:54 | 000,064,440 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Programme\Lenovo\HOTKEY\TPHKSVC.exe -- (TPHKSVC)
SRV - [2010.11.24 17:34:24 | 000,045,496 | ---- | M] (Lenovo Group Limited) [Auto | Stopped] -- C:\Programme\Lenovo\HOTKEY\micmute.exe -- (LENOVO.MICMUTE)
SRV - [2010.10.28 12:13:30 | 000,293,456 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Programme\Common Files\LogiShrd\Bluetooth\LBTServ.exe -- (LBTServ)
SRV - [2010.04.07 15:37:38 | 000,093,032 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Programme\Lenovo\VIRTSCRL\lvvsst.exe -- (Lenovo.VIRTSCRLSVC)
SRV - [2009.12.21 07:44:50 | 003,771,704 | ---- | M] (Motive Systems) [Auto | Running] -- C:\Program Files\M-Files\6.0.2325.14\Bin\x86\mfclient.exe -- (MFClient 6.0.2325.14)
SRV - [2009.12.21 04:40:44 | 009,353,528 | ---- | M] (Motive Systems) [Auto | Running] -- C:\Program Files\M-Files\6.0.2325.14\Bin\x86\mfserver.exe -- (MFServer 6.0.2325.14)
SRV - [2009.12.21 03:50:04 | 000,934,200 | ---- | M] (Motive Systems) [Auto | Running] -- C:\Program Files\M-Files\6.0.2325.14\Bin\x86\mfserveraux.exe -- (MFServerAux 6.0.2325.14)
SRV - [2009.12.21 02:33:16 | 000,642,872 | ---- | M] (Motive Systems) [Auto | Running] -- C:\Program Files\M-Files\6.0.2325.14\Bin\x86\mfsetup.exe -- (MFSetup 6.0.2325.14)
SRV - [2009.07.20 00:55:50 | 004,446,752 | ---- | M] () [Auto | Running] -- C:\Program Files\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe -- (NVIDIA Performance Driver Service)
SRV - [2009.07.14 03:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc)
SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2008.07.15 18:09:52 | 000,090,112 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\System32\AEADISRV.EXE -- (AEADIFilters)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2011.06.29 12:19:55 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2011.06.29 12:19:55 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011.05.29 09:11:20 | 000,022,712 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2011.04.11 16:15:50 | 000,033,088 | ---- | M] (Lenovo (United States) Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\psadd.sys -- (psadd)
DRV - [2011.02.15 17:25:36 | 000,026,872 | ---- | M] (Check Point Software Technologies) [Kernel | Auto | Running] -- C:\Programme\CheckPoint\ZAForceField\ISWKL.sys -- (ISWKL)
DRV - [2011.01.13 15:04:50 | 000,122,992 | ---- | M] (Lenovo.) [Kernel | Boot | Running] -- C:\Windows\System32\DRIVERS\Apsx86.sys -- (Shockprf)
DRV - [2011.01.13 15:02:56 | 000,020,592 | ---- | M] (Lenovo.) [Kernel | Boot | Running] -- C:\Windows\System32\DRIVERS\ApsHM86.sys -- (TPDIGIMN)
DRV - [2010.11.20 14:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\vmbus.sys -- (vmbus)
DRV - [2010.11.20 14:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010.11.20 14:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\storvsc.sys -- (storvsc)
DRV - [2010.11.20 12:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010.11.20 11:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010.11.20 11:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\vms3cap.sys -- (s3cap)
DRV - [2010.11.10 03:49:50 | 004,323,040 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvuvc.sys -- (LVUVC) Logitech Webcam 200(UVC)
DRV - [2010.11.10 03:48:12 | 000,283,744 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvrs.sys -- (LVRS)
DRV - [2010.09.07 15:09:06 | 000,013,680 | ---- | M] (Lenovo Group Limited) [Kernel | System | Running] -- C:\Windows\System32\drivers\smiif32.sys -- (lenovo.smi)
DRV - [2010.08.24 19:31:02 | 000,037,328 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV - [2010.08.24 19:30:52 | 000,038,864 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2010.06.17 15:27:02 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2010.05.15 17:30:50 | 000,461,400 | ---- | M] (Check Point Software Technologies LTD) [Kernel | System | Running] -- C:\Windows\System32\drivers\vsdatant.sys -- (Vsdatant)
DRV - [2010.05.02 16:29:55 | 000,108,640 | ---- | M] (Your Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Mach3.sys -- (Mach3)
DRV - [2009.12.21 02:13:02 | 000,073,400 | ---- | M] (Motive Systems) [File_System | On_Demand | Running] -- C:\Programme\M-Files\6.0.2325.14\Bin\x86\MFFSD.sys -- (MFFSD4A88F8ED-C1B6-40FA-9611-8F49CDF70AD6)
DRV - [2009.12.21 02:12:44 | 000,016,312 | ---- | M] (Motive Systems) [Kernel | On_Demand | Running] -- C:\Programme\M-Files\6.0.2325.14\Bin\x86\MFVDD.sys -- (MFVDD1C0F24D2-7FBC-4F4A-83B6-F2B917364180)
DRV - [2009.09.06 01:21:46 | 009,833,032 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2009.07.14 01:45:33 | 000,083,456 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\serial.sys -- (Serial)
DRV - [2009.07.14 00:02:51 | 004,231,168 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\netw5v32.sys -- (netw5v32) Intel(R)
DRV - [2009.07.14 00:02:50 | 000,211,456 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express) Intel(R)
DRV - [2009.07.02 10:16:22 | 000,038,336 | ---- | M] (Lenovo (United States) Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tvti2c.sys -- (TVTI2C)
DRV - [2008.02.15 19:01:18 | 000,046,592 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)
DRV - [2007.07.30 12:54:02 | 000,038,400 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2007.07.30 11:42:58 | 000,043,008 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2006.11.27 18:44:52 | 000,008,192 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)
DRV - [2005.08.26 11:10:02 | 000,509,312 | ---- | M] (AVerMedia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AVerE506.sys -- (AVerE506)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\URLSearchHook: {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Programme\ZoneAlarm-Sicherheit\tbZone.dll (Conduit Ltd.)
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.ask.com?o=101702&l=dis
IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} -  File not found
IE - HKCU\..\URLSearchHook: {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Programme\pdfforge Toolbar\IE\4.4\pdfforgeToolbarIE.dll (Spigot, Inc.)
IE - HKCU\..\URLSearchHook: {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Programme\ZoneAlarm-Sicherheit\tbZone.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@checkpoint.com/FFApi: C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\npFFApi.dll ()
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Program Files\CheckPoint\ZAForceField\TrustChecker [2011.03.15 00:46:38 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 5.0\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2011.07.07 14:07:27 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 5.0\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
 
[2011.03.15 14:18:10 | 000,000,000 | ---D | M] (No name found) -- C:\Users\ich\AppData\Roaming\mozilla\Extensions
[2011.03.15 14:18:10 | 000,000,000 | ---D | M] (No name found) -- C:\Users\ich\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
File not found (No name found) -- 
 
O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (ZoneAlarm Security Engine Registrar) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Programme\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Programme\pdfforge Toolbar\IE\4.4\pdfforgeToolbarIE.dll (Spigot, Inc.)
O2 - BHO: (Foxit PDF Creator Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} -  File not found
O2 - BHO: (ZoneAlarm-Sicherheit Toolbar) - {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Programme\ZoneAlarm-Sicherheit\tbZone.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Programme\pdfforge Toolbar\IE\4.4\pdfforgeToolbarIE.dll (Spigot, Inc.)
O3 - HKLM\..\Toolbar: (Foxit PDF Creator Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} -  File not found
O3 - HKLM\..\Toolbar: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Programme\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O3 - HKLM\..\Toolbar: (ZoneAlarm-Sicherheit Toolbar) - {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Programme\ZoneAlarm-Sicherheit\tbZone.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Foxit PDF Creator Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} -  File not found
O3 - HKCU\..\Toolbar\WebBrowser: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Programme\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O3 - HKCU\..\Toolbar\WebBrowser: (ZoneAlarm-Sicherheit Toolbar) - {FC2B76FC-2132-4D80-A9A3-1F5C6E49066B} - C:\Programme\ZoneAlarm-Sicherheit\tbZone.dll (Conduit Ltd.)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [ApnUpdater]  File not found
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4 - HKLM..\Run: [ISW] C:\Program Files\CheckPoint\ZAForceField\ForceField.exe (Check Point Software Technologies)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [M-Files Status 6.0.2325.14] C:\Program Files\M-Files\6.0.2325.14\Bin\x86\MFStatus.exe (Motive Systems)
O4 - HKLM..\Run: [M-Files Updates 6.0.2325.14] C:\Program Files\M-Files\6.0.2325.14\Bin\x86\MFAUClient.exe (Motive Systems)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\Windows\System32\nwiz.exe ()
O4 - HKLM..\Run: [SearchSettings] C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe (Spigot, Inc.)
O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - Startup: C:\Users\ich\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Programme\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 82.212.62.62 78.42.43.62 192.168.0.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - Winlogon\Notify\LBTWlgn: DllName - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll - c:\Programme\Common Files\LogiShrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: vsmon - C:\Windows\System32\ZoneLabs\vsmon.exe (Check Point Software Technologies LTD)
SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.i420 - C:\Windows\System32\lvcodec2.dll (Logitech Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.07.07 17:40:59 | 000,579,584 | ---- | C] (OldTimer Tools) -- C:\Users\ich\Desktop\OTL.exe
[2011.07.07 16:06:00 | 000,000,000 | ---D | C] -- C:\Users\ich\AppData\Roaming\Malwarebytes
[2011.07.07 16:05:11 | 000,039,984 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2011.07.07 16:05:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011.07.07 16:05:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.07.07 16:05:06 | 000,022,712 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011.07.07 16:05:06 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011.07.07 16:04:28 | 009,435,312 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\ich\Desktop\mbam-setup-1.51.0.1200.exe
[2011.07.07 14:07:26 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Thunderbird
[2011.06.24 17:41:59 | 000,000,000 | ---D | C] -- C:\Users\ich\AppData\Local\Opera
[2011.06.20 17:13:24 | 000,000,000 | ---D | C] -- C:\Users\ich\Desktop\NC-Dateien
[2011.06.18 16:10:59 | 000,000,000 | ---D | C] -- C:\Users\ich\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\3D-M-SOFT
[2011.06.18 16:10:59 | 000,000,000 | ---D | C] -- C:\Program Files\3D-M-SOFT
[2011.06.17 10:18:57 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[7 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.07.07 17:41:00 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Users\ich\Desktop\OTL.exe
[2011.07.07 17:39:21 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.07.07 16:05:11 | 000,001,067 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.07.07 16:04:32 | 009,435,312 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\ich\Desktop\mbam-setup-1.51.0.1200.exe
[2011.07.07 14:08:29 | 000,013,584 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011.07.07 14:08:29 | 000,013,584 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011.07.07 14:07:28 | 000,002,032 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Thunderbird.lnk
[2011.07.07 14:00:45 | 2401,996,800 | -HS- | M] () -- C:\hiberfil.sys
[2011.07.07 13:57:26 | 676,647,004 | ---- | M] () -- C:\Users\ich\Desktop\Thunderbird 3.1.10 (de) - 2011-07-07.pcv
[2011.07.07 13:55:50 | 000,654,166 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.07.07 13:55:50 | 000,616,008 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.07.07 13:55:50 | 000,130,006 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.07.07 13:55:50 | 000,106,388 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.07.07 13:21:03 | 000,000,061 | ---- | M] () -- C:\Windows\wininit.ini
[2011.07.07 12:33:47 | 000,000,466 | ---- | M] () -- C:\Windows\tasks\SystemToolsDailyTest.job
[2011.07.07 12:33:40 | 000,294,872 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011.07.07 03:02:15 | 000,014,608 | ---- | M] () -- C:\Users\ich\Desktop\Seitenwange Portal Loslagerseite V2 geschweißt V1.1.tap
[2011.07.07 03:01:42 | 000,088,267 | ---- | M] () -- C:\Users\ich\Desktop\Seitenwange Portal Loslagerseite V2 geschweißt.job
[2011.07.07 01:52:35 | 001,624,196 | ---- | M] () -- C:\Users\ich\Desktop\galaxy 016.jpg
[2011.07.07 01:51:08 | 001,489,305 | ---- | M] () -- C:\Users\ich\Desktop\galaxy 013.jpg
[2011.07.07 01:50:12 | 001,603,285 | ---- | M] () -- C:\Users\ich\Desktop\galaxy 015.jpg
[2011.07.06 17:29:02 | 000,014,698 | ---- | M] () -- C:\Users\ich\Desktop\Seitenwange Portal Festlagerseite V2 geschweißt V1.1.tab
[2011.07.06 16:54:30 | 000,075,286 | ---- | M] () -- C:\Users\ich\Desktop\Seitenwange Portal Festlagerseite V2 geschweißt.job
[2011.07.06 15:41:55 | 000,014,555 | ---- | M] () -- C:\Users\ich\Desktop\Seitenwange Portal Festlagerseite V2 geschweißt V1.0.tap
[2011.07.05 22:16:11 | 000,347,448 | ---- | M] () -- C:\Users\ich\Desktop\RE-11196.pdf
[2011.07.05 14:31:28 | 000,503,338 | ---- | M] () -- C:\Users\ich\Desktop\anni6pa.jpg
[2011.07.05 02:48:57 | 322,557,763 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2011.07.04 22:13:25 | 000,004,290 | ---- | M] () -- C:\Users\ich\Desktop\Plasma 6.. Nr. 2.tap
[2011.07.04 22:12:40 | 000,012,453 | ---- | M] () -- C:\Users\ich\Desktop\Plasma 6mm V1.1.tap
[2011.07.04 22:12:18 | 000,040,017 | ---- | M] () -- C:\Users\ich\Desktop\Plasma 6mm V1.job
[2011.07.04 22:11:12 | 000,024,490 | ---- | M] () -- C:\Users\ich\Desktop\Plasma 6.. Nr. 2.job
[2011.07.02 13:11:14 | 000,009,456 | ---- | M] () -- C:\Users\ich\Desktop\Plasma 6mm V1.tap
[2011.07.02 00:20:33 | 000,000,000 | ---- | M] () -- C:\Windows\System32\drivers\lvuvc.hs
[2011.07.02 00:17:14 | 000,001,004 | ---- | M] () -- C:\Users\ich\Desktop\Fertigungsdaten.lnk
[2011.06.30 19:59:10 | 000,070,517 | ---- | M] () -- C:\Users\ich\Desktop\annix1gr.jpg
[2011.06.30 17:20:07 | 000,235,786 | ---- | M] () -- C:\Users\ich\Desktop\Bildschirmfoto 2011-06-30 um 17.19.14.png
[2011.06.29 22:53:39 | 000,020,386 | ---- | M] () -- C:\Users\ich\Desktop\Alibre Drawing.pdf
[2011.06.29 19:05:20 | 000,020,135 | ---- | M] () -- C:\Users\ich\Desktop\document.pdf
[2011.06.29 16:57:12 | 000,107,269 | ---- | M] () -- C:\Users\ich\Desktop\bilder.pdf
[2011.06.29 16:33:29 | 000,378,078 | ---- | M] () -- C:\Users\ich\Desktop\Bildschirmfoto 2011-06-29 um 16.32.44.png
[2011.06.29 12:19:55 | 000,138,192 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys
[2011.06.29 12:19:55 | 000,066,616 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys
[2011.06.28 23:56:02 | 000,036,074 | ---- | M] () -- C:\Users\ich\Desktop\obere Platte Schlitten X komplett.job
[2011.06.28 22:48:06 | 000,096,688 | ---- | M] () -- C:\Users\ich\Desktop\Neue Zeichnung (1).dxf
[2011.06.28 22:43:26 | 000,019,850 | ---- | M] () -- C:\Users\ich\Desktop\WST.part
[2011.06.28 22:43:12 | 000,048,071 | ---- | M] () -- C:\Users\ich\Desktop\SSSSS.job
[2011.06.28 17:15:08 | 000,037,918 | ---- | M] () -- C:\Users\ich\Desktop\Blechteile Absaughaube.job
[2011.06.28 17:13:00 | 000,008,106 | ---- | M] () -- C:\Users\ich\Desktop\Blechteile Absaughaube v3.tap
[2011.06.28 16:30:44 | 000,007,232 | ---- | M] () -- C:\Users\ich\Desktop\Blechteile Absaughaube v2.tap
[2011.06.28 01:23:35 | 000,022,806 | ---- | M] () -- C:\Windows\CondaCam12.ini
[2011.06.28 01:09:32 | 000,832,180 | ---- | M] () -- C:\Users\ich\Desktop\Mts-cncDE.pdf
[2011.06.27 23:26:24 | 000,006,930 | ---- | M] () -- C:\Users\ich\Desktop\Blendenbleche Schaltschrank.tap
[2011.06.27 23:26:10 | 000,024,374 | ---- | M] () -- C:\Users\ich\Desktop\Blendenbleche Schaltschrank.job
[2011.06.27 15:49:07 | 000,000,528 | ---- | M] () -- C:\Windows\tasks\PCDoctorBackgroundMonitorTask.job
[2011.06.24 17:41:56 | 000,001,775 | ---- | M] () -- C:\Users\Public\Desktop\Opera.lnk
[2011.06.24 17:34:19 | 000,267,653 | ---- | M] () -- C:\Users\ich\Desktop\Opera Lesezeichen 24.6.2011.adr
[2011.06.24 16:23:13 | 000,000,829 | ---- | M] () -- C:\Users\ich\Desktop\Schaltnocke Y Fase.nc
[2011.06.24 00:35:45 | 000,187,633 | ---- | M] () -- C:\Users\ich\Desktop\Schaltnocke Y.stp
[2011.06.24 00:24:20 | 000,005,609 | ---- | M] () -- C:\Users\ich\Desktop\Schaltnocke Y.nc
[2011.06.23 02:11:13 | 000,098,119 | ---- | M] () -- C:\Users\ich\Desktop\Bildschirmfoto.jpg
[2011.06.18 16:11:25 | 000,000,144 | ---- | M] () -- C:\Windows\SetOpp.loc
[2011.06.18 16:11:00 | 000,001,034 | ---- | M] () -- C:\Users\ich\Desktop\CondaCam12.lnk
[2011.06.17 16:11:48 | 000,114,064 | ---- | M] () -- C:\Users\ich\Desktop\Daten_Hardal.jpg
[7 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.07.07 16:05:11 | 000,001,067 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.07.07 14:07:28 | 000,002,044 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk
[2011.07.07 14:07:28 | 000,002,032 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Thunderbird.lnk
[2011.07.07 13:54:26 | 676,647,004 | ---- | C] () -- C:\Users\ich\Desktop\Thunderbird 3.1.10 (de) - 2011-07-07.pcv
[2011.07.07 13:21:03 | 000,000,061 | ---- | C] () -- C:\Windows\wininit.ini
[2011.07.07 02:27:54 | 000,014,608 | ---- | C] () -- C:\Users\ich\Desktop\Seitenwange Portal Loslagerseite V2 geschweißt V1.1.tap
[2011.07.07 01:52:20 | 001,624,196 | ---- | C] () -- C:\Users\ich\Desktop\galaxy 016.jpg
[2011.07.07 01:50:54 | 001,489,305 | ---- | C] () -- C:\Users\ich\Desktop\galaxy 013.jpg
[2011.07.07 01:49:55 | 001,603,285 | ---- | C] () -- C:\Users\ich\Desktop\galaxy 015.jpg
[2011.07.06 17:29:02 | 000,014,698 | ---- | C] () -- C:\Users\ich\Desktop\Seitenwange Portal Festlagerseite V2 geschweißt V1.1.tab
[2011.07.05 22:16:10 | 000,347,448 | ---- | C] () -- C:\Users\ich\Desktop\RE-11196.pdf
[2011.07.05 18:41:34 | 000,014,555 | ---- | C] () -- C:\Users\ich\Desktop\Seitenwange Portal Festlagerseite V2 geschweißt V1.0.tap
[2011.07.05 17:55:38 | 000,088,267 | ---- | C] () -- C:\Users\ich\Desktop\Seitenwange Portal Loslagerseite V2 geschweißt.job
[2011.07.05 17:38:55 | 000,075,286 | ---- | C] () -- C:\Users\ich\Desktop\Seitenwange Portal Festlagerseite V2 geschweißt.job
[2011.07.05 14:31:02 | 000,503,338 | ---- | C] () -- C:\Users\ich\Desktop\anni6pa.jpg
[2011.07.04 22:12:40 | 000,012,453 | ---- | C] () -- C:\Users\ich\Desktop\Plasma 6mm V1.1.tap
[2011.07.02 02:13:58 | 000,004,290 | ---- | C] () -- C:\Users\ich\Desktop\Plasma 6.. Nr. 2.tap
[2011.07.02 02:13:14 | 000,024,490 | ---- | C] () -- C:\Users\ich\Desktop\Plasma 6.. Nr. 2.job
[2011.07.02 00:39:49 | 000,009,456 | ---- | C] () -- C:\Users\ich\Desktop\Plasma 6mm V1.tap
[2011.07.02 00:32:25 | 000,040,017 | ---- | C] () -- C:\Users\ich\Desktop\Plasma 6mm V1.job
[2011.07.02 00:17:14 | 000,001,004 | ---- | C] () -- C:\Users\ich\Desktop\Fertigungsdaten.lnk
[2011.06.30 19:59:00 | 000,070,517 | ---- | C] () -- C:\Users\ich\Desktop\annix1gr.jpg
[2011.06.30 17:19:39 | 000,235,786 | ---- | C] () -- C:\Users\ich\Desktop\Bildschirmfoto 2011-06-30 um 17.19.14.png
[2011.06.29 17:30:08 | 000,020,386 | ---- | C] () -- C:\Users\ich\Desktop\Alibre Drawing.pdf
[2011.06.29 17:26:50 | 000,020,135 | ---- | C] () -- C:\Users\ich\Desktop\document.pdf
[2011.06.29 16:57:11 | 000,107,269 | ---- | C] () -- C:\Users\ich\Desktop\bilder.pdf
[2011.06.29 16:33:05 | 000,378,078 | ---- | C] () -- C:\Users\ich\Desktop\Bildschirmfoto 2011-06-29 um 16.32.44.png
[2011.06.28 23:21:29 | 000,036,074 | ---- | C] () -- C:\Users\ich\Desktop\obere Platte Schlitten X komplett.job
[2011.06.28 22:48:05 | 000,096,688 | ---- | C] () -- C:\Users\ich\Desktop\Neue Zeichnung (1).dxf
[2011.06.28 22:43:26 | 000,019,850 | ---- | C] () -- C:\Users\ich\Desktop\WST.part
[2011.06.28 22:43:12 | 000,048,071 | ---- | C] () -- C:\Users\ich\Desktop\SSSSS.job
[2011.06.28 17:12:59 | 000,008,106 | ---- | C] () -- C:\Users\ich\Desktop\Blechteile Absaughaube v3.tap
[2011.06.28 01:09:32 | 000,832,180 | ---- | C] () -- C:\Users\ich\Desktop\Mts-cncDE.pdf
[2011.06.27 23:10:26 | 000,006,930 | ---- | C] () -- C:\Users\ich\Desktop\Blendenbleche Schaltschrank.tap
[2011.06.27 23:09:36 | 000,024,374 | ---- | C] () -- C:\Users\ich\Desktop\Blendenbleche Schaltschrank.job
[2011.06.27 16:28:38 | 000,007,232 | ---- | C] () -- C:\Users\ich\Desktop\Blechteile Absaughaube v2.tap
[2011.06.24 17:41:56 | 000,001,787 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk
[2011.06.24 17:41:56 | 000,001,775 | ---- | C] () -- C:\Users\Public\Desktop\Opera.lnk
[2011.06.24 17:34:19 | 000,267,653 | ---- | C] () -- C:\Users\ich\Desktop\Opera Lesezeichen 24.6.2011.adr
[2011.06.24 00:46:18 | 000,000,829 | ---- | C] () -- C:\Users\ich\Desktop\Schaltnocke Y Fase.nc
[2011.06.24 00:35:44 | 000,187,633 | ---- | C] () -- C:\Users\ich\Desktop\Schaltnocke Y.stp
[2011.06.23 17:05:22 | 000,005,609 | ---- | C] () -- C:\Users\ich\Desktop\Schaltnocke Y.nc
[2011.06.23 02:11:03 | 000,098,119 | ---- | C] () -- C:\Users\ich\Desktop\Bildschirmfoto.jpg
[2011.06.22 16:46:22 | 000,037,918 | ---- | C] () -- C:\Users\ich\Desktop\Blechteile Absaughaube.job
[2011.06.18 16:11:00 | 000,001,034 | ---- | C] () -- C:\Users\ich\Desktop\CondaCam12.lnk
[2011.06.17 16:11:48 | 000,114,064 | ---- | C] () -- C:\Users\ich\Desktop\Daten_Hardal.jpg
[2011.06.17 16:11:25 | 000,000,144 | ---- | C] () -- C:\Windows\SetOpp.loc
[2011.03.28 17:43:41 | 000,003,072 | ---- | C] () -- C:\Windows\System32\34CoInstaller.dll
[2011.03.28 17:43:11 | 000,049,152 | ---- | C] () -- C:\Windows\System32\CardID.dll
[2011.03.15 16:14:11 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2011.03.15 14:24:05 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll
[2011.03.15 01:54:14 | 000,000,100 | ---- | C] () -- C:\Windows\1FB169BC-703B-4282-BD96-2CCF743D3814.ini
[2011.03.15 00:40:32 | 000,000,000 | ---- | C] () -- C:\Windows\HPMProp.INI
[2011.03.14 23:56:27 | 000,000,036 | ---- | C] () -- C:\ProgramData\InstallAlibre.config
[2011.03.14 23:18:39 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2011.03.14 22:15:56 | 001,731,104 | ---- | C] () -- C:\Windows\System32\nvwdmcpl.dll
[2011.03.14 22:15:56 | 001,657,376 | ---- | C] () -- C:\Windows\System32\nwiz.exe
[2011.03.14 22:15:56 | 001,514,016 | ---- | C] () -- C:\Windows\System32\nView.dll
[2011.03.14 22:15:56 | 001,108,512 | ---- | C] () -- C:\Windows\System32\nvwimg.dll
[2011.03.14 22:15:56 | 000,473,632 | ---- | C] () -- C:\Windows\System32\nvShell.dll
[2011.03.14 22:15:56 | 000,449,056 | ---- | C] () -- C:\Windows\System32\nvAppBar.exe
[2011.03.14 22:15:56 | 000,267,296 | ---- | C] () -- C:\Windows\System32\nvTaskbar.exe
[2010.11.10 03:45:32 | 000,102,744 | ---- | C] () -- C:\Windows\System32\LogiDPPApp.exe
[2010.11.10 03:45:30 | 010,871,128 | ---- | C] () -- C:\Windows\System32\LogiDPP.dll
[2010.11.10 03:45:20 | 000,316,248 | ---- | C] () -- C:\Windows\System32\DevManagerCore.dll
[2010.11.10 03:31:42 | 000,026,286 | ---- | C] () -- C:\Windows\System32\lvcoinst.ini
[2010.07.16 16:50:36 | 000,022,806 | ---- | C] () -- C:\Windows\CondaCam12.ini
[2009.07.14 10:47:43 | 000,654,166 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2009.07.14 10:47:43 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2009.07.14 10:47:43 | 000,130,006 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2009.07.14 10:47:43 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2009.07.14 06:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 06:33:53 | 000,294,872 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2009.07.14 04:05:48 | 000,616,008 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2009.07.14 04:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2009.07.14 04:05:48 | 000,106,388 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2009.07.14 04:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2009.07.14 04:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2009.07.14 04:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2009.07.14 01:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 01:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
[2009.06.10 23:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
 
========== LOP Check ==========
 
[2011.03.15 14:10:56 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\.algor
[2011.07.07 17:39:31 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\.purple
[2011.07.07 02:32:21 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\Alibre Design
[2011.04.30 01:18:25 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\CadSoft
[2011.03.14 23:00:40 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\CheckPoint
[2011.04.04 13:49:52 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\elsterformular
[2011.03.15 02:21:14 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\Foxit Software
[2011.06.29 16:57:02 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\gtk-2.0
[2011.04.11 17:34:32 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\IrfanView
[2011.03.15 00:22:16 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\Leadertech
[2011.05.12 17:39:35 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\MS-Buchhalter
[2011.03.20 02:19:31 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\OpenOffice.org
[2011.06.24 17:41:59 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\Opera
[2011.06.01 23:48:04 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\PCDr
[2011.07.07 03:02:17 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\SheetCam TNG
[2011.03.15 14:18:09 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\Thunderbird
[2011.06.01 23:39:46 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\Update
[2011.06.27 15:49:07 | 000,000,528 | ---- | M] () -- C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job
[2011.06.09 20:14:15 | 000,032,630 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2011.07.07 12:33:47 | 000,000,466 | ---- | M] () -- C:\Windows\Tasks\SystemToolsDailyTest.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2011.03.15 14:10:56 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\.algor
[2011.07.07 17:39:31 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\.purple
[2011.04.08 23:18:56 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\Adobe
[2011.07.07 02:32:21 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\Alibre Design
[2011.04.20 13:13:57 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\Avira
[2011.04.30 01:18:25 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\CadSoft
[2011.03.14 23:00:40 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\CheckPoint
[2011.04.04 13:49:52 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\elsterformular
[2011.03.15 02:21:14 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\Foxit Software
[2011.06.29 16:57:02 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\gtk-2.0
[2011.03.14 21:58:41 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\Identities
[2011.04.11 17:34:32 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\IrfanView
[2011.03.15 00:22:16 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\Leadertech
[2011.03.15 00:20:25 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\Logishrd
[2011.03.15 00:22:22 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\Logitech
[2011.03.14 23:44:20 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\Macromedia
[2011.07.07 16:06:00 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\Malwarebytes
[2009.07.14 10:56:56 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\Media Center Programs
[2011.06.01 23:35:50 | 000,000,000 | --SD | M] -- C:\Users\ich\AppData\Roaming\Microsoft
[2011.03.15 14:18:10 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\Mozilla
[2011.05.12 17:39:35 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\MS-Buchhalter
[2011.03.20 02:19:31 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\OpenOffice.org
[2011.06.24 17:41:59 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\Opera
[2011.06.01 23:48:04 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\PCDr
[2011.07.07 03:02:17 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\SheetCam TNG
[2011.07.07 17:43:57 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\Skype
[2011.07.07 16:01:39 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\skypePM
[2011.03.15 14:18:09 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\Thunderbird
[2011.06.01 23:39:46 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\Update
[2011.04.05 11:33:51 | 000,000,000 | ---D | M] -- C:\Users\ich\AppData\Roaming\WinRAR
 
< %APPDATA%\*.exe /s >
[2011.03.15 00:22:16 | 000,053,248 | R--- | M] (Acresso Software Inc.) -- C:\Users\ich\AppData\Roaming\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_bc1a57271cf2f285\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_fab873f3e8a3315c\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_df3f92057fcbe7a7\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
 
< MD5 for: IASTORV.SYS  >
[2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys
[2010.11.20 14:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\System32\drivers\iaStorV.sys
[2010.11.20 14:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_668286aa35d55928\iaStorV.sys
[2010.11.20 14:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_b118bc63e60a139a\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\System32\netlogon.dll
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_ffbf212e963c0162\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2010.11.20 14:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\System32\drivers\nvstor.sys
[2010.11.20 14:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_dd659ed032d28a14\nvstor.sys
[2010.11.20 14:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_3be22d131d40bd72\nvstor.sys
[2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\System32\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_3a154c47375d881d\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009.07.14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll
[2010.11.20 14:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\System32\user32.dll
[2010.11.20 14:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\System32\userinit.exe
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\System32\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.10.28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe
[2009.10.28 07:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe
[2010.11.20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\System32\winlogon.exe
[2010.11.20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe
[2009.07.14 03:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
[2010.05.15 17:30:50 | 000,461,400 | ---- | M] (Check Point Software Technologies LTD) Unable to obtain MD5 -- C:\Windows\system32\drivers\vsdatant.sys
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[7 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ]
 
<            >

< End of report >

--- --- ---

Ich sollte aber evtl. dazu sagen dass ich Thunderbird bereits deinstaliert und neu instaliert habe....

gruss

cosinus · 07.07.2011, 21:46

Logs verwechselt? Ich seh da kein Vollscan Log von Malwarebytes...

dichter84 · 07.07.2011, 21:52

Oh, joa... hier von Malewareb....

Malwarebytes' Anti-Malware 1.51.0.1200
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Datenbank Version: 7041

Windows 6.1.7601 Service Pack 1
Internet Explorer 8.0.7601.17514

07.07.2011 17:01:00
mbam-log-2011-07-07 (17-01-00).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|M:\|)
Durchsuchte Objekte: 282044
Laufzeit: 53 Minute(n), 49 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

gruss

cosinus · 07.07.2011, 21:57

Gibt es noch weitere Logs von Malwarebytes? Wenn ja bitte alle posten, die in Malwarebytes im Reiter Logdateien sichtbar sind.

Wie schreibst du die Mails? Per Webmail oder über einen Mailclient wie Outlook oder Thunderbird?

dichter84 · 08.07.2011, 22:56

Hi,

gibt keine weiteren Logs...

Mails schreibe ich alle über Thunderbird....

cosinus · 10.07.2011, 18:28

Bekommst du diese Mails vom Mailer-Daemon bei jeder gesendeten E-Mail? Oder ist das nur wenn du einer ganz bestimmten Person mailst?

dichter84 · 10.07.2011, 21:05

Hmmmm, gute frage.... nachdem das das 2. mal war hab ich Thunderbird gleich neu installiert. Waren beide bei der gleichen Person....

Ich verschick grad mal eine Mail an die Person zum testen...!

dichter84 · 10.07.2011, 21:52

Interessant, das ganze kommt nur bei EINER e-mail-adresse vor...! Was kann das bedeuten, hat evtl. der Empfänger-PC ´nen Virus..?

cosinus · 11.07.2011, 08:38

Zitat:

X-Resent-For: (die Adresse zu der ich die Mail tatsächlich schicken wollte)
X-Resent-To: sonnenschein.reisen@gmx.net, hornywaterfall1985@gmx.de

Tippst du die Adresse im Empfängerfeld manuell ein oder über Adressbucheintrag? Vllt steht in diesem Adressbucheintrag eine Mülladresse drin...

dichter84 · 11.07.2011, 11:01

Ich klick eigendlich immer nur auf "Antworten"... Hab grad nochmal nachgeschaut, da setzt es dann nur die richtige Adresse ein, und im Adressbuch steht auch nur die richtige Adresse...

gruss

07.07.2011, 21:46	#7
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Liest da jemand meine Mails mit? Logs verwechselt? Ich seh da kein Vollscan Log von Malwarebytes... __________________ Logfiles bitte immer in CODE-Tags posten

07.07.2011, 21:57	#9
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Liest da jemand meine Mails mit? Gibt es noch weitere Logs von Malwarebytes? Wenn ja bitte alle posten, die in Malwarebytes im Reiter Logdateien sichtbar sind. Wie schreibst du die Mails? Per Webmail oder über einen Mailclient wie Outlook oder Thunderbird? __________________ Logfiles bitte immer in CODE-Tags posten

10.07.2011, 18:28	#11
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Liest da jemand meine Mails mit? Bekommst du diese Mails vom Mailer-Daemon bei jeder gesendeten E-Mail? Oder ist das nur wenn du einer ganz bestimmten Person mailst? __________________ Logfiles bitte immer in CODE-Tags posten

Liest da jemand meine Mails mit?

Überwachung, Datenschutz und Spam: Liest da jemand meine Mails mit?