Windows aus Sicherheitsgründen gesperrt

mar8285

Wie so viele habe ich den Bösewicht gestern auch gefangen. Hab mich etwas belesen und gehe wie meine VorgängerInnen vor. OTL ist runter geladen und der scan durchgeführt.

Zur Information: Ich glaub ich weis wie ich den PC infiziert habe. Ein Programm namens Rider Flo versucht über Firefox Zugriff zu bekommen. Ich hab bei der Firewall nur Firefox gelesen und natürlich wie ein Blödmann auf Zugriff erlauben geklickt. Rider Flo versucht den Zugriff auch jetzt wieder zu erlangen.

Da die OTL.txt 10kb zu groß ist poste ich sie so

OTL logfile created on: 15.02.2012 12:47:19 - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Dokumente und Einstellungen\Martin\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

1022,42 Mb Total Physical Memory | 459,37 Mb Available Physical Memory | 44,93% Memory free
2,90 Gb Paging File | 2,30 Gb Available in Paging File | 79,36% Paging File free
Paging file location(s): C:\pagefile.sys 2048 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 58,59 Gb Total Space | 21,35 Gb Free Space | 36,44% Space Free | Partition Type: NTFS
Drive D: | 90,45 Gb Total Space | 45,73 Gb Free Space | 50,55% Space Free | Partition Type: NTFS
Drive F: | 3,74 Gb Total Space | 2,56 Gb Free Space | 68,58% Space Free | Partition Type: FAT32

Computer Name: RICHTER-PC | User Name: Martin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012.02.15 12:18:54 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Martin\Desktop\OTL.exe
PRC - [2011.06.09 12:06:06 | 000,254,696 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
PRC - [2011.01.05 09:18:50 | 000,133,432 | ---- | M] (ICQ, LLC.) -- C:\Programme\ICQ7.2\ICQ.exe
PRC - [2010.06.02 15:58:20 | 000,246,520 | ---- | M] () -- C:\Programme\ICQ6Toolbar\ICQ Service.exe
PRC - [2010.05.20 22:59:30 | 011,312,128 | ---- | M] (OpenOffice.org) -- C:\Programme\OpenOffice.org 3\program\soffice.bin
PRC - [2010.05.20 22:59:28 | 011,318,784 | ---- | M] (OpenOffice.org) -- C:\Programme\OpenOffice.org 3\program\soffice.exe
PRC - [2009.10.11 19:53:44 | 000,185,089 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2009.08.18 11:29:22 | 001,529,728 | ---- | M] (Microsoft Corporation) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WLIDSVC.EXE
PRC - [2009.08.18 11:29:22 | 000,183,152 | ---- | M] (Microsoft Corporation) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WLIDSVCM.EXE
PRC - [2009.06.10 09:44:57 | 000,108,289 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2009.03.02 11:08:43 | 000,209,153 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2008.08.28 10:19:34 | 001,630,208 | ---- | M] (Sitecom Europe BV) -- C:\Programme\Sitecom\Common\RaUI.exe
PRC - [2008.07.09 08:05:20 | 000,919,016 | ---- | M] (Zone Labs, LLC) -- C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
PRC - [2008.07.09 08:05:18 | 000,075,304 | ---- | M] (Zone Labs, LLC) -- C:\WINDOWS\system32\ZoneLabs\vsmon.exe
PRC - [2008.05.13 15:12:54 | 000,069,632 | ---- | M] (Ralink Technology, Corp.) -- C:\Programme\Sitecom\Common\RegistryWriter.exe
PRC - [2008.04.14 03:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008.04.14 03:22:45 | 000,060,928 | ---- | M] (Tomasz Pawlak) -- C:\Dokumente und Einstellungen\Martin\Lokale Einstellungen\Anwendungsdaten\Mozilla\Firefox\firefox.exe
PRC - [2007.03.29 14:41:26 | 000,222,128 | ---- | M] (Macrovision Corporation) -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Macrovision\FLEXnet Connect\6\ISUSPM.exe
PRC - [2001.12.29 08:10:00 | 000,106,561 | ---- | M] (WinZip Computing, Inc. and H.C. Top Systems B.V.) -- C:\Programme\WinZip\WZQKPICK.EXE


========== Modules (No Company Name) ==========

MOD - [2012.01.11 16:44:01 | 011,817,472 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web\62e34cfb5a8b233667c7c5a47a32ad93\System.Web.ni.dll
MOD - [2012.01.11 16:14:15 | 000,303,104 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
MOD - [2011.12.05 21:45:14 | 000,270,336 | ---- | M] () -- c:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
MOD - [2011.10.14 18:33:32 | 000,971,264 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\bce0720436dc6cb76006377f295ea365\System.Configuration.ni.dll
MOD - [2011.10.14 18:32:47 | 000,025,600 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Accessibility\d86a3346c3d90ff12d0df9d7726f3ece\Accessibility.ni.dll
MOD - [2011.10.14 18:29:23 | 005,450,752 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\70cacc44f0b4257f6037eda7a59a0aeb\System.Xml.ni.dll
MOD - [2011.10.14 18:29:18 | 012,430,848 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\71a2ae9ad561a62181cbd9fb11e9de7a\System.Windows.Forms.ni.dll
MOD - [2011.10.14 18:29:03 | 001,587,200 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\c10bea3c4bb7ef654651141bf9419090\System.Drawing.ni.dll
MOD - [2011.10.14 18:27:39 | 007,950,848 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\af39f6e644af02873b9bae319f2bfb13\System.ni.dll
MOD - [2011.10.14 18:27:29 | 011,490,816 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\ca87ba84221991839abbe7d4bc9c6721\mscorlib.ni.dll
MOD - [2011.01.05 09:18:56 | 000,733,184 | ---- | M] () -- C:\Programme\ICQ7.2\MDb.dll
MOD - [2010.06.02 15:58:20 | 000,246,520 | ---- | M] () -- C:\Programme\ICQ6Toolbar\ICQ Service.exe
MOD - [2010.05.04 14:36:28 | 000,970,752 | ---- | M] () -- C:\Programme\OpenOffice.org 3\program\libxml2.dll
MOD - [2010.03.16 12:22:12 | 000,014,848 | ---- | M] () -- c:\Programme\ATI Technologies\ATI.ACE\Core-Static\AxInterop.WBOCXLib.dll
MOD - [2009.01.28 14:03:49 | 000,326,401 | ---- | M] () -- C:\Programme\Avira\AntiVir Desktop\sqlite3.dll
MOD - [2008.07.09 08:06:24 | 000,194,032 | ---- | M] () -- C:\WINDOWS\system32\ZoneLabs\lib\pyd\zpui.pyd
MOD - [2008.07.09 08:06:24 | 000,144,880 | ---- | M] () -- C:\WINDOWS\system32\ZoneLabs\lib\pyd\pyexpat.pyd
MOD - [2008.07.09 08:06:24 | 000,046,576 | ---- | M] () -- C:\WINDOWS\system32\ZoneLabs\lib\pyd\_socket.pyd
MOD - [2008.07.09 08:06:24 | 000,026,096 | ---- | M] () -- C:\WINDOWS\system32\ZoneLabs\lib\pyd\signedDll.pyd
MOD - [2008.07.09 08:06:24 | 000,026,096 | ---- | M] () -- C:\WINDOWS\system32\ZoneLabs\lib\pyd\pyvsinit.pyd
MOD - [2008.07.09 08:05:28 | 000,017,808 | ---- | M] () -- C:\Programme\Zone Labs\ZoneAlarm\zlavscan_loc0407.dll
MOD - [2008.04.14 03:22:16 | 000,014,336 | ---- | M] () -- C:\WINDOWS\system32\msdmo.dll
MOD - [2007.12.13 18:26:50 | 000,796,048 | ---- | M] () -- C:\WINDOWS\system32\libeay32_0.9.6l.dll
MOD - [2007.11.28 04:32:00 | 001,163,264 | ---- | M] () -- C:\Programme\Sitecom\Common\acAuth.dll
MOD - [2007.09.20 18:34:58 | 000,129,024 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- -- (HidServ)
SRV - [2010.06.02 15:58:20 | 000,246,520 | ---- | M] () [Auto | Running] -- C:\Programme\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service)
SRV - [2009.10.11 19:53:44 | 000,185,089 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2009.08.18 11:29:22 | 001,529,728 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2009.06.10 09:44:57 | 000,108,289 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2008.07.09 08:05:18 | 000,075,304 | ---- | M] (Zone Labs, LLC) [Auto | Running] -- C:\WINDOWS\System32\ZoneLabs\vsmon.exe -- (vsmon)
SRV - [2008.05.13 15:12:54 | 000,069,632 | ---- | M] (Ralink Technology, Corp.) [Auto | Running] -- C:\Programme\Sitecom\Common\RegistryWriter.exe -- (RalinkRegistryWriter)


========== Driver Services (SafeList) ==========

DRV - [2012.01.26 16:23:05 | 007,490,560 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2012.01.26 16:17:43 | 000,100,368 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AtihdXP3.sys -- (AtiHDAudioService)
DRV - [2009.12.08 14:31:00 | 000,056,816 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2009.06.10 09:44:57 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.05.19 21:25:14 | 000,096,104 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2009.04.03 23:08:08 | 000,713,344 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\rt2870.sys -- (rt2870)
DRV - [2009.02.13 10:35:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - [2009.01.19 19:31:56 | 000,277,544 | ---- | M] (Protect Software GmbH) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\acedrv11.sys -- (acedrv11)
DRV - [2008.07.09 08:05:22 | 000,394,952 | ---- | M] (Zone Labs, LLC) [Kernel | System | Running] -- C:\WINDOWS\system32\vsdatant.sys -- (vsdatant)
DRV - [2008.02.27 02:10:44 | 000,051,176 | ---- | M] (Zone Labs, LLC) [Kernel | Boot | Running] -- C:\WINDOWS\system32\ZoneLabs\srescan.sys -- (srescan)
DRV - [2007.11.05 10:56:58 | 000,101,120 | R--- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ewusbmdm.sys -- (hwdatacard)
DRV - [2007.07.19 14:10:28 | 000,127,768 | ---- | M] (Kaspersky Lab) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\klif.sys -- (KLIF)
DRV - [2007.03.26 12:21:06 | 004,395,008 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2006.12.28 05:44:44 | 000,084,992 | R--- | M] (ATI Research Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\AtiHdAud.sys -- (HdAudAddService)
DRV - [2006.08.15 06:09:48 | 000,083,200 | R--- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)
DRV - [2006.06.18 22:38:18 | 000,043,520 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdK8.sys -- (AmdK8)
DRV - [2004.08.13 19:56:20 | 000,005,810 | R--- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ASACPI.sys -- (MTsensor)
DRV - [2004.08.09 12:33:26 | 000,114,016 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\prohlp02.sys -- (prohlp02)
DRV - [2004.08.09 12:29:28 | 000,053,920 | ---- | M] (Protection Technology) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\prodrv06.sys -- (prodrv06)
DRV - [2004.07.19 15:49:54 | 000,007,040 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\prosync1.sys -- (prosync1)
DRV - [2003.12.01 16:20:52 | 000,004,832 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\sfhlp01.sys -- (sfhlp01)
DRV - [2002.05.11 04:24:31 | 000,015,872 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Dokumente und Einstellungen\Martin\Lokale Einstellungen\Temp\jgameenp.sys -- (jgameenp)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========



IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1960408961-651377827-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.de/
IE - HKU\S-1-5-21-1960408961-651377827-839522115-1003\..\URLSearchHook: - No CLSID value found
IE - HKU\S-1-5-21-1960408961-651377827-839522115-1003\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKU\S-1-5-21-1960408961-651377827-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.2.9&q="
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.9
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.2.9&q="

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Programme\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Programme\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\smartwebprinting@hp.com: C:\Programme\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2 [2011.03.22 21:56:33 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{8AA36F4F-6DC7-4c06-77AF-5035170634FE}: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Swiss Academic Software\Citavi Picker\Firefox [2011.12.08 14:11:17 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.02.12 23:51:04 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011.12.07 13:47:34 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Programme\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2 [2011.03.22 21:56:33 | 000,000,000 | ---D | M]

[2008.09.02 14:18:28 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\Mozilla\Extensions
[2012.02.01 10:27:15 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\Mozilla\Firefox\Profiles\9772cx8j.default\extensions
[2011.02.20 11:31:06 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\Mozilla\Firefox\Profiles\9772cx8j.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012.01.05 09:10:55 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\Mozilla\Firefox\Profiles\9772cx8j.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2011.05.13 12:34:44 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\Mozilla\Firefox\Profiles\9772cx8j.default\extensions\nostmp
[2011.12.19 11:38:14 | 000,000,933 | ---- | M] () -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\Mozilla\Firefox\Profiles\9772cx8j.default\searchplugins\11-suche.xml
[2011.12.19 11:38:14 | 000,002,419 | ---- | M] () -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\Mozilla\Firefox\Profiles\9772cx8j.default\searchplugins\englische-ergebnisse.xml
[2011.12.19 11:38:14 | 000,010,525 | ---- | M] () -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\Mozilla\Firefox\Profiles\9772cx8j.default\searchplugins\gmx-suche.xml
[2012.02.08 17:12:22 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\Mozilla\Firefox\Profiles\9772cx8j.default\searchplugins\icqplugin-1.xml
[2009.02.08 14:53:29 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\Mozilla\Firefox\Profiles\9772cx8j.default\searchplugins\icqplugin-10.xml
[2009.03.09 20:32:34 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\Mozilla\Firefox\Profiles\9772cx8j.default\searchplugins\icqplugin-11.xml
[2009.03.31 14:53:33 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\Mozilla\Firefox\Profiles\9772cx8j.default\searchplugins\icqplugin-12.xml
[2009.04.23 23:28:10 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\Mozilla\Firefox\Profiles\9772cx8j.default\searchplugins\icqplugin-13.xml
[2009.06.26 09:40:32 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\Mozilla\Firefox\Profiles\9772cx8j.default\searchplugins\icqplugin-14.xml
[2009.06.27 23:02:51 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\Mozilla\Firefox\Profiles\9772cx8j.default\searchplugins\icqplugin-15.xml
[2009.10.05 20:29:28 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\Mozilla\Firefox\Profiles\9772cx8j.default\searchplugins\icqplugin-16.xml
[2009.10.19 14:51:20 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\Mozilla\Firefox\Profiles\9772cx8j.default\searchplugins\icqplugin-17.xml
[2009.11.10 14:42:18 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\Mozilla\Firefox\Profiles\9772cx8j.default\searchplugins\icqplugin-18.xml
[2010.01.01 12:01:10 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\Mozilla\Firefox\Profiles\9772cx8j.default\searchplugins\icqplugin-19.xml
[2008.06.20 09:16:58 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\Mozilla\Firefox\Profiles\9772cx8j.default\searchplugins\icqplugin-2.xml
[2010.01.08 14:31:11 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\Mozilla\Firefox\Profiles\9772cx8j.default\searchplugins\icqplugin-20.xml
[2010.03.19 22:09:24 | 000,000,961 | ---- | M] () -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\Mozilla\Firefox\Profiles\9772cx8j.default\searchplugins\icqplugin-21.xml
[2010.03.25 21:13:18 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\Mozilla\Firefox\Profiles\9772cx8j.default\searchplugins\icqplugin-22.xml
[2010.03.31 20:12:28 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\Mozilla\Firefox\Profiles\9772cx8j.default\searchplugins\icqplugin-23.xml
[2010.04.13 20:38:02 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\Mozilla\Firefox\Profiles\9772cx8j.default\searchplugins\icqplugin-24.xml
[2010.06.27 10:48:42 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\Mozilla\Firefox\Profiles\9772cx8j.default\searchplugins\icqplugin-25.xml
[2010.06.29 17:12:05 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\Mozilla\Firefox\Profiles\9772cx8j.default\searchplugins\icqplugin-26.xml
[2010.07.17 13:31:29 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\Mozilla\Firefox\Profiles\9772cx8j.default\searchplugins\icqplugin-27.xml
[2010.07.22 07:55:21 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\Mozilla\Firefox\Profiles\9772cx8j.default\searchplugins\icqplugin-28.xml
[2010.09.08 13:40:42 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\Mozilla\Firefox\Profiles\9772cx8j.default\searchplugins\icqplugin-29.xml
[2008.07.02 23:15:12 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\Mozilla\Firefox\Profiles\9772cx8j.default\searchplugins\icqplugin-3.xml
[2010.09.18 10:38:12 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\Mozilla\Firefox\Profiles\9772cx8j.default\searchplugins\icqplugin-30.xml
[2010.10.21 07:45:39 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\Mozilla\Firefox\Profiles\9772cx8j.default\searchplugins\icqplugin-31.xml
[2010.10.29 20:00:02 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\Mozilla\Firefox\Profiles\9772cx8j.default\searchplugins\icqplugin-32.xml
[2010.12.15 15:04:48 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\Mozilla\Firefox\Profiles\9772cx8j.default\searchplugins\icqplugin-33.xml
[2011.03.02 14:50:28 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\Mozilla\Firefox\Profiles\9772cx8j.default\searchplugins\icqplugin-34.xml
[2011.03.07 06:28:19 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\Mozilla\Firefox\Profiles\9772cx8j.default\searchplugins\icqplugin-35.xml
[2011.03.29 19:11:01 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\Mozilla\Firefox\Profiles\9772cx8j.default\searchplugins\icqplugin-36.xml
[2011.05.01 10:33:27 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\Mozilla\Firefox\Profiles\9772cx8j.default\searchplugins\icqplugin-37.xml
[2011.05.13 12:35:07 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\Mozilla\Firefox\Profiles\9772cx8j.default\searchplugins\icqplugin-38.xml
[2011.07.05 15:57:19 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\Mozilla\Firefox\Profiles\9772cx8j.default\searchplugins\icqplugin-39.xml
[2008.07.16 21:45:47 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\Mozilla\Firefox\Profiles\9772cx8j.default\searchplugins\icqplugin-4.xml
[2011.08.15 09:17:55 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\Mozilla\Firefox\Profiles\9772cx8j.default\searchplugins\icqplugin-40.xml
[2011.08.17 18:42:31 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\Mozilla\Firefox\Profiles\9772cx8j.default\searchplugins\icqplugin-41.xml
[2008.09.02 14:18:49 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\Mozilla\Firefox\Profiles\9772cx8j.default\searchplugins\icqplugin-5.xml
[2008.09.27 16:29:37 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\Mozilla\Firefox\Profiles\9772cx8j.default\searchplugins\icqplugin-6.xml
[2008.09.28 21:39:57 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\Mozilla\Firefox\Profiles\9772cx8j.default\searchplugins\icqplugin-7.xml
[2008.11.14 18:26:37 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\Mozilla\Firefox\Profiles\9772cx8j.default\searchplugins\icqplugin-8.xml
[2008.12.19 23:49:05 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\Mozilla\Firefox\Profiles\9772cx8j.default\searchplugins\icqplugin-9.xml
[2010.05.12 17:40:06 | 000,001,042 | ---- | M] () -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\Mozilla\Firefox\Profiles\9772cx8j.default\searchplugins\icqplugin.xml
[2011.12.19 11:38:14 | 000,002,457 | ---- | M] () -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\Mozilla\Firefox\Profiles\9772cx8j.default\searchplugins\lastminute.xml
[2011.12.19 11:38:14 | 000,005,508 | ---- | M] () -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\Mozilla\Firefox\Profiles\9772cx8j.default\searchplugins\webde-suche.xml
[2012.01.12 19:08:56 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2009.03.16 14:41:29 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2010.07.15 11:11:39 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Programme\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2012.02.12 23:51:04 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2011.10.03 04:06:04 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll
[2012.02.07 09:11:45 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.02.07 09:11:45 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2012.02.07 09:11:45 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2012.02.07 09:11:45 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.02.07 09:11:45 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.02.07 09:11:45 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml

O1 HOSTS File: ([2008.04.02 19:24:53 | 000,000,847 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (XTTBPos00 Class) - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\Programme\ICQToolbar\toolbaru.dll (IE Toolbar)
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKU\S-1-5-21-1960408961-651377827-839522115-1003\..\Toolbar\ShellBrowser: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKU\S-1-5-21-1960408961-651377827-839522115-1003\..\Toolbar\WebBrowser: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [APSDaemon] C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [hpqSRMon] File not found
O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found
O4 - HKLM..\Run: [StartCCC] c:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [ZoneAlarm Client] C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe (Zone Labs, LLC)
O4 - HKU\S-1-5-21-1960408961-651377827-839522115-1003..\Run: [ffdwnd] C:\Dokumente und Einstellungen\Martin\Lokale Einstellungen\Anwendungsdaten\Mozilla\Firefox\firefox.exe (Tomasz Pawlak)
O4 - HKU\S-1-5-21-1960408961-651377827-839522115-1003..\Run: [ICQ] C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.)
O4 - HKU\S-1-5-21-1960408961-651377827-839522115-1003..\Run: [ISUSPM] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Macrovision\FLEXnet Connect\6\ISUSPM.exe (Macrovision Corporation)
O4 - HKU\S-1-5-21-1960408961-651377827-839522115-1003..\Run: [Steam] C:\Programme\Steam\steam.exe (Valve Corporation)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Sitecom Wireless Utility.lnk = C:\Programme\Sitecom\Common\RaUI.exe (Sitecom Europe BV)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\WinZip Quick Pick.lnk = C:\Programme\WinZip\WZQKPICK.EXE (WinZip Computing, Inc. and H.C. Top Systems B.V.)
O4 - Startup: C:\Dokumente und Einstellungen\Martin\Startmenü\Programme\Autostart\OpenOffice.org 3.2.lnk = C:\Programme\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1960408961-651377827-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.)
O16 - DPF: {41564D57-9980-0010-8000-00AA00389B71} hxxp://download.microsoft.com/download/0/A/9/0A9F8B32-9F8C-4D74-A130-E4CAB36EB01F/wmvadvd.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Martin\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Martin\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007.09.11 15:39:47 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{171490f0-b30b-11dd-9276-001bfc71d718}\Shell - "" = AutoRun
O33 - MountPoints2\{171490f0-b30b-11dd-9276-001bfc71d718}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{171490f0-b30b-11dd-9276-001bfc71d718}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{171490f5-b30b-11dd-9276-001bfc71d718}\Shell - "" = AutoRun
O33 - MountPoints2\{171490f5-b30b-11dd-9276-001bfc71d718}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{171490f5-b30b-11dd-9276-001bfc71d718}\Shell\AutoRun\command - "" = G:\StartVMCLite.exe
O33 - MountPoints2\{981d1102-256d-11dd-aef6-001bfc71d718}\Shell - "" = AutoRun
O33 - MountPoints2\{981d1102-256d-11dd-aef6-001bfc71d718}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{981d1102-256d-11dd-aef6-001bfc71d718}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{981d110a-256d-11dd-aef6-001bfc71d718}\Shell - "" = AutoRun
O33 - MountPoints2\{981d110a-256d-11dd-aef6-001bfc71d718}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{981d110a-256d-11dd-aef6-001bfc71d718}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{a18f018a-fdad-11dd-bc17-001bfc71d718}\Shell - "" = AutoRun
O33 - MountPoints2\{a18f018a-fdad-11dd-bc17-001bfc71d718}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{a18f018a-fdad-11dd-bc17-001bfc71d718}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{a18f0202-fdad-11dd-bc17-001bfc71d718}\Shell - "" = AutoRun
O33 - MountPoints2\{a18f0202-fdad-11dd-bc17-001bfc71d718}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{a18f0202-fdad-11dd-bc17-001bfc71d718}\Shell\AutoRun\command - "" = G:\StartVMCLite.exe
O33 - MountPoints2\{acbdaf9e-00d8-11dd-b193-001bfc71d718}\Shell - "" = AutoRun
O33 - MountPoints2\{acbdaf9e-00d8-11dd-b193-001bfc71d718}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{acbdaf9e-00d8-11dd-b193-001bfc71d718}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{acbdaf9f-00d8-11dd-b193-001bfc71d718}\Shell - "" = AutoRun
O33 - MountPoints2\{acbdaf9f-00d8-11dd-b193-001bfc71d718}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{acbdaf9f-00d8-11dd-b193-001bfc71d718}\Shell\AutoRun\command - "" = G:\StartVMCLite.exe
O33 - MountPoints2\{ad313e9f-1f59-11dd-bae9-001bfc71d718}\Shell - "" = AutoRun
O33 - MountPoints2\{ad313e9f-1f59-11dd-bae9-001bfc71d718}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{ad313e9f-1f59-11dd-bae9-001bfc71d718}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKU\S-1-5-21-1960408961-651377827-839522115-1003\...com [@ = comfile] -- Reg Error: Key error. File not found
O37 - HKU\S-1-5-21-1960408961-651377827-839522115-1003\...exe [@ = exefile] -- Reg Error: Key error. File not found

========== Files/Folders - Created Within 30 Days ==========

[2012.02.15 12:32:21 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Martin\Desktop\OTL.exe
[2012.02.13 15:49:27 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\gtk-2.0
[2012.02.13 15:15:38 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Martin\.thumbnails
[2012.02.13 15:14:39 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Martin\.gimp-2.6
[2012.02.13 15:14:38 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Martin\Eigene Dateien\gegl-0.0
[2012.02.13 15:14:26 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\GIMP
[2012.02.13 15:13:31 | 000,000,000 | ---D | C] -- C:\Programme\GIMP-2.0
[2012.02.01 15:46:35 | 000,000,000 | ---D | C] -- C:\Programme\AMD APP
[2012.02.01 15:46:29 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Catalyst Control Center
[2012.02.01 15:45:52 | 000,100,368 | ---- | C] (Advanced Micro Devices) -- C:\WINDOWS\System32\drivers\AtihdXP3.sys
[2012.02.01 15:45:17 | 000,466,944 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\WINDOWS\System32\ATIDEMGX.dll
[2012.02.01 15:45:14 | 000,311,296 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\atiiiexx.dll
[2012.02.01 15:45:09 | 000,000,000 | ---D | C] -- C:\Programme\ATI
[2012.02.01 15:44:47 | 000,000,000 | ---D | C] -- C:\Programme\ATI Technologies
[2012.02.01 15:25:15 | 000,000,000 | ---D | C] -- C:\tools
[2012.02.01 13:47:18 | 000,527,192 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\XAudio2_7.dll
[2012.02.01 13:47:18 | 000,239,960 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xactengine3_7.dll
[2012.02.01 13:47:18 | 000,074,072 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\XAPOFX1_5.dll
[2012.02.01 13:47:17 | 002,106,216 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\D3DCompiler_43.dll
[2012.02.01 13:47:17 | 001,868,128 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dcsx_43.dll
[2012.02.01 13:47:16 | 001,998,168 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\D3DX9_43.dll
[2012.02.01 13:47:16 | 000,470,880 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx10_43.dll
[2012.02.01 13:47:16 | 000,248,672 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx11_43.dll
[2012.02.01 13:47:15 | 000,528,216 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\XAudio2_6.dll
[2012.02.01 13:47:15 | 000,238,936 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xactengine3_6.dll
[2012.02.01 13:47:15 | 000,074,072 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\XAPOFX1_4.dll
[2012.02.01 13:47:14 | 000,022,360 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\X3DAudio1_7.dll
[2012.02.01 13:44:23 | 000,000,000 | ---D | C] -- C:\Programme\dx929
[2012.01.26 21:09:46 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Martin\Anwendungsdaten\ScummVM
[2012.01.26 21:07:12 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Programme
[2012.01.26 21:07:10 | 000,000,000 | ---D | C] -- C:\Programme\ScummVM
[2012.01.26 16:39:27 | 007,376,896 | ---- | C] (Advanced Micro Devices Inc.) -- C:\WINDOWS\System32\aticaldd.dll
[2012.01.26 16:39:27 | 000,956,160 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\WINDOWS\System32\ativvamv.dll
[2012.01.26 16:39:27 | 000,118,784 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\WINDOWS\System32\atibtmon.exe
[2012.01.26 16:39:27 | 000,065,024 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\WINDOWS\System32\atimpc32.dll
[2012.01.26 16:39:27 | 000,065,024 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\WINDOWS\System32\amdpcom32.dll
[2012.01.26 16:39:27 | 000,057,344 | ---- | C] (Advanced Micro Devices Inc.) -- C:\WINDOWS\System32\aticalrt.dll
[2012.01.26 16:39:27 | 000,045,056 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\WINDOWS\System32\ATIODCLI.exe
[2012.01.26 16:39:26 | 000,294,912 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\WINDOWS\System32\ATIODE.exe
[2012.01.26 16:39:26 | 000,233,472 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\WINDOWS\System32\atiadlxx.dll
[2012.01.26 16:39:26 | 000,159,744 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\WINDOWS\System32\atiapfxx.exe
[2012.01.26 16:39:26 | 000,053,248 | ---- | C] (Advanced Micro Devices Inc.) -- C:\WINDOWS\System32\aticalcl.dll
[2012.01.19 21:07:31 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\LucasArts
[2012.01.19 21:07:27 | 000,000,000 | ---D | C] -- C:\Programme\LucasArts
[2012.01.19 20:47:43 | 000,302,592 | ---- | C] (InstallShield Corporation, Inc.) -- C:\WINDOWS\unin0407.exe
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012.02.15 12:49:27 | 084,207,648 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox.dat
[2012.02.15 12:30:10 | 000,001,090 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012.02.15 12:18:54 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Martin\Desktop\OTL.exe
[2012.02.15 10:51:27 | 000,358,384 | ---- | M] () -- C:\WINDOWS\System32\vsconfig.xml
[2012.02.15 10:50:14 | 000,001,086 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012.02.15 10:49:25 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.02.15 00:24:34 | 000,993,956 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox.idx
[2012.02.14 16:38:19 | 000,004,096 | ---- | M] () -- C:\Dokumente und Einstellungen\Martin\.recently-used.xbel
[2012.02.13 15:54:48 | 000,004,096 | ---- | M] () -- C:\WINDOWS\System32\crash
[2012.02.13 15:14:27 | 000,000,780 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\GIMP 2.lnk
[2012.02.12 21:17:56 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.02.01 15:46:54 | 000,001,324 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2012.02.01 13:20:02 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2012.01.26 16:42:34 | 000,000,000 | ---- | M] () -- C:\WINDOWS\ativpsrm.bin
[2012.01.26 16:32:33 | 019,357,696 | ---- | M] (Advanced Micro Devices, Inc.) -- C:\WINDOWS\System32\atioglxx.dll
[2012.01.26 16:28:34 | 000,026,112 | ---- | M] (ATI Technologies, Inc.) -- C:\WINDOWS\System32\Ati2mdxx.exe
[2012.01.26 16:28:34 | 000,024,064 | ---- | M] (ATI Technologies, Inc.) -- C:\WINDOWS\System32\ativcoxx.dll
[2012.01.26 16:27:36 | 000,053,248 | ---- | M] ( ATI Technologies Inc.) -- C:\WINDOWS\System32\ATIDDC.DLL
[2012.01.26 16:27:25 | 000,192,512 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\System32\ati2evxx.dll
[2012.01.26 16:26:04 | 000,602,112 | ---- | M] (Advanced Micro Devices, Inc.) -- C:\WINDOWS\System32\atiok3x2.dll
[2012.01.26 16:25:31 | 000,159,744 | ---- | M] (Advanced Micro Devices, Inc.) -- C:\WINDOWS\System32\atiapfxx.exe
[2012.01.26 16:25:28 | 000,806,912 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\System32\atikvmag.dll
[2012.01.26 16:25:01 | 005,334,656 | ---- | M] (Advanced Micro Devices, Inc. ) -- C:\WINDOWS\System32\dllcache\ati3duag.dll
[2012.01.26 16:25:01 | 005,334,656 | ---- | M] (Advanced Micro Devices, Inc. ) -- C:\WINDOWS\System32\ati3duag.dll
[2012.01.26 16:25:01 | 000,036,338 | ---- | M] () -- C:\WINDOWS\atiogl.xml
[2012.01.26 16:24:58 | 007,376,896 | ---- | M] (Advanced Micro Devices Inc.) -- C:\WINDOWS\System32\aticaldd.dll
[2012.01.26 16:24:15 | 000,884,736 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\System32\dllcache\ati2cqag.dll
[2012.01.26 16:24:15 | 000,884,736 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\System32\ati2cqag.dll
[2012.01.26 16:23:32 | 000,304,640 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\System32\dllcache\ati2dvag.dll
[2012.01.26 16:23:32 | 000,304,640 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\System32\ati2dvag.dll
[2012.01.26 16:23:10 | 000,000,003 | ---- | M] () -- C:\WINDOWS\System32\ativva5x.dat
[2012.01.26 16:23:09 | 000,466,944 | ---- | M] (Advanced Micro Devices, Inc.) -- C:\WINDOWS\System32\ATIDEMGX.dll
[2012.01.26 16:23:06 | 000,155,648 | ---- | M] (ATI Technologies, Inc.) -- C:\WINDOWS\System32\Oemdspif.dll
[2012.01.26 16:23:05 | 007,490,560 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati2mtag.sys
[2012.01.26 16:23:05 | 007,490,560 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\System32\dllcache\ati2mtag.sys
[2012.01.26 16:22:55 | 000,887,724 | ---- | M] () -- C:\WINDOWS\System32\ativva6x.dat
[2012.01.26 16:21:36 | 000,212,992 | ---- | M] (ATI Technologies, Inc.) -- C:\WINDOWS\System32\atipdlxx.dll
[2012.01.26 16:21:06 | 000,065,024 | ---- | M] (Advanced Micro Devices, Inc. ) -- C:\WINDOWS\System32\atimpc32.dll
[2012.01.26 16:21:06 | 000,065,024 | ---- | M] (Advanced Micro Devices, Inc. ) -- C:\WINDOWS\System32\amdpcom32.dll
[2012.01.26 16:20:43 | 000,608,507 | ---- | M] () -- C:\WINDOWS\System32\atiicdxx.dat
[2012.01.26 16:19:40 | 000,053,248 | ---- | M] (Advanced Micro Devices Inc.) -- C:\WINDOWS\System32\aticalcl.dll
[2012.01.26 16:19:39 | 000,233,472 | ---- | M] (Advanced Micro Devices, Inc.) -- C:\WINDOWS\System32\atiadlxx.dll
[2012.01.26 16:19:26 | 000,017,408 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\System32\atitvo32.dll
[2012.01.26 16:19:11 | 002,097,056 | ---- | M] () -- C:\WINDOWS\System32\ativvaxx.cap
[2012.01.26 16:19:11 | 000,057,344 | ---- | M] (Advanced Micro Devices Inc.) -- C:\WINDOWS\System32\aticalrt.dll
[2012.01.26 16:19:07 | 000,294,912 | ---- | M] (Advanced Micro Devices, Inc.) -- C:\WINDOWS\System32\ATIODE.exe
[2012.01.26 16:17:51 | 000,219,080 | ---- | M] () -- C:\WINDOWS\System32\atiapfxx.blb
[2012.01.26 16:17:43 | 000,100,368 | ---- | M] (Advanced Micro Devices) -- C:\WINDOWS\System32\drivers\AtihdXP3.sys
[2012.01.26 16:17:23 | 000,045,056 | ---- | M] (Advanced Micro Devices, Inc.) -- C:\WINDOWS\System32\ATIODCLI.exe
[2012.01.26 16:16:33 | 000,118,784 | ---- | M] (Advanced Micro Devices, Inc.) -- C:\WINDOWS\System32\atibtmon.exe
[2012.01.26 16:16:29 | 003,307,776 | ---- | M] (Advanced Micro Devices, Inc. ) -- C:\WINDOWS\System32\dllcache\ativvaxx.dll
[2012.01.26 16:16:29 | 003,307,776 | ---- | M] (Advanced Micro Devices, Inc. ) -- C:\WINDOWS\System32\ativvaxx.dll
[2012.01.26 16:15:57 | 000,311,296 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\System32\atiiiexx.dll
[2012.01.26 16:15:17 | 000,956,160 | ---- | M] (Advanced Micro Devices, Inc. ) -- C:\WINDOWS\System32\ativvamv.dll
[2012.01.26 16:15:16 | 000,053,248 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati2erec.dll
[2012.01.26 16:15:03 | 000,043,520 | ---- | M] (ATI Technologies, Inc.) -- C:\WINDOWS\System32\ati2edxx.dll
[2012.01.24 15:45:14 | 000,016,040 | ---- | M] () -- C:\Dokumente und Einstellungen\Martin\Eigene Dateien\Verteidigung.odt
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012.02.14 16:38:19 | 000,004,096 | ---- | C] () -- C:\Dokumente und Einstellungen\Martin\.recently-used.xbel
[2012.02.13 15:14:27 | 000,000,780 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\GIMP 2.lnk
[2012.02.01 15:45:17 | 000,887,724 | ---- | C] () -- C:\WINDOWS\System32\ativva6x.dat
[2012.02.01 15:45:16 | 000,219,080 | ---- | C] () -- C:\WINDOWS\System32\atiapfxx.blb
[2012.02.01 15:45:16 | 000,036,338 | ---- | C] () -- C:\WINDOWS\atiogl.xml
[2012.02.01 15:45:14 | 000,608,507 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.dat
[2012.02.01 15:45:14 | 000,000,003 | ---- | C] () -- C:\WINDOWS\System32\ativva5x.dat
[2012.01.26 16:42:34 | 000,000,000 | ---- | C] () -- C:\WINDOWS\ativpsrm.bin
[2012.01.26 16:39:27 | 002,097,056 | ---- | C] () -- C:\WINDOWS\System32\ativvaxx.cap
[2012.01.24 15:45:13 | 000,016,040 | ---- | C] () -- C:\Dokumente und Einstellungen\Martin\Eigene Dateien\Verteidigung.odt
[2012.01.11 22:06:15 | 000,002,272 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
[2011.12.05 22:04:00 | 000,059,904 | ---- | C] () -- C:\WINDOWS\System32\OpenVideo.dll
[2011.12.05 22:03:52 | 000,054,784 | ---- | C] () -- C:\WINDOWS\System32\OVDecode.dll
[2011.09.28 17:44:14 | 000,179,271 | ---- | C] () -- C:\WINDOWS\System32\xlive.dll.cat
[2011.05.23 08:19:27 | 000,000,552 | ---- | C] () -- C:\WINDOWS\System32\d3d8caps.dat
[2011.03.29 18:02:25 | 000,078,193 | ---- | C] () -- C:\WINDOWS\hpqins05.dat
[2011.03.22 21:50:00 | 000,188,590 | ---- | C] () -- C:\WINDOWS\hpoins28.dat
[2011.03.22 21:50:00 | 000,000,796 | ---- | C] () -- C:\WINDOWS\hpomdl28.dat
[2011.02.16 12:18:00 | 000,001,324 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010.03.19 21:47:47 | 000,000,059 | ---- | C] () -- C:\WINDOWS\RUNAWAY.INI
[2010.03.17 17:47:19 | 000,004,096 | ---- | C] () -- C:\WINDOWS\System32\drivers\rt2870.bin
[2010.03.17 17:47:16 | 000,013,931 | ---- | C] () -- C:\WINDOWS\System32\RaCoInst.dat
[2010.01.19 22:28:11 | 000,001,025 | ---- | C] () -- C:\WINDOWS\System32\sysprs7.dll
[2010.01.19 22:28:11 | 000,000,205 | ---- | C] () -- C:\WINDOWS\System32\lsprst7.dll
[2010.01.19 22:25:11 | 000,001,024 | ---- | C] () -- C:\WINDOWS\System32\clauth2.dll
[2010.01.19 22:25:11 | 000,001,024 | ---- | C] () -- C:\WINDOWS\System32\clauth1.dll
[2010.01.19 22:25:11 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\ssprs.dll
[2010.01.19 22:25:11 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\serauth2.dll
[2010.01.19 22:25:11 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\serauth1.dll
[2010.01.19 22:25:11 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\nsprs.dll
[2009.10.11 21:08:03 | 000,021,840 | ---- | C] () -- C:\WINDOWS\System32\SIntfNT.dll
[2009.10.11 21:08:03 | 000,017,212 | ---- | C] () -- C:\WINDOWS\System32\SIntf32.dll
[2009.10.11 21:08:03 | 000,012,067 | ---- | C] () -- C:\WINDOWS\System32\SIntf16.dll
[2009.10.11 20:47:42 | 000,039,786 | ---- | C] () -- C:\WINDOWS\DIIUnin.dat
[2009.06.06 18:16:24 | 000,000,223 | ---- | C] () -- C:\WINDOWS\MedievalTW_VI.ini
[2009.05.03 18:15:20 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2008.11.29 15:04:00 | 000,004,096 | ---- | C] () -- C:\WINDOWS\d3dx.dat
[2008.07.24 14:05:19 | 000,000,034 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2008.04.21 15:08:18 | 000,008,510 | ---- | C] () -- C:\WINDOWS\hpdj3600.ini
[2008.04.19 14:33:18 | 000,043,520 | ---- | C] () -- C:\WINDOWS\System32\CmdLineExt03.dll
[2008.04.07 16:34:47 | 000,000,305 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\addr_file.html
[2008.04.02 19:48:10 | 084,207,648 | -HS- | C] () -- C:\WINDOWS\System32\drivers\fidbox.dat
[2008.04.02 19:45:31 | 000,021,904 | ---- | C] () -- C:\WINDOWS\System32\imsinstall_loc0407.dll
[2008.04.02 19:45:31 | 000,017,808 | ---- | C] () -- C:\WINDOWS\System32\imslsp_install_loc0407.dll
[2008.04.02 19:45:15 | 000,796,048 | ---- | C] () -- C:\WINDOWS\System32\libeay32_0.9.6l.dll
[2008.04.02 18:28:36 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2008.04.02 18:18:59 | 000,004,212 | -H-- | C] () -- C:\WINDOWS\System32\zllictbl.dat
[2008.04.02 18:17:47 | 000,100,489 | ---- | C] () -- C:\WINDOWS\UninstallFirefox.exe
[2008.04.02 18:17:22 | 000,003,226 | ---- | C] () -- C:\WINDOWS\mozver.dat
[2007.10.11 22:03:51 | 000,034,816 | ---- | C] () -- C:\Dokumente und Einstellungen\Martin\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007.09.17 09:38:18 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI
[2007.09.12 08:34:27 | 000,520,192 | ---- | C] () -- C:\WINDOWS\System32\ati2sgag.exe
[2007.09.12 08:34:19 | 003,107,788 | R--- | C] () -- C:\WINDOWS\System32\ativvaxx.dat
[2007.09.12 07:59:57 | 000,000,710 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2007.09.12 07:28:25 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\ChCfg.exe
[2007.09.12 07:11:59 | 000,021,620 | ---- | C] () -- C:\WINDOWS\Ascd_log.ini
[2007.09.12 07:11:50 | 000,005,810 | R--- | C] () -- C:\WINDOWS\System32\drivers\ASACPI.sys
[2007.09.12 07:11:48 | 000,021,582 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini
[2007.09.12 07:11:35 | 000,010,288 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2007.09.11 16:32:56 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2007.09.11 16:31:26 | 000,130,888 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2007.09.11 15:41:39 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2007.09.11 15:37:04 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2004.08.02 13:20:40 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2002.08.29 03:54:14 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2001.08.23 14:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2001.08.23 14:00:00 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2001.08.23 13:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2001.08.23 13:00:00 | 000,449,236 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2001.08.23 13:00:00 | 000,432,928 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2001.08.23 13:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2001.08.23 13:00:00 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2001.08.23 13:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2001.08.23 13:00:00 | 000,080,544 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2001.08.23 13:00:00 | 000,067,884 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2001.08.23 13:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2001.08.23 13:00:00 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2001.08.23 13:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2001.08.23 13:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat

< End of report >