Schwarzer bildschirm mit Fenster dass ich angeblich Kinderpornographie auf dem Rechner habe...

dixdiver · 18.04.2012, 18:33

... und nach Zahlung von 100€ per Paysafecard oder ukash den Rechner wieder freischalten kann.

Soweit die Einleitung.

Erstmal noch hallo,

ich habe oben kurz beschrieben was der rechner noch macht, nun folgt eine genauere Beschreibung.

auf meinem Laptop läuft noch Windows XP Home edition mit SP 2.
Virensoftware hab ich zur Zeit leider keine, da Antivir den Update verweigert, da ich erst SP 3 laden soll, das hat aber bisher nicht funktioniert.

Nun ist mir heut beim Surfen mit Firefox aufgefallen dass immer wieder sich Werbefenster als neuer Tab geöffnet haben, ohne dass ich was gemacht hatte.

Heut abend hat dann der Trojaner zugeschlagen. erst ist der rechner normal hochgefahren, dann hatte ich Firefox gestartet. Soweit so gut, dann ging firefox zu und danach wurde der Bildschirm schwarz. Kurz darauf erschien das Fenster mit dem hinweis, ich hätte Kinderpornographie oder Sodomie Dateien auf meinem Rechner und er sei jetzt gesperrt.

Ich könnte Ihn wieder entsperren indem ich per Paysafecard oder ukash 100€ Strafe zahle (Das Fenster indem ich den 19 stelligen Ukash Code oder den 16stelligen paysafecard Code eingeben soll, wird mit Button Strafe zahlen bestätigt).

Der ganze aufaba des fensters ist mit einem Logo der Bundespolizei und selbigem Schriftzug in Großbuchstaben hinterlegt. Oben rechts im Fenster ist ein Logo mit dem Schriftzug "Deutsche Polizeigewerkschaft" in blau. Unten links im Fenster ist ein Schriftzug Polizei mit Östreichischen Bundesadler. Direkt über dem Schriftzug steht dann noch "Windows Service Pack 2 217.80.25.155 DE"

Ein Punkt noch, hatte heut Mittag einen Update der Firmware meiner

FRITZ!Box Fon WLAN 7270 v2

auf

Firmware: FRITZ!OS 05.21

Firmware-Version: 54.05.21

durchgeführt.

Der Rechner lässt sich nur noch durch drücken der Powertaste runterfahren, dann taucht kurz die normale XP Oberfläche auf, aber ich kann das Runterfahren nicht stoppen.
Ins BIOS komm ich bein Hochfahren noch rein und der Laptop lässt sich auch mit der XP CD starten, aber ich wollte keine Neuinstallation durchführen, da zuviel Daten unter "eigene dateien" gespeichert sind.

Danke schonmal im Voraus für die Unterstützung

Alex

markusg · 18.04.2012, 18:35

hi
Mit einem sauberen 2. Rechner eine OTLPE-CD erstellen und den infizierten Rechner dann von dieser CD booten:

Falls Du kein Brennprogramm installiert hast, lade dir bitte ISOBurner herunter. Das Programm wird Dir erlauben, OTLPE auf eine CD zu brennen und sie bootfähig zu machen. Du brauchst das Tool nur zu installieren, der Rest läuft automatisch => Wie brenne ich eine ISO Datei auf CD/DVD.

Lade

OTLPENet.exe von OldTimer herunter und speichere sie auf Deinem Desktop. Anmerkung: Die Datei ist ca. 120 MB groß und es wird bei langsamer Internet-Verbindung ein wenig dauern, bis Du sie runtergeladen hast.

Wenn der Download fertig ist, mache einen Doppelklick auf die Datei und beantworte die Frage "Do you want to burn the CD?" mit Yes.
Lege eine leere CD in Deinen Brenner.
ImgBurn (oder Dein Brennprogramm) wird das Archiv extrahieren und OTLPE Network auf die CD brennen.
Wenn der Brenn-Vorgang abgeschlossen ist, wirst Du eine Dialogbox sehen => "Operation successfully completed".
Du kannst nun die Fenster des Brennprogramms schließen.

Nun boote von der OTLPE CD. Hinweis: Wie boote ich von CD

Bebilderte Anleitung: OTLpe-Scan

Dein System sollte nach einigen Minuten den REATOGO-X-PE Desktop anzeigen.
Mache einen Doppelklick auf das OTLPE Icon.
Hinweis: Damit OTLPE auch das richtige installierte Windows scant, musst du den Windows-Ordner des auf der Platte installierten Windows auswählen, einfach nur C: auswählen gibt einen Fehler!
Wenn Du gefragt wirst "Do you wish to load the remote registry", dann wähle Yes.
Wenn Du gefragt wirst "Do you wish to load remote user profile(s) for scanning", dann wähle Yes.
Vergewissere Dich, dass die Box "Automatically Load All Remaining Users" gewählt ist und drücke OK.
OTLpe sollte nun starten.
Drücke Run Scan, um den Scan zu starten.
Wenn der Scan fertig ist, werden die Dateien C:\OTL.Txt und C:\Extras.Txt erstellt
Kopiere diese Datei auf Deinen USB-Stick, wenn Du keine Internetverbindung auf diesem System hast.
Bitte poste den Inhalt von C:\OTL.txt und Extras.txt.

dixdiver · 18.04.2012, 19:52

Hab die CD gebrannt,
Scan läuft, nachdem ich noch nen Stick gefunden hab.
Poste gleich die Ergebnisse wenn sie da sind.

Alex

markusg · 18.04.2012, 19:55

hi,
solche zwischenrufe bitte lassen, da bei hilfesuchenen dann kein neuer post erstellt wird, sondern das neue rann gehangen, muss ich dann ständig hier rein gucken :-)

dixdiver · 18.04.2012, 20:01

Log des Scans:OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 4/18/2012 9:48:33 PM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 2 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,022.00 Mb Total Physical Memory | 794.00 Mb Available Physical Memory | 78.00% Memory free
906.00 Mb Paging File | 842.00 Mb Available in Paging File | 93.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 46.29 Gb Total Space | 11.87 Gb Free Space | 25.64% Space Free | Partition Type: NTFS
Drive D: | 36.88 Gb Total Space | 8.91 Gb Free Space | 24.16% Space Free | Partition Type: NTFS
Drive E: | 9.97 Gb Total Space | 7.32 Gb Free Space | 73.39% Space Free | Partition Type: FAT32
Drive F: | 3.76 Gb Total Space | 0.80 Gb Free Space | 21.23% Space Free | Partition Type: FAT32
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Disabled] --  -- (HidServ)
SRV - File not found [On_Demand] --  -- (AppMgmt)
SRV - [2012/04/13 01:48:49 | 000,253,088 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2011/12/06 17:00:14 | 000,214,896 | ---- | M] () [Auto] -- C:\Programme\Motorola\MotoHelper\MotoHelperService.exe -- (MotoHelper)
SRV - [2011/03/21 08:21:24 | 000,632,832 | ---- | M] (Nokia) [On_Demand] -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2006/10/26 14:49:34 | 000,441,136 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2006/10/26 09:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2005/03/04 19:29:14 | 000,061,440 | ---- | M] (Cyberlink) [Auto] -- C:\Programme\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe -- (CyberLink Media Library Service)
SRV - [2005/03/04 19:28:38 | 000,110,691 | ---- | M] () [Auto] -- C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe -- (CLSched) CyberLink Task Scheduler (CTS)
SRV - [2005/03/04 19:28:34 | 000,184,421 | ---- | M] () [Auto] -- C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe -- (CLCapSvc) CyberLink Background Capture Service (CBCS)
SRV - [2004/11/01 11:55:40 | 000,057,344 | ---- | M] ( ) [Auto] -- C:\WINDOWS\System32\slserv.exe -- (SLService)
SRV - [2004/10/21 21:24:18 | 000,073,728 | ---- | M] (Macrovision Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe -- (IDriverT)
SRV - [2004/08/04 08:00:00 | 000,005,632 | ---- | M] (Oak Technology Inc.) [Auto] -- C:\WINDOWS\system32\E1000.dll -- (MREMP50)
SRV - [2003/06/20 03:25:00 | 000,322,120 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe -- (MDM)
SRV - [2002/11/27 07:30:30 | 000,065,536 | R--- | M] (HP) [On_Demand] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)
SRV - [2001/11/12 08:31:48 | 000,020,480 | ---- | M] (X10) [On_Demand] -- C:\Programme\Common Files\X10\Common\X10nets.exe -- (x10nets)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand] --  -- (WDICA)
DRV - File not found [Kernel | On_Demand] --  -- (wanatw) WAN Miniport (ATW)
DRV - File not found [Kernel | On_Demand] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand] --  -- (PDCOMP)
DRV - File not found [Kernel | System] --  -- (PCIDump)
DRV - File not found [Kernel | System] --  -- (lbrtfdc)
DRV - File not found [Kernel | System] --  -- (i2omgmt)
DRV - File not found [Kernel | System] --  -- (Changer)
DRV - [2011/12/08 00:22:36 | 000,132,424 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\sscdmdm.sys -- (sscdmdm)
DRV - [2011/12/08 00:22:36 | 000,104,648 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\sscdbus.sys -- (sscdbus) SAMSUNG USB Composite Device driver (WDM)
DRV - [2011/12/08 00:22:36 | 000,014,920 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\sscdmdfl.sys -- (sscdmdfl)
DRV - [2011/12/08 00:22:26 | 000,136,808 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ssadmdm.sys -- (ssadmdm)
DRV - [2011/12/08 00:22:26 | 000,121,064 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ssadbus.sys -- (ssadbus) SAMSUNG Android USB Composite Device driver (WDM)
DRV - [2011/12/08 00:22:26 | 000,114,280 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ssadserd.sys -- (ssadserd) SAMSUNG Android USB Diagnostic Serial Port (WDM)
DRV - [2011/12/08 00:22:26 | 000,030,312 | ---- | M] (Google Inc) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ssadadb.sys -- (androidusb)
DRV - [2011/12/08 00:22:26 | 000,012,776 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ssadmdfl.sys -- (ssadmdfl) SAMSUNG Android USB Modem (Filter)
DRV - [2011/11/08 07:59:04 | 000,011,008 | ---- | M] (Motorola Inc) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\motusbdevice.sys -- (motusbdevice)
DRV - [2011/05/18 05:12:38 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys -- (UsbserFilt)
DRV - [2011/05/18 05:12:36 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\usbser_lowerflt.sys -- (upperdev)
DRV - [2011/05/18 05:12:32 | 000,023,168 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ccdcmbo.sys -- (nmwcdc)
DRV - [2011/05/18 05:12:28 | 000,018,176 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ccdcmb.sys -- (nmwcd)
DRV - [2011/04/04 09:55:38 | 000,020,480 | ---- | M] (Motorola) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\motccgp.sys -- (motccgp)
DRV - [2011/03/31 09:53:24 | 000,024,064 | ---- | M] (Motorola) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\motmodem.sys -- (motmodem)
DRV - [2010/10/26 08:20:00 | 000,082,380 | ---- | M] (Oak Technology Inc.) [Kernel | System] -- C:\WINDOWS\System32\drivers\AFS2K.SYS -- (AFS2K)
DRV - [2010/04/01 09:31:50 | 000,023,424 | ---- | M] (Motorola) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\Motousbnet.sys -- (Motousbnet)
DRV - [2009/10/15 09:51:41 | 000,027,136 | ---- | M] (NCH Swift Sound) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\nchssvad.sys -- (NCHSSVAD)
DRV - [2009/05/08 06:56:12 | 000,042,752 | ---- | M] (Motorola Inc) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\motodrv.sys -- (MotDev)
DRV - [2009/01/29 12:18:00 | 000,008,320 | ---- | M] (Motorola) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\motccgpfl.sys -- (motccgpfl)
DRV - [2009/01/29 12:11:20 | 000,006,016 | ---- | M] (Motorola Inc) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\motfilt.sys -- (BTCFilterService)
DRV - [2008/08/26 05:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2008/01/22 08:37:40 | 000,715,248 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\sptd.sys -- (sptd)
DRV - [2007/11/02 10:51:30 | 000,006,400 | ---- | M] (Motorola) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\motswch.sys -- (MotoSwitchService)
DRV - [2006/09/18 09:59:08 | 000,090,800 | R--- | M] (MCCI) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\se27unic.sys -- (se27unic) Sony Ericsson Device 039 USB Ethernet Emulation SEMC39 (WDM)
DRV - [2006/09/18 09:59:02 | 000,086,560 | R--- | M] (MCCI) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SE27obex.sys -- (SE27obex)
DRV - [2006/09/18 09:59:00 | 000,018,704 | R--- | M] (MCCI) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\se27nd5.sys -- (se27nd5) Sony Ericsson Device 039 USB Ethernet Emulation SEMC39 (NDIS)
DRV - [2006/09/18 09:58:58 | 000,088,688 | R--- | M] (MCCI) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SE27mgmt.sys -- (SE27mgmt) Sony Ericsson Device 039 USB WMC Device Management Drivers (WDM)
DRV - [2006/09/18 09:58:54 | 000,097,184 | R--- | M] (MCCI) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SE27mdm.sys -- (SE27mdm)
DRV - [2006/09/18 09:58:52 | 000,009,360 | R--- | M] (MCCI) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SE27mdfl.sys -- (SE27mdfl)
DRV - [2006/09/18 09:58:48 | 000,061,600 | R--- | M] (MCCI) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SE27bus.sys -- (SE27bus) Sony Ericsson Device 039 Driver driver (WDM)
DRV - [2006/02/20 12:59:28 | 000,058,288 | R--- | M] (MCCI) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\w810bus.sys -- (w810bus) Sony Ericsson W810 Driver driver (WDM)
DRV - [2005/03/04 03:18:57 | 000,028,352 | ---- | M] (MusicMatch, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\System32\drivers\MxlW2k.sys -- (MxlW2k)
DRV - [2005/03/01 10:13:08 | 001,013,248 | ---- | M] (Animation Technologies Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\LVHybrid.sys -- (LVHybrid)
DRV - [2005/02/25 08:32:34 | 000,003,026 | ---- | M] (Logix4u) [Kernel | System] -- C:\WINDOWS\system32\drivers\hwinterface.sys -- (hwinterface)
DRV - [2005/02/10 19:52:36 | 000,157,056 | ---- | M] (Texas Instruments) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\tifm21.sys -- (tifm21)
DRV - [2005/01/13 09:11:52 | 001,038,336 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\HSF_DPV.sys -- (HSF_DPV)
DRV - [2005/01/13 09:11:04 | 000,172,800 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\HSFHWAZL.sys -- (HSFHWAZL)
DRV - [2005/01/13 09:11:00 | 000,709,504 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2005/01/05 13:48:42 | 000,226,768 | ---- | M] ( ) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SLDRV\slazldrv.sys -- (Slazldrv)
DRV - [2004/12/13 11:42:14 | 002,329,408 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2004/11/29 14:36:22 | 000,399,616 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\btaudio.sys -- (btaudio)
DRV - [2004/11/29 14:34:38 | 000,023,271 | ---- | M] (Broadcom Corporation.) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\btserial.sys -- (BTSERIAL)
DRV - [2004/11/29 14:34:32 | 000,222,876 | ---- | M] (Broadcom Corporation.) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\btslbcsp.sys -- (BTSLBCSP)
DRV - [2004/11/29 14:34:20 | 000,148,040 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\btwdndis.sys -- (BTWDNDIS)
DRV - [2004/11/29 14:33:14 | 001,337,850 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\btkrnl.sys -- (BTKRNL)
DRV - [2004/11/29 14:31:16 | 000,030,299 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\btport.sys -- (BTDriver)
DRV - [2004/11/29 14:30:44 | 000,055,320 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\btwusb.sys -- (BTWUSB)
DRV - [2004/11/01 11:26:38 | 000,014,520 | ---- | M] ( ) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\SLDRV\RecAgent.sys -- (RecAgent)
DRV - [2004/11/01 11:24:02 | 000,229,720 | ---- | M] ( ) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SLDRV\mtlmnt5.sys -- (Mtlmnt5)
DRV - [2004/11/01 11:19:02 | 000,100,176 | ---- | M] ( ) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SLDRV\slnthal.sys -- (SlNtHal)
DRV - [2004/11/01 11:17:28 | 001,396,048 | ---- | M] ( ) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SLDRV\mtlstrm.sys -- (Mtlstrm)
DRV - [2004/11/01 11:07:52 | 000,013,216 | ---- | M] ( ) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SLDRV\slwdmsup.sys -- (SlWdmSup)
DRV - [2004/10/29 13:48:08 | 003,222,784 | ---- | M] (Intel® Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\w29n51.sys -- (w29n51) Intel(R)
DRV - [2004/10/27 02:24:00 | 000,223,104 | ---- | M] (Marvell) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\yk51x86.sys -- (yukonwxp)
DRV - [2004/08/12 12:45:52 | 000,113,664 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\Hdaudio.sys -- (HdAudAddService)
DRV - [2004/08/04 08:00:00 | 000,138,496 | ---- | M] () [Kernel | System] -- C:\WINDOWS\System32\drivers\afd.sys -- (AFD)
DRV - [2004/08/03 18:10:14 | 000,015,360 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\MPE.sys -- (MPE)
DRV - [2004/01/16 08:02:58 | 000,017,408 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\x10ufx2.sys -- (XUIF)
DRV - [2001/08/17 23:35:52 | 000,035,913 | ---- | M] (SMC) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\smcirda.sys -- (SMCIRDA)
DRV - [2001/08/17 07:13:14 | 000,046,108 | ---- | M] (Xircom, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\cben5.sys -- (CBEN5)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.gmx.net/home
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://go.gmx.de/tab2 [binary data]
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://go.gmx.de/tab2 [binary data]
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.gmx.net/home
IE - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie
IE - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.aldi.com
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\Admin_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.gmx.net/home
IE - HKU\Admin_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://go.gmx.de/tab2 [binary data]
IE - HKU\Admin_ON_C\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKU\Admin_ON_C\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKU\Admin_ON_C\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
IE - HKU\Admin_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.gmx.net/
IE - HKU\Admin_ON_C\Software\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKU\Admin_ON_C\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKU\Admin_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Admin_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>;192.168.*.*
 
IE - HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.aldi.com/
IE - HKU\Administrator_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\Alex_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.gmx.net/home
IE - HKU\Alex_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://go.gmx.de/tab2 [binary data]
IE - HKU\Alex_ON_C\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKU\Alex_ON_C\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKU\Alex_ON_C\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
IE - HKU\Alex_ON_C\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://go.gmx.de/tab2 [binary data]
IE - HKU\Alex_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.gmx.net/home
IE - HKU\Alex_ON_C\Software\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKU\Alex_ON_C\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - Reg Error: Key error. File not found
IE - HKU\Alex_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Alex_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>;192.168.*.*
 
IE - HKU\LocalService_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.aldi.com
 
IE - HKU\NetworkService_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.aldi.com
 
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="
FF - prefs.js..browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..browser.startup.homepage: "hxxp://start.icq.com/"
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.0
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.9
FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.9&q="
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa2,version=2.0.0: C:\Programme\Picasa2\npPicasa2.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.69: C:\Programme\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.69: C:\Programme\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.69: C:\Programme\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  
FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Programme\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll ()
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Google\Toolbar for Firefox\{3112ca9c-de6d-4884-a869-9855de68056c} [2008/12/08 14:06:50 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Programme\Real\RealPlayer\browserrecord [2009/03/31 13:10:05 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011/02/03 02:51:36 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.0.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010/01/13 06:01:13 | 000,000,000 | ---D | M]
 
[2008/12/16 13:56:54 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\mozilla\Extensions
[2012/04/18 05:38:31 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\mozilla\Firefox\Profiles\fngy0b90.default\extensions
[2011/01/25 12:20:52 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\mozilla\Firefox\Profiles\fngy0b90.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2011/09/13 04:01:14 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\mozilla\Firefox\Profiles\fngy0b90.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2012/04/12 02:29:17 | 000,001,056 | ---- | M] () -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Mozilla\Firefox\Profiles\fngy0b90.default\searchplugins\icqplugin.xml
[2012/04/18 05:38:31 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2007/07/26 17:20:12 | 000,000,000 | ---D | M] (Google Settings) -- C:\Programme\Mozilla Firefox\extensions\google-cjk@partners.mozilla.com
[2009/03/31 13:10:05 | 000,000,000 | ---D | M] (RealPlayer Browser Record Plugin) -- C:\PROGRAMME\REAL\REALPLAYER\BROWSERRECORD
[2010/09/30 05:07:03 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
[2008/03/15 09:56:14 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2008/03/15 09:56:14 | 000,002,642 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2008/02/19 10:40:48 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2006/12/03 11:59:22 | 000,000,986 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2006/11/17 07:19:24 | 000,000,801 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
 
Hosts file not found
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Programme\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O3 - HKU\Admin_ON_C\..\Toolbar\ShellBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\Admin_ON_C\..\Toolbar\ShellBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.
O3 - HKU\Admin_ON_C\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.
O3 - HKU\Administrator_ON_C\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\Alex_ON_C\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\Alex_ON_C\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [AlcWzrd] C:\WINDOWS\ALCWZRD.EXE (RealTek Semicoductor Corp.)
O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation)
O4 - HKLM..\Run: [High Definition Audio Property Page Shortcut] C:\WINDOWS\System32\Hdaudpropshortcut.exe (Windows (R) Server 2003 DDK provider)
O4 - HKLM..\Run: [KiesTrayAgent] C:\Programme\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKLM..\Run: [NSU_agent] C:\Programme\Nokia\Nokia Software Updater\nsu3ui_agent.exe ()
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe (NVIDIA Corporation)
O4 - HKLM..\Run: [SmartBtn]  File not found
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SoundMan.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [w810MmHk] C:\Programme\Arima\LED Display Utility\w810MmHk.exe (Dritek System Inc.)
O4 - HKU\Admin_ON_C..\Run: [{5B5EB843-7B19-E233-D143-2D61576D7C13}] C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Koyqty\vybyini.exe ()
O4 - HKU\Admin_ON_C..\Run: [KiesHelper] C:\Programme\Samsung\Kies\KiesHelper.exe (Samsung)
O4 - HKU\Admin_ON_C..\Run: [KiesPDLR] C:\Programme\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
O4 - HKU\Administrator_ON_C..\Run: [AOLMIcon]  File not found
O4 - HKU\Alex_ON_C..\Run: [AOLMIcon]  File not found
O4 - HKU\Alex_ON_C..\Run: [swg]  File not found
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\BTTray.lnk = C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Hotkey.lnk = C:\Programme\SmartButton\SmartButton.exe ()
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\hp psc 1000 series.lnk = C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe (Hewlett-Packard Co.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\hpoddt01.exe.lnk = C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe (Hewlett-Packard)
F3 - HKU\Admin_ON_C WinNT: Load - (C:\DOKUME~1\Admin\LOKALE~1\Temp\727C72746874D848CE8C.exe) - C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Temp\727C72746874D848CE8C.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegedit = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Admin_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Admin_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O7 - HKU\Admin_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegedit = 1
O7 - HKU\Administrator_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Alex_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Senden an &Bluetooth - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_01\bin\NPJPI150_01.dll (Sun Microsystems, Inc.)
O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} -  File not found
O9 - Extra 'Tools' menuitem : ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} -  File not found
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000020 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000021 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000022 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000023 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000024 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000025 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000026 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000027 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000028 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000029 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000030 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000031 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000032 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000033 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000034 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000035 -  File not found
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} hxxp://www.apple.com/qtactivex/qtplugin.cab (QuickTime Object)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} hxxp://office.microsoft.com/officeupdate/content/opuc2.cab (Office Update Installation Engine)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1120475842890 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_01-windows-i586.cab (Java Plug-in 1.5.0_01)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {BA162249-F2C5-4851-8ADC-FC58CB424243} hxxp://static.pe.meinvz.net/photouploader/ImageUploader5.cab?nocache=1216052990 (Image Uploader Control)
O16 - DPF: {CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_01-windows-i586.cab (Java Plug-in 1.5.0_01)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\widimg {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - C:\WINDOWS\system32\BTXPPanel.dll (Broadcom Corporation.)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\034045086874D8485230.exe) - C:\WINDOWS\system32\034045086874D8485230.exe ()
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: 
O24 - Desktop BackupWallPaper: 
O27 - HKLM IFEO\msconfig.exe: Debugger - P9KDMF.EXE File not found
O27 - HKLM IFEO\regedit.exe: Debugger - P9KDMF.EXE File not found
O27 - HKLM IFEO\taskmgr.exe: Debugger - P9KDMF.EXE File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/03/03 07:27:57 | 000,000,050 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{67599716-97a1-11d9-bb21-00038a000015}\Shell\AutoRun\command - "" = G:\OEMBranding.exe
O33 - MountPoints2\{7976d6b6-4cfd-11e1-aebe-000e35f49201}\Shell\AutoRun\command - "" = G:\setup.exe
O33 - MountPoints2\{a5cb2279-8704-11d9-b46f-000e35af0cbc}\Shell\AutoRun\command - "" = H:\OEMBranding.exe
O33 - MountPoints2\{a638fed9-2e28-11e0-ae54-000e35f49201}\Shell\AutoRun\command - "" = G:\wubi.exe --cdmenu
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX: {03F998B2-0E00-11D3-A498-00104B6EB52E} - Viewpoint Media Player
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)
ActiveX: {166B1BCA-3F9C-11CF-8075-444553540000} - Macromedia Shockwave Director 10.1
ActiveX: {1B00725B-C455-4DE6-BFB6-AD540AD427CD} - Viewpoint Media Player
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Macromedia Shockwave Director 10.1
ActiveX: {2AD4C07D-E796-4F6A-A707-5DCA28C79D06} - GMX IE7 Browser Update
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
ActiveX: {8b15971b-5355-4c82-8c07-7e181ea07608} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\fxsocm.inf,Fax.Install.PerUser
ActiveX: {8EFA4753-7169-4CC3-A28B-0A1643B8A39B} - Microsoft .NET Framework 1.1 Hotfix (KB886903)
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {94de52c8-2d59-4f1b-883e-79663d2d9a8c} - Fax Provider
ActiveX: {ACC563BC-4266-43f0-B6ED-9D38C4202C7E} - 
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E78BFA60-5393-4C38-82AB-E8019E464EB4} - .NET Framework
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{3B1C7AB8-CB4D-4B5C-B111-6806A5B8769D} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
 
NetSvcs: 6to4 -  File not found
NetSvcs: AppMgmt -  File not found
NetSvcs: HidServ -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: MREMP50 - C:\WINDOWS\system32\E1000.dll (Oak Technology Inc.)
NetSvcs: WmdmPmSp -  File not found
 
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Adobe Reader - Schnellstart.lnk - C:\Programme\Adobe\Reader 8.0\Reader\reader_sl.exe - (Adobe Systems Incorporated)
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Adobe Reader Synchronizer.lnk - C:\Programme\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe - (Adobe Systems Incorporated)
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Google Updater.lnk -  - File not found
MsConfig - StartUpReg: Adobe ARM - hkey= - key= - C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: AOLMIcon - hkey= - key= -  File not found
MsConfig - StartUpReg: DAEMON Tools - hkey= - key= - C:\Programme\DAEMON Tools\daemon.exe (DT Soft Ltd.)
MsConfig - StartUpReg: GMX SMS-Manager - hkey= - key= -  File not found
MsConfig - StartUpReg: Google Desktop Search - hkey= - key= -  File not found
MsConfig - StartUpReg: GrooveMonitor - hkey= - key= - C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation)
MsConfig - StartUpReg: H/PC Connection Agent - hkey= - key= - C:\Programme\Microsoft ActiveSync\WCESCOMM.EXE (Microsoft Corporation)
MsConfig - StartUpReg: ICQ - hkey= - key= -  File not found
MsConfig - StartUpReg: ICQ Lite - hkey= - key= -  File not found
MsConfig - StartUpReg: InstantOn - hkey= - key= - C:\Programme\CyberLink\PowerCinema Linux\ion_install.exe ()
MsConfig - StartUpReg: mmtask - hkey= - key= - C:\Programme\Musicmatch\Musicmatch Jukebox\mmtask.exe (Musicmatch Inc.)
MsConfig - StartUpReg: NBJ - hkey= - key= - C:\Programme\Ahead\Nero BackItUp\NBJ.exe (Ahead Software AG)
MsConfig - StartUpReg: NeroFilterCheck - hkey= - key= -  File not found
MsConfig - StartUpReg: NokiaMServer - hkey= - key= - C:\Programme\Gemeinsame Dateien\Nokia\MPlatform\NokiaMServer.exe (Nokia)
MsConfig - StartUpReg: NokiaMusic FastStart - hkey= - key= - C:\Programme\Nokia\Nokia Music\NokiaMusic.exe (Nokia)
MsConfig - StartUpReg: PCMService - hkey= - key= - C:\Programme\Home Cinema\PowerCinema\PCMService.exe (CyberLink Corp.)
MsConfig - StartUpReg: QuickTime Task - hkey= - key= - C:\Programme\QuickTime\qttask.exe (Apple Inc.)
MsConfig - StartUpReg: Realtime Monitor - hkey= - key= -  File not found
MsConfig - StartUpReg: RemoteControl - hkey= - key= - C:\Programme\Home Cinema\PowerDVD\PDVDServ.exe (Cyberlink Corp.)
MsConfig - StartUpReg: Skype - hkey= - key= - C:\Programme\Skype\Phone\Skype.exe (Skype Technologies S.A.)
MsConfig - StartUpReg: Sony Ericsson PC Suite - hkey= - key= -  File not found
MsConfig - StartUpReg: swg - hkey= - key= -  File not found
MsConfig - StartUpReg: TkBellExe - hkey= - key= - C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
MsConfig - StartUpReg: updateMgr - hkey= - key= -  File not found
MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 0
MsConfig - State: "services" - 0
MsConfig - State: "startup" - 2
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012/04/18 12:24:33 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Alex\Anwendungsdaten\Motorola
[2012/04/18 08:40:01 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\NetworkService\Favoriten
[2012/04/18 08:34:13 | 000,130,048 | ---- | C] (Eugene Roshal & FAR Group) -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MD638EFn.exe
[2012/04/18 03:33:24 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Desktop\Neuer Ordner
[2012/04/18 03:31:50 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\MyFree Codec
[2012/04/18 03:31:46 | 000,000,000 | ---D | C] -- C:\Programme\MyFree Codec
[2012/04/18 03:31:13 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Eigene Dateien\SelfMV
[2012/04/13 01:51:06 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\Sun
[2012/04/13 01:49:28 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\Macromedia
[2012/04/13 01:49:21 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\Adobe
[2012/04/13 01:48:49 | 000,418,464 | ---- | C] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe
[2012/04/13 01:48:49 | 000,070,304 | ---- | C] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2012/04/13 01:37:15 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Koyqty
[2012/04/13 01:37:15 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Azruo
[2005/02/24 15:32:40 | 000,014,976 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\winddx.sys
[2005/02/08 08:40:06 | 000,057,344 | ---- | C] ( ) -- C:\WINDOWS\System32\slserv.exe
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012/04/18 14:14:26 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012/04/18 14:00:44 | 1071,763,456 | -HS- | M] () -- C:\hiberfil.sys
[2012/04/18 13:57:11 | 000,023,055 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2012/04/18 13:40:22 | 000,777,344 | ---- | M] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
[2012/04/18 13:23:54 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2012/04/18 11:43:17 | 000,000,000 | -HS- | M] () -- C:\WINDOWS\System32\dds_trash_log.cmd
[2012/04/18 11:29:58 | 000,058,880 | -H-- | M] () -- C:\WINDOWS\System32\034045086874D8485230.exe
[2012/04/18 08:41:00 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\tasks\At48.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\tasks\At47.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\tasks\At46.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\tasks\At45.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\tasks\At44.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\tasks\At43.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\tasks\At42.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\tasks\At41.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\tasks\At40.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\tasks\At39.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\tasks\At38.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\tasks\At37.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\tasks\At36.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\tasks\At35.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\tasks\At34.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\tasks\At33.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\tasks\At32.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\tasks\At31.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\tasks\At30.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\tasks\At29.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\tasks\At28.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\tasks\At27.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\tasks\At26.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\tasks\At25.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\tasks\At9.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\tasks\At8.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\tasks\At7.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\tasks\At6.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\tasks\At5.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\tasks\At4.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\tasks\At3.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\tasks\At24.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\tasks\At23.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\tasks\At22.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\tasks\At21.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\tasks\At20.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\tasks\At2.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\tasks\At19.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\tasks\At18.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\tasks\At17.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\tasks\At16.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\tasks\At15.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\tasks\At14.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\tasks\At13.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\tasks\At12.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\tasks\At11.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\tasks\At10.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\tasks\At1.job
[2012/04/18 08:34:11 | 000,130,048 | ---- | M] (Eugene Roshal & FAR Group) -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MD638EFn.exe
[2012/04/18 03:31:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\MyFree Codec
[2012/04/18 03:31:23 | 000,048,128 | ---- | M] () -- C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/04/17 05:15:56 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012/04/13 01:48:49 | 000,418,464 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe
[2012/04/13 01:48:49 | 000,070,304 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2012/04/09 13:09:10 | 000,960,056 | ---- | M] () -- C:\WINDOWS\System32\winsh324
[2012/04/09 13:08:36 | 000,960,056 | ---- | M] () -- C:\WINDOWS\System32\winsh323
[2012/04/09 13:08:20 | 000,960,056 | ---- | M] () -- C:\WINDOWS\System32\winsh322
[2012/04/09 13:08:00 | 000,960,056 | ---- | M] () -- C:\WINDOWS\System32\winsh321
[2012/04/09 13:07:42 | 000,960,056 | ---- | M] () -- C:\WINDOWS\System32\winsh320
[2012/03/30 02:38:15 | 087,227,952 | ---- | M] () -- C:\Dokumente und Einstellungen\Admin\Desktop\avira_free_antivirus_898de.exe
[2012/03/30 01:46:55 | 000,465,960 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2012/03/30 01:46:55 | 000,447,744 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012/03/30 01:46:55 | 000,087,512 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2012/03/30 01:46:55 | 000,074,070 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012/04/18 11:30:42 | 000,960,056 | ---- | C] () -- C:\WINDOWS\System32\winsh324
[2012/04/18 11:30:42 | 000,960,056 | ---- | C] () -- C:\WINDOWS\System32\winsh323
[2012/04/18 11:30:42 | 000,960,056 | ---- | C] () -- C:\WINDOWS\System32\winsh322
[2012/04/18 11:30:42 | 000,960,056 | ---- | C] () -- C:\WINDOWS\System32\winsh321
[2012/04/18 11:30:42 | 000,960,056 | ---- | C] () -- C:\WINDOWS\System32\winsh320
[2012/04/18 11:29:58 | 000,058,880 | -H-- | C] () -- C:\WINDOWS\System32\034045086874D8485230.exe
[2012/04/18 08:34:14 | 000,000,430 | ---- | C] () -- C:\WINDOWS\tasks\At48.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | C] () -- C:\WINDOWS\tasks\At47.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | C] () -- C:\WINDOWS\tasks\At46.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | C] () -- C:\WINDOWS\tasks\At45.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | C] () -- C:\WINDOWS\tasks\At44.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | C] () -- C:\WINDOWS\tasks\At43.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | C] () -- C:\WINDOWS\tasks\At42.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | C] () -- C:\WINDOWS\tasks\At41.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | C] () -- C:\WINDOWS\tasks\At40.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | C] () -- C:\WINDOWS\tasks\At39.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | C] () -- C:\WINDOWS\tasks\At38.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | C] () -- C:\WINDOWS\tasks\At37.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | C] () -- C:\WINDOWS\tasks\At36.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | C] () -- C:\WINDOWS\tasks\At35.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | C] () -- C:\WINDOWS\tasks\At34.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | C] () -- C:\WINDOWS\tasks\At33.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | C] () -- C:\WINDOWS\tasks\At32.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | C] () -- C:\WINDOWS\tasks\At31.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | C] () -- C:\WINDOWS\tasks\At30.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | C] () -- C:\WINDOWS\tasks\At29.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | C] () -- C:\WINDOWS\tasks\At28.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | C] () -- C:\WINDOWS\tasks\At27.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | C] () -- C:\WINDOWS\tasks\At26.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | C] () -- C:\WINDOWS\tasks\At25.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | C] () -- C:\WINDOWS\tasks\At9.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | C] () -- C:\WINDOWS\tasks\At8.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | C] () -- C:\WINDOWS\tasks\At7.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | C] () -- C:\WINDOWS\tasks\At6.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | C] () -- C:\WINDOWS\tasks\At5.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | C] () -- C:\WINDOWS\tasks\At4.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | C] () -- C:\WINDOWS\tasks\At3.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | C] () -- C:\WINDOWS\tasks\At24.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | C] () -- C:\WINDOWS\tasks\At23.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | C] () -- C:\WINDOWS\tasks\At22.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | C] () -- C:\WINDOWS\tasks\At21.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | C] () -- C:\WINDOWS\tasks\At20.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | C] () -- C:\WINDOWS\tasks\At2.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | C] () -- C:\WINDOWS\tasks\At19.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | C] () -- C:\WINDOWS\tasks\At18.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | C] () -- C:\WINDOWS\tasks\At17.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | C] () -- C:\WINDOWS\tasks\At16.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | C] () -- C:\WINDOWS\tasks\At15.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | C] () -- C:\WINDOWS\tasks\At14.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | C] () -- C:\WINDOWS\tasks\At13.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | C] () -- C:\WINDOWS\tasks\At12.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | C] () -- C:\WINDOWS\tasks\At11.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | C] () -- C:\WINDOWS\tasks\At10.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | C] () -- C:\WINDOWS\tasks\At1.job
[2012/04/13 01:50:09 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2012/04/13 01:48:50 | 000,000,884 | ---- | C] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/04/13 01:38:09 | 000,000,000 | -HS- | C] () -- C:\WINDOWS\System32\dds_trash_log.cmd
[2012/03/30 02:36:12 | 087,227,952 | ---- | C] () -- C:\Dokumente und Einstellungen\Admin\Desktop\avira_free_antivirus_898de.exe
[2011/12/23 15:58:28 | 000,030,568 | ---- | C] () -- C:\WINDOWS\MusiccityDownload.exe
[2011/12/23 15:58:24 | 000,974,848 | ---- | C] () -- C:\WINDOWS\System32\cis-2.4.dll
[2011/12/23 15:58:24 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\issacapi_bs-2.3.dll
[2011/12/23 15:58:24 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\issacapi_pe-2.3.dll
[2011/12/23 15:58:24 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\issacapi_se-2.3.dll
[2011/01/18 13:51:52 | 001,354,612 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Scan0002.tif
[2011/01/18 13:50:40 | 001,354,636 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Scan0001.tif
[2010/12/01 10:43:22 | 002,631,226 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Sprechtafel Seite 2.tif
[2010/12/01 10:42:19 | 003,148,194 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Sprechtafel Seite 1.tif
[2010/11/29 13:02:32 | 002,259,066 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Verpackungsplan Schongau Seite 2.tif
[2010/11/29 12:59:48 | 002,440,050 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Verpackungsplan Schongau Seite 1.tif
[2010/11/25 07:15:42 | 000,100,330 | -H-- | C] () -- C:\Dokumente und Einstellungen\Administrator\hpothb07.tif
[2010/11/25 07:15:42 | 000,001,120 | -H-- | C] () -- C:\Dokumente und Einstellungen\Administrator\hpothb07.dat
[2010/10/26 08:14:44 | 000,020,724 | ---- | C] () -- C:\WINDOWS\hpoins01.dat
[2010/10/26 08:14:44 | 000,016,622 | ---- | C] () -- C:\WINDOWS\hpomdl01.dat
[2010/10/26 08:13:41 | 000,561,152 | R--- | C] () -- C:\WINDOWS\System32\hpotscl.dll
[2010/09/30 05:06:26 | 000,777,344 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
[2010/01/18 11:15:05 | 000,000,552 | ---- | C] () -- C:\WINDOWS\System32\d3d8caps.dat
[2009/10/06 03:16:02 | 000,819,200 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2009/09/07 06:09:07 | 000,000,533 | ---- | C] () -- C:\WINDOWS\eReg.dat
[2009/06/19 15:06:22 | 000,197,912 | ---- | C] () -- C:\WINDOWS\System32\physxcudart_20.dll
[2009/06/19 15:06:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll
[2009/06/19 15:06:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSwedish.dll
[2009/06/19 15:06:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSpanish.dll
[2009/06/19 15:06:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll
[2009/06/19 15:06:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelPortugese.dll
[2009/06/19 15:06:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelKorean.dll
[2009/06/19 15:06:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelJapanese.dll
[2009/06/19 15:06:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelGerman.dll
[2009/06/19 15:06:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelFrench.dll
[2008/02/24 15:08:50 | 000,000,156 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\wklnhst.dat
[2008/02/24 15:08:34 | 000,005,120 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/02/24 15:08:34 | 000,000,141 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2007/06/04 18:35:00 | 000,000,135 | ---- | C] () -- C:\Dokumente und Einstellungen\Admin\default.pls
[2006/11/10 15:07:33 | 000,000,000 | ---- | C] () -- C:\WINDOWS\muveeapp.INI
[2006/11/06 15:35:59 | 000,000,156 | ---- | C] () -- C:\Dokumente und Einstellungen\Alex\Anwendungsdaten\wklnhst.dat
[2006/11/06 15:35:51 | 000,010,240 | ---- | C] () -- C:\Dokumente und Einstellungen\Alex\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/11/06 15:35:51 | 000,000,141 | ---- | C] () -- C:\Dokumente und Einstellungen\Alex\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2006/11/06 13:06:52 | 000,000,156 | ---- | C] () -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\wklnhst.dat
[2006/11/06 13:06:50 | 000,048,128 | ---- | C] () -- C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/11/06 13:06:50 | 000,000,138 | ---- | C] () -- C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2005/07/04 06:52:03 | 000,000,002 | ---- | C] () -- C:\WINDOWS\msoffice.ini
[2005/03/07 11:42:16 | 000,019,968 | ---- | C] () -- C:\WINDOWS\System32\cpuinf32.dll
[2005/03/04 18:43:09 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2005/03/04 03:11:54 | 000,127,184 | ---- | C] () -- C:\WINDOWS\Unwise.exe
[2005/03/03 07:18:24 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\PsisDecd.dll
[2005/03/03 06:47:59 | 000,003,776 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2005/03/03 06:23:49 | 004,142,932 | ---- | C] () -- C:\WINDOWS\System32\DETour.exe
[2005/02/25 14:21:31 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2005/02/25 13:35:29 | 000,000,008 | RHS- | C] () -- C:\WINDOWS\System32\EBD0FB56AE.sys
[2005/02/25 13:35:28 | 000,004,704 | -HS- | C] () -- C:\WINDOWS\System32\KGyGaAvL.sys
[2005/02/25 11:47:41 | 000,000,375 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2005/02/25 09:21:20 | 000,000,335 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2005/02/25 04:54:04 | 000,000,748 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2005/02/24 17:02:22 | 000,000,024 | ---- | C] () -- C:\WINDOWS\magix.ini
[2005/02/24 17:02:21 | 000,001,208 | ---- | C] () -- C:\WINDOWS\mgxoschk.ini
[2005/02/24 15:32:40 | 000,221,184 | ---- | C] () -- C:\WINDOWS\System32\amr_cpl.dll
[2005/02/24 15:32:39 | 000,540,672 | ---- | C] () -- C:\WINDOWS\System32\SLLights.dll
[2005/02/24 15:32:39 | 000,380,928 | ---- | C] () -- C:\WINDOWS\System32\slmh.exe
[2005/02/24 15:32:39 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\minirec.exe
[2005/02/24 15:32:39 | 000,151,552 | ---- | C] () -- C:\WINDOWS\System32\SLMOHServ.dll
[2005/02/24 15:32:39 | 000,077,824 | ---- | C] () -- C:\WINDOWS\SmCfg.exe
[2005/02/24 15:14:32 | 000,156,672 | ---- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll
[2005/02/24 15:14:32 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\ChCfg.exe
[2005/02/24 14:51:33 | 000,000,863 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2005/02/24 14:40:50 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2005/02/24 14:37:08 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2005/02/24 14:31:33 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2005/02/24 14:30:42 | 000,337,056 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2005/02/24 14:15:16 | 000,001,256 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2005/02/24 14:15:11 | 000,465,960 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2005/02/24 14:15:11 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2005/02/24 14:15:11 | 000,087,512 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2005/02/24 14:15:11 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2005/02/24 14:15:03 | 000,447,744 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2005/02/24 14:15:03 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2005/02/24 14:15:03 | 000,074,070 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2005/02/24 14:15:03 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2005/02/24 14:15:03 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2005/02/24 14:15:02 | 000,004,518 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2005/02/24 14:15:01 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2005/02/24 14:15:01 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2005/02/24 14:14:59 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2005/02/24 14:14:59 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2005/02/24 14:14:56 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2005/02/24 14:14:53 | 000,001,788 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2005/02/24 14:14:52 | 000,138,496 | ---- | C] () -- C:\WINDOWS\System32\drivers\afd.sys
[2005/02/08 08:40:06 | 000,212,992 | ---- | C] () -- C:\WINDOWS\System32\slextspk.dll
[2005/02/08 08:40:06 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\SLGen.dll
[2005/02/08 08:40:06 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\slcoinst.dll
[2005/02/08 08:40:06 | 000,036,864 | ---- | C] () -- C:\WINDOWS\slrundll.exe
[2004/11/29 14:44:04 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\btprn2k.dll
[2004/09/28 17:54:30 | 003,375,104 | ---- | C] () -- C:\WINDOWS\System32\qt-mt331.dll
[2004/01/14 03:46:34 | 000,172,032 | ---- | C] () -- C:\WINDOWS\System32\tifmicon.dll
[2003/02/27 05:07:20 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\34CoInstaller.dll
[2001/11/14 07:56:00 | 001,802,240 | ---- | C] () -- C:\WINDOWS\System32\lcppn21.dll
 
========== LOP Check ==========
 
[2009/10/15 14:29:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\X10 Commander
[2012/04/18 03:25:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Azruo
[2009/10/14 07:50:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\DAEMON Tools
[2011/11/13 17:29:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\ICQ
[2007/01/10 11:43:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\ICQ Toolbar
[2006/11/18 06:37:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\ICQLite
[2012/04/13 01:37:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Koyqty
[2012/02/01 13:55:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Motorola
[2011/11/14 13:18:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\NCH Swift Sound
[2010/09/30 05:22:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Nokia
[2010/10/19 07:46:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Nseries
[2011/05/01 13:51:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\PC Suite
[2012/01/08 08:14:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Samsung
[2007/05/11 01:55:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Teleca
[2012/01/08 09:15:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Temp
[2006/11/19 08:55:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Alex\Anwendungsdaten\ICQ Toolbar
[2006/11/19 08:56:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Alex\Anwendungsdaten\ICQLite
[2006/12/26 11:56:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Alex\Anwendungsdaten\MAGIX
[2012/04/18 12:24:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Alex\Anwendungsdaten\Motorola
[2007/05/24 04:10:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Alex\Anwendungsdaten\Teleca
[2005/03/04 03:20:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\X10 Commander
[2008/12/02 15:13:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\GMX
[2011/09/13 04:01:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ICQ
[2012/01/08 07:12:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Installations
[2005/03/03 07:27:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\muvee Technologies
[2010/06/25 03:15:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NCH Swift Sound
[2012/01/08 07:17:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Nokia
[2010/09/30 02:45:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NokiaInstallerCache
[2010/09/30 05:19:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NokiaMusic
[2010/09/30 02:58:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Suite
[2012/01/08 08:11:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Samsung
[2009/10/14 07:38:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
[2005/02/25 09:22:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Viewpoint
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\Tasks\At1.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\Tasks\At10.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\Tasks\At11.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\Tasks\At12.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\Tasks\At13.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\Tasks\At14.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\Tasks\At15.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\Tasks\At16.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\Tasks\At17.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\Tasks\At18.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\Tasks\At19.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\Tasks\At2.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\Tasks\At20.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\Tasks\At21.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\Tasks\At22.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\Tasks\At23.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\Tasks\At24.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\Tasks\At25.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\Tasks\At26.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\Tasks\At27.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\Tasks\At28.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\Tasks\At29.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\Tasks\At3.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\Tasks\At30.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\Tasks\At31.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\Tasks\At32.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\Tasks\At33.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\Tasks\At34.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\Tasks\At35.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\Tasks\At36.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\Tasks\At37.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\Tasks\At38.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\Tasks\At39.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\Tasks\At4.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\Tasks\At40.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\Tasks\At41.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\Tasks\At42.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\Tasks\At43.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\Tasks\At44.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\Tasks\At45.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\Tasks\At46.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\Tasks\At47.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\Tasks\At48.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\Tasks\At5.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\Tasks\At6.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\Tasks\At7.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\Tasks\At8.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\Tasks\At9.job
[2011/05/06 09:01:15 | 000,000,334 | ---- | M] () -- C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1288095618.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2010/09/30 05:04:55 | 000,000,000 | ---D | M] -- C:\09c260d5d12643e3eeae
[2012/02/01 13:55:57 | 000,000,000 | -HSD | M] -- C:\Config.Msi
[2008/02/24 15:08:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen
[2008/01/15 08:16:12 | 000,000,000 | ---D | M] -- C:\Eigene Dateien
[2008/01/15 07:47:41 | 000,000,000 | RH-D | M] -- C:\MSOCache
[2005/02/25 09:22:31 | 000,000,000 | ---D | M] -- C:\My Music
[2012/02/01 13:54:42 | 000,000,000 | ---D | M] -- C:\Program Files
[2012/04/18 03:31:46 | 000,000,000 | R--D | M] -- C:\Programme
[2006/12/20 02:37:46 | 000,000,000 | -HSD | M] -- C:\RECYCLER
[2012/04/18 11:32:43 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2012/04/18 13:57:07 | 000,000,000 | ---D | M] -- C:\Temp
[2008/11/26 08:20:56 | 000,000,000 | ---D | M] -- C:\TMP
[2012/04/13 01:37:17 | 000,000,000 | ---D | M] -- C:\WINDOWS
 
< %PROGRAMFILES%\*.exe >
 
Invalid Environment Variable: %LOCALAPPDATA%\*.exe
 
< %systemroot%\*. /mp /s >
 
 
< MD5 for: AGP440.SYS  >
[2004/08/04 08:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2004/08/04 08:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp2.cab:AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2004/08/04 08:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2004/08/04 08:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp2.cab:atapi.sys
[2004/08/03 17:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\dllcache\atapi.sys
[2004/08/03 17:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004/08/03 17:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\i386\atapi.sys
 
< MD5 for: EVENTLOG.DLL  >
[2004/08/04 08:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- C:\WINDOWS\system32\dllcache\eventlog.dll
[2004/08/04 08:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- C:\WINDOWS\system32\eventlog.dll
 
< MD5 for: EXPLORER.EXE  >
[2004/08/04 08:00:00 | 001,035,264 | ---- | M] (Microsoft Corporation) MD5=22FE1BE02EADDE1632E478E4125639E0 -- C:\WINDOWS\explorer.exe
[2004/08/04 08:00:00 | 001,035,264 | ---- | M] (Microsoft Corporation) MD5=22FE1BE02EADDE1632E478E4125639E0 -- C:\WINDOWS\system32\dllcache\explorer.exe
 
< MD5 for: NETLOGON.DLL  >
[2004/08/04 08:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D27395EDCD3416AFD125A9370DCB585C -- C:\WINDOWS\system32\dllcache\netlogon.dll
[2004/08/04 08:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D27395EDCD3416AFD125A9370DCB585C -- C:\WINDOWS\system32\netlogon.dll
 
< MD5 for: SCECLI.DLL  >
[2004/08/04 08:00:00 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- C:\WINDOWS\system32\dllcache\scecli.dll
[2004/08/04 08:00:00 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- C:\WINDOWS\system32\scecli.dll
 
< MD5 for: USER32.DLL  >
[2005/03/02 14:09:46 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=3751D7CF0E0A113D84414992146BCE6A -- C:\WINDOWS\system32\dllcache\user32.dll
[2005/03/02 14:09:46 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=3751D7CF0E0A113D84414992146BCE6A -- C:\WINDOWS\system32\user32.dll
[2005/03/02 14:19:56 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=4C90159A69A5FD3EB39C71411F28FCFF -- C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll
[2004/08/04 08:00:00 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=56785FD5236D7B22CF471A6DA9DB46D8 -- C:\WINDOWS\$NtUninstallKB890859$\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2004/08/04 08:00:00 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\system32\dllcache\userinit.exe
[2004/08/04 08:00:00 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\system32\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2004/08/04 08:00:00 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\system32\dllcache\winlogon.exe
[2004/08/04 08:00:00 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\system32\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2004/08/04 08:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys
[2004/08/04 08:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2005/02/24 15:20:09 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav
[2005/02/24 15:20:08 | 000,638,976 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav
[2005/02/24 15:20:08 | 000,438,272 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav
 
< %systemroot%\system32\*.dll /lockedfiles >
[2004/08/04 08:00:00 | 000,148,480 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\dnsapi.dll
[2008/10/03 12:58:14 | 006,066,176 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\ieframe.dll
[2008/08/26 03:57:18 | 000,267,776 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\iertutil.dll
[2004/08/04 08:00:00 | 000,280,064 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\mstask.dll
[2004/08/04 08:00:00 | 000,067,072 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\ntdsapi.dll
[2004/08/04 08:00:00 | 000,023,040 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\psapi.dll
[2005/02/28 19:11:50 | 008,491,008 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\shell32.dll
[4 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]
 
Invalid Environment Variable: %USERPROFILE%\*.*
 
Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.exe
 
Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.dll
 
Invalid Environment Variable: %USERPROFILE%\Application Data\*.exe
 
 
========== Hard Links - Junction Points - Mount Points - Symbolic Links ==========
[C:\WINDOWS\$NtUninstallKB62591$] ->  -> Unknown point type
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 104 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:DFC5A2B2
< End of report >

--- --- ---

markusg · 18.04.2012, 20:08

hi
auf deinem zweiten pc gehe auf start, programme zubehör editor, kopiere dort
rein:

Code:

ATTFilter

:OTL
O4 - HKU\Admin_ON_C..\Run: [{5B5EB843-7B19-E233-D143-2D61576D7C13}] C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Koyqty\vybyini.exe ()
F3 - HKU\Admin_ON_C WinNT: Load - (C:\DOKUME~1\Admin\LOKALE~1\Temp\727C72746874D848CE8C.exe) - C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Temp\727C72746874D848CE8C.exe
()
:Files
C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Koyqty
C:\DOKUME~1\Admin\LOKALE~1\Temp\727C72746874D848CE8C.exe
C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Sun\Java\Deployment\cache
:Commands
[Reboot]

dieses speicherst du auf nem usb stick als fix.txt
nutze nun wieder OTLPENet.exe (starte also von der erstellten cd) und hake alles an, wie es bereits im post zu OTLPENet.exe beschrieben ist.
• Klicke nun bitte auf den Fix Button.
es sollte nun eine meldung ähnlich dieser: "load fix from file" erscheinen, lade also die fix.txt von deinem stick.
wenn dies nicht funktioniert, bitte den fix manuell eintragen.
dann klicke erneut den fix buton. pc startet evtl. neu. wenn ja, nimm die cd aus dem laufwerk, windows sollte nun normal starten und die otl.txt öffnen,
log posten bitte.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang
in den Thread posten!

Drücke bitte die

+ E Taste.

Öffne dein Systemlaufwerk ( meistens C: )
Suche nun
folgenden Ordner: _OTL und öffne diesen.
Mache einen Rechtsklick auf den Ordner Movedfiles --> Senden an --> Zip-Komprimierter Ordner
Dies wird eine Movedfiles.zip Datei in _OTL erstellen
Lade diese bitte in unseren Uploadchannel
hoch. ( Durchsuchen --> C:\_OTL\Movedfiles.zip )

Teile mir mit ob der Upload problemlos geklappt hat. Danke im voraus

dixdiver · 18.04.2012, 20:34

Hi,

nach dem Fix Run fragt der Rechner nach nem Neustart. Ich klicke ja, aber dann passiert nix...

markusg · 18.04.2012, 20:36

drück mal reset, nimm die cd raus und gucke wie weit du kommst.

dixdiver · 18.04.2012, 20:40

Nach Neustart ohne Cd, erscheint wieder das Fenster mit den bekannten daten. Wenn ich runterfahre kommt kurz wieder die XP Oberfläche...

Alles so wie vorher

markusg · 18.04.2012, 20:41

führe den fix erneut aus, wenn das nicht klappt, erstelle ein neues log

dixdiver · 18.04.2012, 21:00

fix erneut ausgeführt. neustart klappt nicht. bleibt im OTLPE Fenster stehen.

Hab den Fix nochmals ausgeführt. Neustart klappt immer noch nicht. lass jetzt den Scan nochmals laufen um ein neues log zu bekommen, poste ich dann hier.

Hier nun das Neue Log File:OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 4/19/2012 1:03:48 AM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 2 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,022.00 Mb Total Physical Memory | 792.00 Mb Available Physical Memory | 77.00% Memory free
906.00 Mb Paging File | 839.00 Mb Available in Paging File | 93.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 46.29 Gb Total Space | 11.87 Gb Free Space | 25.64% Space Free | Partition Type: NTFS
Drive D: | 36.88 Gb Total Space | 8.91 Gb Free Space | 24.16% Space Free | Partition Type: NTFS
Drive E: | 9.97 Gb Total Space | 7.32 Gb Free Space | 73.39% Space Free | Partition Type: FAT32
Drive F: | 3.76 Gb Total Space | 0.80 Gb Free Space | 21.23% Space Free | Partition Type: FAT32
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Disabled] --  -- (HidServ)
SRV - File not found [On_Demand] --  -- (AppMgmt)
SRV - [2012/04/13 01:48:49 | 000,253,088 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2011/12/06 17:00:14 | 000,214,896 | ---- | M] () [Auto] -- C:\Programme\Motorola\MotoHelper\MotoHelperService.exe -- (MotoHelper)
SRV - [2011/03/21 08:21:24 | 000,632,832 | ---- | M] (Nokia) [On_Demand] -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2006/10/26 14:49:34 | 000,441,136 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2006/10/26 09:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2005/03/04 19:29:14 | 000,061,440 | ---- | M] (Cyberlink) [Auto] -- C:\Programme\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe -- (CyberLink Media Library Service)
SRV - [2005/03/04 19:28:38 | 000,110,691 | ---- | M] () [Auto] -- C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe -- (CLSched) CyberLink Task Scheduler (CTS)
SRV - [2005/03/04 19:28:34 | 000,184,421 | ---- | M] () [Auto] -- C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe -- (CLCapSvc) CyberLink Background Capture Service (CBCS)
SRV - [2004/11/01 11:55:40 | 000,057,344 | ---- | M] ( ) [Auto] -- C:\WINDOWS\System32\slserv.exe -- (SLService)
SRV - [2004/10/21 21:24:18 | 000,073,728 | ---- | M] (Macrovision Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe -- (IDriverT)
SRV - [2004/08/04 08:00:00 | 000,005,632 | ---- | M] (Oak Technology Inc.) [Auto] -- C:\WINDOWS\system32\E1000.dll -- (MREMP50)
SRV - [2003/06/20 03:25:00 | 000,322,120 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe -- (MDM)
SRV - [2002/11/27 07:30:30 | 000,065,536 | R--- | M] (HP) [On_Demand] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)
SRV - [2001/11/12 08:31:48 | 000,020,480 | ---- | M] (X10) [On_Demand] -- C:\Programme\Common Files\X10\Common\X10nets.exe -- (x10nets)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand] --  -- (WDICA)
DRV - File not found [Kernel | On_Demand] --  -- (wanatw) WAN Miniport (ATW)
DRV - File not found [Kernel | On_Demand] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand] --  -- (PDCOMP)
DRV - File not found [Kernel | System] --  -- (PCIDump)
DRV - File not found [Kernel | System] --  -- (lbrtfdc)
DRV - File not found [Kernel | System] --  -- (i2omgmt)
DRV - File not found [Kernel | System] --  -- (Changer)
DRV - [2011/12/08 00:22:36 | 000,132,424 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\sscdmdm.sys -- (sscdmdm)
DRV - [2011/12/08 00:22:36 | 000,104,648 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\sscdbus.sys -- (sscdbus) SAMSUNG USB Composite Device driver (WDM)
DRV - [2011/12/08 00:22:36 | 000,014,920 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\sscdmdfl.sys -- (sscdmdfl)
DRV - [2011/12/08 00:22:26 | 000,136,808 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ssadmdm.sys -- (ssadmdm)
DRV - [2011/12/08 00:22:26 | 000,121,064 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ssadbus.sys -- (ssadbus) SAMSUNG Android USB Composite Device driver (WDM)
DRV - [2011/12/08 00:22:26 | 000,114,280 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ssadserd.sys -- (ssadserd) SAMSUNG Android USB Diagnostic Serial Port (WDM)
DRV - [2011/12/08 00:22:26 | 000,030,312 | ---- | M] (Google Inc) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ssadadb.sys -- (androidusb)
DRV - [2011/12/08 00:22:26 | 000,012,776 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ssadmdfl.sys -- (ssadmdfl) SAMSUNG Android USB Modem (Filter)
DRV - [2011/11/08 07:59:04 | 000,011,008 | ---- | M] (Motorola Inc) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\motusbdevice.sys -- (motusbdevice)
DRV - [2011/05/18 05:12:38 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys -- (UsbserFilt)
DRV - [2011/05/18 05:12:36 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\usbser_lowerflt.sys -- (upperdev)
DRV - [2011/05/18 05:12:32 | 000,023,168 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ccdcmbo.sys -- (nmwcdc)
DRV - [2011/05/18 05:12:28 | 000,018,176 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ccdcmb.sys -- (nmwcd)
DRV - [2011/04/04 09:55:38 | 000,020,480 | ---- | M] (Motorola) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\motccgp.sys -- (motccgp)
DRV - [2011/03/31 09:53:24 | 000,024,064 | ---- | M] (Motorola) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\motmodem.sys -- (motmodem)
DRV - [2010/10/26 08:20:00 | 000,082,380 | ---- | M] (Oak Technology Inc.) [Kernel | System] -- C:\WINDOWS\System32\drivers\AFS2K.SYS -- (AFS2K)
DRV - [2010/04/01 09:31:50 | 000,023,424 | ---- | M] (Motorola) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\Motousbnet.sys -- (Motousbnet)
DRV - [2009/10/15 09:51:41 | 000,027,136 | ---- | M] (NCH Swift Sound) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\nchssvad.sys -- (NCHSSVAD)
DRV - [2009/05/08 06:56:12 | 000,042,752 | ---- | M] (Motorola Inc) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\motodrv.sys -- (MotDev)
DRV - [2009/01/29 12:18:00 | 000,008,320 | ---- | M] (Motorola) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\motccgpfl.sys -- (motccgpfl)
DRV - [2009/01/29 12:11:20 | 000,006,016 | ---- | M] (Motorola Inc) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\motfilt.sys -- (BTCFilterService)
DRV - [2008/08/26 05:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2008/01/22 08:37:40 | 000,715,248 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\sptd.sys -- (sptd)
DRV - [2007/11/02 10:51:30 | 000,006,400 | ---- | M] (Motorola) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\motswch.sys -- (MotoSwitchService)
DRV - [2006/09/18 09:59:08 | 000,090,800 | R--- | M] (MCCI) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\se27unic.sys -- (se27unic) Sony Ericsson Device 039 USB Ethernet Emulation SEMC39 (WDM)
DRV - [2006/09/18 09:59:02 | 000,086,560 | R--- | M] (MCCI) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SE27obex.sys -- (SE27obex)
DRV - [2006/09/18 09:59:00 | 000,018,704 | R--- | M] (MCCI) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\se27nd5.sys -- (se27nd5) Sony Ericsson Device 039 USB Ethernet Emulation SEMC39 (NDIS)
DRV - [2006/09/18 09:58:58 | 000,088,688 | R--- | M] (MCCI) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SE27mgmt.sys -- (SE27mgmt) Sony Ericsson Device 039 USB WMC Device Management Drivers (WDM)
DRV - [2006/09/18 09:58:54 | 000,097,184 | R--- | M] (MCCI) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SE27mdm.sys -- (SE27mdm)
DRV - [2006/09/18 09:58:52 | 000,009,360 | R--- | M] (MCCI) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SE27mdfl.sys -- (SE27mdfl)
DRV - [2006/09/18 09:58:48 | 000,061,600 | R--- | M] (MCCI) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SE27bus.sys -- (SE27bus) Sony Ericsson Device 039 Driver driver (WDM)
DRV - [2006/02/20 12:59:28 | 000,058,288 | R--- | M] (MCCI) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\w810bus.sys -- (w810bus) Sony Ericsson W810 Driver driver (WDM)
DRV - [2005/03/04 03:18:57 | 000,028,352 | ---- | M] (MusicMatch, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\System32\drivers\MxlW2k.sys -- (MxlW2k)
DRV - [2005/03/01 10:13:08 | 001,013,248 | ---- | M] (Animation Technologies Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\LVHybrid.sys -- (LVHybrid)
DRV - [2005/02/25 08:32:34 | 000,003,026 | ---- | M] (Logix4u) [Kernel | System] -- C:\WINDOWS\system32\drivers\hwinterface.sys -- (hwinterface)
DRV - [2005/02/15 13:15:44 | 000,011,008 | ---- | M] (Dritek System Inc.) [Kernel | Disabled] -- C:\Programme\Arima\LED Display Utility\DPortIO.sys -- (DritekPortIO)
DRV - [2005/02/10 19:52:36 | 000,157,056 | ---- | M] (Texas Instruments) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\tifm21.sys -- (tifm21)
DRV - [2005/01/13 09:11:52 | 001,038,336 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\HSF_DPV.sys -- (HSF_DPV)
DRV - [2005/01/13 09:11:04 | 000,172,800 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\HSFHWAZL.sys -- (HSFHWAZL)
DRV - [2005/01/13 09:11:00 | 000,709,504 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2005/01/05 13:48:42 | 000,226,768 | ---- | M] ( ) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SLDRV\slazldrv.sys -- (Slazldrv)
DRV - [2004/12/13 11:42:14 | 002,329,408 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2004/11/29 14:36:22 | 000,399,616 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\btaudio.sys -- (btaudio)
DRV - [2004/11/29 14:34:38 | 000,023,271 | ---- | M] (Broadcom Corporation.) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\btserial.sys -- (BTSERIAL)
DRV - [2004/11/29 14:34:32 | 000,222,876 | ---- | M] (Broadcom Corporation.) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\btslbcsp.sys -- (BTSLBCSP)
DRV - [2004/11/29 14:34:20 | 000,148,040 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\btwdndis.sys -- (BTWDNDIS)
DRV - [2004/11/29 14:33:14 | 001,337,850 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\btkrnl.sys -- (BTKRNL)
DRV - [2004/11/29 14:31:16 | 000,030,299 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\btport.sys -- (BTDriver)
DRV - [2004/11/29 14:30:44 | 000,055,320 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\btwusb.sys -- (BTWUSB)
DRV - [2004/11/01 11:26:38 | 000,014,520 | ---- | M] ( ) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\SLDRV\RecAgent.sys -- (RecAgent)
DRV - [2004/11/01 11:24:02 | 000,229,720 | ---- | M] ( ) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SLDRV\mtlmnt5.sys -- (Mtlmnt5)
DRV - [2004/11/01 11:19:02 | 000,100,176 | ---- | M] ( ) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SLDRV\slnthal.sys -- (SlNtHal)
DRV - [2004/11/01 11:17:28 | 001,396,048 | ---- | M] ( ) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SLDRV\mtlstrm.sys -- (Mtlstrm)
DRV - [2004/11/01 11:07:52 | 000,013,216 | ---- | M] ( ) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SLDRV\slwdmsup.sys -- (SlWdmSup)
DRV - [2004/10/29 13:48:08 | 003,222,784 | ---- | M] (Intel® Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\w29n51.sys -- (w29n51) Intel(R)
DRV - [2004/10/27 02:24:00 | 000,223,104 | ---- | M] (Marvell) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\yk51x86.sys -- (yukonwxp)
DRV - [2004/08/12 12:45:52 | 000,113,664 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\Hdaudio.sys -- (HdAudAddService)
DRV - [2004/08/04 08:00:00 | 000,138,496 | ---- | M] () [Kernel | System] -- C:\WINDOWS\System32\drivers\afd.sys -- (AFD)
DRV - [2004/08/03 18:10:14 | 000,015,360 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\MPE.sys -- (MPE)
DRV - [2004/01/16 08:02:58 | 000,017,408 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\x10ufx2.sys -- (XUIF)
DRV - [2001/08/17 23:35:52 | 000,035,913 | ---- | M] (SMC) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\smcirda.sys -- (SMCIRDA)
DRV - [2001/08/17 07:13:14 | 000,046,108 | ---- | M] (Xircom, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\cben5.sys -- (CBEN5)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.gmx.net/home
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://go.gmx.de/tab2 [binary data]
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://go.gmx.de/tab2 [binary data]
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.gmx.net/home
IE - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie
IE - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.aldi.com
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\Admin_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.gmx.net/home
IE - HKU\Admin_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://go.gmx.de/tab2 [binary data]
IE - HKU\Admin_ON_C\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKU\Admin_ON_C\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKU\Admin_ON_C\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
IE - HKU\Admin_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.gmx.net/
IE - HKU\Admin_ON_C\Software\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKU\Admin_ON_C\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKU\Admin_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Admin_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>;192.168.*.*
 
IE - HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.aldi.com/
IE - HKU\Administrator_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\Alex_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.gmx.net/home
IE - HKU\Alex_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://go.gmx.de/tab2 [binary data]
IE - HKU\Alex_ON_C\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKU\Alex_ON_C\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKU\Alex_ON_C\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
IE - HKU\Alex_ON_C\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://go.gmx.de/tab2 [binary data]
IE - HKU\Alex_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.gmx.net/home
IE - HKU\Alex_ON_C\Software\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKU\Alex_ON_C\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - Reg Error: Key error. File not found
IE - HKU\Alex_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Alex_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>;192.168.*.*
 
IE - HKU\LocalService_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.aldi.com
 
IE - HKU\NetworkService_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.aldi.com
 
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="
FF - prefs.js..browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..browser.startup.homepage: "hxxp://start.icq.com/"
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.0
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.9
FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.9&q="
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa2,version=2.0.0: C:\Programme\Picasa2\npPicasa2.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.69: C:\Programme\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.69: C:\Programme\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.69: C:\Programme\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  
FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Programme\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll ()
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Google\Toolbar for Firefox\{3112ca9c-de6d-4884-a869-9855de68056c} [2008/12/08 14:06:50 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Programme\Real\RealPlayer\browserrecord [2009/03/31 13:10:05 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011/02/03 02:51:36 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.0.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010/01/13 06:01:13 | 000,000,000 | ---D | M]
 
[2008/12/16 13:56:54 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\mozilla\Extensions
[2012/04/18 05:38:31 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\mozilla\Firefox\Profiles\fngy0b90.default\extensions
[2011/01/25 12:20:52 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\mozilla\Firefox\Profiles\fngy0b90.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2011/09/13 04:01:14 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\mozilla\Firefox\Profiles\fngy0b90.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2012/04/12 02:29:17 | 000,001,056 | ---- | M] () -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Mozilla\Firefox\Profiles\fngy0b90.default\searchplugins\icqplugin.xml
[2012/04/18 05:38:31 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2007/07/26 17:20:12 | 000,000,000 | ---D | M] (Google Settings) -- C:\Programme\Mozilla Firefox\extensions\google-cjk@partners.mozilla.com
[2009/03/31 13:10:05 | 000,000,000 | ---D | M] (RealPlayer Browser Record Plugin) -- C:\PROGRAMME\REAL\REALPLAYER\BROWSERRECORD
[2010/09/30 05:07:03 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
[2008/03/15 09:56:14 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2008/03/15 09:56:14 | 000,002,642 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2008/02/19 10:40:48 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2006/12/03 11:59:22 | 000,000,986 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2006/11/17 07:19:24 | 000,000,801 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
 
Hosts file not found
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Programme\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O3 - HKU\Admin_ON_C\..\Toolbar\ShellBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\Admin_ON_C\..\Toolbar\ShellBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.
O3 - HKU\Admin_ON_C\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.
O3 - HKU\Administrator_ON_C\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\Alex_ON_C\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\Alex_ON_C\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [AlcWzrd] C:\WINDOWS\ALCWZRD.EXE (RealTek Semicoductor Corp.)
O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation)
O4 - HKLM..\Run: [High Definition Audio Property Page Shortcut] C:\WINDOWS\System32\Hdaudpropshortcut.exe (Windows (R) Server 2003 DDK provider)
O4 - HKLM..\Run: [KiesTrayAgent] C:\Programme\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKLM..\Run: [NSU_agent] C:\Programme\Nokia\Nokia Software Updater\nsu3ui_agent.exe ()
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe (NVIDIA Corporation)
O4 - HKLM..\Run: [SmartBtn]  File not found
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SoundMan.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [w810MmHk] C:\Programme\Arima\LED Display Utility\w810MmHk.exe (Dritek System Inc.)
O4 - HKU\Admin_ON_C..\Run: [KiesHelper] C:\Programme\Samsung\Kies\KiesHelper.exe (Samsung)
O4 - HKU\Admin_ON_C..\Run: [KiesPDLR] C:\Programme\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
O4 - HKU\Administrator_ON_C..\Run: [AOLMIcon]  File not found
O4 - HKU\Alex_ON_C..\Run: [AOLMIcon]  File not found
O4 - HKU\Alex_ON_C..\Run: [swg]  File not found
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\BTTray.lnk = C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Hotkey.lnk = C:\Programme\SmartButton\SmartButton.exe ()
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\hp psc 1000 series.lnk = C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe (Hewlett-Packard Co.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\hpoddt01.exe.lnk = C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe (Hewlett-Packard)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegedit = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Admin_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Admin_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O7 - HKU\Admin_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegedit = 1
O7 - HKU\Administrator_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Alex_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Senden an &Bluetooth - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_01\bin\NPJPI150_01.dll (Sun Microsystems, Inc.)
O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} -  File not found
O9 - Extra 'Tools' menuitem : ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} -  File not found
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000020 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000021 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000022 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000023 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000024 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000025 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000026 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000027 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000028 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000029 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000030 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000031 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000032 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000033 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000034 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000035 -  File not found
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} hxxp://www.apple.com/qtactivex/qtplugin.cab (QuickTime Object)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} hxxp://office.microsoft.com/officeupdate/content/opuc2.cab (Office Update Installation Engine)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1120475842890 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_01-windows-i586.cab (Java Plug-in 1.5.0_01)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {BA162249-F2C5-4851-8ADC-FC58CB424243} hxxp://static.pe.meinvz.net/photouploader/ImageUploader5.cab?nocache=1216052990 (Image Uploader Control)
O16 - DPF: {CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_01-windows-i586.cab (Java Plug-in 1.5.0_01)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\widimg {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - C:\WINDOWS\system32\BTXPPanel.dll (Broadcom Corporation.)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\034045086874D8485230.exe) - C:\WINDOWS\system32\034045086874D8485230.exe ()
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: 
O24 - Desktop BackupWallPaper: 
O27 - HKLM IFEO\msconfig.exe: Debugger - P9KDMF.EXE File not found
O27 - HKLM IFEO\regedit.exe: Debugger - P9KDMF.EXE File not found
O27 - HKLM IFEO\taskmgr.exe: Debugger - P9KDMF.EXE File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/03/03 07:27:57 | 000,000,050 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{67599716-97a1-11d9-bb21-00038a000015}\Shell\AutoRun\command - "" = G:\OEMBranding.exe
O33 - MountPoints2\{7976d6b6-4cfd-11e1-aebe-000e35f49201}\Shell\AutoRun\command - "" = G:\setup.exe
O33 - MountPoints2\{a5cb2279-8704-11d9-b46f-000e35af0cbc}\Shell\AutoRun\command - "" = H:\OEMBranding.exe
O33 - MountPoints2\{a638fed9-2e28-11e0-ae54-000e35f49201}\Shell\AutoRun\command - "" = G:\wubi.exe --cdmenu
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX: {03F998B2-0E00-11D3-A498-00104B6EB52E} - Viewpoint Media Player
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)
ActiveX: {166B1BCA-3F9C-11CF-8075-444553540000} - Macromedia Shockwave Director 10.1
ActiveX: {1B00725B-C455-4DE6-BFB6-AD540AD427CD} - Viewpoint Media Player
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Macromedia Shockwave Director 10.1
ActiveX: {2AD4C07D-E796-4F6A-A707-5DCA28C79D06} - GMX IE7 Browser Update
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
ActiveX: {8b15971b-5355-4c82-8c07-7e181ea07608} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\fxsocm.inf,Fax.Install.PerUser
ActiveX: {8EFA4753-7169-4CC3-A28B-0A1643B8A39B} - Microsoft .NET Framework 1.1 Hotfix (KB886903)
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {94de52c8-2d59-4f1b-883e-79663d2d9a8c} - Fax Provider
ActiveX: {ACC563BC-4266-43f0-B6ED-9D38C4202C7E} - 
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E78BFA60-5393-4C38-82AB-E8019E464EB4} - .NET Framework
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{3B1C7AB8-CB4D-4B5C-B111-6806A5B8769D} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
 
NetSvcs: 6to4 -  File not found
NetSvcs: AppMgmt -  File not found
NetSvcs: HidServ -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: MREMP50 - C:\WINDOWS\system32\E1000.dll (Oak Technology Inc.)
NetSvcs: WmdmPmSp -  File not found
 
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Adobe Reader - Schnellstart.lnk - C:\Programme\Adobe\Reader 8.0\Reader\reader_sl.exe - (Adobe Systems Incorporated)
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Adobe Reader Synchronizer.lnk - C:\Programme\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe - (Adobe Systems Incorporated)
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Google Updater.lnk -  - File not found
MsConfig - StartUpReg: Adobe ARM - hkey= - key= - C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: AOLMIcon - hkey= - key= -  File not found
MsConfig - StartUpReg: DAEMON Tools - hkey= - key= - C:\Programme\DAEMON Tools\daemon.exe (DT Soft Ltd.)
MsConfig - StartUpReg: GMX SMS-Manager - hkey= - key= -  File not found
MsConfig - StartUpReg: Google Desktop Search - hkey= - key= -  File not found
MsConfig - StartUpReg: GrooveMonitor - hkey= - key= - C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation)
MsConfig - StartUpReg: H/PC Connection Agent - hkey= - key= - C:\Programme\Microsoft ActiveSync\WCESCOMM.EXE (Microsoft Corporation)
MsConfig - StartUpReg: ICQ - hkey= - key= -  File not found
MsConfig - StartUpReg: ICQ Lite - hkey= - key= -  File not found
MsConfig - StartUpReg: InstantOn - hkey= - key= - C:\Programme\CyberLink\PowerCinema Linux\ion_install.exe ()
MsConfig - StartUpReg: mmtask - hkey= - key= - C:\Programme\Musicmatch\Musicmatch Jukebox\mmtask.exe (Musicmatch Inc.)
MsConfig - StartUpReg: NBJ - hkey= - key= - C:\Programme\Ahead\Nero BackItUp\NBJ.exe (Ahead Software AG)
MsConfig - StartUpReg: NeroFilterCheck - hkey= - key= -  File not found
MsConfig - StartUpReg: NokiaMServer - hkey= - key= - C:\Programme\Gemeinsame Dateien\Nokia\MPlatform\NokiaMServer.exe (Nokia)
MsConfig - StartUpReg: NokiaMusic FastStart - hkey= - key= - C:\Programme\Nokia\Nokia Music\NokiaMusic.exe (Nokia)
MsConfig - StartUpReg: PCMService - hkey= - key= - C:\Programme\Home Cinema\PowerCinema\PCMService.exe (CyberLink Corp.)
MsConfig - StartUpReg: QuickTime Task - hkey= - key= - C:\Programme\QuickTime\qttask.exe (Apple Inc.)
MsConfig - StartUpReg: Realtime Monitor - hkey= - key= -  File not found
MsConfig - StartUpReg: RemoteControl - hkey= - key= - C:\Programme\Home Cinema\PowerDVD\PDVDServ.exe (Cyberlink Corp.)
MsConfig - StartUpReg: Skype - hkey= - key= - C:\Programme\Skype\Phone\Skype.exe (Skype Technologies S.A.)
MsConfig - StartUpReg: Sony Ericsson PC Suite - hkey= - key= -  File not found
MsConfig - StartUpReg: swg - hkey= - key= -  File not found
MsConfig - StartUpReg: TkBellExe - hkey= - key= - C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
MsConfig - StartUpReg: updateMgr - hkey= - key= -  File not found
MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 0
MsConfig - State: "services" - 0
MsConfig - State: "startup" - 2
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012/04/18 22:16:26 | 002,237,440 | R--- | C] (OldTimer Tools) -- C:\OTLPE.exe
[2012/04/18 22:16:23 | 000,000,000 | ---D | C] -- C:\_OTL
[2012/04/18 12:24:33 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Alex\Anwendungsdaten\Motorola
[2012/04/18 08:40:01 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\NetworkService\Favoriten
[2012/04/18 08:34:13 | 000,130,048 | ---- | C] (Eugene Roshal & FAR Group) -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MD638EFn.exe
[2012/04/18 03:33:24 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Desktop\Neuer Ordner
[2012/04/18 03:31:50 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\MyFree Codec
[2012/04/18 03:31:46 | 000,000,000 | ---D | C] -- C:\Programme\MyFree Codec
[2012/04/18 03:31:13 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Eigene Dateien\SelfMV
[2012/04/13 01:51:06 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\Sun
[2012/04/13 01:49:28 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\Macromedia
[2012/04/13 01:49:21 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\Adobe
[2012/04/13 01:48:49 | 000,418,464 | ---- | C] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe
[2012/04/13 01:48:49 | 000,070,304 | ---- | C] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2012/04/13 01:37:15 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Azruo
[2005/02/24 15:32:40 | 000,014,976 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\winddx.sys
[2005/02/08 08:40:06 | 000,057,344 | ---- | C] ( ) -- C:\WINDOWS\System32\slserv.exe
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012/04/18 17:45:59 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012/04/18 17:45:57 | 000,777,344 | ---- | M] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
[2012/04/18 17:41:15 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/04/18 17:40:03 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2012/04/18 17:39:27 | 000,023,055 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2012/04/18 17:39:02 | 1071,763,456 | -HS- | M] () -- C:\hiberfil.sys
[2012/04/18 11:43:17 | 000,000,000 | -HS- | M] () -- C:\WINDOWS\System32\dds_trash_log.cmd
[2012/04/18 11:29:58 | 000,058,880 | -H-- | M] () -- C:\WINDOWS\System32\034045086874D8485230.exe
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\tasks\At48.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\tasks\At47.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\tasks\At46.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\tasks\At45.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\tasks\At44.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\tasks\At43.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\tasks\At42.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\tasks\At41.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\tasks\At40.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\tasks\At39.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\tasks\At38.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\tasks\At37.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\tasks\At36.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\tasks\At35.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\tasks\At34.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\tasks\At33.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\tasks\At32.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\tasks\At31.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\tasks\At30.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\tasks\At29.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\tasks\At28.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\tasks\At27.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\tasks\At26.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\tasks\At25.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\tasks\At9.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\tasks\At8.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\tasks\At7.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\tasks\At6.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\tasks\At5.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\tasks\At4.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\tasks\At3.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\tasks\At24.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\tasks\At23.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\tasks\At22.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\tasks\At21.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\tasks\At20.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\tasks\At2.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\tasks\At19.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\tasks\At18.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\tasks\At17.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\tasks\At16.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\tasks\At15.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\tasks\At14.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\tasks\At13.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\tasks\At12.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\tasks\At11.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\tasks\At10.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\tasks\At1.job
[2012/04/18 08:34:11 | 000,130,048 | ---- | M] (Eugene Roshal & FAR Group) -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MD638EFn.exe
[2012/04/18 03:31:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\MyFree Codec
[2012/04/18 03:31:23 | 000,048,128 | ---- | M] () -- C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/04/17 05:15:56 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012/04/13 01:48:49 | 000,418,464 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe
[2012/04/13 01:48:49 | 000,070,304 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2012/04/09 13:09:10 | 000,960,056 | ---- | M] () -- C:\WINDOWS\System32\winsh324
[2012/04/09 13:08:36 | 000,960,056 | ---- | M] () -- C:\WINDOWS\System32\winsh323
[2012/04/09 13:08:20 | 000,960,056 | ---- | M] () -- C:\WINDOWS\System32\winsh322
[2012/04/09 13:08:00 | 000,960,056 | ---- | M] () -- C:\WINDOWS\System32\winsh321
[2012/04/09 13:07:42 | 000,960,056 | ---- | M] () -- C:\WINDOWS\System32\winsh320
[2012/03/30 02:38:15 | 087,227,952 | ---- | M] () -- C:\Dokumente und Einstellungen\Admin\Desktop\avira_free_antivirus_898de.exe
[2012/03/30 01:46:55 | 000,465,960 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2012/03/30 01:46:55 | 000,447,744 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012/03/30 01:46:55 | 000,087,512 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2012/03/30 01:46:55 | 000,074,070 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012/04/18 11:30:42 | 000,960,056 | ---- | C] () -- C:\WINDOWS\System32\winsh324
[2012/04/18 11:30:42 | 000,960,056 | ---- | C] () -- C:\WINDOWS\System32\winsh323
[2012/04/18 11:30:42 | 000,960,056 | ---- | C] () -- C:\WINDOWS\System32\winsh322
[2012/04/18 11:30:42 | 000,960,056 | ---- | C] () -- C:\WINDOWS\System32\winsh321
[2012/04/18 11:30:42 | 000,960,056 | ---- | C] () -- C:\WINDOWS\System32\winsh320
[2012/04/18 11:29:58 | 000,058,880 | -H-- | C] () -- C:\WINDOWS\System32\034045086874D8485230.exe
[2012/04/18 08:34:14 | 000,000,430 | ---- | C] () -- C:\WINDOWS\tasks\At48.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | C] () -- C:\WINDOWS\tasks\At47.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | C] () -- C:\WINDOWS\tasks\At46.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | C] () -- C:\WINDOWS\tasks\At45.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | C] () -- C:\WINDOWS\tasks\At44.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | C] () -- C:\WINDOWS\tasks\At43.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | C] () -- C:\WINDOWS\tasks\At42.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | C] () -- C:\WINDOWS\tasks\At41.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | C] () -- C:\WINDOWS\tasks\At40.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | C] () -- C:\WINDOWS\tasks\At39.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | C] () -- C:\WINDOWS\tasks\At38.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | C] () -- C:\WINDOWS\tasks\At37.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | C] () -- C:\WINDOWS\tasks\At36.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | C] () -- C:\WINDOWS\tasks\At35.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | C] () -- C:\WINDOWS\tasks\At34.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | C] () -- C:\WINDOWS\tasks\At33.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | C] () -- C:\WINDOWS\tasks\At32.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | C] () -- C:\WINDOWS\tasks\At31.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | C] () -- C:\WINDOWS\tasks\At30.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | C] () -- C:\WINDOWS\tasks\At29.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | C] () -- C:\WINDOWS\tasks\At28.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | C] () -- C:\WINDOWS\tasks\At27.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | C] () -- C:\WINDOWS\tasks\At26.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | C] () -- C:\WINDOWS\tasks\At25.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | C] () -- C:\WINDOWS\tasks\At9.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | C] () -- C:\WINDOWS\tasks\At8.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | C] () -- C:\WINDOWS\tasks\At7.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | C] () -- C:\WINDOWS\tasks\At6.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | C] () -- C:\WINDOWS\tasks\At5.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | C] () -- C:\WINDOWS\tasks\At4.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | C] () -- C:\WINDOWS\tasks\At3.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | C] () -- C:\WINDOWS\tasks\At24.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | C] () -- C:\WINDOWS\tasks\At23.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | C] () -- C:\WINDOWS\tasks\At22.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | C] () -- C:\WINDOWS\tasks\At21.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | C] () -- C:\WINDOWS\tasks\At20.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | C] () -- C:\WINDOWS\tasks\At2.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | C] () -- C:\WINDOWS\tasks\At19.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | C] () -- C:\WINDOWS\tasks\At18.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | C] () -- C:\WINDOWS\tasks\At17.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | C] () -- C:\WINDOWS\tasks\At16.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | C] () -- C:\WINDOWS\tasks\At15.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | C] () -- C:\WINDOWS\tasks\At14.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | C] () -- C:\WINDOWS\tasks\At13.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | C] () -- C:\WINDOWS\tasks\At12.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | C] () -- C:\WINDOWS\tasks\At11.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | C] () -- C:\WINDOWS\tasks\At10.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | C] () -- C:\WINDOWS\tasks\At1.job
[2012/04/13 01:50:09 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2012/04/13 01:48:50 | 000,000,884 | ---- | C] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/04/13 01:38:09 | 000,000,000 | -HS- | C] () -- C:\WINDOWS\System32\dds_trash_log.cmd
[2012/03/30 02:36:12 | 087,227,952 | ---- | C] () -- C:\Dokumente und Einstellungen\Admin\Desktop\avira_free_antivirus_898de.exe
[2011/12/23 15:58:28 | 000,030,568 | ---- | C] () -- C:\WINDOWS\MusiccityDownload.exe
[2011/12/23 15:58:24 | 000,974,848 | ---- | C] () -- C:\WINDOWS\System32\cis-2.4.dll
[2011/12/23 15:58:24 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\issacapi_bs-2.3.dll
[2011/12/23 15:58:24 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\issacapi_pe-2.3.dll
[2011/12/23 15:58:24 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\issacapi_se-2.3.dll
[2011/01/18 13:51:52 | 001,354,612 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Scan0002.tif
[2011/01/18 13:50:40 | 001,354,636 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Scan0001.tif
[2010/12/01 10:43:22 | 002,631,226 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Sprechtafel Seite 2.tif
[2010/12/01 10:42:19 | 003,148,194 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Sprechtafel Seite 1.tif
[2010/11/29 13:02:32 | 002,259,066 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Verpackungsplan Schongau Seite 2.tif
[2010/11/29 12:59:48 | 002,440,050 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Verpackungsplan Schongau Seite 1.tif
[2010/11/25 07:15:42 | 000,100,330 | -H-- | C] () -- C:\Dokumente und Einstellungen\Administrator\hpothb07.tif
[2010/11/25 07:15:42 | 000,001,120 | -H-- | C] () -- C:\Dokumente und Einstellungen\Administrator\hpothb07.dat
[2010/10/26 08:14:44 | 000,020,724 | ---- | C] () -- C:\WINDOWS\hpoins01.dat
[2010/10/26 08:14:44 | 000,016,622 | ---- | C] () -- C:\WINDOWS\hpomdl01.dat
[2010/10/26 08:13:41 | 000,561,152 | R--- | C] () -- C:\WINDOWS\System32\hpotscl.dll
[2010/09/30 05:06:26 | 000,777,344 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
[2010/01/18 11:15:05 | 000,000,552 | ---- | C] () -- C:\WINDOWS\System32\d3d8caps.dat
[2009/10/06 03:16:02 | 000,819,200 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2009/09/07 06:09:07 | 000,000,533 | ---- | C] () -- C:\WINDOWS\eReg.dat
[2009/06/19 15:06:22 | 000,197,912 | ---- | C] () -- C:\WINDOWS\System32\physxcudart_20.dll
[2009/06/19 15:06:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll
[2009/06/19 15:06:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSwedish.dll
[2009/06/19 15:06:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSpanish.dll
[2009/06/19 15:06:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll
[2009/06/19 15:06:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelPortugese.dll
[2009/06/19 15:06:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelKorean.dll
[2009/06/19 15:06:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelJapanese.dll
[2009/06/19 15:06:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelGerman.dll
[2009/06/19 15:06:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelFrench.dll
[2008/02/24 15:08:50 | 000,000,156 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\wklnhst.dat
[2008/02/24 15:08:34 | 000,005,120 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/02/24 15:08:34 | 000,000,141 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2007/06/04 18:35:00 | 000,000,135 | ---- | C] () -- C:\Dokumente und Einstellungen\Admin\default.pls
[2006/11/10 15:07:33 | 000,000,000 | ---- | C] () -- C:\WINDOWS\muveeapp.INI
[2006/11/06 15:35:59 | 000,000,156 | ---- | C] () -- C:\Dokumente und Einstellungen\Alex\Anwendungsdaten\wklnhst.dat
[2006/11/06 15:35:51 | 000,010,240 | ---- | C] () -- C:\Dokumente und Einstellungen\Alex\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/11/06 15:35:51 | 000,000,141 | ---- | C] () -- C:\Dokumente und Einstellungen\Alex\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2006/11/06 13:06:52 | 000,000,156 | ---- | C] () -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\wklnhst.dat
[2006/11/06 13:06:50 | 000,048,128 | ---- | C] () -- C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/11/06 13:06:50 | 000,000,138 | ---- | C] () -- C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2005/07/04 06:52:03 | 000,000,002 | ---- | C] () -- C:\WINDOWS\msoffice.ini
[2005/03/07 11:42:16 | 000,019,968 | ---- | C] () -- C:\WINDOWS\System32\cpuinf32.dll
[2005/03/04 18:43:09 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2005/03/04 03:11:54 | 000,127,184 | ---- | C] () -- C:\WINDOWS\Unwise.exe
[2005/03/03 07:18:24 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\PsisDecd.dll
[2005/03/03 06:47:59 | 000,003,776 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2005/03/03 06:23:49 | 004,142,932 | ---- | C] () -- C:\WINDOWS\System32\DETour.exe
[2005/02/25 14:21:31 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2005/02/25 13:35:29 | 000,000,008 | RHS- | C] () -- C:\WINDOWS\System32\EBD0FB56AE.sys
[2005/02/25 13:35:28 | 000,004,704 | -HS- | C] () -- C:\WINDOWS\System32\KGyGaAvL.sys
[2005/02/25 11:47:41 | 000,000,375 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2005/02/25 09:21:20 | 000,000,335 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2005/02/25 04:54:04 | 000,000,748 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2005/02/24 17:02:22 | 000,000,024 | ---- | C] () -- C:\WINDOWS\magix.ini
[2005/02/24 17:02:21 | 000,001,208 | ---- | C] () -- C:\WINDOWS\mgxoschk.ini
[2005/02/24 15:32:40 | 000,221,184 | ---- | C] () -- C:\WINDOWS\System32\amr_cpl.dll
[2005/02/24 15:32:39 | 000,540,672 | ---- | C] () -- C:\WINDOWS\System32\SLLights.dll
[2005/02/24 15:32:39 | 000,380,928 | ---- | C] () -- C:\WINDOWS\System32\slmh.exe
[2005/02/24 15:32:39 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\minirec.exe
[2005/02/24 15:32:39 | 000,151,552 | ---- | C] () -- C:\WINDOWS\System32\SLMOHServ.dll
[2005/02/24 15:32:39 | 000,077,824 | ---- | C] () -- C:\WINDOWS\SmCfg.exe
[2005/02/24 15:14:32 | 000,156,672 | ---- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll
[2005/02/24 15:14:32 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\ChCfg.exe
[2005/02/24 14:51:33 | 000,000,863 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2005/02/24 14:40:50 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2005/02/24 14:37:08 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2005/02/24 14:31:33 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2005/02/24 14:30:42 | 000,337,056 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2005/02/24 14:15:16 | 000,001,256 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2005/02/24 14:15:11 | 000,465,960 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2005/02/24 14:15:11 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2005/02/24 14:15:11 | 000,087,512 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2005/02/24 14:15:11 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2005/02/24 14:15:03 | 000,447,744 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2005/02/24 14:15:03 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2005/02/24 14:15:03 | 000,074,070 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2005/02/24 14:15:03 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2005/02/24 14:15:03 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2005/02/24 14:15:02 | 000,004,518 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2005/02/24 14:15:01 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2005/02/24 14:15:01 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2005/02/24 14:14:59 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2005/02/24 14:14:59 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2005/02/24 14:14:56 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2005/02/24 14:14:53 | 000,001,788 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2005/02/24 14:14:52 | 000,138,496 | ---- | C] () -- C:\WINDOWS\System32\drivers\afd.sys
[2005/02/08 08:40:06 | 000,212,992 | ---- | C] () -- C:\WINDOWS\System32\slextspk.dll
[2005/02/08 08:40:06 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\SLGen.dll
[2005/02/08 08:40:06 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\slcoinst.dll
[2005/02/08 08:40:06 | 000,036,864 | ---- | C] () -- C:\WINDOWS\slrundll.exe
[2004/11/29 14:44:04 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\btprn2k.dll
[2004/09/28 17:54:30 | 003,375,104 | ---- | C] () -- C:\WINDOWS\System32\qt-mt331.dll
[2004/01/14 03:46:34 | 000,172,032 | ---- | C] () -- C:\WINDOWS\System32\tifmicon.dll
[2003/02/27 05:07:20 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\34CoInstaller.dll
[2001/11/14 07:56:00 | 001,802,240 | ---- | C] () -- C:\WINDOWS\System32\lcppn21.dll
 
========== LOP Check ==========
 
[2009/10/15 14:29:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\X10 Commander
[2012/04/18 03:25:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Azruo
[2009/10/14 07:50:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\DAEMON Tools
[2011/11/13 17:29:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\ICQ
[2007/01/10 11:43:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\ICQ Toolbar
[2006/11/18 06:37:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\ICQLite
[2012/02/01 13:55:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Motorola
[2011/11/14 13:18:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\NCH Swift Sound
[2010/09/30 05:22:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Nokia
[2010/10/19 07:46:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Nseries
[2011/05/01 13:51:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\PC Suite
[2012/01/08 08:14:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Samsung
[2007/05/11 01:55:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Teleca
[2012/01/08 09:15:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Temp
[2006/11/19 08:55:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Alex\Anwendungsdaten\ICQ Toolbar
[2006/11/19 08:56:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Alex\Anwendungsdaten\ICQLite
[2006/12/26 11:56:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Alex\Anwendungsdaten\MAGIX
[2012/04/18 12:24:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Alex\Anwendungsdaten\Motorola
[2007/05/24 04:10:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Alex\Anwendungsdaten\Teleca
[2005/03/04 03:20:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\X10 Commander
[2008/12/02 15:13:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\GMX
[2011/09/13 04:01:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ICQ
[2012/01/08 07:12:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Installations
[2005/03/03 07:27:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\muvee Technologies
[2010/06/25 03:15:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NCH Swift Sound
[2012/01/08 07:17:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Nokia
[2010/09/30 02:45:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NokiaInstallerCache
[2010/09/30 05:19:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NokiaMusic
[2010/09/30 02:58:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Suite
[2012/01/08 08:11:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Samsung
[2009/10/14 07:38:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
[2005/02/25 09:22:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Viewpoint
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\Tasks\At1.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\Tasks\At10.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\Tasks\At11.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\Tasks\At12.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\Tasks\At13.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\Tasks\At14.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\Tasks\At15.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\Tasks\At16.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\Tasks\At17.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\Tasks\At18.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\Tasks\At19.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\Tasks\At2.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\Tasks\At20.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\Tasks\At21.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\Tasks\At22.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\Tasks\At23.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\Tasks\At24.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\Tasks\At25.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\Tasks\At26.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\Tasks\At27.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\Tasks\At28.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\Tasks\At29.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\Tasks\At3.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\Tasks\At30.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\Tasks\At31.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\Tasks\At32.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\Tasks\At33.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\Tasks\At34.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\Tasks\At35.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\Tasks\At36.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\Tasks\At37.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\Tasks\At38.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\Tasks\At39.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\Tasks\At4.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\Tasks\At40.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\Tasks\At41.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\Tasks\At42.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\Tasks\At43.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\Tasks\At44.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\Tasks\At45.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\Tasks\At46.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\Tasks\At47.job
[2012/04/18 08:34:14 | 000,000,430 | ---- | M] () -- C:\WINDOWS\Tasks\At48.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\Tasks\At5.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\Tasks\At6.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\Tasks\At7.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\Tasks\At8.job
[2012/04/18 08:34:14 | 000,000,428 | ---- | M] () -- C:\WINDOWS\Tasks\At9.job
[2011/05/06 09:01:15 | 000,000,334 | ---- | M] () -- C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1288095618.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2010/09/30 05:04:55 | 000,000,000 | ---D | M] -- C:\09c260d5d12643e3eeae
[2012/02/01 13:55:57 | 000,000,000 | -HSD | M] -- C:\Config.Msi
[2008/02/24 15:08:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen
[2008/01/15 08:16:12 | 000,000,000 | ---D | M] -- C:\Eigene Dateien
[2008/01/15 07:47:41 | 000,000,000 | RH-D | M] -- C:\MSOCache
[2005/02/25 09:22:31 | 000,000,000 | ---D | M] -- C:\My Music
[2012/02/01 13:54:42 | 000,000,000 | ---D | M] -- C:\Program Files
[2012/04/18 03:31:46 | 000,000,000 | R--D | M] -- C:\Programme
[2006/12/20 02:37:46 | 000,000,000 | -HSD | M] -- C:\RECYCLER
[2012/04/18 11:32:43 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2012/04/18 17:39:27 | 000,000,000 | ---D | M] -- C:\Temp
[2008/11/26 08:20:56 | 000,000,000 | ---D | M] -- C:\TMP
[2012/04/13 01:37:17 | 000,000,000 | ---D | M] -- C:\WINDOWS
[2012/04/18 22:16:23 | 000,000,000 | ---D | M] -- C:\_OTL
 
< %PROGRAMFILES%\*.exe >
 
Invalid Environment Variable: %LOCALAPPDATA%\*.exe
 
< %systemroot%\*. /mp /s >
 
 
< MD5 for: AGP440.SYS  >
[2004/08/04 08:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2004/08/04 08:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp2.cab:AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2004/08/04 08:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2004/08/04 08:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp2.cab:atapi.sys
[2004/08/03 17:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\dllcache\atapi.sys
[2004/08/03 17:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004/08/03 17:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\i386\atapi.sys
 
< MD5 for: EVENTLOG.DLL  >
[2004/08/04 08:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- C:\WINDOWS\system32\dllcache\eventlog.dll
[2004/08/04 08:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- C:\WINDOWS\system32\eventlog.dll
 
< MD5 for: EXPLORER.EXE  >
[2004/08/04 08:00:00 | 001,035,264 | ---- | M] (Microsoft Corporation) MD5=22FE1BE02EADDE1632E478E4125639E0 -- C:\WINDOWS\explorer.exe
[2004/08/04 08:00:00 | 001,035,264 | ---- | M] (Microsoft Corporation) MD5=22FE1BE02EADDE1632E478E4125639E0 -- C:\WINDOWS\system32\dllcache\explorer.exe
 
< MD5 for: NETLOGON.DLL  >
[2004/08/04 08:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D27395EDCD3416AFD125A9370DCB585C -- C:\WINDOWS\system32\dllcache\netlogon.dll
[2004/08/04 08:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D27395EDCD3416AFD125A9370DCB585C -- C:\WINDOWS\system32\netlogon.dll
 
< MD5 for: SCECLI.DLL  >
[2004/08/04 08:00:00 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- C:\WINDOWS\system32\dllcache\scecli.dll
[2004/08/04 08:00:00 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- C:\WINDOWS\system32\scecli.dll
 
< MD5 for: USER32.DLL  >
[2005/03/02 14:09:46 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=3751D7CF0E0A113D84414992146BCE6A -- C:\WINDOWS\system32\dllcache\user32.dll
[2005/03/02 14:09:46 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=3751D7CF0E0A113D84414992146BCE6A -- C:\WINDOWS\system32\user32.dll
[2005/03/02 14:19:56 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=4C90159A69A5FD3EB39C71411F28FCFF -- C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll
[2004/08/04 08:00:00 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=56785FD5236D7B22CF471A6DA9DB46D8 -- C:\WINDOWS\$NtUninstallKB890859$\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2004/08/04 08:00:00 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\system32\dllcache\userinit.exe
[2004/08/04 08:00:00 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\system32\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2004/08/04 08:00:00 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\system32\dllcache\winlogon.exe
[2004/08/04 08:00:00 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\system32\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2004/08/04 08:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys
[2004/08/04 08:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2005/02/24 15:20:09 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav
[2005/02/24 15:20:08 | 000,638,976 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav
[2005/02/24 15:20:08 | 000,438,272 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav
 
< %systemroot%\system32\*.dll /lockedfiles >
[2004/08/04 08:00:00 | 000,148,480 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\dnsapi.dll
[2008/10/03 12:58:14 | 006,066,176 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\ieframe.dll
[2008/08/26 03:57:18 | 000,267,776 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\iertutil.dll
[2004/08/04 08:00:00 | 000,280,064 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\mstask.dll
[2004/08/04 08:00:00 | 000,067,072 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\ntdsapi.dll
[2004/08/04 08:00:00 | 000,023,040 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\psapi.dll
[2005/02/28 19:11:50 | 008,491,008 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\shell32.dll
[4 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]
 
Invalid Environment Variable: %USERPROFILE%\*.*
 
Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.exe
 
Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.dll
 
Invalid Environment Variable: %USERPROFILE%\Application Data\*.exe
 
 
========== Hard Links - Junction Points - Mount Points - Symbolic Links ==========
[C:\WINDOWS\$NtUninstallKB62591$] ->  -> Unknown point type
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 104 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:DFC5A2B2
< End of report >

--- --- ---

markusg · 19.04.2012, 10:34

teste mal, ob du mit f8 bei neustart den abgesicherten modus mit eingabeaufforderung wählen kannst.

dixdiver · 19.04.2012, 10:45

Ja, über F8 geht er in die Aufforderung Abgesicherter Modus

zur Auswahl stehen: - Abgesicherter Modus
- Abgesicherter Modus mit Netzwerktreibern
- Abgesicherter Modus mit Eingabeaufforderung

Alex

markusg · 19.04.2012, 10:49

gehe in den abges.modus mit eingabeaufforderung.
wenn er funktioniert, kopierst du combofix, was gleich als anleitung kommt, auf nen stick, schließt den stick an das infizierte gerät, schreibst:
d:\combofix.exe
enter
falls das nicht geht:
e:\combofix.exe
enter
bis du das richtige laufwerk hast.
dann, falls nen aktieves antivirus programm angezeigt wird, klicke ok.
wenn cf fertig ist, in den normalen modus starten, log posten.

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Downloade dir bitte Combofix von einem dieser Downloadspiegel

Link 1
Link 2

WICHTIG - Speichere Combofix auf deinem Desktop

Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

dixdiver · 19.04.2012, 10:53

selbst im abgesicherten Modus kommt der Trojaner hoch und blockt den Rechner :-(

Schwarzer bildschirm mit Fenster dass ich angeblich Kinderpornographie auf dem Rechner habe...

Plagegeister aller Art und deren Bekämpfung: Schwarzer bildschirm mit Fenster dass ich angeblich Kinderpornographie auf dem Rechner habe...