Mach bitte ein neues CustomLog:

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

• Starte bitte die OTL.exe.
  Vista und Win7 User mit Rechtsklick "als Administrator starten"
• Kopiere nun den Inhalt in die Textbox.

netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
         

• Schliesse bitte nun alle Programme. (Wichtig)
• Klicke nun bitte auf den Quick Scan Button.
• Klick auf .
• Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Fertig.

OTL logfile created on: 02.09.2011 16:34:04 - Run 3
OTL by OldTimer - Version 3.2.26.5     Folder = C:\Users\Fabian\Desktop
Windows Vista Home Premium Edition  (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.16809)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,06 Gb Available Physical Memory | 68,83% Memory free
6,20 Gb Paging File | 5,29 Gb Available in Paging File | 85,46% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 303,35 Gb Total Space | 97,17 Gb Free Space | 32,03% Space Free | Partition Type: NTFS
Drive D: | 149,72 Gb Total Space | 42,77 Gb Free Space | 28,56% Space Free | Partition Type: NTFS
Drive Z: | 995,00 Mb Total Space | 994,99 Mb Free Space | 100,00% Space Free | Partition Type: FAT32
 
Computer Name: FABIAN-PC | User Name: Fabian | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2011.08.23 19:18:44 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\Fabian\Desktop\OTL.exe
PRC - [2010.04.13 00:46:36 | 001,135,912 | ---- | M] () -- C:\Programme\DivX\DivX Update\DivXUpdate.exe
PRC - [2009.11.03 16:42:05 | 002,923,192 | ---- | M] () -- C:\Programme\Pando Networks\Media Booster\PMB.exe
PRC - [2008.10.29 08:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008.10.25 12:44:34 | 000,031,072 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe
PRC - [2008.07.21 14:24:44 | 000,068,865 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
PRC - [2008.07.21 14:24:40 | 000,266,497 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe
PRC - [2008.07.21 14:24:40 | 000,149,761 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
PRC - [2008.02.26 17:24:06 | 004,939,776 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
PRC - [2008.01.29 17:38:32 | 000,583,048 | ---- | M] (Symantec Corporation) -- C:\Programme\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
PRC - [2008.01.18 15:26:17 | 000,185,896 | ---- | M] (RealNetworks, Inc.) -- C:\Programme\Common Files\Real\Update_OB\realsched.exe
PRC - [2008.01.09 22:55:56 | 001,232,896 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe
PRC - [2007.09.26 11:53:56 | 000,554,352 | ---- | M] (Symantec Corporation) -- C:\Programme\Symantec\LiveUpdate\AluSchedulerSvc.exe
PRC - [2007.05.28 18:57:54 | 000,275,968 | ---- | M] (Rocket Division Software) -- C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
PRC - [2007.01.01 01:36:01 | 001,006,264 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MSASCui.exe
PRC - [2006.11.02 14:35:35 | 000,176,128 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wpcumi.exe
PRC - [2003.03.19 10:55:56 | 000,335,872 | ---- | M] (Microsoft Corporation) -- C:\Programme\Common Files\microsoft shared\VS7Debug\mdm.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2010.04.13 00:46:46 | 000,095,528 | ---- | M] () -- C:\Programme\DivX\DivX Update\DivXUpdateCheck.dll
MOD - [2010.04.13 00:46:36 | 001,135,912 | ---- | M] () -- C:\Programme\DivX\DivX Update\DivXUpdate.exe
MOD - [2009.11.03 16:42:05 | 002,923,192 | ---- | M] () -- C:\Programme\Pando Networks\Media Booster\PMB.exe
MOD - [2009.09.05 00:15:06 | 000,067,872 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2007.09.20 19:34:58 | 000,129,024 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Auto | Stopped] --  -- (sdCoreService)
SRV - File not found [Auto | Stopped] --  -- (sdAuxService)
SRV - File not found [On_Demand | Stopped] --  -- (osagent)
SRV - File not found [On_Demand | Stopped] --  -- (oad)
SRV - File not found [Disabled | Stopped] --  -- (NMIndexingService)
SRV - File not found [Auto | Stopped] --  -- (LiveUpdate Notice Ex)
SRV - File not found [Auto | Stopped] --  -- (LckFldService)
SRV - File not found [Auto | Stopped] --  -- (CLTNetCnService)
SRV - [2010.05.01 19:48:37 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2008.07.21 14:24:44 | 000,068,865 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe -- (AntiVirScheduler)
SRV - [2008.07.21 14:24:40 | 000,149,761 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe -- (AntiVirService)
SRV - [2008.01.29 17:38:32 | 000,583,048 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe -- (LiveUpdate Notice Service)
SRV - [2007.09.26 11:53:56 | 002,999,664 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Programme\Symantec\LiveUpdate\LuComServer_3_2.EXE -- (LiveUpdate)
SRV - [2007.09.26 11:53:56 | 000,554,352 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe -- (Automatisches LiveUpdate - Scheduler)
SRV - [2007.05.28 18:57:54 | 000,275,968 | ---- | M] (Rocket Division Software) [Auto | Running] -- C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- (StarWindServiceAE)
SRV - [2007.01.01 01:36:01 | 000,265,912 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2011.08.07 10:00:00 | 000,374,392 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Programme\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2010.12.29 22:37:28 | 000,691,696 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\sptd.sys -- (sptd)
DRV - [2010.03.25 20:06:30 | 000,099,728 | ---- | M] (Sun Microsystems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VBoxNetAdp.sys -- (VBoxNetAdp)
DRV - [2009.11.09 05:21:18 | 000,059,388 | ---- | M] (PowerISO Computing, Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\scdemu.sys -- (SCDEmu)
DRV - [2008.07.21 14:24:45 | 000,075,072 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2008.06.03 15:36:45 | 000,052,032 | ---- | M] (Avira GmbH) [File_System | On_Demand | Running] -- C:\Programme\Avira\AntiVir PersonalEdition Classic\avgntflt.sys -- (avgntflt)
DRV - [2008.04.30 13:06:48 | 000,021,248 | ---- | M] (AVIRA GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2008.02.14 15:56:02 | 000,118,784 | ---- | M] (Realtek Corporation                                            ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)
DRV - [2007.12.26 23:18:24 | 000,016,712 | ---- | M] (G DATA Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\GRD.sys -- (GRD)
DRV - [2007.12.05 02:41:00 | 008,238,720 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2007.10.18 01:16:00 | 000,079,688 | ---- | M] (PCTools Research Pty Ltd.) [Kernel | System | Running] -- C:\Windows\System32\drivers\iksyssec.sys -- (IKSysSec)
DRV - [2007.10.18 01:15:00 | 000,062,280 | ---- | M] (PCTools Research Pty Ltd.) [Kernel | System | Running] -- C:\Windows\System32\drivers\iksysflt.sys -- (IKSysFlt)
DRV - [2007.10.18 01:14:00 | 000,041,288 | ---- | M] (PCTools Research Pty Ltd.) [File_System | Boot | Running] -- C:\Windows\system32\drivers\ikfilesec.sys -- (IKFileSec)
DRV - [2007.07.02 17:37:10 | 000,131,616 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvrd32.sys -- (nvrd32)
DRV - [2007.07.02 17:37:08 | 000,110,112 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvstor32.sys -- (nvstor32)
DRV - [2007.06.13 23:47:12 | 000,048,256 | ---- | M] (JMicron Technology Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\jraid.sys -- (JRAID)
DRV - [2007.02.27 16:25:04 | 000,011,840 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir PersonalEdition Classic\avgio.sys -- (avgio)
DRV - [2007.02.18 00:15:34 | 000,232,816 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\VMM.sys -- (vmm)
DRV - [2007.01.30 02:20:04 | 000,361,728 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\emBDA.sys -- (USB28xxBGA)
DRV - [2007.01.30 02:19:48 | 000,039,680 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\emOEM.sys -- (USB28xxOEM)
DRV - [2007.01.29 06:20:34 | 000,059,280 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\VMNetSrv.sys -- (VPCNetS2)
DRV - [2006.10.30 11:22:26 | 000,008,192 | ---- | M] (ATI Technologies Inc.) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\AtiPcie.sys -- (AtiPcie) ATI PCI Express (3GIO)
DRV - [2003.04.19 01:32:04 | 000,004,736 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\tandpl.sys -- (tandpl)
DRV - [2003.03.02 18:44:26 | 000,007,552 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\enodpl.sys -- (enodpl)
DRV - [2002.07.17 16:20:32 | 000,084,832 | ---- | M] (Adaptec) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ASPI32.SYS -- (ASPI)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
IE - HKLM\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - Reg Error: Key error. File not found
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {40c3cc16-7269-4b32-9531-17f2950fb06f} - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.defaultthis.engineName: "Winload Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2319825&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://start.icq.com/"
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.9
FF - prefs.js..extensions.enabledItems: personas@christopher.beard:1.5.1
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:1.6.6.20090220
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {e9911ec6-1bcc-40b0-9993-e0eea7f6953f}:2.5.8.6
FF - prefs.js..extensions.enabledItems: {40c3cc16-7269-4b32-9531-17f2950fb06f}:3.5.0.12
FF - prefs.js..extensions.enabledItems: {AA994882-F391-4d2e-806F-8908DA4814ED}:2.4.15
FF - prefs.js..keyword.URL: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2319825&q="
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.50524.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.11.3088: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/npracplug;version=1.0.0.0: C:\Program Files\Real\RealArcade\Plugins\Mozilla\npracplug.dll File not found
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.2.3146: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.11.3006: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc;version=0.8.6h: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN Team)
FF - HKCU\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll File not found
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Fabian\AppData\Local\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Fabian\AppData\Local\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}: C:\ProgramData\Mozilla\Firefox Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2007.11.02 22:05:49 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2008.01.18 15:26:39 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.21\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.09.01 22:47:53 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.21\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.09.01 22:47:53 | 000,000,000 | ---D | M]
 
[2008.02.22 19:36:11 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Fabian\AppData\Roaming\mozilla\Extensions
[2011.09.02 13:16:50 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions
[2007.11.22 22:14:16 | 000,000,000 | ---D | M] (Adblock) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{34274bf4-1d97-a289-e984-17e546307e4f}
[2011.08.06 02:59:23 | 000,000,000 | ---D | M] (Winload Community Toolbar) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}
[2010.04.02 13:34:00 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011.08.05 18:05:07 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2008.04.05 21:40:09 | 000,000,000 | ---D | M] (ReloadEvery) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644}
[2011.08.22 16:40:01 | 000,000,000 | ---D | M] (kikin plugin) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{AA994882-F391-4d2e-806F-8908DA4814ED}
[2010.05.30 19:37:16 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2007.11.18 18:58:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{b69a9db4-d0a1-4722-b56b-f20757a29cdf}
[2010.05.31 21:41:40 | 000,000,000 | ---D | M] (DVDVideoSoft Toolbar) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}
[2010.01.31 12:29:04 | 000,000,000 | ---D | M] (Personas) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\personas@christopher.beard
[2010.05.01 14:52:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\staged-xpis
[2010.05.25 19:15:26 | 000,005,318 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\alle-notende.xml
[2010.02.04 17:45:40 | 000,002,254 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\askcom.xml
[2011.07.24 15:31:22 | 000,000,917 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\conduit.xml
[2010.12.29 22:37:47 | 000,002,059 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\daemon-search.xml
[2011.08.31 15:59:34 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-1.xml
[2010.09.16 21:51:06 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-10.xml
[2010.10.21 15:35:06 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-11.xml
[2010.10.28 22:30:02 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-12.xml
[2010.11.01 20:10:54 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-13.xml
[2010.12.12 18:15:49 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-14.xml
[2011.03.05 16:55:13 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-15.xml
[2011.03.06 15:53:40 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-16.xml
[2011.03.24 19:24:37 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-17.xml
[2011.05.28 14:30:50 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-18.xml
[2011.08.05 18:05:29 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-19.xml
[2007.11.05 23:42:58 | 000,000,949 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-2.xml
[2011.09.01 22:48:08 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-20.xml
[2007.11.27 22:45:15 | 000,000,949 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-3.xml
[2009.05.13 19:07:53 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-4.xml
[2010.06.23 20:00:54 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-5.xml
[2010.06.28 00:08:50 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-6.xml
[2010.07.22 13:15:12 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-7.xml
[2010.07.26 10:58:21 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-8.xml
[2010.09.08 21:35:51 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-9.xml
[2011.08.05 18:05:07 | 000,000,168 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin.gif
[2011.08.05 18:05:07 | 000,000,618 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin.src
[2011.03.30 15:14:34 | 000,001,042 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin.xml
[2011.08.05 18:15:16 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2009.06.12 13:58:33 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2007.11.27 22:26:07 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions\google-cjk@partners.mozilla.com
[2010.04.02 13:33:15 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
[2009.11.03 16:42:01 | 000,238,776 | ---- | M] (Pando Networks) -- C:\Program Files\mozilla firefox\plugins\npPandoWebInst.dll
[2005.04.27 22:10:49 | 000,102,400 | ---- | M] (RealNetworks) -- C:\Program Files\mozilla firefox\plugins\npracplug.dll
[2011.08.18 19:08:30 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.08.18 19:08:30 | 000,002,344 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011.08.18 19:08:30 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.08.18 19:08:30 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.08.18 19:08:30 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2011.08.25 19:25:53 | 000,000,098 | ---- | M]) - C:\Windows\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1       localhost
O2 - BHO: (HP Print Clips) - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Programme\HP\Smart Web Printing\hpswp_framework.dll (Hewlett-Packard Co.)
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - No CLSID value found.
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Programme\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {8DBB6D8E-E4A6-4E3B-9753-AF78B226441C} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {ED4BD629-C1B6-4399-8A34-02CCAA921DC9} - No CLSID value found.
O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [DAEMON Tools] C:\Program Files\DAEMON Tools\daemon.exe (DT Soft Ltd.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [HCWemmon] C:\Windows\HCWemmon.exe (eMPIA Technology, Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvSvc] C:\Windows\System32\nvsvc.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [PWRISOVM.EXE] C:\Programme\PowerISO\PWRISOVM.EXE (PowerISO Computing, Inc.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Symantec PIF AlertEng] C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe (Symantec Corporation)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [WPCUMI] C:\Windows\System32\wpcumi.exe (Microsoft Corporation)
O4 - HKCU..\Run: [AlcoholAutomount] C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe (Alcohol Soft Development Team)
O4 - HKCU..\Run: [DAEMON Tools] C:\Program Files\DAEMON Tools\daemon.exe (DT Soft Ltd.)
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKCU..\Run: [EA Core]  File not found
O4 - HKCU..\Run: [ICQ]  File not found
O4 - HKCU..\Run: [msnmsgr]  File not found
O4 - HKCU..\Run: [Pando Media Booster] C:\Programme\Pando Networks\Media Booster\PMB.exe ()
O4 - Startup: C:\Users\Fabian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk = C:\Programme\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Users\Fabian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk = C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Fabian\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: HP Sammelmappe - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Programme\HP\Smart Web Printing\hpswp_extensions.dll (Hewlett-Packard Co.)
O9 - Extra Button: HP Intelligente Auswahl - {700259D7-1666-479a-93B1-3250410481E8} - C:\Programme\HP\Smart Web Printing\hpswp_extensions.dll (Hewlett-Packard Co.)
O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Desktop Hintergrund.bmp
O24 - Desktop BackupWallPaper: C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Desktop Hintergrund.bmp
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
SafeBootMin: AppMgmt -  File not found
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sdauxservice -  File not found
SafeBootMin: sdcoreservice -  File not found
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: AppMgmt -  File not found
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sdauxservice -  File not found
SafeBootNet: sdcoreservice -  File not found
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {AAC3F1F0-5649-4670-A698-F1523729F015} - Microsoft .NET Framework 1.1 Hotfix (KB929729)
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Reg Error: Value error.
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
 
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)
Drivers32: VIDC.FPS1 - C:\Windows\System32\frapsvid.dll (Beepa P/L)
Drivers32: VIDC.IV41 - C:\Windows\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.VP60 - C:\Windows\System32\vp6vfw.dll (On2.com)
Drivers32: vidc.VP61 - C:\Windows\System32\vp6vfw.dll (On2.com)
Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.09.02 13:34:31 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2011.09.01 23:38:08 | 000,000,000 | ---D | C] -- C:\Users\Fabian\.hades
[2011.09.01 18:04:49 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2011.08.29 19:27:09 | 000,000,000 | ---D | C] -- C:\Program Files\AutocompletePro
[2011.08.26 17:01:23 | 000,000,000 | ---D | C] -- C:\Program Files\DemonFlyff
[2011.08.25 21:51:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2011.08.25 19:25:12 | 000,000,000 | ---D | C] -- C:\_OTL
[2011.08.23 19:18:40 | 000,580,096 | ---- | C] (OldTimer Tools) -- C:\Users\Fabian\Desktop\OTL.exe
[2011.08.21 15:14:57 | 000,000,000 | ---D | C] -- C:\Users\Fabian\AppData\Local\No23 Recorder
[2011.08.21 15:14:54 | 000,000,000 | ---D | C] -- C:\Users\Fabian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\No23 Recorder
[2011.08.21 15:14:08 | 000,000,000 | ---D | C] -- C:\Users\Fabian\AppData\Roaming\kikin
[2011.08.21 15:14:07 | 000,000,000 | ---D | C] -- C:\Program Files\kikin
[2011.08.06 17:56:00 | 000,000,000 | ---D | C] -- C:\Users\Fabian\Documents\My Kindle Content
[2011.08.06 17:55:37 | 000,000,000 | ---D | C] -- C:\Users\Fabian\AppData\Local\Amazon
[2011.08.06 02:59:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Vokabel Trainer
[2011.08.05 18:05:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ICQ7.5
[2011.08.05 18:04:32 | 000,000,000 | ---D | C] -- C:\Program Files\ICQ7.5
 
========== Files - Modified Within 30 Days ==========
 
[2011.09.02 16:40:06 | 000,000,420 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{C27515C3-4436-493B-94A2-3C3CF69BDCC9}.job
[2011.09.02 16:28:50 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.09.02 16:28:39 | 000,003,200 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011.09.02 16:28:38 | 000,003,200 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011.09.02 16:28:19 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.09.02 16:28:17 | 3220,692,992 | -HS- | M] () -- C:\hiberfil.sys
[2011.09.02 13:51:00 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1054673845-2891796712-3211906163-1000UA.job
[2011.09.02 13:36:04 | 000,076,800 | ---- | M] () -- C:\Users\Fabian\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.09.02 13:20:00 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.09.02 12:48:12 | 000,655,692 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.09.02 12:48:12 | 000,621,850 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.09.02 12:48:12 | 000,122,662 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.09.02 12:48:12 | 000,108,934 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.09.01 20:51:56 | 000,000,476 | -H-- | M] () -- C:\Windows\tasks\Norton Security Scan for Fabian.job
[2011.09.01 18:06:33 | 000,010,097 | ---- | M] () -- C:\Users\Fabian\Desktop\13.odt
[2011.08.28 22:32:58 | 000,000,805 | ---- | M] () -- C:\Users\Fabian\Desktop\Flyff.exe - Verknüpfung.lnk
[2011.08.26 19:51:24 | 000,000,069 | ---- | M] () -- C:\Windows\NeroDigital.ini
[2011.08.25 21:51:15 | 000,000,810 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011.08.25 19:25:53 | 000,000,098 | ---- | M] () -- C:\Windows\System32\drivers\etc\Hosts
[2011.08.23 19:18:44 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\Fabian\Desktop\OTL.exe
[2011.08.22 19:15:49 | 000,008,268 | ---- | M] () -- C:\Users\Fabian\AppData\Local\d3d9caps.dat
[2011.08.06 00:51:00 | 000,001,072 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1054673845-2891796712-3211906163-1000Core.job
 
========== Files Created - No Company Name ==========
 
[2011.09.02 12:47:05 | 000,280,909 | ---- | C] () -- C:\Users\Fabian\Desktop\Multi-Toolbar Remover.exe
[2011.08.28 22:32:58 | 000,000,805 | ---- | C] () -- C:\Users\Fabian\Desktop\Flyff.exe - Verknüpfung.lnk
[2011.08.25 21:51:15 | 000,000,810 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011.08.22 19:31:59 | 3220,692,992 | -HS- | C] () -- C:\hiberfil.sys
[2011.01.03 00:22:14 | 000,073,728 | ---- | C] () -- C:\Windows\System32\GkSui18.EXE
[2010.09.03 18:45:49 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe
[2010.09.03 18:45:49 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2010.09.03 18:45:49 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2010.09.03 18:45:49 | 000,077,312 | ---- | C] () -- C:\Windows\MBR.exe
[2010.09.03 18:45:49 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2009.02.20 15:28:45 | 000,162,304 | ---- | C] () -- C:\Windows\System32\ztvunrar36.dll
[2009.02.20 15:28:45 | 000,077,312 | ---- | C] () -- C:\Windows\System32\ztvunace26.dll
[2008.12.22 13:10:46 | 000,009,509 | ---- | C] () -- C:\ProgramData\LUUnInstall.LiveUpdate
[2008.10.18 16:40:43 | 000,004,984 | ---- | C] () -- C:\ProgramData\jexqjxsy.dne
[2008.09.01 22:42:53 | 000,264,192 | ---- | C] () -- C:\Windows\System32\midas.dll
[2008.08.13 14:34:20 | 000,000,094 | ---- | C] () -- C:\Users\Fabian\AppData\Local\fusioncache.dat
[2008.03.28 15:20:24 | 000,138,024 | -H-- | C] () -- C:\Windows\System32\mlfcache.dat
[2008.01.14 19:44:58 | 000,149,504 | ---- | C] () -- C:\Windows\System32\UNWISE.EXE
[2008.01.14 19:44:19 | 000,032,825 | ---- | C] () -- C:\Windows\Irremote.ini
[2008.01.14 19:44:09 | 000,065,536 | ---- | C] () -- C:\Windows\System32\dmcrypto.dll
[2008.01.14 19:43:46 | 000,000,209 | ---- | C] () -- C:\Windows\ODBCINST.INI
[2008.01.14 19:43:46 | 000,000,135 | ---- | C] () -- C:\Windows\ODBC.INI
[2008.01.14 19:43:45 | 000,159,744 | ---- | C] () -- C:\Windows\System32\hcwChDB.dll
[2008.01.14 19:43:14 | 000,002,075 | ---- | C] () -- C:\Windows\HCWPNP.INI
[2008.01.14 19:42:12 | 000,040,960 | ---- | C] () -- C:\Windows\System32\bdadll.dll
[2007.12.26 23:41:32 | 000,019,900 | ---- | C] () -- C:\Users\Fabian\AppData\Roaming\UserTile.png
[2007.12.26 01:09:48 | 000,000,025 | ---- | C] () -- C:\Windows\SIERRA.INI
[2007.12.26 01:04:15 | 000,156,160 | ---- | C] () -- C:\Windows\System32\unrar3.dll
[2007.12.26 01:04:15 | 000,075,264 | ---- | C] () -- C:\Windows\System32\unacev2.dll
[2007.12.08 11:27:15 | 000,008,268 | ---- | C] () -- C:\Users\Fabian\AppData\Local\d3d9caps.dat
[2007.11.22 22:22:43 | 000,000,305 | ---- | C] () -- C:\ProgramData\addr_file.html
[2007.11.18 19:15:53 | 000,237,568 | ---- | C] () -- C:\Windows\System32\lame_enc.dll
[2007.11.08 18:10:12 | 000,069,632 | R--- | C] () -- C:\Windows\System32\xmltok.dll
[2007.11.08 18:10:12 | 000,036,864 | R--- | C] () -- C:\Windows\System32\xmlparse.dll
[2007.11.08 17:52:59 | 000,007,552 | ---- | C] () -- C:\Windows\System32\drivers\enodpl.sys
[2007.11.08 17:52:59 | 000,004,736 | ---- | C] () -- C:\Windows\System32\drivers\tandpl.sys
[2007.11.06 21:36:09 | 000,007,316 | ---- | C] () -- C:\Users\Fabian\AppData\Roaming\wklnhst.dat
[2007.11.03 20:54:04 | 000,641,021 | ---- | C] () -- C:\Windows\unins000.exe
[2007.11.03 20:54:04 | 000,002,577 | ---- | C] () -- C:\Windows\unins000.dat
[2007.11.03 01:30:52 | 000,001,156 | ---- | C] () -- C:\Windows\mozver.dat
[2007.11.02 22:10:23 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2007.11.02 20:41:38 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2007.11.02 20:41:36 | 000,076,800 | ---- | C] () -- C:\Users\Fabian\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007.04.14 16:57:06 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelTraditionalChinese.dll
[2007.04.14 16:57:06 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelSwedish.dll
[2007.04.14 16:57:06 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelSpanish.dll
[2007.04.14 16:57:04 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelSimplifiedChinese.dll
[2007.04.14 16:57:04 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelPortugese.dll
[2007.04.14 16:57:04 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelKorean.dll
[2007.04.14 16:57:04 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelJapanese.dll
[2007.04.14 16:57:04 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelGerman.dll
[2007.04.14 16:57:04 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelFrench.dll
[2007.01.01 03:49:06 | 000,000,342 | ---- | C] () -- C:\Windows\{9A3BC157-B94F-4EFD-ABA9-1E56DEB00655}_WiseFW.ini
[2006.11.02 17:33:31 | 000,655,692 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2006.11.02 17:33:31 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2006.11.02 17:33:31 | 000,122,662 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2006.11.02 17:33:31 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2006.11.02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 14:47:37 | 002,340,168 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 12:33:01 | 000,621,850 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 12:33:01 | 000,108,934 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006.11.02 09:22:43 | 000,099,999 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2006.11.02 09:22:43 | 000,018,271 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2006.08.11 10:52:02 | 000,012,288 | ---- | C] () -- C:\Windows\System32\EvOnlDiag.dll
[2002.07.31 18:32:03 | 000,056,832 | ---- | C] () -- C:\Windows\System32\iyvu9_32.dll
[2000.04.14 17:50:02 | 000,343,040 | ---- | C] () -- C:\Windows\System32\Lffpx7.dll
[1998.06.11 14:08:06 | 000,095,232 | ---- | C] () -- C:\Windows\System32\Lfkodak.dll
 
========== LOP Check ==========
 
[2010.12.24 20:15:31 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\.minecraft
[2007.11.27 22:09:51 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Application Data
[2007.11.29 16:14:08 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Atari
[2007.12.29 21:09:12 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Azureus
[2007.12.23 21:13:22 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Command & Conquer 3 Tiberium Wars
[2007.11.23 19:34:22 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\concept design
[2008.06.21 14:36:08 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Crystal Player
[2010.12.29 22:44:48 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\DAEMON Tools Lite
[2007.12.26 21:43:16 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\DeepBurner
[2011.07.01 11:26:57 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\DVDVideoSoft
[2011.07.01 11:22:35 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\DVDVideoSoftIEHelpers
[2009.11.10 09:56:37 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\FMZilla
[2010.04.25 00:02:38 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\gtk-2.0
[2011.09.02 13:22:26 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\ICQ
[2007.11.03 00:21:25 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\ICQ Toolbar
[2010.09.17 14:52:39 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\ICQLite
[2008.01.09 21:33:16 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\JLC's Software
[2008.03.12 13:21:29 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Jägermeister RadioPlayer
[2011.08.22 16:36:03 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\kikin
[2009.06.23 13:31:36 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Lern-o-Mat
[2007.11.18 19:21:23 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\lexiCan 2
[2008.03.28 15:28:14 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Netscape
[2008.03.12 21:40:21 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Opera
[2008.01.27 22:57:11 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Ordner HP Share-to-Web
[2007.11.16 21:45:09 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Participatory Culture Foundation
[2007.11.17 00:00:14 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\PCF-VLC
[2007.12.26 23:41:32 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\PeerNetworking
[2008.07.01 09:12:45 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Recorder
[2009.11.02 21:11:08 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Softplicity
[2010.08.10 13:45:08 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Spesoft Audio Converter
[2009.11.08 16:04:31 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\streamripper
[2011.08.22 19:30:51 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Teeworlds
[2007.11.17 17:36:15 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Template
[2007.11.23 15:41:43 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\TrojanHunter
[2011.09.02 14:12:57 | 000,032,638 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2011.09.02 16:40:06 | 000,000,420 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{C27515C3-4436-493B-94A2-3C3CF69BDCC9}.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2010.12.24 20:15:31 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\.minecraft
[2011.09.02 12:58:23 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Adobe
[2007.11.03 00:16:08 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Ahead
[2009.12.21 14:37:01 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Apple Computer
[2007.11.27 22:09:51 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Application Data
[2007.11.29 16:14:08 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Atari
[2007.12.29 21:09:12 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Azureus
[2007.12.23 21:13:22 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Command & Conquer 3 Tiberium Wars
[2007.11.23 19:34:22 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\concept design
[2008.06.21 14:36:08 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Crystal Player
[2010.12.29 22:44:48 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\DAEMON Tools Lite
[2007.12.26 21:43:16 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\DeepBurner
[2010.04.17 16:02:37 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\DivX
[2011.08.22 19:30:50 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\dvdcss
[2011.07.01 11:26:57 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\DVDVideoSoft
[2011.07.01 11:22:35 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\DVDVideoSoftIEHelpers
[2009.11.10 09:56:37 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\FMZilla
[2007.11.04 02:12:13 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Google
[2010.04.25 00:02:38 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\gtk-2.0
[2008.09.13 14:58:45 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\HP
[2008.09.13 14:53:50 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\HPAppData
[2011.09.02 13:22:26 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\ICQ
[2007.11.03 00:21:25 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\ICQ Toolbar
[2010.09.17 14:52:39 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\ICQLite
[2007.11.02 20:25:03 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Identities
[2007.11.03 00:19:50 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\InstallShield
[2008.01.09 21:33:16 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\JLC's Software
[2008.03.12 13:21:29 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Jägermeister RadioPlayer
[2011.08.22 16:36:03 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\kikin
[2009.06.23 13:31:36 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Lern-o-Mat
[2007.11.18 19:21:23 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\lexiCan 2
[2007.11.02 21:54:53 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Macromedia
[2010.09.01 19:10:10 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Malwarebytes
[2006.11.02 14:37:34 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Media Center Programs
[2011.08.16 19:26:45 | 000,000,000 | --SD | M] -- C:\Users\Fabian\AppData\Roaming\Microsoft
[2008.02.22 19:36:11 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Mozilla
[2008.03.28 15:28:14 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Netscape
[2011.09.01 18:06:33 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\OpenOffice.org2
[2008.03.12 21:40:21 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Opera
[2008.01.27 22:57:11 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Ordner HP Share-to-Web
[2007.11.16 21:45:09 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Participatory Culture Foundation
[2007.11.24 13:09:56 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\PC Tools
[2007.11.17 00:00:14 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\PCF-VLC
[2007.12.26 23:41:32 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\PeerNetworking
[2009.12.07 18:43:59 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Real
[2008.07.01 09:12:45 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Recorder
[2009.11.02 21:11:08 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Softplicity
[2010.08.10 13:45:08 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Spesoft Audio Converter
[2009.11.08 16:04:31 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\streamripper
[2007.12.27 21:22:02 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Sun
[2007.11.02 22:10:29 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Talkback
[2011.08.22 19:30:51 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Teeworlds
[2007.11.17 17:36:15 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Template
[2007.11.23 15:41:43 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\TrojanHunter
[2007.11.02 22:04:03 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\vlc
[2008.01.12 21:26:54 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Winamp
[2007.11.03 00:17:35 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\WinRAR
 
< %APPDATA%\*.exe /s >
[2008.05.28 18:46:30 | 000,065,536 | R--- | M] (Macrovision Corporation) -- C:\Users\Fabian\AppData\Roaming\Microsoft\Installer\{0CE1A6C0-F3F7-49E6-8F9D-2431F9827441}\NewShortcut4_0CE1A6C0F3F749E68F9D2431F9827441.exe
[2008.05.28 18:46:30 | 000,008,854 | R--- | M] () -- C:\Users\Fabian\AppData\Roaming\Microsoft\Installer\{0CE1A6C0-F3F7-49E6-8F9D-2431F9827441}\UNINST_Uninstall_G_0CE1A6C0F3F749E68F9D2431F9827441_1.exe
[2010.04.03 18:10:06 | 000,040,960 | R--- | M] (InstallShield Software Corp.) -- C:\Users\Fabian\AppData\Roaming\Microsoft\Installer\{3571656A-575D-4CED-809D-5547587121FF}\NewShortcut1.exe
[2010.04.03 18:10:06 | 000,040,960 | R--- | M] (InstallShield Software Corp.) -- C:\Users\Fabian\AppData\Roaming\Microsoft\Installer\{3571656A-575D-4CED-809D-5547587121FF}\NewShortcut3.exe
[2010.04.03 18:10:06 | 000,040,960 | R--- | M] (InstallShield Software Corp.) -- C:\Users\Fabian\AppData\Roaming\Microsoft\Installer\{3571656A-575D-4CED-809D-5547587121FF}\NewShortcut8.EXE
[2010.07.12 19:44:57 | 000,010,134 | R--- | M] () -- C:\Users\Fabian\AppData\Roaming\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe
[2010.02.23 18:53:21 | 000,439,816 | ---- | M] (RealNetworks, Inc.) -- C:\Users\Fabian\AppData\Roaming\Real\Update\setup3.09\setup.exe
[2010.05.25 17:59:38 | 000,443,912 | ---- | M] (RealNetworks, Inc.) -- C:\Users\Fabian\AppData\Roaming\Real\Update\setup3.10\setup.exe
[2010.09.12 17:46:23 | 000,456,200 | ---- | M] (RealNetworks, Inc.) -- C:\Users\Fabian\AppData\Roaming\Real\Update\setup3.12\setup.exe
[2011.01.30 19:49:48 | 000,510,120 | ---- | M] (RealNetworks, Inc.) -- C:\Users\Fabian\AppData\Roaming\Real\Update\setup3.13\setup.exe
[2011.08.27 22:12:20 | 000,310,400 | ---- | M] (RealNetworks, Inc.) -- C:\Users\Fabian\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\8.00\rnupgagent.exe
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2008.01.19 09:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\SoftwareDistribution\Download\b2ee164db645e6bc8d77bb51f082e3b3\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2007.01.01 02:36:07 | 000,056,504 | ---- | M] (Microsoft Corporation) MD5=198636E76971EBC96404547EC0FD5E75 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_cb7c81c7\AGP440.sys
[2007.01.01 02:36:07 | 000,056,504 | ---- | M] (Microsoft Corporation) MD5=198636E76971EBC96404547EC0FD5E75 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6000.20598_none_b85cfa98dae9b436\AGP440.sys
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\ERDNT\cache\AGP440.sys
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\drivers\AGP440.sys
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2007.01.01 03:25:09 | 000,021,688 | ---- | M] (Microsoft Corporation) MD5=28D0C21DB4FFED1BBFB42E9AA34E0C0D -- C:\Windows\ERDNT\cache\atapi.sys
[2007.01.01 03:25:09 | 000,021,688 | ---- | M] (Microsoft Corporation) MD5=28D0C21DB4FFED1BBFB42E9AA34E0C0D -- C:\Windows\System32\drivers\atapi.sys
[2007.01.01 03:25:09 | 000,021,688 | ---- | M] (Microsoft Corporation) MD5=28D0C21DB4FFED1BBFB42E9AA34E0C0D -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_37a5f048\atapi.sys
[2007.01.01 03:25:09 | 000,021,688 | ---- | M] (Microsoft Corporation) MD5=28D0C21DB4FFED1BBFB42E9AA34E0C0D -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20658_none_dbad770d3da236bb\atapi.sys
[2008.01.19 09:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\SoftwareDistribution\Download\b2ee164db645e6bc8d77bb51f082e3b3\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\ERDNT\cache\cngaudit.dll
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: IASTOR.SYS  >
[2007.07.12 16:35:02 | 000,305,176 | ---- | M] (Intel Corporation) MD5=2358C53F30CB9DCD1D3843C4E2F299B2 -- C:\Windows\System32\drivers\iaStor.sys
[2007.07.12 16:35:02 | 000,305,176 | ---- | M] (Intel Corporation) MD5=2358C53F30CB9DCD1D3843C4E2F299B2 -- C:\Windows\System32\DriverStore\FileRepository\iastor.inf_ec8a8d1b\iaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2008.01.19 09:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\SoftwareDistribution\Download\b2ee164db645e6bc8d77bb51f082e3b3\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\drivers\iaStorV.sys
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2006.11.02 11:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\ERDNT\cache\netlogon.dll
[2006.11.02 11:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\System32\netlogon.dll
[2006.11.02 11:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll
[2008.01.19 09:35:36 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\SoftwareDistribution\Download\b2ee164db645e6bc8d77bb51f082e3b3\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\drivers\nvstor.sys
[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008.01.19 09:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\SoftwareDistribution\Download\b2ee164db645e6bc8d77bb51f082e3b3\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys
 
< MD5 for: NVSTOR32.SYS  >
[2007.07.02 17:37:08 | 000,110,112 | ---- | M] (NVIDIA Corporation) MD5=703E3A7093B0FAC0EEBADBB8E931ECAF -- C:\Windows\System32\drivers\nvstor32.sys
[2007.07.02 17:37:08 | 000,110,112 | ---- | M] (NVIDIA Corporation) MD5=703E3A7093B0FAC0EEBADBB8E931ECAF -- C:\Windows\System32\DriverStore\FileRepository\nvrd32.inf_bbf77119\nvstor32.sys
 
< MD5 for: SCECLI.DLL  >
[2008.01.19 09:36:19 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\SoftwareDistribution\Download\b2ee164db645e6bc8d77bb51f082e3b3\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2006.11.02 11:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\ERDNT\cache\scecli.dll
[2006.11.02 11:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\System32\scecli.dll
[2006.11.02 11:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll
 
< MD5 for: USER32.DLL  >
[2007.01.01 02:03:03 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=3322B167C8F76319C991B851514DFAC9 -- C:\Windows\ERDNT\cache\user32.dll
[2008.01.19 09:36:46 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\SoftwareDistribution\Download\b2ee164db645e6bc8d77bb51f082e3b3\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll
[2006.11.02 11:46:13 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=E698A5437B89A285ACA3FF022356810A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16386_none_cb01aa4570716e5e\user32.dll
[2007.01.01 02:03:03 | 000,633,856 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll
[2007.01.01 02:03:03 | 000,633,856 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.20587_none_cb8c4940898e24a6\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.01.19 09:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\SoftwareDistribution\Download\b2ee164db645e6bc8d77bb51f082e3b3\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\ERDNT\cache\userinit.exe
[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\System32\userinit.exe
[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe
 
< MD5 for: VIAMRAID.SYS  >
[2006.11.08 15:23:52 | 000,102,912 | ---- | M] (VIA Technologies inc,.ltd) MD5=7DC3E1DC6E4F8BE381C31BFEA578412A -- C:\Windows\System32\drivers\viamraid.sys
[2006.11.08 15:23:52 | 000,102,912 | ---- | M] (VIA Technologies inc,.ltd) MD5=7DC3E1DC6E4F8BE381C31BFEA578412A -- C:\Windows\System32\DriverStore\FileRepository\viamraid.inf_74a36694\viamraid.sys
 
< MD5 for: WININIT.EXE  >
[2008.01.19 09:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\SoftwareDistribution\Download\b2ee164db645e6bc8d77bb51f082e3b3\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe
[2007.01.01 02:06:13 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=39D959CD9F3BC44F78DB3C6588AAC3FE -- C:\Windows\ERDNT\cache\wininit.exe
[2007.01.01 02:06:13 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=39D959CD9F3BC44F78DB3C6588AAC3FE -- C:\Windows\System32\wininit.exe
[2007.01.01 02:06:13 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=39D959CD9F3BC44F78DB3C6588AAC3FE -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.20593_none_2f37c4ba208e02ab\wininit.exe
[2006.11.02 11:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.16386_none_2ebbf6d3076595ce\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe
[2007.01.01 02:06:13 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=A3FEA6ED9FD3CF07219A632E4A716226 -- C:\Windows\ERDNT\cache\winlogon.exe
[2007.01.01 02:06:13 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=A3FEA6ED9FD3CF07219A632E4A716226 -- C:\Windows\System32\winlogon.exe
[2007.01.01 02:06:13 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=A3FEA6ED9FD3CF07219A632E4A716226 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.20593_none_6e080d01f12ed7fe\winlogon.exe
[2008.01.19 09:33:37 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\SoftwareDistribution\Download\b2ee164db645e6bc8d77bb51f082e3b3\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2006.11.02 10:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\Windows\System32\drivers\ws2ifsl.sys
[2006.11.02 10:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6000.16386_none_4d4fded8cae2956d\ws2ifsl.sys
[2008.01.19 07:56:49 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\SoftwareDistribution\Download\b2ee164db645e6bc8d77bb51f082e3b3\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
[2010.12.29 22:37:28 | 000,691,696 | ---- | M] () Unable to obtain MD5 -- C:\Windows\system32\drivers\sptd.sys
 
< %systemroot%\System32\config\*.sav >
[2007.10.16 08:29:22 | 006,664,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2007.10.16 08:29:20 | 000,102,400 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2007.10.16 08:29:22 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2007.10.16 08:29:28 | 015,720,448 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2007.10.16 08:29:29 | 006,021,120 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 481 bytes -> C:\ProgramData\TEMP:05EE1EEF
@Alternate Data Stream - 106 bytes -> C:\ProgramData\TEMP:DFC5A2B2

< End of report >
         

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

:OTL
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKLM\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - Reg Error: Key error. File not found
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {40c3cc16-7269-4b32-9531-17f2950fb06f} - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - Reg Error: Key error. File not found
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.defaultthis.engineName: "Winload Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2319825&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.startup.homepage: "http://start.icq.com/"
FF - prefs.js..keyword.URL: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2319825&q="
[2011.08.06 02:59:23 | 000,000,000 | ---D | M] (Winload Community Toolbar) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}
[2010.04.02 13:34:00 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011.08.05 18:05:07 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2008.04.05 21:40:09 | 000,000,000 | ---D | M] (ReloadEvery) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644}
[2011.08.22 16:40:01 | 000,000,000 | ---D | M] (kikin plugin) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{AA994882-F391-4d2e-806F-8908DA4814ED}
[2010.05.30 19:37:16 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2007.11.18 18:58:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{b69a9db4-d0a1-4722-b56b-f20757a29cdf}
[2010.05.31 21:41:40 | 000,000,000 | ---D | M] (DVDVideoSoft Toolbar) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}
[2010.05.01 14:52:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\staged-xpis
[2010.02.04 17:45:40 | 000,002,254 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\askcom.xml
[2011.07.24 15:31:22 | 000,000,917 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\conduit.xml
[2010.12.29 22:37:47 | 000,002,059 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\daemon-search.xml
[2011.08.31 15:59:34 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-1.xml
[2010.09.16 21:51:06 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-10.xml
[2010.10.21 15:35:06 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-11.xml
[2010.10.28 22:30:02 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-12.xml
[2010.11.01 20:10:54 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-13.xml
[2010.12.12 18:15:49 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-14.xml
[2011.03.05 16:55:13 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-15.xml
[2011.03.06 15:53:40 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-16.xml
[2011.03.24 19:24:37 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-17.xml
[2011.05.28 14:30:50 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-18.xml
[2011.08.05 18:05:29 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-19.xml
[2007.11.05 23:42:58 | 000,000,949 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-2.xml
[2011.09.01 22:48:08 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-20.xml
[2007.11.27 22:45:15 | 000,000,949 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-3.xml
[2009.05.13 19:07:53 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-4.xml
[2010.06.23 20:00:54 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-5.xml
[2010.06.28 00:08:50 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-6.xml
[2010.07.22 13:15:12 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-7.xml
[2010.07.26 10:58:21 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-8.xml
[2010.09.08 21:35:51 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-9.xml
[2011.08.05 18:05:07 | 000,000,168 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin.gif
[2011.08.05 18:05:07 | 000,000,618 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin.src
[2011.03.30 15:14:34 | 000,001,042 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin.xml
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - No CLSID value found.
O2 - BHO: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {8DBB6D8E-E4A6-4E3B-9753-AF78B226441C} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {ED4BD629-C1B6-4399-8A34-02CCAA921DC9} - No CLSID value found.
O4 - HKCU..\Run: [EA Core]  File not found
O4 - HKCU..\Run: [ICQ]  File not found
O4 - HKCU..\Run: [msnmsgr]  File not found
O4 - HKCU..\Run: [Pando Media Booster] C:\Programme\Pando Networks\Media Booster\PMB.exe ()
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
[2011.01.03 00:22:14 | 000,073,728 | ---- | C] () -- C:\Windows\System32\GkSui18.EXE
[2008.10.18 16:40:43 | 000,004,984 | ---- | C] () -- C:\ProgramData\jexqjxsy.dne
@Alternate Data Stream - 481 bytes -> C:\ProgramData\TEMP:05EE1EEF
@Alternate Data Stream - 106 bytes -> C:\ProgramData\TEMP:DFC5A2B2
:Commands
[emptytemp]
[resethosts]
         

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

All processes killed
========== OTL ==========
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Local Page| /E : value set successfully!
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{855F3B16-6D32-4fe6-8A56-BBB695989046} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4fe6-8A56-BBB695989046}\ not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\StartPageCache| /E : value set successfully!
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\ deleted successfully.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{40c3cc16-7269-4b32-9531-17f2950fb06f} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{40c3cc16-7269-4b32-9531-17f2950fb06f}\ not found.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{8dbb6d8e-e4a6-4e3b-9753-af78b226441c} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8dbb6d8e-e4a6-4e3b-9753-af78b226441c}\ not found.
Prefs.js: "Ask.com" removed from browser.search.defaultengine
Prefs.js: "ICQ Search" removed from browser.search.defaultenginename
Prefs.js: "Winload Customized Web Search" removed from browser.search.defaultthis.engineName
Prefs.js: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2319825&SearchSource=3&q={searchTerms}" removed from browser.search.defaulturl
Prefs.js: "Ask.com" removed from browser.search.order.1
Prefs.js: "hxxp://start.icq.com/" removed from browser.startup.homepage
Prefs.js: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2319825&q=" removed from keyword.URL
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\searchplugin folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\modules folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\META-INF folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\defaults folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\components folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f} folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\META-INF folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\defaults\preferences folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\defaults folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\components folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\chrome folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\search_engine folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\META-INF folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\defaults\preferences folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\defaults folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\components folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\skin folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\tr folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\sk folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\ru folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\it folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\he folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\fr folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\es folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\en-US folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\de folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\cs folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\bg folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content\img folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644}\chrome folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644} folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{AA994882-F391-4d2e-806F-8908DA4814ED}\settings folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{AA994882-F391-4d2e-806F-8908DA4814ED}\components folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{AA994882-F391-4d2e-806F-8908DA4814ED}\chrome folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{AA994882-F391-4d2e-806F-8908DA4814ED} folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}\chrome folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{b69a9db4-d0a1-4722-b56b-f20757a29cdf} folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\searchplugin folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\META-INF folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\lib folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\defaults folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\components folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\chrome folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f} folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\staged-xpis\{b69a9db4-d0a1-4722-b56b-f20757a29cdf} folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\staged-xpis folder moved successfully.
C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\askcom.xml moved successfully.
C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\conduit.xml moved successfully.
C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\daemon-search.xml moved successfully.
C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-1.xml moved successfully.
C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-10.xml moved successfully.
C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-11.xml moved successfully.
C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-12.xml moved successfully.
C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-13.xml moved successfully.
C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-14.xml moved successfully.
C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-15.xml moved successfully.
C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-16.xml moved successfully.
C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-17.xml moved successfully.
C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-18.xml moved successfully.
C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-19.xml moved successfully.
C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-2.xml moved successfully.
C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-20.xml moved successfully.
C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-3.xml moved successfully.
C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-4.xml moved successfully.
C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-5.xml moved successfully.
C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-6.xml moved successfully.
C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-7.xml moved successfully.
C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-8.xml moved successfully.
C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-9.xml moved successfully.
C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin.gif moved successfully.
C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin.src moved successfully.
C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin.xml moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1E8A6170-7264-4D0F-BEAE-D42A53123C75}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1E8A6170-7264-4D0F-BEAE-D42A53123C75}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}\ deleted successfully.
C:\Programme\ConduitEngine\prxConduitEngine.dll moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{855F3B16-6D32-4FE6-8A56-BBB695989046} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4FE6-8A56-BBB695989046}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{8DBB6D8E-E4A6-4E3B-9753-AF78B226441C} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8DBB6D8E-E4A6-4E3B-9753-AF78B226441C}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{ED4BD629-C1B6-4399-8A34-02CCAA921DC9} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ED4BD629-C1B6-4399-8A34-02CCAA921DC9}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\EA Core deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\ICQ deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\msnmsgr deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Pando Media Booster deleted successfully.
C:\Programme\Pando Networks\Media Booster\PMB.exe moved successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\autoexec.bat moved successfully.
C:\Windows\System32\GkSui18.EXE moved successfully.
C:\ProgramData\jexqjxsy.dne moved successfully.
ADS C:\ProgramData\TEMP:05EE1EEF deleted successfully.
ADS C:\ProgramData\TEMP:DFC5A2B2 deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: asasas
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Fabian
->Temp folder emptied: 70557407 bytes
->Temporary Internet Files folder emptied: 140723361 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 47514330 bytes
->Google Chrome cache emptied: 0 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 10623 bytes
 
User: Gast
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Public
->Temp folder emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 867504 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 248,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.26.5 log created on 09042011_142014

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...
         

Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - also beide Haken setzen, auf Start scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.




Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen!

2011/09/04 15:05:52.0890 3092	TDSS rootkit removing tool 2.5.17.0 Aug 22 2011 15:46:57
2011/09/04 15:05:53.0093 3092	================================================================================
2011/09/04 15:05:53.0093 3092	SystemInfo:
2011/09/04 15:05:53.0093 3092	
2011/09/04 15:05:53.0093 3092	OS Version: 6.0.6000 ServicePack: 0.0
2011/09/04 15:05:53.0093 3092	Product type: Workstation
2011/09/04 15:05:53.0093 3092	ComputerName: FABIAN-PC
2011/09/04 15:05:53.0093 3092	UserName: Fabian
2011/09/04 15:05:53.0093 3092	Windows directory: C:\Windows
2011/09/04 15:05:53.0093 3092	System windows directory: C:\Windows
2011/09/04 15:05:53.0093 3092	Processor architecture: Intel x86
2011/09/04 15:05:53.0093 3092	Number of processors: 2
2011/09/04 15:05:53.0093 3092	Page size: 0x1000
2011/09/04 15:05:53.0093 3092	Boot type: Normal boot
2011/09/04 15:05:53.0093 3092	================================================================================
2011/09/04 15:05:53.0936 3092	Initialize success
2011/09/04 15:06:03.0514 4912	================================================================================
2011/09/04 15:06:03.0514 4912	Scan started
2011/09/04 15:06:03.0514 4912	Mode: Manual; 
2011/09/04 15:06:03.0514 4912	================================================================================
2011/09/04 15:06:04.0606 4912	ACPI            (192bdbd1540645c4a2aa69f24cce197f) C:\Windows\system32\drivers\acpi.sys
2011/09/04 15:06:04.0684 4912	adp94xx         (2edc5bbac6c651ece337bde8ed97c9fb) C:\Windows\system32\drivers\adp94xx.sys
2011/09/04 15:06:04.0762 4912	adpahci         (b84088ca3cdca97da44a984c6ce1ccad) C:\Windows\system32\drivers\adpahci.sys
2011/09/04 15:06:04.0824 4912	adpu160m        (7880c67bccc27c86fd05aa2afb5ea469) C:\Windows\system32\drivers\adpu160m.sys
2011/09/04 15:06:04.0902 4912	adpu320         (9ae713f8e30efc2abccd84904333df4d) C:\Windows\system32\drivers\adpu320.sys
2011/09/04 15:06:04.0980 4912	AFD             (5d24caf8efd924a875698ff28384db8b) C:\Windows\system32\drivers\afd.sys
2011/09/04 15:06:05.0043 4912	agp440          (ef23439cdd587f64c2c1b8825cead7d8) C:\Windows\system32\drivers\agp440.sys
2011/09/04 15:06:05.0105 4912	aic78xx         (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
2011/09/04 15:06:05.0168 4912	aliide          (90395b64600ebb4552e26e178c94b2e4) C:\Windows\system32\drivers\aliide.sys
2011/09/04 15:06:05.0230 4912	amdagp          (2b13e304c9dfdfa5eb582f6a149fa2c7) C:\Windows\system32\drivers\amdagp.sys
2011/09/04 15:06:05.0277 4912	amdide          (0577df1d323fe75a739c787893d300ea) C:\Windows\system32\drivers\amdide.sys
2011/09/04 15:06:05.0339 4912	AmdK7           (dc487885bcef9f28eece6fac0e5ddfc5) C:\Windows\system32\drivers\amdk7.sys
2011/09/04 15:06:05.0402 4912	AmdK8           (0ca0071da4315b00fc1328ca86b425da) C:\Windows\system32\DRIVERS\amdk8.sys
2011/09/04 15:06:05.0542 4912	arc             (5f673180268bb1fdb69c99b6619fe379) C:\Windows\system32\drivers\arc.sys
2011/09/04 15:06:05.0604 4912	arcsas          (957f7540b5e7f602e44648c7de5a1c05) C:\Windows\system32\drivers\arcsas.sys
2011/09/04 15:06:05.0682 4912	ASPI            (e54e27976e2c5a6465d44c10b1d87ac0) C:\Windows\System32\DRIVERS\ASPI32.sys
2011/09/04 15:06:05.0745 4912	AsyncMac        (e86cf7ce67d5de898f27ef884dc357d8) C:\Windows\system32\DRIVERS\asyncmac.sys
2011/09/04 15:06:05.0792 4912	atapi           (28d0c21db4ffed1bbfb42e9aa34e0c0d) C:\Windows\system32\drivers\atapi.sys
2011/09/04 15:06:05.0838 4912	AtiPcie         (a356e45e8432432c06981ea63a1e0fe8) C:\Windows\system32\DRIVERS\AtiPcie.sys
2011/09/04 15:06:05.0963 4912	avgio           (71a751d7f8b0219bcf827596fc5af318) C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgio.sys
2011/09/04 15:06:06.0010 4912	avgntflt        (cf8a756118fc374c494fb8c86c03bcc7) C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgntflt.sys
2011/09/04 15:06:06.0057 4912	avipbb          (fdba6800835b9628ef401f642284ce55) C:\Windows\system32\DRIVERS\avipbb.sys
2011/09/04 15:06:06.0119 4912	Beep            (ac3dd1708b22761ebd7cbe14dcc3b5d7) C:\Windows\system32\drivers\Beep.sys
2011/09/04 15:06:06.0244 4912	bowser          (913cd06fbe9105ce6077e90fd4418561) C:\Windows\system32\DRIVERS\bowser.sys
2011/09/04 15:06:06.0322 4912	BrFiltLo        (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
2011/09/04 15:06:06.0384 4912	BrFiltUp        (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
2011/09/04 15:06:06.0447 4912	Brserid         (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
2011/09/04 15:06:06.0556 4912	BrSerWdm        (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
2011/09/04 15:06:06.0603 4912	BrUsbMdm        (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
2011/09/04 15:06:06.0634 4912	BrUsbSer        (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys
2011/09/04 15:06:06.0681 4912	BTHMODEM        (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys
2011/09/04 15:06:06.0852 4912	cdfs            (6c3a437fc873c6f6a4fc620b6888cb86) C:\Windows\system32\DRIVERS\cdfs.sys
2011/09/04 15:06:06.0899 4912	cdrom           (8d1866e61af096ae8b582454f5e4d303) C:\Windows\system32\DRIVERS\cdrom.sys
2011/09/04 15:06:06.0962 4912	circlass        (da8e0afc7baa226c538ef53ac2f90897) C:\Windows\system32\drivers\circlass.sys
2011/09/04 15:06:07.0040 4912	CLFS            (1b84fd0937d3b99af9ba38ddff3daf54) C:\Windows\system32\CLFS.sys
2011/09/04 15:06:07.0118 4912	cmdide          (45201046c776ffdaf3fc8a0029c581c8) C:\Windows\system32\drivers\cmdide.sys
2011/09/04 15:06:07.0180 4912	Compbatt        (82b8c91d327cfecf76cb58716f7d4997) C:\Windows\system32\drivers\compbatt.sys
2011/09/04 15:06:07.0227 4912	crcdisk         (2a213ae086bbec5e937553c7d9a2b22c) C:\Windows\system32\drivers\crcdisk.sys
2011/09/04 15:06:07.0289 4912	Crusoe          (22a7f883508176489f559ee745b5bf5d) C:\Windows\system32\drivers\crusoe.sys
2011/09/04 15:06:07.0398 4912	DfsC            (a7179de59ae269ab70345527894ccd7c) C:\Windows\system32\Drivers\dfsc.sys
2011/09/04 15:06:07.0461 4912	disk            (841af4c4d41d3e3b2f244e976b0f7963) C:\Windows\system32\drivers\disk.sys
2011/09/04 15:06:07.0554 4912	drmkaud         (ee472cd2c01f6f8e8aa1fa06ffef61b6) C:\Windows\system32\drivers\drmkaud.sys
2011/09/04 15:06:07.0632 4912	DXGKrnl         (2d13d9e98caf6321f219b28921af214c) C:\Windows\System32\drivers\dxgkrnl.sys
2011/09/04 15:06:07.0710 4912	E1G60           (f88fb26547fd2ce6d0a5af2985892c48) C:\Windows\system32\DRIVERS\E1G60I32.sys
2011/09/04 15:06:07.0773 4912	Ecache          (38573398f734b71b06cd2411494f234a) C:\Windows\system32\drivers\ecache.sys
2011/09/04 15:06:07.0882 4912	eeCtrl          (8f7dbc4be48f5388a6fe1f285e7948ef) C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
2011/09/04 15:06:08.0147 4912	elxstor         (e8f3f21a71720c84bcf423b80028359f) C:\Windows\system32\drivers\elxstor.sys
2011/09/04 15:06:08.0256 4912	enodpl          (b4556f3d468c8dcb0b259d9d866cd4c4) C:\Windows\system32\drivers\enodpl.sys
2011/09/04 15:06:08.0397 4912	fastfat         (84a317cb0b3954d3768cdcd018dbf670) C:\Windows\system32\drivers\fastfat.sys
2011/09/04 15:06:08.0475 4912	fdc             (63bdada84951b9c03e641800e176898a) C:\Windows\system32\DRIVERS\fdc.sys
2011/09/04 15:06:08.0522 4912	FileInfo        (65773d6115c037ffd7ef8280ae85eb9d) C:\Windows\system32\drivers\fileinfo.sys
2011/09/04 15:06:08.0568 4912	Filetrace       (c226dd0de060745f3e042f58dcf78402) C:\Windows\system32\drivers\filetrace.sys
2011/09/04 15:06:08.0631 4912	flpydisk        (6603957eff5ec62d25075ea8ac27de68) C:\Windows\system32\DRIVERS\flpydisk.sys
2011/09/04 15:06:08.0678 4912	FltMgr          (a6a8da7ae4d53394ab22ac3ab6d3f5d3) C:\Windows\system32\drivers\fltmgr.sys
2011/09/04 15:06:08.0771 4912	Fs_Rec          (66a078591208baa210c7634b11eb392c) C:\Windows\system32\drivers\Fs_Rec.sys
2011/09/04 15:06:08.0880 4912	gagp30kx        (4e1cd0a45c50a8882616cae5bf82f3c5) C:\Windows\system32\drivers\gagp30kx.sys
2011/09/04 15:06:08.0943 4912	GEARAspiWDM     (8182ff89c65e4d38b2de4bb0fb18564e) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
2011/09/04 15:06:09.0005 4912	GRD             (1524d3a6850ee14e88d860c3696100c0) C:\Windows\system32\drivers\GRD.sys
2011/09/04 15:06:09.0099 4912	HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys
2011/09/04 15:06:09.0161 4912	HDAudBus        (0db613a7e427b5663563677796fd5258) C:\Windows\system32\DRIVERS\HDAudBus.sys
2011/09/04 15:06:09.0286 4912	HidBth          (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys
2011/09/04 15:06:09.0395 4912	HidIr           (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys
2011/09/04 15:06:09.0473 4912	HidUsb          (01e7971e9f4bd6ac6a08db52d0ea0418) C:\Windows\system32\DRIVERS\hidusb.sys
2011/09/04 15:06:09.0551 4912	HpCISSs         (df353b401001246853763c4b7aaa6f50) C:\Windows\system32\drivers\hpcisss.sys
2011/09/04 15:06:09.0598 4912	HTTP            (f31d27ccf514549a17e79bebe01b40b6) C:\Windows\system32\drivers\HTTP.sys
2011/09/04 15:06:09.0848 4912	i2omp           (324c2152ff2c61abae92d09f3cca4d63) C:\Windows\system32\drivers\i2omp.sys
2011/09/04 15:06:09.0941 4912	i8042prt        (bea9838cd25d36beba3f94386a761d60) C:\Windows\system32\DRIVERS\i8042prt.sys
2011/09/04 15:06:10.0004 4912	iaStor          (2358c53f30cb9dcd1d3843c4e2f299b2) C:\Windows\system32\drivers\iastor.sys
2011/09/04 15:06:10.0066 4912	iaStorV         (c957bf4b5d80b46c5017bf0101e6c906) C:\Windows\system32\drivers\iastorv.sys
2011/09/04 15:06:10.0160 4912	iirsp           (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
2011/09/04 15:06:10.0253 4912	IKFileSec       (bb07262041a213fea5fccf0a9f90d85a) C:\Windows\system32\drivers\ikfilesec.sys
2011/09/04 15:06:10.0284 4912	IKSysFlt        (b2581314d54f8de4262f0a51f7ba63d0) C:\Windows\system32\drivers\iksysflt.sys
2011/09/04 15:06:10.0331 4912	IKSysSec        (6f544cd764f949170b46a4dab11673e2) C:\Windows\system32\drivers\iksyssec.sys
2011/09/04 15:06:10.0456 4912	IntcAzAudAddService (4de88b49c891f45cd9ea6d83a341d3e3) C:\Windows\system32\drivers\RTKVHDA.sys
2011/09/04 15:06:10.0581 4912	intelide        (97469037714070e45194ed318d636401) C:\Windows\system32\drivers\intelide.sys
2011/09/04 15:06:10.0612 4912	intelppm        (ce44cc04262f28216dd4341e9e36a16f) C:\Windows\system32\DRIVERS\intelppm.sys
2011/09/04 15:06:10.0659 4912	IpFilterDriver  (880c6f86cc3f551b8fea2c11141268c0) C:\Windows\system32\DRIVERS\ipfltdrv.sys
2011/09/04 15:06:10.0768 4912	IPMIDRV         (40f34f8aba2a015d780e4b09138b6c17) C:\Windows\system32\drivers\ipmidrv.sys
2011/09/04 15:06:10.0862 4912	IPNAT           (10077c35845101548037df04fd1a420b) C:\Windows\system32\DRIVERS\ipnat.sys
2011/09/04 15:06:10.0940 4912	IRENUM          (a82f328f4792304184642d6d397bb1e3) C:\Windows\system32\drivers\irenum.sys
2011/09/04 15:06:10.0986 4912	isapnp          (350fca7e73cf65bcef43fae1e4e91293) C:\Windows\system32\drivers\isapnp.sys
2011/09/04 15:06:11.0033 4912	iScsiPrt        (4dca456d4d5723f8fa9c6760d240b0df) C:\Windows\system32\DRIVERS\msiscsi.sys
2011/09/04 15:06:11.0096 4912	iteatapi        (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
2011/09/04 15:06:11.0142 4912	iteraid         (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
2011/09/04 15:06:11.0189 4912	JRAID           (c1632fe31d1824a43dea29725312e3fa) C:\Windows\system32\drivers\jraid.sys
2011/09/04 15:06:11.0252 4912	kbdclass        (c9b0cf786d5f151a43c7be8e243f2819) C:\Windows\system32\DRIVERS\kbdclass.sys
2011/09/04 15:06:11.0283 4912	kbdhid          (97ab2fb84e8e77d93cee85550f4cf7f9) C:\Windows\system32\DRIVERS\kbdhid.sys
2011/09/04 15:06:11.0376 4912	KSecDD          (11d0bc1f2afd8abbb5a3dc47a042de54) C:\Windows\system32\Drivers\ksecdd.sys
2011/09/04 15:06:11.0548 4912	lltdio          (fd015b4f95daa2b712f0e372a116fbad) C:\Windows\system32\DRIVERS\lltdio.sys
2011/09/04 15:06:11.0673 4912	LSI_FC          (a2262fb9f28935e862b4db46438c80d2) C:\Windows\system32\drivers\lsi_fc.sys
2011/09/04 15:06:11.0766 4912	LSI_SAS         (30d73327d390f72a62f32c103daf1d6d) C:\Windows\system32\drivers\lsi_sas.sys
2011/09/04 15:06:11.0829 4912	LSI_SCSI        (e1e36fefd45849a95f1ab81de0159fe3) C:\Windows\system32\drivers\lsi_scsi.sys
2011/09/04 15:06:11.0907 4912	luafv           (42885bb44b6e065b8575a8dd6c430c52) C:\Windows\system32\drivers\luafv.sys
2011/09/04 15:06:12.0000 4912	megasas         (d153b14fc6598eae8422a2037553adce) C:\Windows\system32\drivers\megasas.sys
2011/09/04 15:06:12.0094 4912	Modem           (21755967298a46fb6adfec9db6012211) C:\Windows\system32\drivers\modem.sys
2011/09/04 15:06:12.0172 4912	monitor         (47c09851f763f2e03bfadd581747ecec) C:\Windows\system32\DRIVERS\monitor.sys
2011/09/04 15:06:12.0219 4912	mouclass        (4a00b3cf90ad075193ca5aeece71154c) C:\Windows\system32\DRIVERS\mouclass.sys
2011/09/04 15:06:12.0266 4912	mouhid          (8d9b701d716843c39e93b3432cb721fc) C:\Windows\system32\DRIVERS\mouhid.sys
2011/09/04 15:06:12.0312 4912	MountMgr        (01f1e5a3e4877c931cbb31613fec16a6) C:\Windows\system32\drivers\mountmgr.sys
2011/09/04 15:06:12.0375 4912	mpio            (583a41f26278d9e0ea548163d6139397) C:\Windows\system32\drivers\mpio.sys
2011/09/04 15:06:12.0437 4912	mpsdrv          (6e7a7f0c1193ee5648443fe2d4b789ec) C:\Windows\system32\drivers\mpsdrv.sys
2011/09/04 15:06:12.0484 4912	Mraid35x        (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
2011/09/04 15:06:12.0546 4912	MRxDAV          (08f0c494a69cf3106ee7ffc48d8e5ac7) C:\Windows\system32\drivers\mrxdav.sys
2011/09/04 15:06:12.0593 4912	mrxsmb          (dc5632cbc8a3d02ce1114debb64b7037) C:\Windows\system32\DRIVERS\mrxsmb.sys
2011/09/04 15:06:12.0640 4912	mrxsmb10        (f813456c00b904dc3b6558cad7b13bba) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2011/09/04 15:06:12.0671 4912	mrxsmb20        (30a67c7d8b80281028916ded6a64aec9) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2011/09/04 15:06:12.0718 4912	msahci          (742aed7939e734c36b7e8d6228ce26b7) C:\Windows\system32\drivers\msahci.sys
2011/09/04 15:06:12.0765 4912	msdsm           (3fc82a2ae4cc149165a94699183d3028) C:\Windows\system32\drivers\msdsm.sys
2011/09/04 15:06:12.0812 4912	Msfs            (729eafefd4e7417165f353a18dbe947d) C:\Windows\system32\drivers\Msfs.sys
2011/09/04 15:06:12.0874 4912	msisadrv        (0a64168b63535520adfd6b959695404a) C:\Windows\system32\drivers\msisadrv.sys
2011/09/04 15:06:12.0952 4912	MSKSSRV         (892cedefa7e0ffe7be8da651b651d047) C:\Windows\system32\drivers\MSKSSRV.sys
2011/09/04 15:06:12.0999 4912	MSPCLOCK        (ae2cb1da69b2676b4cee2a501af5871c) C:\Windows\system32\drivers\MSPCLOCK.sys
2011/09/04 15:06:13.0014 4912	MSPQM           (f910da84fa90c44a3addb7cd874463fd) C:\Windows\system32\drivers\MSPQM.sys
2011/09/04 15:06:13.0077 4912	MsRPC           (84571c0ae07647ba38d493f5f0015df7) C:\Windows\system32\drivers\MsRPC.sys
2011/09/04 15:06:13.0217 4912	mssmbios        (e09cedb1bca303b7f6ae22f512e56969) C:\Windows\system32\DRIVERS\mssmbios.sys
2011/09/04 15:06:13.0280 4912	MSTEE           (c826dd1373f38afd9ca46ec3c436a14e) C:\Windows\system32\drivers\MSTEE.sys
2011/09/04 15:06:13.0326 4912	Mup             (fa7aa70050cf5e2d15de00941e5665e5) C:\Windows\system32\Drivers\mup.sys
2011/09/04 15:06:13.0420 4912	NativeWifiP     (be8c26e61be5c5a49a6babd17aeed1b7) C:\Windows\system32\DRIVERS\nwifi.sys
2011/09/04 15:06:13.0498 4912	NDIS            (6e8dfface597629cef5df7d69217628f) C:\Windows\system32\drivers\ndis.sys
2011/09/04 15:06:13.0576 4912	NdisTapi        (81659cdcbd0f9a9e07e6878ad8c78d3f) C:\Windows\system32\DRIVERS\ndistapi.sys
2011/09/04 15:06:13.0623 4912	Ndisuio         (5de5ee546bf40838ebe0e01cb629df64) C:\Windows\system32\DRIVERS\ndisuio.sys
2011/09/04 15:06:13.0670 4912	NdisWan         (397402adcbb8946223a1950101f6cd94) C:\Windows\system32\DRIVERS\ndiswan.sys
2011/09/04 15:06:13.0716 4912	NDProxy         (1b24fa907af283199a81b3bb37e5e526) C:\Windows\system32\drivers\NDProxy.sys
2011/09/04 15:06:13.0763 4912	NetBIOS         (356dbb9f98e8dc1028dd3092fceeb877) C:\Windows\system32\DRIVERS\netbios.sys
2011/09/04 15:06:13.0794 4912	netbt           (231f6ccfdb7a604221f18fb0852c8560) C:\Windows\system32\DRIVERS\netbt.sys
2011/09/04 15:06:13.0888 4912	nfrd960         (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys
2011/09/04 15:06:13.0966 4912	Npfs            (4f9832beb9fafd8ceb0e541f1323b26e) C:\Windows\system32\drivers\Npfs.sys
2011/09/04 15:06:14.0044 4912	nsiproxy        (b488dfec274de1fc9d653870ef2587be) C:\Windows\system32\drivers\nsiproxy.sys
2011/09/04 15:06:14.0153 4912	Ntfs            (01db57ff55bcf719545570f3bd050000) C:\Windows\system32\drivers\Ntfs.sys
2011/09/04 15:06:14.0262 4912	ntrigdigi       (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys
2011/09/04 15:06:14.0294 4912	Null            (ec5efb3c60f1b624648344a328bce596) C:\Windows\system32\drivers\Null.sys
2011/09/04 15:06:14.0606 4912	nvlddmkm        (f623c2b16fde938b908031aeba445344) C:\Windows\system32\DRIVERS\nvlddmkm.sys
2011/09/04 15:06:14.0996 4912	nvraid          (e69e946f80c1c31c53003bfbf50cbb7c) C:\Windows\system32\drivers\nvraid.sys
2011/09/04 15:06:15.0089 4912	nvrd32          (ed399014a8029de02ba5ae01da8cc9ee) C:\Windows\system32\drivers\nvrd32.sys
2011/09/04 15:06:15.0136 4912	nvstor          (9e0ba19a28c498a6d323d065db76dffc) C:\Windows\system32\drivers\nvstor.sys
2011/09/04 15:06:15.0183 4912	nvstor32        (703e3a7093b0fac0eebadbb8e931ecaf) C:\Windows\system32\drivers\nvstor32.sys
2011/09/04 15:06:15.0245 4912	nv_agp          (07c186427eb8fcc3d8d7927187f260f7) C:\Windows\system32\drivers\nv_agp.sys
2011/09/04 15:06:15.0448 4912	ohci1394        (8994cbfc215a9ef4495e6ae7992954fc) C:\Windows\system32\DRIVERS\ohci1394.sys
2011/09/04 15:06:15.0557 4912	Parport         (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys
2011/09/04 15:06:15.0604 4912	partmgr         (555a5b2c8022983bc7467bc925b222ee) C:\Windows\system32\drivers\partmgr.sys
2011/09/04 15:06:15.0635 4912	Parvdm          (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys
2011/09/04 15:06:15.0698 4912	pci             (a48c4d0acc933f7a37e52ab0761811ad) C:\Windows\system32\drivers\pci.sys
2011/09/04 15:06:15.0729 4912	pciide          (3a1efd3fd478c8a6d528ec297dbcb36f) C:\Windows\system32\drivers\pciide.sys
2011/09/04 15:06:15.0776 4912	pcmcia          (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys
2011/09/04 15:06:15.0854 4912	PEAUTH          (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
2011/09/04 15:06:16.0088 4912	PptpMiniport    (c04dec5ace67c5247b150c4223970bb7) C:\Windows\system32\DRIVERS\raspptp.sys
2011/09/04 15:06:16.0150 4912	Processor       (0e3cef5d28b40cf273281d620c50700a) C:\Windows\system32\drivers\processr.sys
2011/09/04 15:06:16.0228 4912	PSched          (2c8bae55247c4e09352e870292e4d1ab) C:\Windows\system32\DRIVERS\pacer.sys
2011/09/04 15:06:16.0306 4912	ql2300          (ccdac889326317792480c0a67156a1ec) C:\Windows\system32\drivers\ql2300.sys
2011/09/04 15:06:16.0384 4912	ql40xx          (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
2011/09/04 15:06:16.0462 4912	QWAVEdrv        (d2b3e2b7426dc23e185fbc73c8936c12) C:\Windows\system32\drivers\qwavedrv.sys
2011/09/04 15:06:16.0493 4912	RasAcd          (bd7b30f55b3649506dd8b3d38f571d2a) C:\Windows\system32\DRIVERS\rasacd.sys
2011/09/04 15:06:16.0571 4912	Rasl2tp         (68b0019fee429ec49d29017af937e482) C:\Windows\system32\DRIVERS\rasl2tp.sys
2011/09/04 15:06:16.0634 4912	RasPppoe        (ccf4e9c6cbbac81437f88cb2ae0b6c96) C:\Windows\system32\DRIVERS\raspppoe.sys
2011/09/04 15:06:16.0680 4912	rdbss           (54129c5d9581bbec8bd1ebd3ba813f47) C:\Windows\system32\DRIVERS\rdbss.sys
2011/09/04 15:06:16.0727 4912	RDPCDD          (794585276b5d7fca9f3fc15543f9f0b9) C:\Windows\system32\DRIVERS\RDPCDD.sys
2011/09/04 15:06:16.0790 4912	rdpdr           (e8bd98d46f2ed77132ba927fccb47d8b) C:\Windows\system32\drivers\rdpdr.sys
2011/09/04 15:06:16.0836 4912	RDPENCDD        (980b56e2e273e19d3a9d72d5c420f008) C:\Windows\system32\drivers\rdpencdd.sys
2011/09/04 15:06:16.0914 4912	RDPWD           (8830e790a74a96605faba74f9665bb3c) C:\Windows\system32\drivers\RDPWD.sys
2011/09/04 15:06:17.0008 4912	rspndr          (97e939d2128fec5d5a3e6e79b290a2f4) C:\Windows\system32\DRIVERS\rspndr.sys
2011/09/04 15:06:17.0070 4912	RTL8169         (abbe0f54ba3a378262c9cb86cf7d91f8) C:\Windows\system32\DRIVERS\Rtlh86.sys
2011/09/04 15:06:17.0117 4912	sbp2port        (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
2011/09/04 15:06:17.0180 4912	SCDEmu          (16b1abe7f3e35f21dac57592b6c5d464) C:\Windows\system32\drivers\SCDEmu.sys
2011/09/04 15:06:17.0304 4912	Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\SECDRV.SYS
2011/09/04 15:06:17.0382 4912	Serenum         (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\DRIVERS\serenum.sys
2011/09/04 15:06:17.0429 4912	Serial          (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\DRIVERS\serial.sys
2011/09/04 15:06:17.0476 4912	sermouse        (2baf2abc0da0d50ebe8289c720977052) C:\Windows\system32\drivers\sermouse.sys
2011/09/04 15:06:17.0601 4912	sffdisk         (103b79418da647736ee95645f305f68a) C:\Windows\system32\drivers\sffdisk.sys
2011/09/04 15:06:17.0679 4912	sffp_mmc        (8fd08a310645fe872eeec6e08c6bf3ee) C:\Windows\system32\drivers\sffp_mmc.sys
2011/09/04 15:06:17.0710 4912	sffp_sd         (9cfa05fcfcb7124e69cfc812b72f9614) C:\Windows\system32\drivers\sffp_sd.sys
2011/09/04 15:06:17.0741 4912	sfloppy         (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys
2011/09/04 15:06:17.0835 4912	sisagp          (d2a595d6eebeeaf4334f8e50efbc9931) C:\Windows\system32\drivers\sisagp.sys
2011/09/04 15:06:17.0882 4912	SiSRaid2        (cedd6f4e7d84e9f98b34b3fe988373aa) C:\Windows\system32\drivers\sisraid2.sys
2011/09/04 15:06:17.0928 4912	SiSRaid4        (df843c528c4f69d12ce41ce462e973a7) C:\Windows\system32\drivers\sisraid4.sys
2011/09/04 15:06:18.0006 4912	Smb             (46baf398809a0f3b2d3300a1760e4b91) C:\Windows\system32\DRIVERS\smb.sys
2011/09/04 15:06:18.0084 4912	spldr           (426f9b029aa9162ceccf65369457d046) C:\Windows\system32\drivers\spldr.sys
2011/09/04 15:06:18.0178 4912	sptd            (cdddec541bc3c96f91ecb48759673505) C:\Windows\system32\Drivers\sptd.sys
2011/09/04 15:06:18.0178 4912	Suspicious file (NoAccess): C:\Windows\system32\Drivers\sptd.sys. md5: cdddec541bc3c96f91ecb48759673505
2011/09/04 15:06:18.0194 4912	sptd - detected LockedFile.Multi.Generic (1)
2011/09/04 15:06:18.0240 4912	srv             (e86bf07b1d2ec33c52b3b31e5814001a) C:\Windows\system32\DRIVERS\srv.sys
2011/09/04 15:06:18.0303 4912	srv2            (e8c4d5bca3c7b5c2a040052aa467b5bf) C:\Windows\system32\DRIVERS\srv2.sys
2011/09/04 15:06:18.0350 4912	srvnet          (8ae0f61f71e97ace067cdab67c98746b) C:\Windows\system32\DRIVERS\srvnet.sys
2011/09/04 15:06:18.0443 4912	ssmdrv          (71d609c5dff067906d930bde031c4cfe) C:\Windows\system32\DRIVERS\ssmdrv.sys
2011/09/04 15:06:18.0521 4912	swenum          (9c539aaffb0b6d7bce984c74317ff29f) C:\Windows\system32\DRIVERS\swenum.sys
2011/09/04 15:06:18.0615 4912	Symc8xx         (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
2011/09/04 15:06:18.0677 4912	Sym_hi          (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
2011/09/04 15:06:18.0724 4912	Sym_u3          (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
2011/09/04 15:06:18.0786 4912	tandpl          (126d7b3b4c7b724491c604060e1f4e14) C:\Windows\system32\drivers\tandpl.sys
2011/09/04 15:06:18.0927 4912	Tcpip           (52a8bd6294f7d1443c6184c67ae13af4) C:\Windows\system32\drivers\tcpip.sys
2011/09/04 15:06:19.0083 4912	Tcpip6          (52a8bd6294f7d1443c6184c67ae13af4) C:\Windows\system32\DRIVERS\tcpip.sys
2011/09/04 15:06:19.0223 4912	tcpipreg        (5ce0c4a7b12d0067dad527d72b68c726) C:\Windows\system32\drivers\tcpipreg.sys
2011/09/04 15:06:19.0270 4912	TDPIPE          (964248aef49c31fa6a93201a73ffaf50) C:\Windows\system32\drivers\tdpipe.sys
2011/09/04 15:06:19.0317 4912	TDTCP           (7d2c1ae1648a60fce4aa0f7982e419d3) C:\Windows\system32\drivers\tdtcp.sys
2011/09/04 15:06:19.0379 4912	tdx             (7973f7239486800cd79e4fdbab6a07df) C:\Windows\system32\DRIVERS\tdx.sys
2011/09/04 15:06:19.0410 4912	TermDD          (cfe870506361bac80a549749116ad870) C:\Windows\system32\DRIVERS\termdd.sys
2011/09/04 15:06:19.0535 4912	tssecsrv        (29f0eca726f0d51f7e048bdb0b372f29) C:\Windows\system32\DRIVERS\tssecsrv.sys
2011/09/04 15:06:19.0629 4912	tunmp           (a858917785681743c512950fdfa14db7) C:\Windows\system32\DRIVERS\tunmp.sys
2011/09/04 15:06:19.0676 4912	tunnel          (29f1d1d888ee61d20d5662e72aa34129) C:\Windows\system32\DRIVERS\tunnel.sys
2011/09/04 15:06:19.0754 4912	uagp35          (c3ade15414120033a36c0f293d4a4121) C:\Windows\system32\drivers\uagp35.sys
2011/09/04 15:06:19.0832 4912	udfs            (1811e1016d96e3ea0e170f7c23804e50) C:\Windows\system32\DRIVERS\udfs.sys
2011/09/04 15:06:19.0956 4912	uliagpkx        (75e6890ebfce0841d3291b02e7a8bdb0) C:\Windows\system32\drivers\uliagpkx.sys
2011/09/04 15:06:20.0019 4912	uliahci         (3cd4ea35a6221b85dcc25daa46313f8d) C:\Windows\system32\drivers\uliahci.sys
2011/09/04 15:06:20.0097 4912	UlSata          (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
2011/09/04 15:06:20.0144 4912	ulsata2         (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
2011/09/04 15:06:20.0206 4912	umbus           (dc8828971d997de009647fce59e0ce8f) C:\Windows\system32\DRIVERS\umbus.sys
2011/09/04 15:06:20.0300 4912	USB28xxBGA      (9b01ce1eda6ad1acfd4f865d6cb0a790) C:\Windows\system32\DRIVERS\emBDA.sys
2011/09/04 15:06:20.0362 4912	USB28xxOEM      (c93e4f6bd1cbd163662e7c9be021b895) C:\Windows\system32\DRIVERS\emOEM.sys
2011/09/04 15:06:20.0424 4912	USBAAPL         (4b8a9c16b6d9258ed99c512aecb8c555) C:\Windows\system32\Drivers\usbaapl.sys
2011/09/04 15:06:20.0502 4912	usbccgp         (03b01e8dbd2da2b49157b7e51912aaf2) C:\Windows\system32\DRIVERS\usbccgp.sys
2011/09/04 15:06:20.0549 4912	usbcir          (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys
2011/09/04 15:06:20.0612 4912	usbehci         (2f83363f98484f8edaf49f9b41520d14) C:\Windows\system32\DRIVERS\usbehci.sys
2011/09/04 15:06:20.0658 4912	usbhub          (14d2a4dcd92c0b3368667aed6893463d) C:\Windows\system32\DRIVERS\usbhub.sys
2011/09/04 15:06:20.0721 4912	usbohci         (51dc36722172d45f2f935ce5cc18a812) C:\Windows\system32\DRIVERS\usbohci.sys
2011/09/04 15:06:20.0799 4912	usbprint        (b51e52acf758be00ef3a58ea452fe360) C:\Windows\system32\DRIVERS\usbprint.sys
2011/09/04 15:06:20.0861 4912	usbscan         (b1f95285c08ddfe00c0b955462637ec7) C:\Windows\system32\DRIVERS\usbscan.sys
2011/09/04 15:06:20.0939 4912	USBSTOR         (7887ce56934e7f104e98c975f47353c5) C:\Windows\system32\DRIVERS\USBSTOR.SYS
2011/09/04 15:06:21.0002 4912	usbuhci         (325dbbacb8a36af9988ccf40eac228cc) C:\Windows\system32\DRIVERS\usbuhci.sys
2011/09/04 15:06:21.0095 4912	usbvideo        (46f3a2912ef88cd8e87d4f9b304cd949) C:\Windows\system32\Drivers\usbvideo.sys
2011/09/04 15:06:21.0189 4912	VBoxNetAdp      (b9d3c274e937a15fd2cef8aa1e4c3477) C:\Windows\system32\DRIVERS\VBoxNetAdp.sys
2011/09/04 15:06:21.0314 4912	vga             (7d92be0028ecdedec74617009084b5ef) C:\Windows\system32\DRIVERS\vgapnp.sys
2011/09/04 15:06:21.0360 4912	VgaSave         (17a8f877314e4067f8c8172cc6d9101c) C:\Windows\System32\drivers\vga.sys
2011/09/04 15:06:21.0438 4912	viaagp          (045d9961e591cf0674a920b6ba3ba5cb) C:\Windows\system32\drivers\viaagp.sys
2011/09/04 15:06:21.0485 4912	ViaC7           (56a4de5f02f2e88182b0981119b4dd98) C:\Windows\system32\drivers\viac7.sys
2011/09/04 15:06:21.0532 4912	viaide          (fd2e3175fcada350c7ab4521dca187ec) C:\Windows\system32\drivers\viaide.sys
2011/09/04 15:06:21.0594 4912	viamraid        (7dc3e1dc6e4f8be381c31bfea578412a) C:\Windows\system32\drivers\viamraid.sys
2011/09/04 15:06:21.0688 4912	vmm             (590c7a3a1133e51a7e1cef67366e75af) C:\Windows\system32\Drivers\vmm.sys
2011/09/04 15:06:21.0766 4912	volmgr          (cc8a64a532fd2844ee68f4061ed8a7fd) C:\Windows\system32\drivers\volmgr.sys
2011/09/04 15:06:21.0828 4912	volmgrx         (294da8d3f965f6a8db934a83c7b461ff) C:\Windows\system32\drivers\volmgrx.sys
2011/09/04 15:06:21.0860 4912	volsnap         (11ef6c1caef76b685233450a126125d6) C:\Windows\system32\drivers\volsnap.sys
2011/09/04 15:06:21.0922 4912	VPCNetS2        (f96a678debdccb0b4bb7f38cb2580589) C:\Windows\system32\DRIVERS\VMNetSrv.sys
2011/09/04 15:06:21.0969 4912	vsmraid         (d984439746d42b30fc65a4c3546c6829) C:\Windows\system32\drivers\vsmraid.sys
2011/09/04 15:06:22.0078 4912	WacomPen        (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
2011/09/04 15:06:22.0156 4912	Wanarp          (6798c1209a53b5a0ded8d437c45145ff) C:\Windows\system32\DRIVERS\wanarp.sys
2011/09/04 15:06:22.0187 4912	Wanarpv6        (6798c1209a53b5a0ded8d437c45145ff) C:\Windows\system32\DRIVERS\wanarp.sys
2011/09/04 15:06:22.0265 4912	Wd              (afc5ad65b991c1e205cf25cfdbf7a6f4) C:\Windows\system32\drivers\wd.sys
2011/09/04 15:06:22.0343 4912	Wdf01000        (7b5f66e4a2219c7d9daf9e738480e534) C:\Windows\system32\drivers\Wdf01000.sys
2011/09/04 15:06:22.0546 4912	WmiAcpi         (701a9f884a294327e9141d73746ee279) C:\Windows\system32\drivers\wmiacpi.sys
2011/09/04 15:06:22.0671 4912	WpdUsb          (2d27171b16a577ef14c1273668753485) C:\Windows\system32\DRIVERS\wpdusb.sys
2011/09/04 15:06:22.0733 4912	ws2ifsl         (84620aecdcfd2a7a14e6263927d8c0ed) C:\Windows\system32\drivers\ws2ifsl.sys
2011/09/04 15:06:22.0811 4912	WUDFRd          (ee0974d4042da9cf4c569ac4eca8c9c0) C:\Windows\system32\DRIVERS\WUDFRd.sys
2011/09/04 15:06:22.0874 4912	MBR (0x1B8)     (5c616939100b85e558da92b899a0fc36) \Device\Harddisk0\DR0
2011/09/04 15:06:22.0920 4912	Boot (0x1200)   (0a140da3497d9a9e788655e7a080b614) \Device\Harddisk0\DR0\Partition0
2011/09/04 15:06:22.0967 4912	Boot (0x1200)   (a3c54cb350ecb343b9505df3004dfd6c) \Device\Harddisk0\DR0\Partition1
2011/09/04 15:06:22.0998 4912	Boot (0x1200)   (443756b766fa81e5a2d93d886ca9e6fa) \Device\Harddisk0\DR0\Partition2
2011/09/04 15:06:23.0014 4912	================================================================================
2011/09/04 15:06:23.0014 4912	Scan finished
2011/09/04 15:06:23.0014 4912	================================================================================
2011/09/04 15:06:23.0045 4836	Detected object count: 1
2011/09/04 15:06:23.0045 4836	Actual detected object count: 1
2011/09/04 15:06:40.0611 4836	LockedFile.Multi.Generic(sptd) - User select action: Skip 
2011/09/04 15:06:56.0195 5984	================================================================================
2011/09/04 15:06:56.0195 5984	Scan started
2011/09/04 15:06:56.0195 5984	Mode: Manual; 
2011/09/04 15:06:56.0195 5984	================================================================================
2011/09/04 15:06:56.0866 5984	ACPI            (192bdbd1540645c4a2aa69f24cce197f) C:\Windows\system32\drivers\acpi.sys
2011/09/04 15:06:56.0913 5984	adp94xx         (2edc5bbac6c651ece337bde8ed97c9fb) C:\Windows\system32\drivers\adp94xx.sys
2011/09/04 15:06:56.0991 5984	adpahci         (b84088ca3cdca97da44a984c6ce1ccad) C:\Windows\system32\drivers\adpahci.sys
2011/09/04 15:06:57.0053 5984	adpu160m        (7880c67bccc27c86fd05aa2afb5ea469) C:\Windows\system32\drivers\adpu160m.sys
2011/09/04 15:06:57.0116 5984	adpu320         (9ae713f8e30efc2abccd84904333df4d) C:\Windows\system32\drivers\adpu320.sys
2011/09/04 15:06:57.0178 5984	AFD             (5d24caf8efd924a875698ff28384db8b) C:\Windows\system32\drivers\afd.sys
2011/09/04 15:06:57.0225 5984	agp440          (ef23439cdd587f64c2c1b8825cead7d8) C:\Windows\system32\drivers\agp440.sys
2011/09/04 15:06:57.0256 5984	aic78xx         (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
2011/09/04 15:06:57.0303 5984	aliide          (90395b64600ebb4552e26e178c94b2e4) C:\Windows\system32\drivers\aliide.sys
2011/09/04 15:06:57.0350 5984	amdagp          (2b13e304c9dfdfa5eb582f6a149fa2c7) C:\Windows\system32\drivers\amdagp.sys
2011/09/04 15:06:57.0396 5984	amdide          (0577df1d323fe75a739c787893d300ea) C:\Windows\system32\drivers\amdide.sys
2011/09/04 15:06:57.0443 5984	AmdK7           (dc487885bcef9f28eece6fac0e5ddfc5) C:\Windows\system32\drivers\amdk7.sys
2011/09/04 15:06:57.0490 5984	AmdK8           (0ca0071da4315b00fc1328ca86b425da) C:\Windows\system32\DRIVERS\amdk8.sys
2011/09/04 15:06:57.0584 5984	arc             (5f673180268bb1fdb69c99b6619fe379) C:\Windows\system32\drivers\arc.sys
2011/09/04 15:06:57.0630 5984	arcsas          (957f7540b5e7f602e44648c7de5a1c05) C:\Windows\system32\drivers\arcsas.sys
2011/09/04 15:06:57.0708 5984	ASPI            (e54e27976e2c5a6465d44c10b1d87ac0) C:\Windows\System32\DRIVERS\ASPI32.sys
2011/09/04 15:06:57.0755 5984	AsyncMac        (e86cf7ce67d5de898f27ef884dc357d8) C:\Windows\system32\DRIVERS\asyncmac.sys
2011/09/04 15:06:57.0802 5984	atapi           (28d0c21db4ffed1bbfb42e9aa34e0c0d) C:\Windows\system32\drivers\atapi.sys
2011/09/04 15:06:57.0849 5984	AtiPcie         (a356e45e8432432c06981ea63a1e0fe8) C:\Windows\system32\DRIVERS\AtiPcie.sys
2011/09/04 15:06:57.0958 5984	avgio           (71a751d7f8b0219bcf827596fc5af318) C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgio.sys
2011/09/04 15:06:57.0989 5984	avgntflt        (cf8a756118fc374c494fb8c86c03bcc7) C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgntflt.sys
2011/09/04 15:06:58.0020 5984	avipbb          (fdba6800835b9628ef401f642284ce55) C:\Windows\system32\DRIVERS\avipbb.sys
2011/09/04 15:06:58.0083 5984	Beep            (ac3dd1708b22761ebd7cbe14dcc3b5d7) C:\Windows\system32\drivers\Beep.sys
2011/09/04 15:06:58.0176 5984	bowser          (913cd06fbe9105ce6077e90fd4418561) C:\Windows\system32\DRIVERS\bowser.sys
2011/09/04 15:06:58.0223 5984	BrFiltLo        (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
2011/09/04 15:06:58.0254 5984	BrFiltUp        (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
2011/09/04 15:06:58.0332 5984	Brserid         (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
2011/09/04 15:06:58.0395 5984	BrSerWdm        (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
2011/09/04 15:06:58.0442 5984	BrUsbMdm        (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
2011/09/04 15:06:58.0473 5984	BrUsbSer        (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys
2011/09/04 15:06:58.0520 5984	BTHMODEM        (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys
2011/09/04 15:06:58.0660 5984	cdfs            (6c3a437fc873c6f6a4fc620b6888cb86) C:\Windows\system32\DRIVERS\cdfs.sys
2011/09/04 15:06:58.0707 5984	cdrom           (8d1866e61af096ae8b582454f5e4d303) C:\Windows\system32\DRIVERS\cdrom.sys
2011/09/04 15:06:58.0785 5984	circlass        (da8e0afc7baa226c538ef53ac2f90897) C:\Windows\system32\drivers\circlass.sys
2011/09/04 15:06:58.0832 5984	CLFS            (1b84fd0937d3b99af9ba38ddff3daf54) C:\Windows\system32\CLFS.sys
2011/09/04 15:06:58.0894 5984	cmdide          (45201046c776ffdaf3fc8a0029c581c8) C:\Windows\system32\drivers\cmdide.sys
2011/09/04 15:06:58.0941 5984	Compbatt        (82b8c91d327cfecf76cb58716f7d4997) C:\Windows\system32\drivers\compbatt.sys
2011/09/04 15:06:58.0988 5984	crcdisk         (2a213ae086bbec5e937553c7d9a2b22c) C:\Windows\system32\drivers\crcdisk.sys
2011/09/04 15:06:59.0050 5984	Crusoe          (22a7f883508176489f559ee745b5bf5d) C:\Windows\system32\drivers\crusoe.sys
2011/09/04 15:06:59.0144 5984	DfsC            (a7179de59ae269ab70345527894ccd7c) C:\Windows\system32\Drivers\dfsc.sys
2011/09/04 15:06:59.0222 5984	disk            (841af4c4d41d3e3b2f244e976b0f7963) C:\Windows\system32\drivers\disk.sys
2011/09/04 15:06:59.0331 5984	drmkaud         (ee472cd2c01f6f8e8aa1fa06ffef61b6) C:\Windows\system32\drivers\drmkaud.sys
2011/09/04 15:06:59.0409 5984	DXGKrnl         (2d13d9e98caf6321f219b28921af214c) C:\Windows\System32\drivers\dxgkrnl.sys
2011/09/04 15:06:59.0471 5984	E1G60           (f88fb26547fd2ce6d0a5af2985892c48) C:\Windows\system32\DRIVERS\E1G60I32.sys
2011/09/04 15:06:59.0518 5984	Ecache          (38573398f734b71b06cd2411494f234a) C:\Windows\system32\drivers\ecache.sys
2011/09/04 15:06:59.0627 5984	eeCtrl          (8f7dbc4be48f5388a6fe1f285e7948ef) C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
2011/09/04 15:06:59.0768 5984	elxstor         (e8f3f21a71720c84bcf423b80028359f) C:\Windows\system32\drivers\elxstor.sys
2011/09/04 15:06:59.0830 5984	enodpl          (b4556f3d468c8dcb0b259d9d866cd4c4) C:\Windows\system32\drivers\enodpl.sys
2011/09/04 15:06:59.0924 5984	fastfat         (84a317cb0b3954d3768cdcd018dbf670) C:\Windows\system32\drivers\fastfat.sys
2011/09/04 15:06:59.0955 5984	fdc             (63bdada84951b9c03e641800e176898a) C:\Windows\system32\DRIVERS\fdc.sys
2011/09/04 15:07:00.0002 5984	FileInfo        (65773d6115c037ffd7ef8280ae85eb9d) C:\Windows\system32\drivers\fileinfo.sys
2011/09/04 15:07:00.0064 5984	Filetrace       (c226dd0de060745f3e042f58dcf78402) C:\Windows\system32\drivers\filetrace.sys
2011/09/04 15:07:00.0111 5984	flpydisk        (6603957eff5ec62d25075ea8ac27de68) C:\Windows\system32\DRIVERS\flpydisk.sys
2011/09/04 15:07:00.0189 5984	FltMgr          (a6a8da7ae4d53394ab22ac3ab6d3f5d3) C:\Windows\system32\drivers\fltmgr.sys
2011/09/04 15:07:00.0267 5984	Fs_Rec          (66a078591208baa210c7634b11eb392c) C:\Windows\system32\drivers\Fs_Rec.sys
2011/09/04 15:07:00.0298 5984	gagp30kx        (4e1cd0a45c50a8882616cae5bf82f3c5) C:\Windows\system32\drivers\gagp30kx.sys
2011/09/04 15:07:00.0360 5984	GEARAspiWDM     (8182ff89c65e4d38b2de4bb0fb18564e) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
2011/09/04 15:07:00.0438 5984	GRD             (1524d3a6850ee14e88d860c3696100c0) C:\Windows\system32\drivers\GRD.sys
2011/09/04 15:07:00.0501 5984	HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys
2011/09/04 15:07:00.0548 5984	HDAudBus        (0db613a7e427b5663563677796fd5258) C:\Windows\system32\DRIVERS\HDAudBus.sys
2011/09/04 15:07:00.0594 5984	HidBth          (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys
2011/09/04 15:07:00.0626 5984	HidIr           (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys
2011/09/04 15:07:00.0672 5984	HidUsb          (01e7971e9f4bd6ac6a08db52d0ea0418) C:\Windows\system32\DRIVERS\hidusb.sys
2011/09/04 15:07:00.0750 5984	HpCISSs         (df353b401001246853763c4b7aaa6f50) C:\Windows\system32\drivers\hpcisss.sys
2011/09/04 15:07:00.0938 5984	HTTP            (f31d27ccf514549a17e79bebe01b40b6) C:\Windows\system32\drivers\HTTP.sys
2011/09/04 15:07:00.0984 5984	i2omp           (324c2152ff2c61abae92d09f3cca4d63) C:\Windows\system32\drivers\i2omp.sys
2011/09/04 15:07:01.0031 5984	i8042prt        (bea9838cd25d36beba3f94386a761d60) C:\Windows\system32\DRIVERS\i8042prt.sys
2011/09/04 15:07:01.0094 5984	iaStor          (2358c53f30cb9dcd1d3843c4e2f299b2) C:\Windows\system32\drivers\iastor.sys
2011/09/04 15:07:01.0140 5984	iaStorV         (c957bf4b5d80b46c5017bf0101e6c906) C:\Windows\system32\drivers\iastorv.sys
2011/09/04 15:07:01.0406 5984	iirsp           (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
2011/09/04 15:07:01.0718 5984	IKFileSec       (bb07262041a213fea5fccf0a9f90d85a) C:\Windows\system32\drivers\ikfilesec.sys
2011/09/04 15:07:01.0780 5984	IKSysFlt        (b2581314d54f8de4262f0a51f7ba63d0) C:\Windows\system32\drivers\iksysflt.sys
2011/09/04 15:07:01.0827 5984	IKSysSec        (6f544cd764f949170b46a4dab11673e2) C:\Windows\system32\drivers\iksyssec.sys
2011/09/04 15:07:01.0952 5984	IntcAzAudAddService (4de88b49c891f45cd9ea6d83a341d3e3) C:\Windows\system32\drivers\RTKVHDA.sys
2011/09/04 15:07:02.0061 5984	intelide        (97469037714070e45194ed318d636401) C:\Windows\system32\drivers\intelide.sys
2011/09/04 15:07:02.0123 5984	intelppm        (ce44cc04262f28216dd4341e9e36a16f) C:\Windows\system32\DRIVERS\intelppm.sys
2011/09/04 15:07:02.0170 5984	IpFilterDriver  (880c6f86cc3f551b8fea2c11141268c0) C:\Windows\system32\DRIVERS\ipfltdrv.sys
2011/09/04 15:07:02.0264 5984	IPMIDRV         (40f34f8aba2a015d780e4b09138b6c17) C:\Windows\system32\drivers\ipmidrv.sys
2011/09/04 15:07:02.0326 5984	IPNAT           (10077c35845101548037df04fd1a420b) C:\Windows\system32\DRIVERS\ipnat.sys
2011/09/04 15:07:02.0357 5984	IRENUM          (a82f328f4792304184642d6d397bb1e3) C:\Windows\system32\drivers\irenum.sys
2011/09/04 15:07:02.0404 5984	isapnp          (350fca7e73cf65bcef43fae1e4e91293) C:\Windows\system32\drivers\isapnp.sys
2011/09/04 15:07:02.0513 5984	iScsiPrt        (4dca456d4d5723f8fa9c6760d240b0df) C:\Windows\system32\DRIVERS\msiscsi.sys
2011/09/04 15:07:02.0778 5984	iteatapi        (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
2011/09/04 15:07:02.0966 5984	iteraid         (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
2011/09/04 15:07:03.0028 5984	JRAID           (c1632fe31d1824a43dea29725312e3fa) C:\Windows\system32\drivers\jraid.sys
2011/09/04 15:07:03.0075 5984	kbdclass        (c9b0cf786d5f151a43c7be8e243f2819) C:\Windows\system32\DRIVERS\kbdclass.sys
2011/09/04 15:07:03.0122 5984	kbdhid          (97ab2fb84e8e77d93cee85550f4cf7f9) C:\Windows\system32\DRIVERS\kbdhid.sys
2011/09/04 15:07:03.0168 5984	KSecDD          (11d0bc1f2afd8abbb5a3dc47a042de54) C:\Windows\system32\Drivers\ksecdd.sys
2011/09/04 15:07:03.0293 5984	lltdio          (fd015b4f95daa2b712f0e372a116fbad) C:\Windows\system32\DRIVERS\lltdio.sys
2011/09/04 15:07:03.0387 5984	LSI_FC          (a2262fb9f28935e862b4db46438c80d2) C:\Windows\system32\drivers\lsi_fc.sys
2011/09/04 15:07:03.0418 5984	LSI_SAS         (30d73327d390f72a62f32c103daf1d6d) C:\Windows\system32\drivers\lsi_sas.sys
2011/09/04 15:07:03.0480 5984	LSI_SCSI        (e1e36fefd45849a95f1ab81de0159fe3) C:\Windows\system32\drivers\lsi_scsi.sys
2011/09/04 15:07:03.0496 5984	luafv           (42885bb44b6e065b8575a8dd6c430c52) C:\Windows\system32\drivers\luafv.sys
2011/09/04 15:07:03.0590 5984	megasas         (d153b14fc6598eae8422a2037553adce) C:\Windows\system32\drivers\megasas.sys
2011/09/04 15:07:03.0652 5984	Modem           (21755967298a46fb6adfec9db6012211) C:\Windows\system32\drivers\modem.sys
2011/09/04 15:07:03.0730 5984	monitor         (47c09851f763f2e03bfadd581747ecec) C:\Windows\system32\DRIVERS\monitor.sys
2011/09/04 15:07:03.0777 5984	mouclass        (4a00b3cf90ad075193ca5aeece71154c) C:\Windows\system32\DRIVERS\mouclass.sys
2011/09/04 15:07:03.0808 5984	mouhid          (8d9b701d716843c39e93b3432cb721fc) C:\Windows\system32\DRIVERS\mouhid.sys
2011/09/04 15:07:03.0855 5984	MountMgr        (01f1e5a3e4877c931cbb31613fec16a6) C:\Windows\system32\drivers\mountmgr.sys
2011/09/04 15:07:03.0886 5984	mpio            (583a41f26278d9e0ea548163d6139397) C:\Windows\system32\drivers\mpio.sys
2011/09/04 15:07:03.0933 5984	mpsdrv          (6e7a7f0c1193ee5648443fe2d4b789ec) C:\Windows\system32\drivers\mpsdrv.sys
2011/09/04 15:07:03.0995 5984	Mraid35x        (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
2011/09/04 15:07:04.0058 5984	MRxDAV          (08f0c494a69cf3106ee7ffc48d8e5ac7) C:\Windows\system32\drivers\mrxdav.sys
2011/09/04 15:07:04.0120 5984	mrxsmb          (dc5632cbc8a3d02ce1114debb64b7037) C:\Windows\system32\DRIVERS\mrxsmb.sys
2011/09/04 15:07:04.0167 5984	mrxsmb10        (f813456c00b904dc3b6558cad7b13bba) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2011/09/04 15:07:04.0214 5984	mrxsmb20        (30a67c7d8b80281028916ded6a64aec9) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2011/09/04 15:07:04.0260 5984	msahci          (742aed7939e734c36b7e8d6228ce26b7) C:\Windows\system32\drivers\msahci.sys
2011/09/04 15:07:04.0307 5984	msdsm           (3fc82a2ae4cc149165a94699183d3028) C:\Windows\system32\drivers\msdsm.sys
2011/09/04 15:07:04.0370 5984	Msfs            (729eafefd4e7417165f353a18dbe947d) C:\Windows\system32\drivers\Msfs.sys
2011/09/04 15:07:04.0432 5984	msisadrv        (0a64168b63535520adfd6b959695404a) C:\Windows\system32\drivers\msisadrv.sys
2011/09/04 15:07:04.0494 5984	MSKSSRV         (892cedefa7e0ffe7be8da651b651d047) C:\Windows\system32\drivers\MSKSSRV.sys
2011/09/04 15:07:04.0526 5984	MSPCLOCK        (ae2cb1da69b2676b4cee2a501af5871c) C:\Windows\system32\drivers\MSPCLOCK.sys
2011/09/04 15:07:04.0557 5984	MSPQM           (f910da84fa90c44a3addb7cd874463fd) C:\Windows\system32\drivers\MSPQM.sys
2011/09/04 15:07:04.0604 5984	MsRPC           (84571c0ae07647ba38d493f5f0015df7) C:\Windows\system32\drivers\MsRPC.sys
2011/09/04 15:07:04.0666 5984	mssmbios        (e09cedb1bca303b7f6ae22f512e56969) C:\Windows\system32\DRIVERS\mssmbios.sys
2011/09/04 15:07:04.0713 5984	MSTEE           (c826dd1373f38afd9ca46ec3c436a14e) C:\Windows\system32\drivers\MSTEE.sys
2011/09/04 15:07:04.0760 5984	Mup             (fa7aa70050cf5e2d15de00941e5665e5) C:\Windows\system32\Drivers\mup.sys
2011/09/04 15:07:04.0838 5984	NativeWifiP     (be8c26e61be5c5a49a6babd17aeed1b7) C:\Windows\system32\DRIVERS\nwifi.sys
2011/09/04 15:07:04.0931 5984	NDIS            (6e8dfface597629cef5df7d69217628f) C:\Windows\system32\drivers\ndis.sys
2011/09/04 15:07:04.0978 5984	NdisTapi        (81659cdcbd0f9a9e07e6878ad8c78d3f) C:\Windows\system32\DRIVERS\ndistapi.sys
2011/09/04 15:07:05.0009 5984	Ndisuio         (5de5ee546bf40838ebe0e01cb629df64) C:\Windows\system32\DRIVERS\ndisuio.sys
2011/09/04 15:07:05.0056 5984	NdisWan         (397402adcbb8946223a1950101f6cd94) C:\Windows\system32\DRIVERS\ndiswan.sys
2011/09/04 15:07:05.0103 5984	NDProxy         (1b24fa907af283199a81b3bb37e5e526) C:\Windows\system32\drivers\NDProxy.sys
2011/09/04 15:07:05.0150 5984	NetBIOS         (356dbb9f98e8dc1028dd3092fceeb877) C:\Windows\system32\DRIVERS\netbios.sys
2011/09/04 15:07:05.0228 5984	netbt           (231f6ccfdb7a604221f18fb0852c8560) C:\Windows\system32\DRIVERS\netbt.sys
2011/09/04 15:07:05.0352 5984	nfrd960         (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys
2011/09/04 15:07:05.0462 5984	Npfs            (4f9832beb9fafd8ceb0e541f1323b26e) C:\Windows\system32\drivers\Npfs.sys
2011/09/04 15:07:05.0540 5984	nsiproxy        (b488dfec274de1fc9d653870ef2587be) C:\Windows\system32\drivers\nsiproxy.sys
2011/09/04 15:07:05.0633 5984	Ntfs            (01db57ff55bcf719545570f3bd050000) C:\Windows\system32\drivers\Ntfs.sys
2011/09/04 15:07:05.0680 5984	ntrigdigi       (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys
2011/09/04 15:07:05.0711 5984	Null            (ec5efb3c60f1b624648344a328bce596) C:\Windows\system32\drivers\Null.sys
2011/09/04 15:07:06.0086 5984	nvlddmkm        (f623c2b16fde938b908031aeba445344) C:\Windows\system32\DRIVERS\nvlddmkm.sys
2011/09/04 15:07:06.0288 5984	nvraid          (e69e946f80c1c31c53003bfbf50cbb7c) C:\Windows\system32\drivers\nvraid.sys
2011/09/04 15:07:06.0398 5984	nvrd32          (ed399014a8029de02ba5ae01da8cc9ee) C:\Windows\system32\drivers\nvrd32.sys
2011/09/04 15:07:06.0460 5984	nvstor          (9e0ba19a28c498a6d323d065db76dffc) C:\Windows\system32\drivers\nvstor.sys
2011/09/04 15:07:06.0522 5984	nvstor32        (703e3a7093b0fac0eebadbb8e931ecaf) C:\Windows\system32\drivers\nvstor32.sys
2011/09/04 15:07:06.0585 5984	nv_agp          (07c186427eb8fcc3d8d7927187f260f7) C:\Windows\system32\drivers\nv_agp.sys
2011/09/04 15:07:06.0725 5984	ohci1394        (8994cbfc215a9ef4495e6ae7992954fc) C:\Windows\system32\DRIVERS\ohci1394.sys
2011/09/04 15:07:06.0819 5984	Parport         (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys
2011/09/04 15:07:06.0866 5984	partmgr         (555a5b2c8022983bc7467bc925b222ee) C:\Windows\system32\drivers\partmgr.sys
2011/09/04 15:07:06.0897 5984	Parvdm          (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys
2011/09/04 15:07:06.0959 5984	pci             (a48c4d0acc933f7a37e52ab0761811ad) C:\Windows\system32\drivers\pci.sys
2011/09/04 15:07:06.0990 5984	pciide          (3a1efd3fd478c8a6d528ec297dbcb36f) C:\Windows\system32\drivers\pciide.sys
2011/09/04 15:07:07.0037 5984	pcmcia          (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys
2011/09/04 15:07:07.0100 5984	PEAUTH          (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
2011/09/04 15:07:07.0256 5984	PptpMiniport    (c04dec5ace67c5247b150c4223970bb7) C:\Windows\system32\DRIVERS\raspptp.sys
2011/09/04 15:07:07.0302 5984	Processor       (0e3cef5d28b40cf273281d620c50700a) C:\Windows\system32\drivers\processr.sys
2011/09/04 15:07:07.0380 5984	PSched          (2c8bae55247c4e09352e870292e4d1ab) C:\Windows\system32\DRIVERS\pacer.sys
2011/09/04 15:07:07.0458 5984	ql2300          (ccdac889326317792480c0a67156a1ec) C:\Windows\system32\drivers\ql2300.sys
2011/09/04 15:07:07.0505 5984	ql40xx          (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
2011/09/04 15:07:07.0552 5984	QWAVEdrv        (d2b3e2b7426dc23e185fbc73c8936c12) C:\Windows\system32\drivers\qwavedrv.sys
2011/09/04 15:07:07.0599 5984	RasAcd          (bd7b30f55b3649506dd8b3d38f571d2a) C:\Windows\system32\DRIVERS\rasacd.sys
2011/09/04 15:07:07.0661 5984	Rasl2tp         (68b0019fee429ec49d29017af937e482) C:\Windows\system32\DRIVERS\rasl2tp.sys
2011/09/04 15:07:07.0692 5984	RasPppoe        (ccf4e9c6cbbac81437f88cb2ae0b6c96) C:\Windows\system32\DRIVERS\raspppoe.sys
2011/09/04 15:07:07.0739 5984	rdbss           (54129c5d9581bbec8bd1ebd3ba813f47) C:\Windows\system32\DRIVERS\rdbss.sys
2011/09/04 15:07:07.0770 5984	RDPCDD          (794585276b5d7fca9f3fc15543f9f0b9) C:\Windows\system32\DRIVERS\RDPCDD.sys
2011/09/04 15:07:07.0848 5984	rdpdr           (e8bd98d46f2ed77132ba927fccb47d8b) C:\Windows\system32\drivers\rdpdr.sys
2011/09/04 15:07:07.0911 5984	RDPENCDD        (980b56e2e273e19d3a9d72d5c420f008) C:\Windows\system32\drivers\rdpencdd.sys
2011/09/04 15:07:07.0989 5984	RDPWD           (8830e790a74a96605faba74f9665bb3c) C:\Windows\system32\drivers\RDPWD.sys
2011/09/04 15:07:08.0098 5984	rspndr          (97e939d2128fec5d5a3e6e79b290a2f4) C:\Windows\system32\DRIVERS\rspndr.sys
2011/09/04 15:07:08.0145 5984	RTL8169         (abbe0f54ba3a378262c9cb86cf7d91f8) C:\Windows\system32\DRIVERS\Rtlh86.sys
2011/09/04 15:07:08.0207 5984	sbp2port        (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
2011/09/04 15:07:08.0254 5984	SCDEmu          (16b1abe7f3e35f21dac57592b6c5d464) C:\Windows\system32\drivers\SCDEmu.sys
2011/09/04 15:07:08.0348 5984	Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\SECDRV.SYS
2011/09/04 15:07:08.0410 5984	Serenum         (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\DRIVERS\serenum.sys
2011/09/04 15:07:08.0457 5984	Serial          (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\DRIVERS\serial.sys
2011/09/04 15:07:08.0504 5984	sermouse        (2baf2abc0da0d50ebe8289c720977052) C:\Windows\system32\drivers\sermouse.sys
2011/09/04 15:07:08.0597 5984	sffdisk         (103b79418da647736ee95645f305f68a) C:\Windows\system32\drivers\sffdisk.sys
2011/09/04 15:07:08.0628 5984	sffp_mmc        (8fd08a310645fe872eeec6e08c6bf3ee) C:\Windows\system32\drivers\sffp_mmc.sys
2011/09/04 15:07:08.0660 5984	sffp_sd         (9cfa05fcfcb7124e69cfc812b72f9614) C:\Windows\system32\drivers\sffp_sd.sys
2011/09/04 15:07:08.0706 5984	sfloppy         (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys
2011/09/04 15:07:08.0769 5984	sisagp          (d2a595d6eebeeaf4334f8e50efbc9931) C:\Windows\system32\drivers\sisagp.sys
2011/09/04 15:07:08.0816 5984	SiSRaid2        (cedd6f4e7d84e9f98b34b3fe988373aa) C:\Windows\system32\drivers\sisraid2.sys
2011/09/04 15:07:08.0862 5984	SiSRaid4        (df843c528c4f69d12ce41ce462e973a7) C:\Windows\system32\drivers\sisraid4.sys
2011/09/04 15:07:08.0940 5984	Smb             (46baf398809a0f3b2d3300a1760e4b91) C:\Windows\system32\DRIVERS\smb.sys
2011/09/04 15:07:09.0003 5984	spldr           (426f9b029aa9162ceccf65369457d046) C:\Windows\system32\drivers\spldr.sys
2011/09/04 15:07:09.0081 5984	sptd            (cdddec541bc3c96f91ecb48759673505) C:\Windows\system32\Drivers\sptd.sys
2011/09/04 15:07:09.0081 5984	Suspicious file (NoAccess): C:\Windows\system32\Drivers\sptd.sys. md5: cdddec541bc3c96f91ecb48759673505
2011/09/04 15:07:09.0096 5984	sptd - detected LockedFile.Multi.Generic (1)
2011/09/04 15:07:09.0159 5984	srv             (e86bf07b1d2ec33c52b3b31e5814001a) C:\Windows\system32\DRIVERS\srv.sys
2011/09/04 15:07:09.0237 5984	srv2            (e8c4d5bca3c7b5c2a040052aa467b5bf) C:\Windows\system32\DRIVERS\srv2.sys
2011/09/04 15:07:09.0268 5984	srvnet          (8ae0f61f71e97ace067cdab67c98746b) C:\Windows\system32\DRIVERS\srvnet.sys
2011/09/04 15:07:09.0330 5984	ssmdrv          (71d609c5dff067906d930bde031c4cfe) C:\Windows\system32\DRIVERS\ssmdrv.sys
2011/09/04 15:07:09.0393 5984	swenum          (9c539aaffb0b6d7bce984c74317ff29f) C:\Windows\system32\DRIVERS\swenum.sys
2011/09/04 15:07:09.0471 5984	Symc8xx         (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
2011/09/04 15:07:09.0502 5984	Sym_hi          (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
2011/09/04 15:07:09.0549 5984	Sym_u3          (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
2011/09/04 15:07:09.0611 5984	tandpl          (126d7b3b4c7b724491c604060e1f4e14) C:\Windows\system32\drivers\tandpl.sys
2011/09/04 15:07:09.0720 5984	Tcpip           (52a8bd6294f7d1443c6184c67ae13af4) C:\Windows\system32\drivers\tcpip.sys
2011/09/04 15:07:09.0783 5984	Tcpip6          (52a8bd6294f7d1443c6184c67ae13af4) C:\Windows\system32\DRIVERS\tcpip.sys
2011/09/04 15:07:09.0845 5984	tcpipreg        (5ce0c4a7b12d0067dad527d72b68c726) C:\Windows\system32\drivers\tcpipreg.sys
2011/09/04 15:07:09.0908 5984	TDPIPE          (964248aef49c31fa6a93201a73ffaf50) C:\Windows\system32\drivers\tdpipe.sys
2011/09/04 15:07:09.0970 5984	TDTCP           (7d2c1ae1648a60fce4aa0f7982e419d3) C:\Windows\system32\drivers\tdtcp.sys
2011/09/04 15:07:10.0017 5984	tdx             (7973f7239486800cd79e4fdbab6a07df) C:\Windows\system32\DRIVERS\tdx.sys
2011/09/04 15:07:10.0095 5984	TermDD          (cfe870506361bac80a549749116ad870) C:\Windows\system32\DRIVERS\termdd.sys
2011/09/04 15:07:10.0235 5984	tssecsrv        (29f0eca726f0d51f7e048bdb0b372f29) C:\Windows\system32\DRIVERS\tssecsrv.sys
2011/09/04 15:07:10.0298 5984	tunmp           (a858917785681743c512950fdfa14db7) C:\Windows\system32\DRIVERS\tunmp.sys
2011/09/04 15:07:10.0344 5984	tunnel          (29f1d1d888ee61d20d5662e72aa34129) C:\Windows\system32\DRIVERS\tunnel.sys
2011/09/04 15:07:10.0407 5984	uagp35          (c3ade15414120033a36c0f293d4a4121) C:\Windows\system32\drivers\uagp35.sys
2011/09/04 15:07:10.0485 5984	udfs            (1811e1016d96e3ea0e170f7c23804e50) C:\Windows\system32\DRIVERS\udfs.sys
2011/09/04 15:07:10.0563 5984	uliagpkx        (75e6890ebfce0841d3291b02e7a8bdb0) C:\Windows\system32\drivers\uliagpkx.sys
2011/09/04 15:07:10.0625 5984	uliahci         (3cd4ea35a6221b85dcc25daa46313f8d) C:\Windows\system32\drivers\uliahci.sys
2011/09/04 15:07:10.0672 5984	UlSata          (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
2011/09/04 15:07:10.0719 5984	ulsata2         (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
2011/09/04 15:07:10.0781 5984	umbus           (dc8828971d997de009647fce59e0ce8f) C:\Windows\system32\DRIVERS\umbus.sys
2011/09/04 15:07:10.0875 5984	USB28xxBGA      (9b01ce1eda6ad1acfd4f865d6cb0a790) C:\Windows\system32\DRIVERS\emBDA.sys
2011/09/04 15:07:10.0937 5984	USB28xxOEM      (c93e4f6bd1cbd163662e7c9be021b895) C:\Windows\system32\DRIVERS\emOEM.sys
2011/09/04 15:07:11.0046 5984	USBAAPL         (4b8a9c16b6d9258ed99c512aecb8c555) C:\Windows\system32\Drivers\usbaapl.sys
2011/09/04 15:07:11.0124 5984	usbccgp         (03b01e8dbd2da2b49157b7e51912aaf2) C:\Windows\system32\DRIVERS\usbccgp.sys
2011/09/04 15:07:11.0187 5984	usbcir          (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys
2011/09/04 15:07:11.0249 5984	usbehci         (2f83363f98484f8edaf49f9b41520d14) C:\Windows\system32\DRIVERS\usbehci.sys
2011/09/04 15:07:11.0280 5984	usbhub          (14d2a4dcd92c0b3368667aed6893463d) C:\Windows\system32\DRIVERS\usbhub.sys
2011/09/04 15:07:11.0343 5984	usbohci         (51dc36722172d45f2f935ce5cc18a812) C:\Windows\system32\DRIVERS\usbohci.sys
2011/09/04 15:07:11.0390 5984	usbprint        (b51e52acf758be00ef3a58ea452fe360) C:\Windows\system32\DRIVERS\usbprint.sys
2011/09/04 15:07:11.0452 5984	usbscan         (b1f95285c08ddfe00c0b955462637ec7) C:\Windows\system32\DRIVERS\usbscan.sys
2011/09/04 15:07:11.0499 5984	USBSTOR         (7887ce56934e7f104e98c975f47353c5) C:\Windows\system32\DRIVERS\USBSTOR.SYS
2011/09/04 15:07:11.0561 5984	usbuhci         (325dbbacb8a36af9988ccf40eac228cc) C:\Windows\system32\DRIVERS\usbuhci.sys
2011/09/04 15:07:11.0624 5984	usbvideo        (46f3a2912ef88cd8e87d4f9b304cd949) C:\Windows\system32\Drivers\usbvideo.sys
2011/09/04 15:07:11.0702 5984	VBoxNetAdp      (b9d3c274e937a15fd2cef8aa1e4c3477) C:\Windows\system32\DRIVERS\VBoxNetAdp.sys
2011/09/04 15:07:11.0811 5984	vga             (7d92be0028ecdedec74617009084b5ef) C:\Windows\system32\DRIVERS\vgapnp.sys
2011/09/04 15:07:11.0842 5984	VgaSave         (17a8f877314e4067f8c8172cc6d9101c) C:\Windows\System32\drivers\vga.sys
2011/09/04 15:07:11.0889 5984	viaagp          (045d9961e591cf0674a920b6ba3ba5cb) C:\Windows\system32\drivers\viaagp.sys
2011/09/04 15:07:11.0936 5984	ViaC7           (56a4de5f02f2e88182b0981119b4dd98) C:\Windows\system32\drivers\viac7.sys
2011/09/04 15:07:11.0967 5984	viaide          (fd2e3175fcada350c7ab4521dca187ec) C:\Windows\system32\drivers\viaide.sys
2011/09/04 15:07:12.0029 5984	viamraid        (7dc3e1dc6e4f8be381c31bfea578412a) C:\Windows\system32\drivers\viamraid.sys
2011/09/04 15:07:12.0092 5984	vmm             (590c7a3a1133e51a7e1cef67366e75af) C:\Windows\system32\Drivers\vmm.sys
2011/09/04 15:07:12.0154 5984	volmgr          (cc8a64a532fd2844ee68f4061ed8a7fd) C:\Windows\system32\drivers\volmgr.sys
2011/09/04 15:07:12.0201 5984	volmgrx         (294da8d3f965f6a8db934a83c7b461ff) C:\Windows\system32\drivers\volmgrx.sys
2011/09/04 15:07:12.0248 5984	volsnap         (11ef6c1caef76b685233450a126125d6) C:\Windows\system32\drivers\volsnap.sys
2011/09/04 15:07:12.0294 5984	VPCNetS2        (f96a678debdccb0b4bb7f38cb2580589) C:\Windows\system32\DRIVERS\VMNetSrv.sys
2011/09/04 15:07:12.0326 5984	vsmraid         (d984439746d42b30fc65a4c3546c6829) C:\Windows\system32\drivers\vsmraid.sys
2011/09/04 15:07:12.0419 5984	WacomPen        (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
2011/09/04 15:07:12.0482 5984	Wanarp          (6798c1209a53b5a0ded8d437c45145ff) C:\Windows\system32\DRIVERS\wanarp.sys
2011/09/04 15:07:12.0513 5984	Wanarpv6        (6798c1209a53b5a0ded8d437c45145ff) C:\Windows\system32\DRIVERS\wanarp.sys
2011/09/04 15:07:12.0575 5984	Wd              (afc5ad65b991c1e205cf25cfdbf7a6f4) C:\Windows\system32\drivers\wd.sys
2011/09/04 15:07:12.0638 5984	Wdf01000        (7b5f66e4a2219c7d9daf9e738480e534) C:\Windows\system32\drivers\Wdf01000.sys
2011/09/04 15:07:13.0386 5984	WmiAcpi         (701a9f884a294327e9141d73746ee279) C:\Windows\system32\drivers\wmiacpi.sys
2011/09/04 15:07:13.0496 5984	WpdUsb          (2d27171b16a577ef14c1273668753485) C:\Windows\system32\DRIVERS\wpdusb.sys
2011/09/04 15:07:13.0527 5984	ws2ifsl         (84620aecdcfd2a7a14e6263927d8c0ed) C:\Windows\system32\drivers\ws2ifsl.sys
2011/09/04 15:07:13.0620 5984	WUDFRd          (ee0974d4042da9cf4c569ac4eca8c9c0) C:\Windows\system32\DRIVERS\WUDFRd.sys
2011/09/04 15:07:13.0698 5984	MBR (0x1B8)     (5c616939100b85e558da92b899a0fc36) \Device\Harddisk0\DR0
2011/09/04 15:07:13.0745 5984	Boot (0x1200)   (0a140da3497d9a9e788655e7a080b614) \Device\Harddisk0\DR0\Partition0
2011/09/04 15:07:13.0808 5984	Boot (0x1200)   (a3c54cb350ecb343b9505df3004dfd6c) \Device\Harddisk0\DR0\Partition1
2011/09/04 15:07:13.0886 5984	Boot (0x1200)   (443756b766fa81e5a2d93d886ca9e6fa) \Device\Harddisk0\DR0\Partition2
2011/09/04 15:07:13.0886 5984	================================================================================
2011/09/04 15:07:13.0886 5984	Scan finished
2011/09/04 15:07:13.0886 5984	================================================================================
2011/09/04 15:07:13.0917 5472	Detected object count: 1
2011/09/04 15:07:13.0917 5472	Actual detected object count: 1
2011/09/04 15:07:21.0998 5472	LockedFile.Multi.Generic(sptd) - User select action: Skip
         

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

• Lade dir ComboFix hier herunter auf deinen Desktop.

• Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

• Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
  Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

• Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

ComboFix 11-09-03.01 - Fabian 04.09.2011  15:50:45.2.2 - x86
Microsoft® Windows Vista™ Home Premium   6.0.6000.0.1252.49.1031.18.3071.1930 [GMT 2:00]
ausgeführt von:: c:\users\Fabian\Downloads\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\AutocompletePro
c:\program files\AutocompletePro\FireFoxExtension.exe
c:\program files\AutocompletePro\InstTracker.exe
c:\users\Fabian\AppData\Local\ApplicationHistory
c:\users\Fabian\AppData\Local\ApplicationHistory\csc.exe.3e4ac0af.ini
c:\users\Fabian\AppData\Local\ApplicationHistory\LearnWeb.exe.5cc4f719.ini
c:\users\Fabian\AppData\Local\ApplicationHistory\LearnWeb.exe.5cc4f719.ini.inuse
c:\users\Fabian\AppData\Local\ApplicationHistory\regasm.exe.11f1da13.ini
c:\users\Fabian\AppData\Local\ApplicationHistory\regHelp.exe.9ce4343f.ini.inuse
c:\windows\IsUn0407.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2011-08-04 bis 2011-09-04  ))))))))))))))))))))))))))))))
.
.
2011-09-04 14:03 . 2011-09-04 14:03	--------	d-----w-	c:\users\Public\AppData\Local\temp
2011-09-04 14:03 . 2011-09-04 14:03	--------	d-----w-	c:\users\Gast\AppData\Local\temp
2011-09-04 14:03 . 2011-09-04 14:03	--------	d-----w-	c:\users\Default\AppData\Local\temp
2011-09-04 14:03 . 2011-09-04 14:03	--------	d-----w-	c:\users\asasas\AppData\Local\temp
2011-09-01 21:38 . 2011-09-01 21:38	--------	d-----w-	c:\users\Fabian\.hades
2011-09-01 16:04 . 2011-09-01 16:04	--------	d-----w-	c:\program files\ESET
2011-08-26 15:01 . 2011-09-04 09:57	--------	d-----w-	c:\program files\DemonFlyff
2011-08-25 17:25 . 2011-08-25 17:25	--------	d-----w-	C:\_OTL
2011-08-21 13:14 . 2011-08-21 13:15	--------	d-----w-	c:\users\Fabian\AppData\Local\No23 Recorder
2011-08-21 13:14 . 2011-08-22 14:36	--------	d-----w-	c:\users\Fabian\AppData\Roaming\kikin
2011-08-21 13:14 . 2011-08-22 14:36	--------	d-----w-	c:\program files\kikin
2011-08-06 15:55 . 2011-08-26 19:11	--------	d-----w-	c:\users\Fabian\AppData\Local\Amazon
2011-08-06 00:59 . 2011-08-06 00:59	--------	d-----w-	c:\programdata\Vokabel Trainer
2011-08-05 16:04 . 2011-08-05 22:51	--------	d-----w-	c:\program files\ICQ7.5
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-02 15:07 . 2011-07-19 11:14	404640	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2011-07-06 17:52 . 2010-09-02 19:02	41272	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-06 17:52 . 2010-09-02 19:02	22712	----a-w-	c:\windows\system32\drivers\mbam.sys
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-09 1232896]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2006-11-02 125440]
"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2007-04-03 165784]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-07-02 219520]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2008-02-26 4939776]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 39792]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-21 266497]
"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2007-04-03 165784]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"HCWemmon"="HCWemmon.exe" [2007-03-29 61440]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-01-18 185896]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-12-05 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-05 8530464]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-05 81920]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152]
"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2009-11-09 180224]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"WPCUMI"="c:\windows\system32\WpcUmi.exe" [2006-11-02 176128]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-04-12 1135912]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-09-21 47904]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-24 421160]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-07-06 1047656]
.
c:\users\Fabian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2008-10-25 98696]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1054673845-2891796712-3211906163-1000]
"EnableNotificationsRef"=dword:00000001
.
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-04-16 135664]
R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\svcntaux.exe [x]
R3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\System32\DRIVERS\ASPI32.sys [2002-07-17 84832]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-04-16 135664]
R3 oad;Visibroker Activation Daemon;c:\progra~1\Borland\vbroker\bin\oad.exe [x]
R3 osagent;VisiBroker Smart Agent;c:\progra~1\Borland\vbroker\bin\osagent.exe [x]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [2010-03-25 99728]
R3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-12-29 691696]
S1 GRD;G DATA Rootkit Detector Driver;c:\windows\system32\drivers\GRD.sys [2007-12-26 16712]
S2 Automatisches LiveUpdate - Scheduler;Automatisches LiveUpdate - Scheduler;c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2007-09-26 554352]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - 34080359
*Deregistered* - 34080359
.
Inhalt des "geplante Tasks" Ordners
.
2011-09-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-16 14:50]
.
2011-09-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-16 14:50]
.
2011-08-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1054673845-2891796712-3211906163-1000Core.job
- c:\users\Fabian\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-29 10:33]
.
2011-09-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1054673845-2891796712-3211906163-1000UA.job
- c:\users\Fabian\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-29 10:33]
.
2011-09-03 c:\windows\Tasks\Norton Security Scan for Fabian.job
- c:\program files\Norton Security Scan\Engine\2.7.3.34\Nss.exe [2010-05-04 00:27]
.
2011-09-04 c:\windows\Tasks\User_Feed_Synchronization-{C27515C3-4436-493B-94A2-3C3CF69BDCC9}.job
- c:\windows\system32\msfeedssync.exe [2006-11-02 09:45]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = 
mStart Page = 
mLocal Page = 
IE: Free YouTube to Mp3 Converter - c:\users\Fabian\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files\ICQ7.5\ICQ.exe
LSP: c:\windows\system32\wpclsp.dll
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\
FF - prefs.js: browser.search.defaulturl - 
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - 
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
FF - Ext: Personas: personas@christopher.beard - %profile%\extensions\personas@christopher.beard
FF - user.js: yahoo.homepage.dontask - true
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
AddRemove-Delphi5 - c:\windows\IsUn0407.exe
AddRemove-SimCity 3000 - c:\windows\IsUn0407.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2011-09-04 16:03
Windows 6.0.6000  NTFS
.
Scanne versteckte Prozesse... 
.
Scanne versteckte Autostarteinträge... 
.
Scanne versteckte Dateien... 
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-1054673845-2891796712-3211906163-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{71A06FB0-4C3D-0389-5C06-1FB541F5D4B7}*]
"oabhnckpkkalloggejejeppkpomcdj"=hex:64,61,61,66,6e,6d,66,6d,00,ff
"oafimlmgandppomdmjhajbkjollaof"=hex:6a,61,66,66,70,63,6a,70,6a,6e,67,61,6c,65,
   65,63,69,62,6a,61,00,fa
"naphkpapgopdcioehgjcbkckkdhi"=hex:6b,61,61,66,6c,70,61,68,6d,6c,6b,6e,64,69,
   6c,6b,63,61,65,65,62,6c,00,00
.
[HKEY_USERS\S-1-5-21-1054673845-2891796712-3211906163-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{A62E457B-77DF-2B5B-D39B-1C9A28D9FF5F}*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-1054673845-2891796712-3211906163-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{F87ED1E6-97B2-3220-9702-AE471FEC7AA8}*]
"haclgmicdgfkepeh"=hex:6b,61,67,69,61,6e,6b,62,6c,61,6f,63,65,6a,6b,6c,67,68,
   70,61,66,6a,00,00
.
Zeit der Fertigstellung: 2011-09-04  16:06:33
ComboFix-quarantined-files.txt  2011-09-04 14:06
ComboFix2.txt  2010-09-03 17:09
.
Vor Suchlauf: 29 Verzeichnis(se), 107.018.350.592 Bytes frei
Nach Suchlauf: 31 Verzeichnis(se), 106.984.919.040 Bytes frei
.
- - End Of File - - 0F5F947ECBC5796B686A5B6FFF2AE1C2
         

Combofix - Scripten

1. Starte das Notepad (Start / Ausführen / notepad[Enter])

2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein.

Hinweis: Falls Du Deinen Benutzernamen unkenntlich gemacht hast, musst Du das Ausgesternte in Deinen richtigen Benutzernamen wieder verwandeln, sonst funktioniert das Script nicht!!

Regnull::
[HKEY_USERS\S-1-5-21-1054673845-2891796712-3211906163-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{71A06FB0-4C3D-0389-5C06-1FB541F5D4B7}*]
[HKEY_USERS\S-1-5-21-1054673845-2891796712-3211906163-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{A62E457B-77DF-2B5B-D39B-1C9A28D9FF5F}*]
[HKEY_USERS\S-1-5-21-1054673845-2891796712-3211906163-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{F87ED1E6-97B2-3220-9702-AE471FEC7AA8}*]
         

3. Speichere im Notepad als CFScript.txt auf dem Desktop.

4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall.
(Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !)

5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.



6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien:
Combofix.txt

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

So, das wäre gemacht. (Hat auch nur 3,5 Stunden gedauert )
Noch mal danke, dass du dir die Zeit nimmst hier drüber zu gucken und mir zu helfen!
Aber wie ist denn so dein "Zwischenbericht"?^^

ComboFix 11-09-03.01 - Fabian 04.09.2011  17:27:38.3.2 - x86
Microsoft® Windows Vista™ Home Premium   6.0.6000.0.1252.49.1031.18.3071.1631 [GMT 2:00]
ausgeführt von:: c:\users\Fabian\Downloads\ComboFix.exe
Benutzte Befehlsschalter :: c:\users\Fabian\Desktop\CFScript.txt
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\iun6002.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2011-08-04 bis 2011-09-04  ))))))))))))))))))))))))))))))
.
.
2011-09-04 18:57 . 2011-09-04 18:57	--------	d-----w-	c:\users\Public\AppData\Local\temp
2011-09-04 18:57 . 2011-09-04 18:57	--------	d-----w-	c:\users\Gast\AppData\Local\temp
2011-09-04 18:57 . 2011-09-04 18:57	--------	d-----w-	c:\users\Default\AppData\Local\temp
2011-09-04 18:57 . 2011-09-04 18:57	--------	d-----w-	c:\users\asasas\AppData\Local\temp
2011-09-01 21:38 . 2011-09-01 21:38	--------	d-----w-	c:\users\Fabian\.hades
2011-09-01 16:04 . 2011-09-01 16:04	--------	d-----w-	c:\program files\ESET
2011-08-26 15:01 . 2011-09-04 09:57	--------	d-----w-	c:\program files\DemonFlyff
2011-08-25 17:25 . 2011-08-25 17:25	--------	d-----w-	C:\_OTL
2011-08-21 13:14 . 2011-08-21 13:15	--------	d-----w-	c:\users\Fabian\AppData\Local\No23 Recorder
2011-08-21 13:14 . 2011-08-22 14:36	--------	d-----w-	c:\users\Fabian\AppData\Roaming\kikin
2011-08-21 13:14 . 2011-08-22 14:36	--------	d-----w-	c:\program files\kikin
2011-08-06 15:55 . 2011-08-26 19:11	--------	d-----w-	c:\users\Fabian\AppData\Local\Amazon
2011-08-06 00:59 . 2011-08-06 00:59	--------	d-----w-	c:\programdata\Vokabel Trainer
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-02 15:07 . 2011-07-19 11:14	404640	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2011-07-06 17:52 . 2010-09-02 19:02	41272	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-06 17:52 . 2010-09-02 19:02	22712	----a-w-	c:\windows\system32\drivers\mbam.sys
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-09 1232896]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2006-11-02 125440]
"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2007-04-03 165784]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-07-02 219520]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2008-02-26 4939776]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 39792]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-21 266497]
"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2007-04-03 165784]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"HCWemmon"="HCWemmon.exe" [2007-03-29 61440]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-01-18 185896]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-12-05 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-05 8530464]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-05 81920]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152]
"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2009-11-09 180224]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"WPCUMI"="c:\windows\system32\WpcUmi.exe" [2006-11-02 176128]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-04-12 1135912]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-09-21 47904]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-24 421160]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-07-06 1047656]
.
c:\users\Fabian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2008-10-25 98696]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1054673845-2891796712-3211906163-1000]
"EnableNotificationsRef"=dword:00000001
.
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-04-16 135664]
R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\svcntaux.exe [x]
R3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\System32\DRIVERS\ASPI32.sys [2002-07-17 84832]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-04-16 135664]
R3 oad;Visibroker Activation Daemon;c:\progra~1\Borland\vbroker\bin\oad.exe [x]
R3 osagent;VisiBroker Smart Agent;c:\progra~1\Borland\vbroker\bin\osagent.exe [x]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [2010-03-25 99728]
R3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-12-29 691696]
S1 GRD;G DATA Rootkit Detector Driver;c:\windows\system32\drivers\GRD.sys [2007-12-26 16712]
S2 Automatisches LiveUpdate - Scheduler;Automatisches LiveUpdate - Scheduler;c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2007-09-26 554352]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - 34080359
*Deregistered* - 34080359
.
Inhalt des "geplante Tasks" Ordners
.
2011-09-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-16 14:50]
.
2011-09-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-16 14:50]
.
2011-08-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1054673845-2891796712-3211906163-1000Core.job
- c:\users\Fabian\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-29 10:33]
.
2011-09-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1054673845-2891796712-3211906163-1000UA.job
- c:\users\Fabian\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-29 10:33]
.
2011-09-04 c:\windows\Tasks\Norton Security Scan for Fabian.job
- c:\program files\Norton Security Scan\Engine\2.7.3.34\Nss.exe [2010-05-04 00:27]
.
2011-09-04 c:\windows\Tasks\User_Feed_Synchronization-{C27515C3-4436-493B-94A2-3C3CF69BDCC9}.job
- c:\windows\system32\msfeedssync.exe [2006-11-02 09:45]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = 
mStart Page = 
mLocal Page = 
IE: Free YouTube to Mp3 Converter - c:\users\Fabian\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files\ICQ7.5\ICQ.exe
LSP: c:\windows\system32\wpclsp.dll
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\
FF - prefs.js: browser.search.defaulturl - 
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - 
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
FF - Ext: Personas: personas@christopher.beard - %profile%\extensions\personas@christopher.beard
FF - user.js: yahoo.homepage.dontask - true
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
AddRemove-Super_nude_patch_II_1.0 - c:\windows\iun6002.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2011-09-04 20:57
Windows 6.0.6000  NTFS
.
Scanne versteckte Prozesse... 
.
Scanne versteckte Autostarteinträge... 
.
Scanne versteckte Dateien... 
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
Zeit der Fertigstellung: 2011-09-04  21:00:11
ComboFix-quarantined-files.txt  2011-09-04 19:00
ComboFix2.txt  2011-09-04 14:06
ComboFix3.txt  2010-09-03 17:09
.
Vor Suchlauf: 30 Verzeichnis(se), 107.018.489.856 Bytes frei
Nach Suchlauf: 31 Verzeichnis(se), 106.986.168.320 Bytes frei
.
- - End Of File - - 27B317D5D873F1EF737149C33ED72849
         

Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!


Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.

• Starte die aswMBR.exe - (aswMBR.exe Anleitung)
  Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
• Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
  Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  
• Klicke auf Scan.
• Warte bitte bis Scan finished successfully im DOS-Fenster steht.
• Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).

Osam:

Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 20:19:19 on 05.09.2011

OS: Windows Vista Home Premium Edition (Build 6000), 32-bit
Default Browser: Mozilla Corporation Firefox 3.6.21

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskUserS-1-5-21-1054673845-2891796712-3211906163-1000Core.job" - "Google Inc." - C:\Users\Fabian\AppData\Local\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskUserS-1-5-21-1054673845-2891796712-3211906163-1000UA.job" - "Google Inc." - C:\Users\Fabian\AppData\Local\Google\Update\GoogleUpdate.exe
"Norton Security Scan for Fabian.job" - "Symantec Corporation" - C:\Program Files\Norton Security Scan\Engine\2.7.3.34\Nss.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"bdeadmin.cpl" - ? - C:\Windows\system32\bdeadmin.cpl
"DivXControlPanelApplet.cpl" - "DivX, Inc." - C:\Windows\system32\DivXControlPanelApplet.cpl
"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\Windows\system32\FlashPlayerCPLApp.cpl
"ODBCCP32.CPL" - "Microsoft Corporation" - C:\Windows\system32\ODBCCP32.CPL
"PhysX.cpl" - ? - C:\Windows\system32\PhysX.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"Adobe Gamma" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma.cpl
"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\MLCFG32.CPL
"Pando" - "Pando Networks" - C:\Program Files\Pando Networks\Media Booster\PMB.cpl
"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"a6j3wedu" (a6j3wedu) - "Microsoft Corporation" - C:\Windows\system32\drivers\a6j3wedu.sys  (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Advanced SCSI Programming Interface Driver" (ASPI) - ? - C:\Windows\System32\DRIVERS\ASPI32.sys
"ae7cwhut" (ae7cwhut) - "Microsoft Corporation" - C:\Windows\system32\drivers\ae7cwhut.sys  (Hidden registry entry, rootkit activity | File signed by Microsoft)
"aine0bck" (aine0bck) - ? - C:\Windows\system32\drivers\aine0bck.sys  (Hidden registry entry, rootkit activity | File not found)
"avgio" (avgio) - "Avira GmbH" - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgio.sys
"avgntflt" (avgntflt) - "Avira GmbH" - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys
"catchme" (catchme) - ? - C:\Users\Fabian\AppData\Local\Temp\catchme.sys  (File not found)
"enodpl" (enodpl) - ? - C:\Windows\System32\drivers\enodpl.sys  (File found, but it contains no detailed information)
"File Security Driver" (IKFileSec) - "PCTools Research Pty Ltd." - C:\Windows\System32\drivers\ikfilesec.sys
"G DATA Rootkit Detector Driver" (GRD) - "G DATA Software" - C:\Windows\system32\drivers\GRD.sys
"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)
"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)
"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)
"SCDEmu" (SCDEmu) - "PowerISO Computing, Inc." - C:\Windows\system32\drivers\SCDEmu.sys
"sptd" (sptd) - "Duplex Secure Ltd." - C:\Windows\System32\Drivers\sptd.sys  (File is exclusively opened, access blocked)
"ssmdrv" (ssmdrv) - "AVIRA GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys
"Symantec Eraser Control driver" (eeCtrl) - "Symantec Corporation" - C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
"System Filter Driver" (IKSysFlt) - "PCTools Research Pty Ltd." - C:\Windows\System32\drivers\iksysflt.sys
"System Security Driver" (IKSysSec) - "PCTools Research Pty Ltd." - C:\Windows\System32\drivers\iksyssec.sys
"tandpl" (tandpl) - ? - C:\Windows\System32\drivers\tandpl.sys  (File found, but it contains no detailed information)
"uglyipod" (uglyipod) - ? - C:\Users\Fabian\AppData\Local\Temp\uglyipod.sys  (Hidden registry entry, rootkit activity | File not found)
"VBoxNetFlt Service" (VBoxNetFlt) - ? - C:\Windows\System32\DRIVERS\VBoxNetFlt.sys  (File not found)
"Virtual Machine Monitor" (vmm) - "Microsoft Corporation" - C:\Windows\system32\Drivers\vmm.sys
"VirtualBox Host-Only Ethernet Adapter" (VBoxNetAdp) - "Sun Microsystems, Inc." - C:\Windows\System32\DRIVERS\VBoxNetAdp.sys

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - C:\Program Files\OpenOffice.org 2.4\program\shlxthdl.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
{88FED34C-F0CA-4636-A375-3CB6248B04CD} "Local Groove Web Services Protocol" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----
{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{AEB6717E-7E19-11d0-97EE-00C04FD91972} "{AEB6717E-7E19-11d0-97EE-00C04FD91972}" - ? -   (File not found | COM-object registry key not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -   (File not found | COM-object registry key not found)
{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)
{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)
{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -   (File not found | COM-object registry key not found)
{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -   (File not found | COM-object registry key not found)
{99FD978C-D287-4F50-827F-B2C658EDA8E7} "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} "Groove Explorer Icon Overlay 2 (GFS Stub)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{920E6DB1-9907-4370-B3A0-BAFC03D81399} "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{16F3DD56-1AF5-4347-846D-7C10C4192619} "Groove Explorer Icon Overlay 3 (GFS Folder)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{2916C86E-86A6-43FE-8112-43ABE6BF8DCC} "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{2A541AE1-5BF6-4665-A8A3-CFA9672E4291} "Groove Folder Synchronization" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{6C467336-8281-4E60-8204-430CED96822D} "Groove GFS Context Menu Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{A449600E-1DC6-4232-B948-9BD794D62056} "Groove GFS Stub Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{387E725D-DC16-4D76-B310-2C93ED4752A0} "Groove XML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{73B24247-042E-4EF5-ADC2-42F62E6FD654} "ICQ Lite Shell Extension" - ? -   (File not found | COM-object registry key not found)
{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Program Files\iTunes\iTunesMiniPlayer.dll
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONFILTER.DLL
{00020d75-0000-0000-c000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\MLSHEXT.DLL
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - C:\Program Files\OpenOffice.org 2.4\program\shlxthdl.dll
{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - C:\Program Files\OpenOffice.org 2.4\program\shlxthdl.dll
{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - C:\Program Files\OpenOffice.org 2.4\program\shlxthdl.dll
{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - C:\Program Files\OpenOffice.org 2.4\program\shlxthdl.dll
{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\OLKFSTUB.DLL
{967B2D40-8B7D-4127-9049-61EA0C2C6DCE} "PowerISO" - "PowerISO Computing, Inc." - C:\Program Files\PowerISO\PWRISOSH.DLL
{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} "RealOne Player Context Menu Class" - "RealNetworks, Inc." - C:\Program Files\Real\RealPlayer\rpshell.dll
{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)
{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Program Files\Avira\AntiVir PersonalEdition Classic\shlext.dll
{280CFDE1-1354-4431-92F3-03073BA593FB} "TotalConverter Context Menu Shell Extension" - ? -   (File not found | COM-object registry key not found)
{8932AEFE-9DB6-4f43-AFB2-5682F55E773A} "VPCHostCopyHook" - "Microsoft Corporation" - C:\Program Files\Microsoft Virtual PC\VPCShExH.DLL
{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -   (File not found | COM-object registry key not found)
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Program Files\WinRAR\rarext.dll  (File found, but it contains no detailed information)

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} "Java Plug-in 1.6.0_03" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_19" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab
{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} "Java Plug-in 1.6.0_19" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_19" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_19.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
{A93C41D8-01F8-4F8B-B14C-DE20B117E636} "HP Intelligente Auswahl" - "Hewlett-Packard Co." - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
{E763472E-A716-4CD9-89BD-DBDA6122F741} "HP Sammelmappe" - "Hewlett-Packard Co." - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
"ICQ7.5" - "ICQ, LLC." - C:\Program Files\ICQ7.5\ICQ.exe
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{053F9267-DC04-4294-A72C-58F732D338C0} "HP Print Clips" - "Hewlett-Packard Co." - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll
{3049C3E9-B461-4BC5-8870-4C09146192CA} "RealPlayer Download and Record Plugin for Internet Explorer" - "RealPlayer" - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"Adobe Gamma.lnk" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe  (Shortcut exists | File exists)
"OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE  (Shortcut exists | File exists)
"desktop.ini" - ? - C:\Users\Fabian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"AlcoholAutomount" - "Alcohol Soft Development Team" - "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
"DAEMON Tools" - "DT Soft Ltd." - "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
"DAEMON Tools Lite" - "DT Soft Ltd" - "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
"AdobeCS4ServiceManager" - "Adobe Systems Incorporated" - "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
"AppleSyncNotifier" - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
"avgnt" - "Avira GmbH" - "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
"DAEMON Tools" - "DT Soft Ltd." - "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
"DivXUpdate" - ? - "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
"GrooveMonitor" - "Microsoft Corporation" - "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
"HP Software Update" - "Hewlett-Packard Co." - C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
"iTunesHelper" - "Apple Inc." - "C:\Program Files\iTunes\iTunesHelper.exe"
"Malwarebytes' Anti-Malware (reboot)" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
"PWRISOVM.EXE" - "PowerISO Computing, Inc." - C:\Program Files\PowerISO\PWRISOVM.EXE
"QuickTime Task" - "Apple Inc." - "C:\Program Files\QuickTime\QTTask.exe" -atboottime
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
"Symantec PIF AlertEng" - "Symantec Corporation" - "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
"TkBellExe" - "RealNetworks, Inc." - "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"LIDIL hpzll5ha" - "Hewlett-Packard Company" - C:\Windows\system32\hpzll5ha.dll
"Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\Windows\system32\msonpmon.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"AntiVir PersonalEdition Classic Guard" (AntiVirService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
"AntiVir PersonalEdition Classic Planer" (AntiVirScheduler) - "Avira GmbH" - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
"Automatisches LiveUpdate - Scheduler" (Automatisches LiveUpdate - Scheduler) - "Symantec Corporation" - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
"FLEXnet Licensing Service" (FLEXnet Licensing Service) - ? - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe
"LckFldService" (LckFldService) - ? - C:\Windows\system32\LckFldService.exe  (File not found)
"LiveUpdate" (LiveUpdate) - "Symantec Corporation" - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
"LiveUpdate Notice Service" (LiveUpdate Notice Service) - "Symantec Corporation" - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
"LiveUpdate Notice Service Ex" (LiveUpdate Notice Ex) - ? - "c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon  (File not found)
"Machine Debug Manager" (MDM) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
"Microsoft Office Groove Audit Service" (Microsoft Office Groove Audit Service) - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"PC Tools Auxiliary Service" (sdAuxService) - ? - C:\Program Files\Spyware Doctor\svcntaux.exe  (File not found)
"PC Tools Security Service" (sdCoreService) - ? - C:\Program Files\Spyware Doctor\swdsvc.exe  (File not found)
"StarWind AE Service" (StarWindServiceAE) - "Rocket Division Software" - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
"Symantec Lic NetConnect service" (CLTNetCnService) - ? - "c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon  (File not found)
"Visibroker Activation Daemon" (oad) - ? - C:\PROGRA~1\Borland\vbroker\bin\oad.exe  (File not found)
"VisiBroker Smart Agent" (osagent) - ? - C:\PROGRA~1\Borland\vbroker\bin\osagent.exe  (File not found)

===[ Logfile end ]=========================================[ Logfile end ]===

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru
         

und das letzte noch. Sorry wegen dem Doppelpost :/

aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software
Run date: 2011-09-05 20:20:38
-----------------------------
20:20:38.184    OS Version: Windows 6.0.6000 
20:20:38.185    Number of processors: 2 586 0x4303
20:20:38.187    ComputerName: FABIAN-PC  UserName: Fabian
20:20:39.699    Initialize success
20:22:12.129    AVAST engine defs: 11090500
20:22:24.968    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
20:22:24.968    Disk 0 Vendor: ST3500630AS 3.AAD Size: 476940MB BusType: 3
20:22:27.011    Disk 0 MBR read successfully
20:22:27.027    Disk 0 MBR scan
20:22:27.042    Disk 0 Windows VISTA default MBR code
20:22:27.058    Disk 0 scanning sectors +976771072
20:22:27.152    Disk 0 scanning C:\Windows\system32\drivers
20:22:39.522    Service scanning
20:22:40.349    Service sptd C:\Windows\System32\Drivers\sptd.sys **LOCKED** 32
20:22:41.004    Modules scanning
20:22:48.368    Disk 0 trace - called modules:
20:22:48.414    ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll >>UNKNOWN [0x853221f8]<<
20:22:48.414    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x854fda48]
20:22:48.430    3 ntkrnlpa.exe[820b0cf5] -> nt!IofCallDriver -> [0x853917d8]
20:22:48.430    5 acpi.sys[8046932a] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x8539f5f8]
20:22:48.446    \Driver\atapi[0x845915f8] -> IRP_MJ_CREATE -> 0x853221f8
20:22:49.538    AVAST engine scan C:\Windows
20:22:54.826    AVAST engine scan C:\Windows\system32
20:25:45.084    AVAST engine scan C:\Windows\system32\drivers
20:25:58.578    AVAST engine scan C:\Users\Fabian
21:28:09.814    AVAST engine scan C:\ProgramData
21:32:28.634    Scan finished successfully
21:36:48.358    Disk 0 MBR has been saved successfully to "C:\Users\Fabian\Desktop\MBR.dat"
21:36:48.374    The log file has been saved successfully to "C:\Users\Fabian\Desktop\aswMBR.txt"
         

GMER ging nicht?

Oh sorry, hab ich vergessen zu erwähnen. Nein, das ging nicht. Es ist die ersten 3 Mal abgestürzt dann hab ich es sein lassen.