Trojaner / Malware ? Mail Account hat Spam Mails verschickt

28missi · 01.06.2012, 12:37

Hallo Zusammen!

Bin langsam verzweifelt. Hatte mir einen Trojaner eingefangen Rootkit.gen
Hatte dann auch noch worm32. Habe alles entfernt. Hatte damals Avira laufen. Habe jetzt auf Zone Alarm gewechselt in der Hoffnung mit einer guten Firewall mir erst gar keine neuen Bedrohungen einzufangen.
Nun hat mein Mail Account bei web.de letzte Nacht Spam Mails verschickt.
Waren die alten doch noch aktiv? Warum hat Zone Alarm nichts gefunden?

hier die Log DatenOTL Logfile:

Code:

ATTFilter

OTL logfile created on: 01.06.2012 09:05:00 - Run 1
OTL by OldTimer - Version 3.2.45.0 Folder = C:\Dokumente und Einstellungen\test\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,24 Gb Total Physical Memory | 0,80 Gb Available Physical Memory | 64,26% Memory free
1,83 Gb Paging File | 1,37 Gb Available in Paging File | 74,61% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 37,25 Gb Total Space | 24,82 Gb Free Space | 66,63% Space Free | Partition Type: NTFS
 
Computer Name: TEST-101EE4A811 | User Name: test | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.06.01 09:04:26 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\test\Desktop\OTL.exe
PRC - [2011.08.10 13:53:16 | 002,419,592 | ---- | M] (Check Point Software Technologies LTD) -- C:\Programme\CheckPoint\ZoneAlarm\vsmon.exe
PRC - [2011.08.10 13:31:08 | 000,072,848 | ---- | M] (Check Point Software Technologies LTD) -- C:\Programme\CheckPoint\ZoneAlarm\zatray.exe
PRC - [2011.07.25 15:00:58 | 000,493,184 | ---- | M] (Check Point Software Technologies) -- C:\Programme\CheckPoint\ZAForceField\ISWSVC.exe
PRC - [2011.07.25 15:00:56 | 000,738,944 | ---- | M] (Check Point Software Technologies) -- C:\Programme\CheckPoint\ZAForceField\ForceField.exe
PRC - [2011.07.22 09:49:26 | 000,511,920 | ---- | M] (REINER SCT) -- C:\WINDOWS\system32\cjpcsc.exe
PRC - [2011.06.09 14:06:06 | 000,254,696 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
PRC - [2010.02.18 17:44:15 | 000,202,256 | ---- | M] (RealNetworks, Inc.) -- C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
PRC - [2008.04.14 14:00:00 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2006.03.03 21:03:10 | 000,069,632 | ---- | M] (HP) -- C:\WINDOWS\system32\HPZipm12.exe
PRC - [2003.09.08 15:48:26 | 000,065,536 | ---- | M] () -- C:\Programme\Launch Manager\WButton.exe
PRC - [2003.09.04 15:46:02 | 000,040,960 | ---- | M] (Wistron) -- C:\Programme\Launch Manager\HotkeyApp.exe
PRC - [2003.06.25 10:53:30 | 000,204,800 | ---- | M] (Wistron) -- C:\Programme\Launch Manager\OSD.exe
PRC - [2003.05.12 14:28:50 | 000,032,768 | ---- | M] () -- C:\Programme\Launch Manager\LaunchAp.exe
PRC - [2002.11.25 19:23:20 | 000,172,032 | ---- | M] (Agere Systems) -- C:\Programme\ltmoh\ltmoh.exe
PRC - [1997.10.18 00:00:00 | 000,051,984 | ---- | M] () -- C:\Programme\Microsoft Office\Office\OSA.EXE
 
 
========== Modules (No Company Name) ==========
 
MOD - [2007.05.31 09:38:16 | 000,167,936 | ---- | M] () -- C:\WINDOWS\system32\SerialXP.dll
MOD - [2003.09.08 15:48:26 | 000,065,536 | ---- | M] () -- C:\Programme\Launch Manager\WButton.exe
MOD - [2003.05.12 14:28:50 | 000,032,768 | ---- | M] () -- C:\Programme\Launch Manager\LaunchAp.exe
MOD - [1997.10.18 00:00:00 | 003,782,416 | ---- | M] () -- C:\Programme\Microsoft Office\Office\MSO97.DLL
MOD - [1997.10.18 00:00:00 | 000,051,984 | ---- | M] () -- C:\Programme\Microsoft Office\Office\OSA.EXE
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Auto | Stopped] -- C:\WINDOWS\system32\eeufail.dll -- (mggmh)
SRV - [2012.05.06 15:42:07 | 000,257,696 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.04.21 03:16:42 | 000,129,976 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2011.12.07 15:00:34 | 000,114,000 | ---- | M] (Joosoft.com GmbH) [Auto | Running] -- C:\WINDOWS\system32\UpdSvc.dll -- (Update-Service)
SRV - [2011.08.10 13:53:16 | 002,419,592 | ---- | M] (Check Point Software Technologies LTD) [Auto | Running] -- C:\Programme\CheckPoint\ZoneAlarm\vsmon.exe -- (vsmon)
SRV - [2011.07.25 15:00:58 | 000,493,184 | ---- | M] (Check Point Software Technologies) [Auto | Running] -- C:\Programme\CheckPoint\ZAForceField\ISWSVC.exe -- (IswSvc)
SRV - [2011.07.22 09:49:26 | 000,511,920 | ---- | M] (REINER SCT) [Auto | Running] -- C:\WINDOWS\system32\cjpcsc.exe -- (cjpcsc)
SRV - [2008.07.29 19:16:38 | 000,132,096 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing)
SRV - [2008.04.14 14:00:00 | 000,114,176 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\netdde.exe -- (NetDDEdsdm)
SRV - [2008.04.14 14:00:00 | 000,114,176 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\netdde.exe -- (NetDDE)
SRV - [2008.04.14 14:00:00 | 000,053,248 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\mprdim.dll -- (RemoteAccess)
SRV - [2008.04.14 14:00:00 | 000,033,792 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\msgsvc.dll -- (Messenger)
SRV - [2008.04.14 14:00:00 | 000,017,408 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\alrsvc.dll -- (Alerter)
SRV - [2006.03.03 21:03:10 | 000,069,632 | ---- | M] (HP) [Auto | Running] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\Wbutton.sys -- (Wbutton)
DRV - File not found [Kernel | Disabled | Stopped] -- system32\DRIVERS\s24trans.sys -- (s24trans)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\23.tmp -- (MEMSWEEP2)
DRV - File not found [Kernel | System | Stopped] -- -- (mailKmd)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOKUME~1\test\LOKALE~1\Temp\catchme.sys -- (catchme)
DRV - [2011.08.10 13:31:08 | 000,525,840 | ---- | M] (Check Point Software Technologies LTD) [Kernel | System | Running] -- C:\WINDOWS\system32\vsdatant.sys -- (Vsdatant)
DRV - [2011.07.25 15:00:52 | 000,027,016 | ---- | M] (Check Point Software Technologies) [Kernel | Auto | Running] -- C:\Programme\CheckPoint\ZAForceField\ISWKL.sys -- (ISWKL)
DRV - [2011.03.29 13:08:08 | 000,028,144 | ---- | M] (REINER SCT) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\cjusb.sys -- (cjusb)
DRV - [2010.11.06 14:11:12 | 000,035,008 | ---- | M] (hxxp://libusb-win32.sourceforge.net) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\libusb0.sys -- (libusb0)
DRV - [2010.10.14 17:08:38 | 000,132,184 | ---- | M] (Kaspersky Lab ZAO) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\kl1.sys -- (KL1)
DRV - [2010.10.14 17:08:38 | 000,011,352 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\kl2.sys -- (kl2)
DRV - [2010.09.21 16:51:58 | 000,327,256 | ---- | M] (Kaspersky Lab) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\klif.sys -- (KLIF)
DRV - [2008.11.25 10:49:44 | 000,040,960 | R--- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Rts5161ccid.sys -- (USBCCID)
DRV - [2008.04.14 14:00:00 | 000,800,384 | ---- | M] (Microsoft Corp., Veritas Software) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\dmboot.sys -- (dmboot)
DRV - [2008.04.14 14:00:00 | 000,143,744 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\fastfat.sys -- (Fastfat)
DRV - [2008.04.14 14:00:00 | 000,066,048 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\udfs.sys -- (Udfs)
DRV - [2008.04.14 14:00:00 | 000,013,952 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\cbidf2k.sys -- (cbidf2k)
DRV - [2007.05.31 09:38:16 | 000,014,949 | ---- | M] (franson.biz) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\bizVSerialNT.sys -- (bizVSerial)
DRV - [2006.04.28 17:26:46 | 000,088,688 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SE27mgmt.sys -- (SE27mgmt) Sony Ericsson Device 039 USB WMC Device Management Drivers (WDM)
DRV - [2006.04.28 17:25:44 | 000,097,184 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SE27mdm.sys -- (SE27mdm)
DRV - [2006.04.28 17:25:40 | 000,009,360 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SE27mdfl.sys -- (SE27mdfl)
DRV - [2006.04.28 17:24:42 | 000,061,600 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SE27bus.sys -- (SE27bus) Sony Ericsson Device 039 Driver driver (WDM)
DRV - [2005.12.21 05:32:56 | 000,029,152 | R--- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usb2vcom.sys -- (usb2vcom)
DRV - [2005.09.19 03:07:00 | 000,035,275 | ---- | M] (SCM Microsystems Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\TwkUsb2K.sys -- (CHIPDRIVE USB SmartCardReader)
DRV - [2004.08.25 15:06:00 | 000,185,611 | ---- | M] (SCM Microsystems Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\TWKSER2K.sys -- (TWKSER2K)
DRV - [2004.01.02 20:52:00 | 001,646,720 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\w22n51.sys -- (w22n51) Intel(R)
DRV - [2003.07.15 02:33:26 | 000,111,168 | ---- | M] (Applied Drivers Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\cwawdm.sys -- (cs429x)
DRV - [2003.05.07 04:46:38 | 000,026,240 | ---- | M] (Winbond Electronics Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\wbsd.sys -- (WBSD) Winbond Secure Digital Storage (SD/MMC)
DRV - [2003.04.28 11:27:06 | 000,009,867 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\HOTKEY.sys -- (Hotkey)
DRV - [2003.04.24 02:14:00 | 000,004,828 | ---- | M] (Towitoko AG) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\TWKMS.sys -- (TwkMs)
DRV - [2003.04.16 02:04:18 | 000,030,464 | ---- | M] (Winbond Electronics Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\wbms.sys -- (WBMS) Winbond Memory Stick Storage (MS)
DRV - [2003.02.14 20:59:14 | 001,169,792 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2002.12.17 21:41:36 | 000,042,368 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\bcm4sbxp.sys -- (bcm4sbxp)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.web.de/br/ie8_startpage
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.bing.com/?PC=BNHP
IE - HKCU\..\URLSearchHook: {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Programme\ZoneAlarm-Sicherheit\prxtbZon0.dll (Conduit Ltd.)
IE - HKCU\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKCU\..\SearchScopes\{02DC2E6A-4707-456F-AE7A-CB12C4CC1787}: "URL" = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&affID=110819&tl=gbn193052&tt=050412_30b&babsrc=SP_ss&mntrId=4c9fa22b000000000000000e356ecbd5
IE - HKCU\..\SearchScopes\{1BD30256-1263-4BDE-BA34-98DBBBA3AFC4}: "URL" = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}
IE - HKCU\..\SearchScopes\{28A90140-3C17-454D-A26D-F38EC69C483F}: "URL" = hxxp://go.gmx.net/tb/ie_searchplugin/?su={searchTerms}
IE - HKCU\..\SearchScopes\{75E3E68F-CE3C-4387-9EC3-BC67702BB0FE}: "URL" = hxxp://go.web.de/br/ie8_search_amazon/?keywords={searchTerms}
IE - HKCU\..\SearchScopes\{7D3489F0-9553-4BDD-8299-CB1A8C3E85F5}: "URL" = hxxp://go.web.de/br/ie8_search_web/?su={searchTerms}
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2613550
IE - HKCU\..\SearchScopes\{BB47DE44-9AA3-4E82-AE9E-06732B7DDB4E}: "URL" = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
IE - HKCU\..\SearchScopes\{EBC4F45B-0875-4BC2-99AB-5FCDB9A8F578}: "URL" = hxxp://go.web.de/br/ie8_search_ebay/?q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Search the web (Babylon)"
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..browser.search.selectedEngine: "Bing"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.web.de/"
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.0
FF - prefs.js..extensions.enabledItems: {fd639891-5cc6-45ae-9055-a7a6abb5a7a9}:1.2.12.0
FF - prefs.js..extensions.enabledItems: {d40f5e7b-d2cf-4856-b441-cc613eeffbe3}:1.67
FF - prefs.js..keyword.URL: "hxxp://search.babylon.com/?affID=110819&tl=gbn193052&tt=050412_30b&babsrc=KW_ss&mntrId=4c9fa22b000000000000000e356ecbd5&q="
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@checkpoint.com/FFApi: C:\Programme\CheckPoint\ZAForceField\TrustChecker\bin\npFFApi.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.688: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.688: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.688: c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010.02.18 17:45:23 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Programme\CheckPoint\ZAForceField\TrustChecker [2012.05.09 14:10:56 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.05.01 15:30:17 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2012.04.12 14:00:13 | 000,000,000 | ---D | M]
 
[2010.02.12 16:27:32 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Extensions
[2010.02.12 16:27:32 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012.05.30 14:18:24 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\extensions
[2011.07.23 14:22:07 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012.05.30 14:18:24 | 000,000,000 | ---D | M] (ZoneAlarm-Sicherheit Community Toolbar) -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\extensions\{fc2b76fc-2132-4d80-a9a3-1f5c6e49066b}
[2011.12.10 10:20:04 | 000,000,000 | ---D | M] (Santander Chipcard Plugin) -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\extensions\{fd639891-5cc6-45ae-9055-a7a6abb5a7a9}
[2011.12.19 21:56:47 | 000,000,933 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\searchplugins\11-suche.xml
[2011.10.13 17:19:44 | 000,000,855 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\searchplugins\1und1-suche.xml
[2011.10.10 15:27:30 | 000,001,281 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\searchplugins\amazondotcom-de.xml
[2011.10.10 14:59:22 | 000,002,364 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\searchplugins\eBay-de.xml
[2011.12.19 21:56:47 | 000,002,419 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\searchplugins\englische-ergebnisse.xml
[2011.10.13 17:01:56 | 000,010,507 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\searchplugins\gmx-suche.xml
[2011.10.10 15:12:38 | 000,002,385 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\searchplugins\lastminute.xml
[2011.10.13 17:34:10 | 000,002,248 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\searchplugins\mailcom-search.xml
[2011.10.13 15:07:08 | 000,005,490 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\searchplugins\webde-suche.xml
[2012.05.01 15:30:13 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.05.01 15:30:14 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\distribution\extensions
[2012.05.01 15:30:14 | 000,000,000 | ---D | M] (WEB.DE Toolbar) -- C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de
[2012.01.22 17:10:05 | 000,138,614 | ---- | M] () (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\TEST\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\605JKKZ1.DEFAULT\EXTENSIONS\{D40F5E7B-D2CF-4856-B441-CC613EEFFBE3}.XPI
[2012.04.21 03:18:00 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2011.11.10 06:54:13 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll
[2008.09.15 11:52:06 | 000,376,832 | ---- | M] ( ) -- C:\Programme\mozilla firefox\plugins\npsnapfish.dll
[2007.04.11 07:17:00 | 000,954,368 | ---- | M] (PPI Financial Systems GmbH) -- C:\Programme\mozilla firefox\plugins\NP_SEBChipcardPlugin.dll
[2012.04.21 03:54:08 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.04.05 20:49:12 | 000,002,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\babylon.xml
[2012.04.21 03:54:08 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2012.04.21 03:54:08 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2012.04.21 03:54:08 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.04.21 03:54:08 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.04.21 03:54:08 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2012.01.17 22:50:18 | 000,441,479 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1    www.007guard.com
O1 - Hosts: 127.0.0.1    007guard.com
O1 - Hosts: 127.0.0.1    008i.com
O1 - Hosts: 127.0.0.1    www.008k.com
O1 - Hosts: 127.0.0.1    008k.com
O1 - Hosts: 127.0.0.1    www.00hq.com
O1 - Hosts: 127.0.0.1    00hq.com
O1 - Hosts: 127.0.0.1    010402.com
O1 - Hosts: 127.0.0.1    www.032439.com
O1 - Hosts: 127.0.0.1    032439.com
O1 - Hosts: 127.0.0.1    www.1001-search.info
O1 - Hosts: 127.0.0.1    1001-search.info
O1 - Hosts: 127.0.0.1    www.100888290cs.com
O1 - Hosts: 127.0.0.1    100888290cs.com
O1 - Hosts: 127.0.0.1    www.100sexlinks.com
O1 - Hosts: 127.0.0.1    100sexlinks.com
O1 - Hosts: 127.0.0.1    www.10sek.com
O1 - Hosts: 127.0.0.1    10sek.com
O1 - Hosts: 127.0.0.1    www.123topsearch.com
O1 - Hosts: 127.0.0.1    123topsearch.com
O1 - Hosts: 127.0.0.1    www.132.com
O1 - Hosts: 127.0.0.1    132.com
O1 - Hosts: 127.0.0.1    www.136136.net
O1 - Hosts: 127.0.0.1    136136.net
O1 - Hosts: 15212 more lines...
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (ZoneAlarm Security Engine Registrar) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Programme\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O2 - BHO: (ZoneAlarm-Sicherheit Toolbar) - {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Programme\ZoneAlarm-Sicherheit\prxtbZon0.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Programme\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O3 - HKLM\..\Toolbar: (ZoneAlarm-Sicherheit Toolbar) - {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Programme\ZoneAlarm-Sicherheit\prxtbZon0.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {C424171E-592A-415A-9EB1-DFD6D95D3530} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Programme\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O3 - HKCU\..\Toolbar\WebBrowser: (ZoneAlarm-Sicherheit Toolbar) - {FC2B76FC-2132-4D80-A9A3-1F5C6E49066B} - C:\Programme\ZoneAlarm-Sicherheit\prxtbZon0.dll (Conduit Ltd.)
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [CtrlVol] C:\Programme\Launch Manager\CtrlVol.exe (Wistron)
O4 - HKLM..\Run: [HotkeyApp] C:\Programme\Launch Manager\HotkeyApp.exe (Wistron)
O4 - HKLM..\Run: [ISW] C:\Programme\CheckPoint\ZAForceField\ForceField.exe (Check Point Software Technologies)
O4 - HKLM..\Run: [LaunchAp] C:\Programme\Launch Manager\LaunchAp.exe ()
O4 - HKLM..\Run: [LMgrOSD] C:\Programme\Launch Manager\OSD.exe (Wistron)
O4 - HKLM..\Run: [LtMoh] C:\Programme\ltmoh\ltmoh.exe (Agere Systems)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [Wbutton] C:\Programme\Launch Manager\Wbutton.exe ()
O4 - HKLM..\Run: [ZoneAlarm] C:\Programme\CheckPoint\ZoneAlarm\zatray.exe (Check Point Software Technologies LTD)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Microsoft-Indexerstellung.lnk = C:\Programme\Microsoft Office\Office\FINDFAST.EXE (Microsoft Corporation)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Office-Start.lnk = C:\Programme\Microsoft Office\Office\OSA.EXE ()
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\VR-NetWorld Auftragsprüfung.lnk = C:\Programme\VR-NetWorld\VRToolCheckOrder.exe (VR-NetWorld Software)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\WISO Mein Steuer-Sparbuch heute.lnk = C:\Programme\WISO\Steuersoftware 2012\mshaktuell.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0A88DECB-188B-4A64-80E9-CE5FEB4BB59D}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - (igfxsrvc.dll) - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.04.17 16:08:06 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.06.01 09:04:18 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\test\Desktop\OTL.exe
[2012.06.01 08:43:20 | 000,388,608 | ---- | C] (Trend Micro Inc.) -- C:\Dokumente und Einstellungen\test\Desktop\HiJackThis204.exe
[2012.06.01 07:18:38 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\test\Recent
[2012.06.01 07:01:32 | 003,862,112 | ---- | C] (Piriform Ltd) -- C:\Dokumente und Einstellungen\test\Desktop\ccsetup319.exe
[2012.05.21 20:34:49 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\test\Downloads
[2012.05.09 13:58:59 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Kaspersky SDK
[2012.05.09 13:49:00 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\test\Eigene Dateien\ForceField Shared Files
[2012.05.09 13:48:51 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\CheckPoint
[2012.05.09 13:48:35 | 000,000,000 | ---D | C] -- C:\Programme\Conduit
[2012.05.09 13:48:33 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\test\Lokale Einstellungen\Anwendungsdaten\ZoneAlarm-Sicherheit
[2012.05.09 13:48:31 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\test\Lokale Einstellungen\Anwendungsdaten\Conduit
[2012.05.09 13:48:28 | 000,000,000 | ---D | C] -- C:\Programme\ZoneAlarm-Sicherheit
[2012.05.09 13:46:03 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Check Point
[2012.05.09 13:46:01 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CheckPoint
[2012.05.09 13:45:53 | 000,000,000 | ---D | C] -- C:\Programme\CheckPoint
[2012.05.09 13:20:21 | 000,000,000 | -H-D | C] -- C:\WINDOWS\$hf_mig$
[2012.05.08 13:39:53 | 000,000,000 | -H-D | C] -- C:\Dokumente und Einstellungen\test\Desktop\Lokale Einstellungen
[2012.05.07 14:32:56 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\FastStone
[2012.05.07 14:32:52 | 000,000,000 | ---D | C] -- C:\Programme\FastStone Capture
[2012.05.07 14:32:52 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\FastStone Capture
[2012.01.23 11:35:11 | 039,401,336 | ---- | C] (Apple Inc.) -- C:\Programme\QuickTimeInstaller.exe
[2011.12.07 14:58:44 | 000,541,544 | ---- | C] (JooSoft GmbH) -- C:\Programme\7z920.exe
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.06.01 09:04:26 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\test\Desktop\OTL.exe
[2012.06.01 09:02:06 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\test\defogger_reenable
[2012.06.01 09:01:44 | 000,050,477 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Desktop\Defogger.exe
[2012.06.01 08:57:54 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.06.01 08:43:21 | 000,388,608 | ---- | M] (Trend Micro Inc.) -- C:\Dokumente und Einstellungen\test\Desktop\HiJackThis204.exe
[2012.06.01 08:40:16 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012.06.01 08:13:10 | 000,001,452 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Desktop\message-rfc822-attachment.eml
[2012.06.01 08:08:43 | 000,000,268 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1275210071-1993962763-1957994488-1003.job
[2012.06.01 08:08:23 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.06.01 08:08:19 | 000,126,912 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012.06.01 07:14:17 | 000,278,352 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Eigene Dateien\cc_20120601_071402.reg
[2012.06.01 07:04:06 | 000,000,660 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Dokumente\Desktop\CCleaner.lnk
[2012.06.01 07:02:47 | 003,862,112 | ---- | M] (Piriform Ltd) -- C:\Dokumente und Einstellungen\test\Desktop\ccsetup319.exe
[2012.05.31 08:36:04 | 000,010,726 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Eigene Dateien\VR-NetWorld.pdf
[2012.05.30 18:29:15 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1275210071-1993962763-1957994488-1003.job
[2012.05.21 20:35:27 | 000,000,022 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Desktop\ausmalbild_kostenlos.zip
[2012.05.09 19:37:24 | 000,479,376 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2012.05.09 19:37:24 | 000,433,138 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012.05.09 19:37:24 | 000,092,732 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2012.05.09 19:37:24 | 000,068,094 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012.05.09 13:57:51 | 000,415,771 | ---- | M] () -- C:\WINDOWS\System32\vsconfig.xml
[2012.05.07 14:32:52 | 000,000,728 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Dokumente\Desktop\FastStone Capture.lnk
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.06.01 09:02:06 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\test\defogger_reenable
[2012.06.01 09:01:40 | 000,050,477 | ---- | C] () -- C:\Dokumente und Einstellungen\test\Desktop\Defogger.exe
[2012.06.01 08:13:06 | 000,001,452 | ---- | C] () -- C:\Dokumente und Einstellungen\test\Desktop\message-rfc822-attachment.eml
[2012.06.01 08:08:19 | 000,126,912 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012.06.01 07:14:11 | 000,278,352 | ---- | C] () -- C:\Dokumente und Einstellungen\test\Eigene Dateien\cc_20120601_071402.reg
[2012.05.21 20:34:54 | 000,000,022 | ---- | C] () -- C:\Dokumente und Einstellungen\test\Desktop\ausmalbild_kostenlos.zip
[2012.05.09 13:49:13 | 000,415,771 | ---- | C] () -- C:\WINDOWS\System32\vsconfig.xml
[2012.05.07 14:32:52 | 000,000,728 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Dokumente\Desktop\FastStone Capture.lnk
[2012.02.15 14:11:59 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2012.01.03 11:56:09 | 000,000,595 | ---- | C] () -- C:\WINDOWS\wiso.ini
[2012.01.02 20:03:27 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2012.01.02 20:03:27 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2012.01.02 20:03:27 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2012.01.02 20:03:27 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2012.01.02 20:03:27 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2012.01.02 17:56:26 | 000,103,981 | ---- | C] () -- C:\WINDOWS\hpoins08.dat
[2012.01.02 17:56:26 | 000,004,445 | ---- | C] () -- C:\WINDOWS\hpomdl08.dat
[2011.12.21 15:02:26 | 000,000,095 | ---- | C] () -- C:\WINDOWS\ParrotFlashWiz.INI
[2011.10.29 12:58:18 | 000,167,936 | ---- | C] () -- C:\WINDOWS\System32\SerialXP.dll
[2011.10.29 12:58:18 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\win32com.dll
[2011.10.09 10:54:17 | 000,000,364 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2011.10.05 18:24:07 | 000,001,296 | ---- | C] () -- C:\WINDOWS\HBCIKRNL.INI
[2010.09.21 17:42:55 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\drivers\SymSMR130.dat
 
========== LOP Check ==========
 
[2011.12.06 22:36:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\adisoft AG
[2011.12.07 15:09:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Babylon
[2010.02.04 22:53:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\BTrieve
[2012.03.19 15:57:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Buhl Data Service GmbH
[2012.05.09 13:46:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CheckPoint
[2012.01.20 16:14:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DesktopIcons
[2012.05.09 13:58:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Kaspersky SDK
[2010.02.07 16:28:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Lexware
[2009.04.25 10:25:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Drivers HeadQuarters
[2011.10.29 12:58:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\REINER SCT
[2012.01.20 17:26:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\1&1 Mail & Media GmbH
[2009.11.24 18:46:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\ACD Systems
[2012.01.03 12:03:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Buhl Data Service
[2012.05.09 13:48:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\CheckPoint
[2011.07.07 07:05:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Image Zone Express
[2010.02.05 10:03:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Lexware
[2009.09.29 14:19:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\MyPhoneExplorer
[2010.09.18 09:16:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\OpenOffice.org
[2011.12.11 17:14:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Teleca
[2010.02.12 16:27:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Thunderbird
[2010.05.22 23:14:13 | 000,000,484 | ---- | M] () -- C:\WINDOWS\Tasks\Install.job
 
========== Purity Check ==========
 
 
 
< End of report >

--- --- ---
OTL Logfile:

Code:

ATTFilter

OTL Extras logfile created on: 01.06.2012 09:05:00 - Run 1
OTL by OldTimer - Version 3.2.45.0 Folder = C:\Dokumente und Einstellungen\test\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,24 Gb Total Physical Memory | 0,80 Gb Available Physical Memory | 64,26% Memory free
1,83 Gb Paging File | 1,37 Gb Available in Paging File | 74,61% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 37,25 Gb Total Space | 24,82 Gb Free Space | 66,63% Space Free | Partition Type: NTFS
 
Computer Name: TEST-101EE4A811 | User Name: test | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
http [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring" = 1
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"9660:TCP" = 9660:TCP:*:Enabled:rrfhsf
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\Mozilla Firefox\firefox.exe" = C:\Programme\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation)
"C:\Program Files\Real\RealPlayer\realplay.exe" = C:\Program Files\Real\RealPlayer\realplay.exe:*:Enabled:RealPlayer -- (RealNetworks, Inc.)
"C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\WebKit2WebProcess.exe" = C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\WebKit2WebProcess.exe:*:Enabled:WebKit
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02E89EFC-7B07-4D5A-AA03-9EC0902914EE}" = VC 9.0 Runtime
"{0CC1DAFB-40C8-4903-953D-471E541477C7}" = WISO Steuer 2012
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216018FF}" = Java(TM) 6 Update 30
"{27555031-A116-4EC6-9991-7B400142A936}" = HP PSC & OfficeJet 6.1.A
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{4886533F-EA40-40DC-B1BB-B13BF22B3CD1}" = ZoneAlarm Firewall
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{66910000-8B30-4973-A159-6371345AFFA5}" = WebReg
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime
"{8777AC6D-89F9-4793-8266-DE406F343E89}" = QFolder
"{8815F011-43AF-4F50-BBD8-D78ED3D6F5B9}" = VR-NetWorld
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel(R) Extreme Graphics 2 Driver
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{AA898D01-D4E3-43C6-8E25-70CA660B9F16}" = CHIPDRIVE extern/intern/micro treiber 3.1
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.3) - Deutsch
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C4B76E93-3FC2-4E90-81EE-EE62948CFB03}" = Sony Ericsson Mobile Phone Monitor
"{C6812939-B117-48E6-A3BA-1709C14A3C8C}" = Scan
"{C8753E28-2680-49BF-BD48-DD38FD086EFE}" = AiO_Scan_CDA
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D0846526-66DD-4DC9-A02C-98F9A2806812}" = Launch Manager V1.1.0
"{ED9A325D-9622-4FD0-A731-73D23C6265F3}" = CapMan
"{F0312AC6-988B-11DA-9C49-000476F770CC}" = CIB pdf brewer 2.5.26
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F32E8EE8-83AD-4553-B2F8-CBFB3ABDC179}" = ZoneAlarm Antivirus
"{F4F4F84E-804F-4E9A-84D7-C34283F0088F}" = RealUpgrade 1.0
"{F50D4138-E662-4CFE-B297-5E8BF80A797E}" = ZoneAlarm Security
"{FC338210-F594-11D3-BA24-00001C3AB4DF}" = cyberJack Base Components
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"Agere Systems Soft Modem" = Agere Systems AC'97 Modem
"CCleaner" = CCleaner
"Excel" = Microsoft Excel 97
"FastStone Capture" = FastStone Capture 5.3
"ie8" = Windows Internet Explorer 8
"IrfanView" = IrfanView (remove only)
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox 12.0 (x86 de)" = Mozilla Firefox 12.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MPE" = MyPhoneExplorer
"Parrot Flash Update Wizard" = Parrot Software Update Tool
"Pocoyo Hot Season Screensaver" = Pocoyo Hot Season Screensaver
"RealPlayer 12.0" = RealPlayer
"Word8.0" = Microsoft Word 97
"ZoneAlarm Antivirus" = ZoneAlarm Antivirus
"ZoneAlarm Toolbar" = ZoneAlarm Toolbar
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 01.06.2012 00:36:56 | Computer Name = TEST-101EE4A811 | Source = Userenv | ID = 1090
Description = Der Sitzungsstatus des Richtlinienergebnissatzes konnte nicht protokolliert
werden. Ein Verbindungsversuch mit WMI ist fehlgeschlagen. Für diese Anwendung 
der Richtlinie wird keine Richtlinienergebnissatz-Protokollierung durchgeführt.
 
Error - 01.06.2012 00:36:56 | Computer Name = TEST-101EE4A811 | Source = Userenv | ID = 1090
Description = Der Sitzungsstatus des Richtlinienergebnissatzes konnte nicht protokolliert
werden. Ein Verbindungsversuch mit WMI ist fehlgeschlagen. Für diese Anwendung 
der Richtlinie wird keine Richtlinienergebnissatz-Protokollierung durchgeführt.
 
Error - 01.06.2012 00:43:22 | Computer Name = TEST-101EE4A811 | Source = Userenv | ID = 1090
Description = Der Sitzungsstatus des Richtlinienergebnissatzes konnte nicht protokolliert
werden. Ein Verbindungsversuch mit WMI ist fehlgeschlagen. Für diese Anwendung 
der Richtlinie wird keine Richtlinienergebnissatz-Protokollierung durchgeführt.
 
Error - 01.06.2012 00:43:23 | Computer Name = TEST-101EE4A811 | Source = Userenv | ID = 1090
Description = Der Sitzungsstatus des Richtlinienergebnissatzes konnte nicht protokolliert
werden. Ein Verbindungsversuch mit WMI ist fehlgeschlagen. Für diese Anwendung 
der Richtlinie wird keine Richtlinienergebnissatz-Protokollierung durchgeführt.
 
Error - 01.06.2012 00:55:03 | Computer Name = TEST-101EE4A811 | Source = Userenv | ID = 1090
Description = Der Sitzungsstatus des Richtlinienergebnissatzes konnte nicht protokolliert
werden. Ein Verbindungsversuch mit WMI ist fehlgeschlagen. Für diese Anwendung 
der Richtlinie wird keine Richtlinienergebnissatz-Protokollierung durchgeführt.
 
Error - 01.06.2012 00:55:03 | Computer Name = TEST-101EE4A811 | Source = Userenv | ID = 1090
Description = Der Sitzungsstatus des Richtlinienergebnissatzes konnte nicht protokolliert
werden. Ein Verbindungsversuch mit WMI ist fehlgeschlagen. Für diese Anwendung 
der Richtlinie wird keine Richtlinienergebnissatz-Protokollierung durchgeführt.
 
Error - 01.06.2012 02:09:11 | Computer Name = TEST-101EE4A811 | Source = Userenv | ID = 1090
Description = Der Sitzungsstatus des Richtlinienergebnissatzes konnte nicht protokolliert
werden. Ein Verbindungsversuch mit WMI ist fehlgeschlagen. Für diese Anwendung 
der Richtlinie wird keine Richtlinienergebnissatz-Protokollierung durchgeführt.
 
Error - 01.06.2012 02:09:11 | Computer Name = TEST-101EE4A811 | Source = Userenv | ID = 1090
Description = Der Sitzungsstatus des Richtlinienergebnissatzes konnte nicht protokolliert
werden. Ein Verbindungsversuch mit WMI ist fehlgeschlagen. Für diese Anwendung 
der Richtlinie wird keine Richtlinienergebnissatz-Protokollierung durchgeführt.
 
Error - 01.06.2012 02:13:59 | Computer Name = TEST-101EE4A811 | Source = Userenv | ID = 1090
Description = Der Sitzungsstatus des Richtlinienergebnissatzes konnte nicht protokolliert
werden. Ein Verbindungsversuch mit WMI ist fehlgeschlagen. Für diese Anwendung 
der Richtlinie wird keine Richtlinienergebnissatz-Protokollierung durchgeführt.
 
Error - 01.06.2012 02:13:59 | Computer Name = TEST-101EE4A811 | Source = Userenv | ID = 1090
Description = Der Sitzungsstatus des Richtlinienergebnissatzes konnte nicht protokolliert
werden. Ein Verbindungsversuch mit WMI ist fehlgeschlagen. Für diese Anwendung 
der Richtlinie wird keine Richtlinienergebnissatz-Protokollierung durchgeführt.
 
[ System Events ]
Error - 01.06.2012 00:36:34 | Computer Name = TEST-101EE4A811 | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Arbeitsstationsdienst" wurde mit folgendem Fehler beendet:
%%2
 
Error - 01.06.2012 00:36:35 | Computer Name = TEST-101EE4A811 | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Arbeitsstationsdienst"
abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%2
 
Error - 01.06.2012 00:36:35 | Computer Name = TEST-101EE4A811 | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Driver Installer" wurde mit folgendem Fehler beendet: 
%%126
 
Error - 01.06.2012 00:36:58 | Computer Name = TEST-101EE4A811 | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Arbeitsstationsdienst"
abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%2
 
Error - 01.06.2012 00:36:58 | Computer Name = TEST-101EE4A811 | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Arbeitsstationsdienst" wurde mit folgendem Fehler beendet:
%%2
 
Error - 01.06.2012 02:08:51 | Computer Name = TEST-101EE4A811 | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Arbeitsstationsdienst" wurde mit folgendem Fehler beendet:
%%2
 
Error - 01.06.2012 02:08:52 | Computer Name = TEST-101EE4A811 | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Arbeitsstationsdienst"
abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%2
 
Error - 01.06.2012 02:08:52 | Computer Name = TEST-101EE4A811 | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Driver Installer" wurde mit folgendem Fehler beendet: 
%%126
 
Error - 01.06.2012 02:09:18 | Computer Name = TEST-101EE4A811 | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Arbeitsstationsdienst"
abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%2
 
Error - 01.06.2012 02:09:18 | Computer Name = TEST-101EE4A811 | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Arbeitsstationsdienst" wurde mit folgendem Fehler beendet:
%%2
 
 
< End of report >

--- --- ---
GMER Logfile:

Code:

ATTFilter

GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-06-01 13:06:59
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 TOSHIBA_MK4025GAS rev.KA100A
Running: omm346gc.exe; Driver: C:\DOKUME~1\test\LOKALE~1\Temp\kfryyaob.sys
 
 
---- System - GMER 1.0.15 ----
 
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwAdjustPrivilegesToken [0xB0F0266E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwClose [0xB0F02F02]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwConnectPort [0xB0DD02F4]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwCreateEvent [0xB0F037D0]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateFile [0xB0DCA5CA]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateKey [0xB0DE958A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwCreateMutant [0xB0F036A8]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwCreateNamedPipeFile [0xB0F02274]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreatePort [0xB0DD0A80]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateProcess [0xB0DE3E4E]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateProcessEx [0xB0DE423C]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateSection [0xB0DED6F6]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwCreateSemaphore [0xB0F03902]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwCreateSymbolicLinkObject [0xB0F0558C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwCreateThread [0xB0F02BA0]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateWaitablePort [0xB0DD0BB6]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwDebugActiveProcess [0xB0F04F36]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwDeleteFile [0xB0DCB1E0]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwDeleteKey [0xB0DEAE3C]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwDeleteValueKey [0xB0DEA7B2]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwDeviceIoControlFile [0xB0F03178]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwDuplicateObject [0xB0DE2D8A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwEnumerateKey [0xB0F01FAC]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwEnumerateValueKey [0xB0F02056]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwFsControlFile [0xB0F02F84]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwLoadDriver [0xB0DC5E88]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwLoadKey [0xB0DEB794]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwLoadKey2 [0xB0DEB99C]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwMapViewOfSection [0xB0DEDA5E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwNotifyChangeKey [0xB0F021A2]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwOpenEvent [0xB0F03872]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwOpenFile [0xB0DCADF2]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwOpenKey [0xB0F016BE]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwOpenMutant [0xB0F03740]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwOpenProcess [0xB0DE6160]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwOpenSection [0xB0F055B6]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwOpenSemaphore [0xB0F039A4]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwOpenThread [0xB0DE5D8A]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwProtectVirtualMemory [0xB0DFA090]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwQueryKey [0xB0F02100]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwQueryMultipleValueKey [0xB0F01D28]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwQuerySection [0xB0F05958]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwQueryValueKey [0xB0F01978]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwQueueApcThread [0xB0F052A6]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwRenameKey [0xB0DEC72A]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwReplaceKey [0xB0DEC060]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwReplyPort [0xB0F03D2E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwReplyWaitReceivePort [0xB0F03BF4]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwRequestWaitReplyPort [0xB0DCFEC4]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwRestoreKey [0xB0DED0FC]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwResumeThread [0xB0F05E30]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwSaveKey [0xB0F0132A]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSecureConnectPort [0xB0DD059C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwSetContextThread [0xB0F02DBE]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSetInformationFile [0xB0DCB5A4]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSetInformationObject [0xB0DF9F7C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwSetInformationToken [0xB0F04586]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSetSecurityObject [0xB0DECC6A]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSetSystemInformation [0xB0DC5648]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSetValueKey [0xB0DE9F72]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwSuspendProcess [0xB0F05B7C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwSuspendThread [0xB0F05CA4]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSystemDebugControl [0xB0DE4EA4]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwTerminateProcess [0xB0DE4C20]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwTerminateThread [0xB0F02956]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwUnloadDriver [0xB0DC629C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwUnmapViewOfSection [0xB0F0580E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwWriteVirtualMemory [0xB0F02AE0]
 
Code \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) FsRtlCheckLockForReadAccess
Code \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) IoIsOperationSynchronous
 
---- Kernel code sections - GMER 1.0.15 ----
 
.text ntoskrnl.exe!_abnormal_termination + 104 804E2770 12 Bytes [80, 0A, DD, B0, 4E, 3E, DE, ...] {OR BYTE [EDX], 0xdd; MOV AL, 0x4e; FIDIV WORD DS:[EAX-0x4f21bdc4]}
.text ntoskrnl.exe!_abnormal_termination + 114 804E2780 16 Bytes [F6, D6, DE, B0, 02, 39, F0, ...]
.text ntoskrnl.exe!_abnormal_termination + 1D0 804E283C 12 Bytes [88, 5E, DC, B0, 94, B7, DE, ...]
.text ntoskrnl.exe!_abnormal_termination + 34C 804E29B8 16 Bytes [2A, C7, DE, B0, 60, C0, DE, ...]
.text ntoskrnl.exe!_abnormal_termination + 440 804E2AAC 12 Bytes [7C, 5B, F0, B0, A4, 5C, F0, ...]
.text ntoskrnl.exe!IoIsOperationSynchronous 804E876A 5 Bytes JMP B0EF7382 \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab)
.text ntoskrnl.exe!FsRtlCheckLockForReadAccess 80512969 5 Bytes JMP B0EF6FA8 \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab)
 
---- User code sections - GMER 1.0.15 ----
 
.text C:\WINDOWS\system32\igfxtray.exe[232] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\igfxtray.exe[232] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\igfxtray.exe[232] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\igfxtray.exe[232] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\igfxtray.exe[232] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\igfxtray.exe[232] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\igfxtray.exe[232] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\igfxtray.exe[232] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\AGRSMMSG.exe[316] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\AGRSMMSG.exe[316] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\AGRSMMSG.exe[316] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\AGRSMMSG.exe[316] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\AGRSMMSG.exe[316] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\AGRSMMSG.exe[316] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\AGRSMMSG.exe[316] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\AGRSMMSG.exe[316] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[364] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[364] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[364] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[364] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[364] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[364] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[364] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[364] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[428] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[428] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[428] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[428] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[428] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[428] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[428] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[428] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\CheckPoint\ZAForceField\ForceField.exe[480] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\CheckPoint\ZAForceField\ForceField.exe[480] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\CheckPoint\ZAForceField\ForceField.exe[480] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\CheckPoint\ZAForceField\ForceField.exe[480] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\CheckPoint\ZAForceField\ForceField.exe[480] kernel32.dll!SetUnhandledExceptionFilter 7C84495D 5 Bytes JMP 209F37DD C:\Programme\CheckPoint\ZAForceField\Plugins\ISWDMP.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\CheckPoint\ZAForceField\ForceField.exe[480] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\CheckPoint\ZAForceField\ForceField.exe[480] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\CheckPoint\ZAForceField\ForceField.exe[480] USER32.dll!DefDlgProcW + 56E 7E3742A8 5 Bytes JMP 20CB9270 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\cjpcsc.exe[548] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\cjpcsc.exe[548] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\cjpcsc.exe[548] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\cjpcsc.exe[548] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\cjpcsc.exe[548] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\cjpcsc.exe[548] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\cjpcsc.exe[548] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\cjpcsc.exe[548] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\svchost.exe[632] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\svchost.exe[632] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\svchost.exe[632] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\svchost.exe[632] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\svchost.exe[632] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\svchost.exe[632] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\svchost.exe[632] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\svchost.exe[632] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\Explorer.EXE[728] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\Explorer.EXE[728] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\Explorer.EXE[728] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\Explorer.EXE[728] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\Explorer.EXE[728] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\Explorer.EXE[728] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\Explorer.EXE[728] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\Explorer.EXE[728] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\winlogon.exe[912] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\winlogon.exe[912] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\winlogon.exe[912] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\winlogon.exe[912] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\winlogon.exe[912] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\winlogon.exe[912] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\winlogon.exe[912] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\winlogon.exe[912] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\services.exe[956] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\services.exe[956] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\services.exe[956] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\services.exe[956] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\services.exe[956] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\services.exe[956] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\services.exe[956] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\services.exe[956] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\lsass.exe[968] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\lsass.exe[968] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\lsass.exe[968] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\lsass.exe[968] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\lsass.exe[968] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\lsass.exe[968] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\lsass.exe[968] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\hkcmd.exe[1092] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\hkcmd.exe[1092] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\hkcmd.exe[1092] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\hkcmd.exe[1092] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\hkcmd.exe[1092] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\hkcmd.exe[1092] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\hkcmd.exe[1092] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\hkcmd.exe[1092] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1124] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1124] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1124] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1124] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1124] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1124] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1124] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1124] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Java\jre6\bin\jqs.exe[1140] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Java\jre6\bin\jqs.exe[1140] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Java\jre6\bin\jqs.exe[1140] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Java\jre6\bin\jqs.exe[1140] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Java\jre6\bin\jqs.exe[1140] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Java\jre6\bin\jqs.exe[1140] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Java\jre6\bin\jqs.exe[1140] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Java\jre6\bin\jqs.exe[1140] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\CheckPoint\ZAForceField\IswSvc.exe[1148] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\CheckPoint\ZAForceField\IswSvc.exe[1148] USER32.dll!DefDlgProcW + 56E 7E3742A8 5 Bytes JMP 20CB9270 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1248] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1248] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1248] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1248] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1248] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1248] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1248] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1248] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\svchost.exe[1392] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\svchost.exe[1392] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\svchost.exe[1392] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\svchost.exe[1392] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\svchost.exe[1392] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\svchost.exe[1392] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\svchost.exe[1392] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\svchost.exe[1392] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\HPZipm12.exe[1428] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\HPZipm12.exe[1428] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\HPZipm12.exe[1428] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\HPZipm12.exe[1428] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\HPZipm12.exe[1428] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\HPZipm12.exe[1428] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\HPZipm12.exe[1428] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\HPZipm12.exe[1428] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\spoolsv.exe[1472] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\spoolsv.exe[1472] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\spoolsv.exe[1472] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\spoolsv.exe[1472] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\spoolsv.exe[1472] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\spoolsv.exe[1472] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\spoolsv.exe[1472] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\spoolsv.exe[1472] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1564] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1564] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1564] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1564] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1564] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1564] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1564] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1564] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1720] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1720] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1720] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1720] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1720] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1720] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1720] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1720] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\ltmoh\Ltmoh.exe[1816] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\ltmoh\Ltmoh.exe[1816] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\ltmoh\Ltmoh.exe[1816] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\ltmoh\Ltmoh.exe[1816] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\ltmoh\Ltmoh.exe[1816] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\ltmoh\Ltmoh.exe[1816] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\ltmoh\Ltmoh.exe[1816] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\ltmoh\Ltmoh.exe[1816] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\SCardSvr.exe[2032] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\SCardSvr.exe[2032] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\SCardSvr.exe[2032] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\SCardSvr.exe[2032] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\SCardSvr.exe[2032] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\SCardSvr.exe[2032] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\SCardSvr.exe[2032] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\SCardSvr.exe[2032] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[2148] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[2148] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[2148] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[2148] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[2148] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[2148] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[2148] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[2148] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\LaunchAp.exe[2200] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\LaunchAp.exe[2200] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\LaunchAp.exe[2200] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\LaunchAp.exe[2200] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\LaunchAp.exe[2200] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\LaunchAp.exe[2200] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\LaunchAp.exe[2200] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\LaunchAp.exe[2200] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\HotkeyApp.exe[2344] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\HotkeyApp.exe[2344] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\HotkeyApp.exe[2344] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\HotkeyApp.exe[2344] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\HotkeyApp.exe[2344] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\HotkeyApp.exe[2344] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\HotkeyApp.exe[2344] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\HotkeyApp.exe[2344] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\OSD.exe[2504] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\OSD.exe[2504] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\OSD.exe[2504] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\OSD.exe[2504] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\OSD.exe[2504] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\OSD.exe[2504] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\OSD.exe[2504] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\OSD.exe[2504] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\Wbutton.exe[2572] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\Wbutton.exe[2572] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\Wbutton.exe[2572] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\Wbutton.exe[2572] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\Wbutton.exe[2572] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\Wbutton.exe[2572] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\Wbutton.exe[2572] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\Wbutton.exe[2572] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe[2672] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe[2672] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe[2672] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe[2672] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe[2672] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe[2672] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe[2672] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe[2672] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe[2760] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe[2760] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe[2760] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe[2760] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe[2760] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe[2760] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe[2760] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe[2760] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\CheckPoint\ZoneAlarm\zatray.exe[2928] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\CheckPoint\ZoneAlarm\zatray.exe[2928] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\CheckPoint\ZoneAlarm\zatray.exe[2928] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\CheckPoint\ZoneAlarm\zatray.exe[2928] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\CheckPoint\ZoneAlarm\zatray.exe[2928] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\CheckPoint\ZoneAlarm\zatray.exe[2928] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\CheckPoint\ZoneAlarm\zatray.exe[2928] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\CheckPoint\ZoneAlarm\zatray.exe[2928] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\ctfmon.exe[2952] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\ctfmon.exe[2952] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\ctfmon.exe[2952] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\ctfmon.exe[2952] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\ctfmon.exe[2952] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\ctfmon.exe[2952] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\ctfmon.exe[2952] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\ctfmon.exe[2952] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Microsoft Office\Office\OSA.EXE[3088] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Microsoft Office\Office\OSA.EXE[3088] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Microsoft Office\Office\OSA.EXE[3088] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Microsoft Office\Office\OSA.EXE[3088] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Microsoft Office\Office\OSA.EXE[3088] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Microsoft Office\Office\OSA.EXE[3088] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Microsoft Office\Office\OSA.EXE[3088] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Microsoft Office\Office\OSA.EXE[3088] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Dokumente und Einstellungen\test\Desktop\omm346gc.exe[3432] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Dokumente und Einstellungen\test\Desktop\omm346gc.exe[3432] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Dokumente und Einstellungen\test\Desktop\omm346gc.exe[3432] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Dokumente und Einstellungen\test\Desktop\omm346gc.exe[3432] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Dokumente und Einstellungen\test\Desktop\omm346gc.exe[3432] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Dokumente und Einstellungen\test\Desktop\omm346gc.exe[3432] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Dokumente und Einstellungen\test\Desktop\omm346gc.exe[3432] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Dokumente und Einstellungen\test\Desktop\omm346gc.exe[3432] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\alg.exe[3512] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\alg.exe[3512] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\alg.exe[3512] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\alg.exe[3512] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\alg.exe[3512] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\alg.exe[3512] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\alg.exe[3512] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\alg.exe[3512] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
 
---- Devices - GMER 1.0.15 ----
 
Device \Driver\Tcpip \Device\Ip vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
Device \Driver\Tcpip \Device\Tcp vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
Device \Driver\Tcpip \Device\Udp vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
Device \Driver\Tcpip \Device\RawIp vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
Device \Driver\Tcpip \Device\IPMULTICAST vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
 
---- EOF - GMER 1.0.15 ----

--- --- ---

Hoffe ich habe nichts vergessen. Wie mach ich weiter?

Danke im voraus

cosinus · 03.06.2012, 14:21

Zitat:

Hatte mir einen Trojaner eingefangen Rootkit.gen
Hatte dann auch noch worm32.

Angaben viel zu ungenau! Logs davon posten!

Zitat:

Warum hat Zone Alarm nichts gefunden?

Weil ZoneAlarm ein schwachsinniger/kontraproduktiver Paketfilter ist, den man viel zu schnell und leicht umgehen kann!
ZoneAlarm ist kontraproduktiver Müll, bitte umgehend deinstallieren und die Windows-Firewall einschalten!

28missi · 04.06.2012, 08:52

Hallo!

die Logs habe ich nicht mehr. Ich hatte unter Avira Rootkit.gen in Quarantäne verschoben. Durch Deinstallation und Umstellung auf Zone Alarm habe ich nichts mehr.

Zone Alarm ist Schrott? Und dafür habe ich auch noch Geld
Hatte mich vorher extra informiert, und Zone Alarm hatte bei den Firewalls zumindest angeblich gut abgeschnitten. Werde es aber jetzt deinstallieren und die Windows Firewall einschalten.

Kann man mit meinen aktuellen Logs was anfangen oder soll ich nach Deinstallation von Zone Alarm nochmal neue machen?

Danke für die Hilfe!

cosinus · 04.06.2012, 15:05

Zitat:

die Logs habe ich nicht mehr. Ich hatte unter Avira Rootkit.gen in Quarantäne verschoben.

Dann lässt sich auch nichts mehr richtig nachvollziehen was genau deinen Rechner befallen hat bzw. wo genau es rumlag - eine Aussage bzw. Hilfe so mit nicht oder nur sehr eingeschränkt noch möglich

Zitat:

Zone Alarm ist Schrott? Und dafür habe ich auch noch Geld

Überflüssiger Unsinn. Alles was man benötigt bringt Windows schon mit. Wieso kaufst du diesen Müll auch gleich?

Zitat:

Kann man mit meinen aktuellen Logs was anfangen oder soll ich nach Deinstallation von Zone Alarm nochmal neue machen?

Erst ZoneAlarm deinstallieren, anschließend routinemäßig einen Vollscan mit Malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen!
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Außerdem müssen alle Funde entfernt werden.

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

ATTFilter

 hier steht das Log

28missi · 04.06.2012, 20:08

Hallo Arne!

also Malwarebytes hat nicht gebracht. Keine infizierten Dateien gefunden.

Code:

ATTFilter

Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.06.04.04

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
test :: TEST-101EE4A811 [Administrator]

04.06.2012 16:20:55
mbam-log-2012-06-04 (16-20-55).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 211676
Laufzeit: 30 Minute(n), 25 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

und eset hat folgende log datei

Code:

ATTFilter

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=5e3f66f995591c45ad126e438adb1aed
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-06-04 06:37:37
# local_time=2012-06-04 08:37:37 (+0100, Westeuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 0 0 0 0
# compatibility_mode=8192 67108863 100 0 986 986 0 0
# scanned=34592
# found=5
# cleaned=0
# scan_time=3454
C:\Dokumente und Einstellungen\test\Desktop\Handy\MyPhoneExplorer_Setup_v1.7.4.exe	Win32/Adware.ADON application (unable to clean)	00000000000000000000000000000000	I
C:\Dokumente und Einstellungen\test\Desktop\Handy\SETool2 Lite v1.11.7z	multiple threats (unable to clean)	00000000000000000000000000000000	I
C:\Programme\PDFCreator\message.exe	a variant of Win32/InstallCore.A application (unable to clean)	00000000000000000000000000000000	I
C:\System Volume Information\_restore{E71F2826-3DF9-4171-A5E1-0763559AA45D}\RP291\A0036445.dll	a variant of Win32/Mediyes.J trojan (unable to clean)	00000000000000000000000000000000	I
C:\System Volume Information\_restore{E71F2826-3DF9-4171-A5E1-0763559AA45D}\RP291\A0036452.dll	a variant of Win32/Mediyes.J trojan (unable to clean)	00000000000000000000000000000000	I

hoffe, ich hab das jetzt richtig gemacht mit dem einfügen.

Wie krieg ich den Trojaner jetzt endgültig raus?

Danke für Deine Hilfe

cosinus · 04.06.2012, 21:27

Hätte da mal zwei Fragen bevor es weiter geht

1.) Geht der normale Modus von Windows (wieder) uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

28missi · 05.06.2012, 12:58

Hallo Arne!

nein vermisse nichts, Windows fährt normal hoch und habe auch keine leeren Ordner gefunden.

Gruß
Ulrike

cosinus · 05.06.2012, 15:47

Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

ATTFilter

 hier steht das Log

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Setze oben mittig den Haken bei Scanne alle Benutzer
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die Textbox von OTL - wenn OTL auf deutsch ist wird sie mit beschriftet

Code:

ATTFilter

netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf .
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

28missi · 05.06.2012, 19:59

Hallo Arne

hier der Log file von OTL

Code:

ATTFilter

OTL logfile created on: 05.06.2012 20:49:24 - Run 4
OTL by OldTimer - Version 3.2.45.0     Folder = C:\Dokumente und Einstellungen\test\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,24 Gb Total Physical Memory | 0,88 Gb Available Physical Memory | 71,25% Memory free
1,84 Gb Paging File | 1,65 Gb Available in Paging File | 89,56% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 37,25 Gb Total Space | 25,18 Gb Free Space | 67,60% Space Free | Partition Type: NTFS
 
Computer Name: TEST-101EE4A811 | User Name: test | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.06.01 09:04:26 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\test\Desktop\OTL.exe
PRC - [2011.07.22 09:49:26 | 000,511,920 | ---- | M] (REINER SCT) -- C:\WINDOWS\system32\cjpcsc.exe
PRC - [2011.06.09 14:06:06 | 000,254,696 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
PRC - [2010.02.18 17:44:15 | 000,202,256 | ---- | M] (RealNetworks, Inc.) -- C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
PRC - [2008.04.14 14:00:00 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2003.09.08 15:48:26 | 000,065,536 | ---- | M] () -- C:\Programme\Launch Manager\WButton.exe
PRC - [2003.09.04 15:46:02 | 000,040,960 | ---- | M] (Wistron) -- C:\Programme\Launch Manager\HotkeyApp.exe
PRC - [2003.06.25 10:53:30 | 000,204,800 | ---- | M] (Wistron) -- C:\Programme\Launch Manager\OSD.exe
PRC - [2003.05.12 14:28:50 | 000,032,768 | ---- | M] () -- C:\Programme\Launch Manager\LaunchAp.exe
PRC - [2002.11.25 19:23:20 | 000,172,032 | ---- | M] (Agere Systems) -- C:\Programme\ltmoh\ltmoh.exe
PRC - [1997.10.18 00:00:00 | 000,051,984 | ---- | M] () -- C:\Programme\Microsoft Office\Office\OSA.EXE
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.04.04 07:53:56 | 000,301,056 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.DEU
MOD - [2007.05.31 09:38:16 | 000,167,936 | ---- | M] () -- C:\WINDOWS\system32\SerialXP.dll
MOD - [2003.09.08 15:48:26 | 000,065,536 | ---- | M] () -- C:\Programme\Launch Manager\WButton.exe
MOD - [2003.05.12 14:28:50 | 000,032,768 | ---- | M] () -- C:\Programme\Launch Manager\LaunchAp.exe
MOD - [1997.10.18 00:00:00 | 003,782,416 | ---- | M] () -- C:\Programme\Microsoft Office\Office\MSO97.DLL
MOD - [1997.10.18 00:00:00 | 000,051,984 | ---- | M] () -- C:\Programme\Microsoft Office\Office\OSA.EXE
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Auto | Stopped] -- C:\WINDOWS\system32\eeufail.dll -- (mggmh)
SRV - [2012.06.05 13:18:01 | 000,241,664 | ---- | M] (Parental Solutions Inc.) [Auto | Running] -- C:\WINDOWS\system32\pouavgrhm.dll -- (Dnscache)
SRV - [2012.05.06 15:42:07 | 000,257,696 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.04.21 03:16:42 | 000,129,976 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2011.12.07 15:00:34 | 000,114,000 | ---- | M] (Joosoft.com GmbH) [Auto | Running] -- C:\WINDOWS\system32\UpdSvc.dll -- (Update-Service)
SRV - [2011.07.22 09:49:26 | 000,511,920 | ---- | M] (REINER SCT) [Auto | Running] -- C:\WINDOWS\system32\cjpcsc.exe -- (cjpcsc)
SRV - [2008.07.29 19:16:38 | 000,132,096 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing)
SRV - [2008.04.14 14:00:00 | 000,114,176 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\netdde.exe -- (NetDDEdsdm)
SRV - [2008.04.14 14:00:00 | 000,114,176 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\netdde.exe -- (NetDDE)
SRV - [2008.04.14 14:00:00 | 000,053,248 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\mprdim.dll -- (RemoteAccess)
SRV - [2008.04.14 14:00:00 | 000,033,792 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\msgsvc.dll -- (Messenger)
SRV - [2008.04.14 14:00:00 | 000,017,408 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\alrsvc.dll -- (Alerter)
SRV - [2006.03.03 21:03:10 | 000,069,632 | ---- | M] (HP) [Auto | Stopped] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (WDICA)
DRV - File not found [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\Wbutton.sys -- (Wbutton)
DRV - File not found [Kernel | Disabled | Stopped] -- system32\DRIVERS\s24trans.sys -- (s24trans)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] --  -- (PCIDump)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\23.tmp -- (MEMSWEEP2)
DRV - File not found [Kernel | System | Stopped] --  -- (mailKmd)
DRV - File not found [Kernel | System | Stopped] --  -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] --  -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] --  -- (Changer)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOKUME~1\test\LOKALE~1\Temp\catchme.sys -- (catchme)
DRV - [2011.03.29 13:08:08 | 000,028,144 | ---- | M] (REINER SCT) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\cjusb.sys -- (cjusb)
DRV - [2010.11.06 14:11:12 | 000,035,008 | ---- | M] (hxxp://libusb-win32.sourceforge.net) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\libusb0.sys -- (libusb0)
DRV - [2008.11.25 10:49:44 | 000,040,960 | R--- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Rts5161ccid.sys -- (USBCCID)
DRV - [2008.04.14 14:00:00 | 000,800,384 | ---- | M] (Microsoft Corp., Veritas Software) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\dmboot.sys -- (dmboot)
DRV - [2008.04.14 14:00:00 | 000,143,744 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\fastfat.sys -- (Fastfat)
DRV - [2008.04.14 14:00:00 | 000,066,048 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\udfs.sys -- (Udfs)
DRV - [2008.04.14 14:00:00 | 000,013,952 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\cbidf2k.sys -- (cbidf2k)
DRV - [2007.05.31 09:38:16 | 000,014,949 | ---- | M] (franson.biz) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\bizVSerialNT.sys -- (bizVSerial)
DRV - [2006.04.28 17:26:46 | 000,088,688 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SE27mgmt.sys -- (SE27mgmt) Sony Ericsson Device 039 USB WMC Device Management Drivers (WDM)
DRV - [2006.04.28 17:25:44 | 000,097,184 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SE27mdm.sys -- (SE27mdm)
DRV - [2006.04.28 17:25:40 | 000,009,360 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SE27mdfl.sys -- (SE27mdfl)
DRV - [2006.04.28 17:24:42 | 000,061,600 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SE27bus.sys -- (SE27bus) Sony Ericsson Device 039 Driver driver (WDM)
DRV - [2005.12.21 05:32:56 | 000,029,152 | R--- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usb2vcom.sys -- (usb2vcom)
DRV - [2005.09.19 03:07:00 | 000,035,275 | ---- | M] (SCM Microsystems Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\TwkUsb2K.sys -- (CHIPDRIVE USB SmartCardReader)
DRV - [2004.08.25 15:06:00 | 000,185,611 | ---- | M] (SCM Microsystems Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\TWKSER2K.sys -- (TWKSER2K)
DRV - [2004.01.02 20:52:00 | 001,646,720 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\w22n51.sys -- (w22n51) Intel(R)
DRV - [2003.07.15 02:33:26 | 000,111,168 | ---- | M] (Applied Drivers Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\cwawdm.sys -- (cs429x)
DRV - [2003.05.07 04:46:38 | 000,026,240 | ---- | M] (Winbond Electronics Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\wbsd.sys -- (WBSD) Winbond Secure Digital Storage (SD/MMC)
DRV - [2003.04.28 11:27:06 | 000,009,867 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\HOTKEY.sys -- (Hotkey)
DRV - [2003.04.24 02:14:00 | 000,004,828 | ---- | M] (Towitoko AG) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\TWKMS.sys -- (TwkMs)
DRV - [2003.04.16 02:04:18 | 000,030,464 | ---- | M] (Winbond Electronics Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\wbms.sys -- (WBMS) Winbond Memory Stick Storage (MS)
DRV - [2003.02.14 20:59:14 | 001,169,792 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2002.12.17 21:41:36 | 000,042,368 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\bcm4sbxp.sys -- (bcm4sbxp)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.web.de/br/ie8_startpage
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.bing.com/?PC=BNHP
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\..\SearchScopes\{02DC2E6A-4707-456F-AE7A-CB12C4CC1787}: "URL" = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&affID=110819&tl=gbn193052&tt=050412_30b&babsrc=SP_ss&mntrId=4c9fa22b000000000000000e356ecbd5
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\..\SearchScopes\{1BD30256-1263-4BDE-BA34-98DBBBA3AFC4}: "URL" = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\..\SearchScopes\{28A90140-3C17-454D-A26D-F38EC69C483F}: "URL" = hxxp://go.gmx.net/tb/ie_searchplugin/?su={searchTerms}
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\..\SearchScopes\{75E3E68F-CE3C-4387-9EC3-BC67702BB0FE}: "URL" = hxxp://go.web.de/br/ie8_search_amazon/?keywords={searchTerms}
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\..\SearchScopes\{7D3489F0-9553-4BDD-8299-CB1A8C3E85F5}: "URL" = hxxp://go.web.de/br/ie8_search_web/?su={searchTerms}
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2613550
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\..\SearchScopes\{BB47DE44-9AA3-4E82-AE9E-06732B7DDB4E}: "URL" = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\..\SearchScopes\{EBC4F45B-0875-4BC2-99AB-5FCDB9A8F578}: "URL" = hxxp://go.web.de/br/ie8_search_ebay/?q={searchTerms}
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Search the web (Babylon)"
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..browser.search.selectedEngine: "Bing"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.web.de/"
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.0
FF - prefs.js..extensions.enabledItems: {fd639891-5cc6-45ae-9055-a7a6abb5a7a9}:1.2.12.0
FF - prefs.js..extensions.enabledItems: {d40f5e7b-d2cf-4856-b441-cc613eeffbe3}:1.67
FF - prefs.js..keyword.URL: "hxxp://search.babylon.com/?affID=110819&tl=gbn193052&tt=050412_30b&babsrc=KW_ss&mntrId=4c9fa22b000000000000000e356ecbd5&q="
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@checkpoint.com/FFApi: C:\Programme\CheckPoint\ZAForceField\TrustChecker\bin\npFFApi.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.688: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.688: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.688: c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010.02.18 17:45:23 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.05.01 15:30:17 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2012.04.12 14:00:13 | 000,000,000 | ---D | M]
 
[2010.02.12 16:27:32 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Extensions
[2010.02.12 16:27:32 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012.05.30 14:18:24 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\extensions
[2011.07.23 14:22:07 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012.05.30 14:18:24 | 000,000,000 | ---D | M] (ZoneAlarm-Sicherheit Community Toolbar) -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\extensions\{fc2b76fc-2132-4d80-a9a3-1f5c6e49066b}
[2011.12.10 10:20:04 | 000,000,000 | ---D | M] (Santander Chipcard Plugin) -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\extensions\{fd639891-5cc6-45ae-9055-a7a6abb5a7a9}
[2011.12.19 21:56:47 | 000,000,933 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\searchplugins\11-suche.xml
[2011.10.13 17:19:44 | 000,000,855 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\searchplugins\1und1-suche.xml
[2011.10.10 15:27:30 | 000,001,281 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\searchplugins\amazondotcom-de.xml
[2011.10.10 14:59:22 | 000,002,364 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\searchplugins\eBay-de.xml
[2011.12.19 21:56:47 | 000,002,419 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\searchplugins\englische-ergebnisse.xml
[2011.10.13 17:01:56 | 000,010,507 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\searchplugins\gmx-suche.xml
[2011.10.10 15:12:38 | 000,002,385 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\searchplugins\lastminute.xml
[2011.10.13 17:34:10 | 000,002,248 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\searchplugins\mailcom-search.xml
[2011.10.13 15:07:08 | 000,005,490 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\searchplugins\webde-suche.xml
[2012.05.01 15:30:13 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.05.01 15:30:14 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\distribution\extensions
[2012.05.01 15:30:14 | 000,000,000 | ---D | M] (WEB.DE Toolbar) -- C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de
[2012.01.22 17:10:05 | 000,138,614 | ---- | M] () (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\TEST\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\605JKKZ1.DEFAULT\EXTENSIONS\{D40F5E7B-D2CF-4856-B441-CC613EEFFBE3}.XPI
[2012.04.21 03:18:00 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2011.11.10 06:54:13 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll
[2008.09.15 11:52:06 | 000,376,832 | ---- | M] ( ) -- C:\Programme\mozilla firefox\plugins\npsnapfish.dll
[2007.04.11 07:17:00 | 000,954,368 | ---- | M] (PPI Financial Systems GmbH) -- C:\Programme\mozilla firefox\plugins\NP_SEBChipcardPlugin.dll
[2012.04.21 03:54:08 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.04.05 20:49:12 | 000,002,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\babylon.xml
[2012.04.21 03:54:08 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2012.04.21 03:54:08 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2012.04.21 03:54:08 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.04.21 03:54:08 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.04.21 03:54:08 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2012.01.17 22:50:18 | 000,441,479 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: 127.0.0.1	www.007guard.com
O1 - Hosts: 127.0.0.1	007guard.com
O1 - Hosts: 127.0.0.1	008i.com
O1 - Hosts: 127.0.0.1	www.008k.com
O1 - Hosts: 127.0.0.1	008k.com
O1 - Hosts: 127.0.0.1	www.00hq.com
O1 - Hosts: 127.0.0.1	00hq.com
O1 - Hosts: 127.0.0.1	010402.com
O1 - Hosts: 127.0.0.1	www.032439.com
O1 - Hosts: 127.0.0.1	032439.com
O1 - Hosts: 127.0.0.1	www.1001-search.info
O1 - Hosts: 127.0.0.1	1001-search.info
O1 - Hosts: 127.0.0.1	www.100888290cs.com
O1 - Hosts: 127.0.0.1	100888290cs.com
O1 - Hosts: 127.0.0.1	www.100sexlinks.com
O1 - Hosts: 127.0.0.1	100sexlinks.com
O1 - Hosts: 127.0.0.1	www.10sek.com
O1 - Hosts: 127.0.0.1	10sek.com
O1 - Hosts: 127.0.0.1	www.123topsearch.com
O1 - Hosts: 127.0.0.1	123topsearch.com
O1 - Hosts: 127.0.0.1	www.132.com
O1 - Hosts: 127.0.0.1	132.com
O1 - Hosts: 127.0.0.1	www.136136.net
O1 - Hosts: 127.0.0.1	136136.net
O1 - Hosts: 15212 more lines...
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O3 - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\..\Toolbar\WebBrowser: (no name) - {C424171E-592A-415A-9EB1-DFD6D95D3530} - No CLSID value found.
O3 - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\..\Toolbar\WebBrowser: (no name) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - No CLSID value found.
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [CtrlVol] C:\Programme\Launch Manager\CtrlVol.exe (Wistron)
O4 - HKLM..\Run: [HotkeyApp] C:\Programme\Launch Manager\HotkeyApp.exe (Wistron)
O4 - HKLM..\Run: [LaunchAp] C:\Programme\Launch Manager\LaunchAp.exe ()
O4 - HKLM..\Run: [LMgrOSD] C:\Programme\Launch Manager\OSD.exe (Wistron)
O4 - HKLM..\Run: [LtMoh] C:\Programme\ltmoh\ltmoh.exe (Agere Systems)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [Wbutton] C:\Programme\Launch Manager\Wbutton.exe ()
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Microsoft-Indexerstellung.lnk = C:\Programme\Microsoft Office\Office\FINDFAST.EXE (Microsoft Corporation)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Office-Start.lnk = C:\Programme\Microsoft Office\Office\OSA.EXE ()
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\VR-NetWorld Auftragsprüfung.lnk = C:\Programme\VR-NetWorld\VRToolCheckOrder.exe (VR-NetWorld Software)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\WISO Mein Steuer-Sparbuch heute.lnk = C:\Programme\WISO\Steuersoftware 2012\mshaktuell.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0A88DECB-188B-4A64-80E9-CE5FEB4BB59D}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - (igfxsrvc.dll) - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.04.17 16:08:06 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
NetSvcs: 6to4 -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: mggmh - C:\WINDOWS\system32\eeufail.dll File not found
 
 
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: DnsCache - C:\WINDOWS\system32\pouavgrhm.dll (Parental Solutions Inc.)
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7
ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Sicherheitsupdate für Windows XP (KB923789)
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {ACC563BC-4266-43f0-B6ED-9D38C4202C7E} - 
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
ActiveX: >{E9D28A7F-49A0-41E8-95B7-4C699B1D3A6A} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
 
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.06.05 13:18:01 | 000,241,664 | ---- | C] (Parental Solutions Inc.) -- C:\WINDOWS\System32\pouavgrhm.dll
[2012.06.04 19:23:36 | 000,000,000 | ---D | C] -- C:\Programme\ESET
[2012.06.04 16:17:19 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2012.06.04 16:14:46 | 010,063,000 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Dokumente und Einstellungen\test\Desktop\mbam-setup-1.61.0.1400.exe
[2012.06.01 09:04:18 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\test\Desktop\OTL.exe
[2012.06.01 07:18:38 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\test\Recent
[2012.05.21 20:34:49 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\test\Downloads
[2012.05.09 13:58:59 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Kaspersky SDK
[2012.05.09 13:49:00 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\test\Eigene Dateien\ForceField Shared Files
[2012.05.09 13:48:51 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\CheckPoint
[2012.05.09 13:48:35 | 000,000,000 | ---D | C] -- C:\Programme\Conduit
[2012.05.09 13:48:31 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\test\Lokale Einstellungen\Anwendungsdaten\Conduit
[2012.05.09 13:46:01 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CheckPoint
[2012.05.09 13:45:53 | 000,000,000 | ---D | C] -- C:\Programme\CheckPoint
[2012.05.09 13:20:21 | 000,000,000 | -H-D | C] -- C:\WINDOWS\$hf_mig$
[2012.05.08 13:39:53 | 000,000,000 | -H-D | C] -- C:\Dokumente und Einstellungen\test\Desktop\Lokale Einstellungen
[2012.05.07 14:32:56 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\FastStone
[2012.05.07 14:32:52 | 000,000,000 | ---D | C] -- C:\Programme\FastStone Capture
[2012.05.07 14:32:52 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\FastStone Capture
[2012.01.23 11:35:11 | 039,401,336 | ---- | C] (Apple Inc.) -- C:\Programme\QuickTimeInstaller.exe
[2011.12.07 14:58:44 | 000,541,544 | ---- | C] (JooSoft GmbH) -- C:\Programme\7z920.exe
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.06.05 20:49:19 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1275210071-1993962763-1957994488-1003.job
[2012.06.05 20:49:19 | 000,000,268 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1275210071-1993962763-1957994488-1003.job
[2012.06.05 20:40:00 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012.06.05 14:21:46 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.06.05 14:21:20 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.06.05 13:18:01 | 000,241,664 | ---- | M] (Parental Solutions Inc.) -- C:\WINDOWS\System32\pouavgrhm.dll
[2012.06.04 16:16:45 | 010,063,000 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Dokumente und Einstellungen\test\Desktop\mbam-setup-1.61.0.1400.exe
[2012.06.04 15:48:16 | 000,184,763 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Desktop\2012-06-04 xax Arbeitsvertrag UK (Entwurf).pdf
[2012.06.01 09:17:17 | 000,302,592 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Desktop\omm346gc.exe
[2012.06.01 09:04:26 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\test\Desktop\OTL.exe
[2012.06.01 09:02:06 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\test\defogger_reenable
[2012.06.01 08:13:10 | 000,001,452 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Desktop\message-rfc822-attachment.eml
[2012.06.01 08:08:19 | 000,126,912 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012.06.01 07:14:17 | 000,278,352 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Eigene Dateien\cc_20120601_071402.reg
[2012.06.01 07:04:06 | 000,000,660 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Dokumente\Desktop\CCleaner.lnk
[2012.05.31 08:36:04 | 000,010,726 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Eigene Dateien\VR-NetWorld.pdf
[2012.05.21 20:35:27 | 000,000,022 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Desktop\ausmalbild_kostenlos.zip
[2012.05.09 19:37:24 | 000,479,376 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2012.05.09 19:37:24 | 000,433,138 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012.05.09 19:37:24 | 000,092,732 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2012.05.09 19:37:24 | 000,068,094 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012.05.07 14:32:52 | 000,000,728 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Dokumente\Desktop\FastStone Capture.lnk
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.06.04 15:46:50 | 000,184,763 | ---- | C] () -- C:\Dokumente und Einstellungen\test\Desktop\2012-06-04 xax Arbeitsvertrag UK (Entwurf).pdf
[2012.06.01 09:17:14 | 000,302,592 | ---- | C] () -- C:\Dokumente und Einstellungen\test\Desktop\omm346gc.exe
[2012.06.01 09:02:06 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\test\defogger_reenable
[2012.06.01 08:13:06 | 000,001,452 | ---- | C] () -- C:\Dokumente und Einstellungen\test\Desktop\message-rfc822-attachment.eml
[2012.06.01 08:08:19 | 000,126,912 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012.06.01 07:14:11 | 000,278,352 | ---- | C] () -- C:\Dokumente und Einstellungen\test\Eigene Dateien\cc_20120601_071402.reg
[2012.05.21 20:34:54 | 000,000,022 | ---- | C] () -- C:\Dokumente und Einstellungen\test\Desktop\ausmalbild_kostenlos.zip
[2012.05.07 14:32:52 | 000,000,728 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Dokumente\Desktop\FastStone Capture.lnk
[2012.02.15 14:11:59 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2012.01.03 11:56:09 | 000,000,595 | ---- | C] () -- C:\WINDOWS\wiso.ini
[2012.01.02 20:03:27 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2012.01.02 20:03:27 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2012.01.02 20:03:27 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2012.01.02 20:03:27 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2012.01.02 20:03:27 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2012.01.02 17:56:26 | 000,103,981 | ---- | C] () -- C:\WINDOWS\hpoins08.dat
[2012.01.02 17:56:26 | 000,004,445 | ---- | C] () -- C:\WINDOWS\hpomdl08.dat
[2011.12.21 15:02:26 | 000,000,095 | ---- | C] () -- C:\WINDOWS\ParrotFlashWiz.INI
[2011.10.29 12:58:18 | 000,167,936 | ---- | C] () -- C:\WINDOWS\System32\SerialXP.dll
[2011.10.29 12:58:18 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\win32com.dll
[2011.10.09 10:54:17 | 000,000,364 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2011.10.05 18:24:07 | 000,001,296 | ---- | C] () -- C:\WINDOWS\HBCIKRNL.INI
[2010.09.21 17:42:55 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\drivers\SymSMR130.dat
 
========== LOP Check ==========
 
[2011.12.06 22:36:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\adisoft AG
[2011.12.07 15:09:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Babylon
[2010.02.04 22:53:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\BTrieve
[2012.03.19 15:57:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Buhl Data Service GmbH
[2012.05.09 13:46:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CheckPoint
[2012.01.20 16:14:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DesktopIcons
[2012.05.09 13:58:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Kaspersky SDK
[2010.02.07 16:28:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Lexware
[2009.04.25 10:25:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Drivers HeadQuarters
[2011.10.29 12:58:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\REINER SCT
[2012.01.18 08:10:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Bytemobile
[2012.01.20 17:26:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\1&1 Mail & Media GmbH
[2009.11.24 18:46:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\ACD Systems
[2012.01.03 12:03:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Buhl Data Service
[2012.05.09 13:48:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\CheckPoint
[2011.07.07 07:05:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Image Zone Express
[2010.02.05 10:03:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Lexware
[2010.09.18 09:16:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\OpenOffice.org
[2011.12.11 17:14:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Teleca
[2010.02.12 16:27:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Thunderbird
[2010.05.22 23:14:13 | 000,000,484 | ---- | M] () -- C:\WINDOWS\Tasks\Install.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2012.01.20 17:26:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\1&1 Mail & Media GmbH
[2009.11.24 18:46:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\ACD Systems
[2012.01.25 10:16:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Adobe
[2010.02.26 21:32:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Ahead
[2012.01.24 09:28:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Apple Computer
[2012.01.03 12:03:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Buhl Data Service
[2012.05.09 13:48:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\CheckPoint
[2012.05.07 14:32:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\FastStone
[2009.11.27 13:11:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Help
[2009.04.19 21:00:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\HP
[2009.04.17 16:14:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Identities
[2011.07.07 07:05:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Image Zone Express
[2009.04.25 14:35:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\InstallShield
[2010.02.05 10:03:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Lexware
[2011.12.25 13:04:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Macromedia
[2012.01.17 17:28:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Malwarebytes
[2012.01.25 10:16:40 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Microsoft
[2009.04.18 15:06:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla
[2010.09.18 09:16:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\OpenOffice.org
[2010.02.18 17:48:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Real
[2009.09.28 20:37:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Sony Ericsson
[2010.02.05 10:25:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Sun
[2011.12.11 17:14:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Teleca
[2010.02.12 16:27:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Thunderbird
[2011.12.07 15:11:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\WinRAR
 
< %APPDATA%\*.exe /s >
[2011.10.05 19:18:39 | 000,045,056 | R--- | M] (InstallShield Software Corp.) -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Microsoft\Installer\{AA898D01-D4E3-43C6-8E25-70CA660B9F16}\NewShortcut2_DF0CCA89BE294B7D9A229DB872E01239.exe
[2011.10.05 19:18:39 | 000,040,960 | R--- | M] (InstallShield Software Corp.) -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Microsoft\Installer\{AA898D01-D4E3-43C6-8E25-70CA660B9F16}\NewShortcut3_DF0CCA89BE294B7D9A229DB872E01239.exe
[2011.10.05 19:18:39 | 000,040,960 | R--- | M] (InstallShield Software Corp.) -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Microsoft\Installer\{AA898D01-D4E3-43C6-8E25-70CA660B9F16}\NewShortcut8_DF0CCA89BE294B7D9A229DB872E01239.exe
 
< %SYSTEMDRIVE%\*.exe >
 
< MD5 for: AGP440.SYS  >
[2008.04.14 14:00:00 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2008.04.14 14:00:00 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008.04.14 00:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ERDNT\cache\atapi.sys
[2008.04.14 00:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\dllcache\atapi.sys
[2008.04.14 00:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2008.04.14 14:00:00 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\ReinstallBackups\0006\DriverFiles\i386\atapi.sys
 
< MD5 for: EVENTLOG.DLL  >
[2008.04.14 14:00:00 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\ERDNT\cache\eventlog.dll
[2008.04.14 14:00:00 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\dllcache\eventlog.dll
[2008.04.14 14:00:00 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll
 
< MD5 for: NETLOGON.DLL  >
[2008.04.14 14:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\ERDNT\cache\netlogon.dll
[2008.04.14 14:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\dllcache\netlogon.dll
[2008.04.14 14:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll
 
< MD5 for: SCECLI.DLL  >
[2008.04.14 14:00:00 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\ERDNT\cache\scecli.dll
[2008.04.14 14:00:00 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\dllcache\scecli.dll
[2008.04.14 14:00:00 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll
 
< MD5 for: USER32.DLL  >
[2008.04.14 14:00:00 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\ERDNT\cache\user32.dll
[2008.04.14 14:00:00 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\dllcache\user32.dll
[2008.04.14 14:00:00 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.04.14 14:00:00 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ERDNT\cache\userinit.exe
[2008.04.14 14:00:00 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\dllcache\userinit.exe
[2008.04.14 14:00:00 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2008.04.14 14:00:00 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ERDNT\cache\winlogon.exe
[2008.04.14 14:00:00 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\dllcache\winlogon.exe
[2008.04.14 14:00:00 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2008.04.14 14:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys
[2008.04.14 14:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2009.04.17 17:50:23 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav
[2009.04.17 17:50:23 | 001,089,536 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav
[2009.04.17 17:50:23 | 000,442,368 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< End of report >

Wie jetzt weiter?

Vielen Dank !!!

cosinus · 05.06.2012, 20:30

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

ATTFilter

:OTL
SRV - File not found [Auto | Stopped] -- C:\WINDOWS\system32\eeufail.dll -- (mggmh)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\23.tmp -- (MEMSWEEP2)
DRV - File not found [Kernel | System | Stopped] --  -- (mailKmd)
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.web.de/br/ie8_startpage
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.bing.com/?PC=BNHP
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\..\SearchScopes\{02DC2E6A-4707-456F-AE7A-CB12C4CC1787}: "URL" = http://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/?q={searchTerms}&affID=110819&tl=gbn193052&tt=050412_30b&babsrc=SP_ss&mntrId=4c9fa22b000000000000000e356ecbd5
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\..\SearchScopes\{1BD30256-1263-4BDE-BA34-98DBBBA3AFC4}: "URL" = http://go.web.de/tb/ie_searchplugin/?su={searchTerms}
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\..\SearchScopes\{28A90140-3C17-454D-A26D-F38EC69C483F}: "URL" = http://go.gmx.net/tb/ie_searchplugin/?su={searchTerms}
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\..\SearchScopes\{75E3E68F-CE3C-4387-9EC3-BC67702BB0FE}: "URL" = http://go.web.de/br/ie8_search_amazon/?keywords={searchTerms}
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\..\SearchScopes\{7D3489F0-9553-4BDD-8299-CB1A8C3E85F5}: "URL" = http://go.web.de/br/ie8_search_web/?su={searchTerms}
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2613550
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\..\SearchScopes\{BB47DE44-9AA3-4E82-AE9E-06732B7DDB4E}: "URL" = http://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\..\SearchScopes\{EBC4F45B-0875-4BC2-99AB-5FCDB9A8F578}: "URL" = http://go.web.de/br/ie8_search_ebay/?q={searchTerms}
FF - prefs.js..browser.search.defaultenginename: "Search the web (Babylon)"
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..keyword.URL: "http://search.babylon.com/?affID=110819&tl=gbn193052&tt=050412_30b&babsrc=KW_ss&mntrId=4c9fa22b000000000000000e356ecbd5&q="
FF - HKLM\Software\MozillaPlugins\@checkpoint.com/FFApi: C:\Programme\CheckPoint\ZAForceField\TrustChecker\bin\npFFApi.dll File not found
[2011.07.23 14:22:07 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012.05.30 14:18:24 | 000,000,000 | ---D | M] (ZoneAlarm-Sicherheit Community Toolbar) -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\extensions\{fc2b76fc-2132-4d80-a9a3-1f5c6e49066b}
[2012.05.01 15:30:14 | 000,000,000 | ---D | M] (WEB.DE Toolbar) -- C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de
[2012.04.05 20:49:12 | 000,002,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\babylon.xml
O3 - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\..\Toolbar\WebBrowser: (no name) - {C424171E-592A-415A-9EB1-DFD6D95D3530} - No CLSID value found.
O3 - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\..\Toolbar\WebBrowser: (no name) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - No CLSID value found.
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
NetSvcs: mggmh - C:\WINDOWS\system32\eeufail.dll File not found
:Files
C:\WINDOWS\System32\pouavgrhm.dll
C:\Programme\CheckPoint
C:\Dokumente und Einstellungen\test\Anwendungsdaten\CheckPoint
C:\Programme\Conduit
C:\Dokumente und Einstellungen\test\Lokale Einstellungen\Anwendungsdaten\Conduit
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CheckPoint
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Babylon
:Commands
[purity]
[emptytemp]
[emptyflash]
[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

28missi · 06.06.2012, 20:10

Hallo Arne,

habe alles nach Deiner Anweisung durchgeführt

hier der Logfile

Code:

ATTFilter

All processes killed
========== OTL ==========
Service mggmh stopped successfully!
Service mggmh deleted successfully!
File C:\WINDOWS\system32\eeufail.dll not found.
Service MEMSWEEP2 stopped successfully!
Service MEMSWEEP2 deleted successfully!
File C:\WINDOWS\system32\23.tmp not found.
Service mailKmd stopped successfully!
Service mailKmd deleted successfully!
HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\SOFTWARE\Microsoft\Internet Explorer\Main\\Default_Page_URL| /E : value set successfully!
HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKEY_USERS\S-1-5-21-1275210071-1993962763-1957994488-1003\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_USERS\S-1-5-21-1275210071-1993962763-1957994488-1003\Software\Microsoft\Internet Explorer\SearchScopes\{02DC2E6A-4707-456F-AE7A-CB12C4CC1787}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02DC2E6A-4707-456F-AE7A-CB12C4CC1787}\ not found.
Registry key HKEY_USERS\S-1-5-21-1275210071-1993962763-1957994488-1003\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_USERS\S-1-5-21-1275210071-1993962763-1957994488-1003\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ not found.
Registry key HKEY_USERS\S-1-5-21-1275210071-1993962763-1957994488-1003\Software\Microsoft\Internet Explorer\SearchScopes\{1BD30256-1263-4BDE-BA34-98DBBBA3AFC4}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1BD30256-1263-4BDE-BA34-98DBBBA3AFC4}\ not found.
Registry key HKEY_USERS\S-1-5-21-1275210071-1993962763-1957994488-1003\Software\Microsoft\Internet Explorer\SearchScopes\{28A90140-3C17-454D-A26D-F38EC69C483F}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{28A90140-3C17-454D-A26D-F38EC69C483F}\ not found.
Registry key HKEY_USERS\S-1-5-21-1275210071-1993962763-1957994488-1003\Software\Microsoft\Internet Explorer\SearchScopes\{75E3E68F-CE3C-4387-9EC3-BC67702BB0FE}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75E3E68F-CE3C-4387-9EC3-BC67702BB0FE}\ not found.
Registry key HKEY_USERS\S-1-5-21-1275210071-1993962763-1957994488-1003\Software\Microsoft\Internet Explorer\SearchScopes\{7D3489F0-9553-4BDD-8299-CB1A8C3E85F5}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7D3489F0-9553-4BDD-8299-CB1A8C3E85F5}\ not found.
Registry key HKEY_USERS\S-1-5-21-1275210071-1993962763-1957994488-1003\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ not found.
Registry key HKEY_USERS\S-1-5-21-1275210071-1993962763-1957994488-1003\Software\Microsoft\Internet Explorer\SearchScopes\{BB47DE44-9AA3-4E82-AE9E-06732B7DDB4E}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BB47DE44-9AA3-4E82-AE9E-06732B7DDB4E}\ not found.
Registry key HKEY_USERS\S-1-5-21-1275210071-1993962763-1957994488-1003\Software\Microsoft\Internet Explorer\SearchScopes\{EBC4F45B-0875-4BC2-99AB-5FCDB9A8F578}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EBC4F45B-0875-4BC2-99AB-5FCDB9A8F578}\ not found.
Prefs.js: "Search the web (Babylon)" removed from browser.search.defaultenginename
Prefs.js: "Search the web (Babylon)" removed from browser.search.order.1
Prefs.js: "hxxp://search.babylon.com/?affID=110819&tl=gbn193052&tt=050412_30b&babsrc=KW_ss&mntrId=4c9fa22b000000000000000e356ecbd5&q=" removed from keyword.URL
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@checkpoint.com/FFApi\ deleted successfully.
C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}\defaults\preferences folder moved successfully.
C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}\defaults folder moved successfully.
C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}\chrome folder moved successfully.
C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} folder moved successfully.
C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\extensions\{fc2b76fc-2132-4d80-a9a3-1f5c6e49066b}\searchplugin folder moved successfully.
C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\extensions\{fc2b76fc-2132-4d80-a9a3-1f5c6e49066b}\Plugins folder moved successfully.
C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\extensions\{fc2b76fc-2132-4d80-a9a3-1f5c6e49066b}\modules folder moved successfully.
C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\extensions\{fc2b76fc-2132-4d80-a9a3-1f5c6e49066b}\META-INF folder moved successfully.
C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\extensions\{fc2b76fc-2132-4d80-a9a3-1f5c6e49066b}\defaults folder moved successfully.
C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\extensions\{fc2b76fc-2132-4d80-a9a3-1f5c6e49066b}\components folder moved successfully.
C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\extensions\{fc2b76fc-2132-4d80-a9a3-1f5c6e49066b}\chrome folder moved successfully.
C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\extensions\{fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\skin\webapps folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\skin\weather folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\skin\ticker folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\skin\shopping folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\skin\search folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\skin\pref folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\skin\phish folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\skin\newtab\initial-thumbs folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\skin\newtab folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\skin\neterror folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\skin\horoscope folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\skin\homebutton folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\skin\highlight folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\skin\help folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\skin\email folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\skin\ebay folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\skin\brand folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\skin folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\en-US\webapps folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\en-US\weather folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\en-US\ticker folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\en-US\shopping folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\en-US\search folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\en-US\pref folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\en-US\phish folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\en-US\newtab folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\en-US\neterror folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\en-US\main folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\en-US\horoscope folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\en-US\highlight folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\en-US\help folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\en-US\email folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\en-US\ebay folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\en-US folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\de-DE\webapps folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\de-DE\weather folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\de-DE\ticker folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\de-DE\shopping folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\de-DE\search folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\de-DE\pref folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\de-DE\phish folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\de-DE\newtab folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\de-DE\neterror folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\de-DE\main folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\de-DE\horoscope folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\de-DE\highlight folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\de-DE\help\page folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\de-DE\help folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\de-DE\email folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\de-DE\ebay folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\de-DE folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\defaults\preferences folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\defaults folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\content\webapps folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\content\weather folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\content\util folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\content\tracking folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\content\ticker folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\content\shopping folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\content\search\mcollect folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\content\search folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\content\pref folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\content\phish folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\content\newtab folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\content\neterror folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\content\main folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\content\hotnews folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\content\horoscope folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\content\highlight folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\content\help folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\content\email folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\content\ebay folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\content folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\components folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de folder moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\babylon.xml moved successfully.
Registry value HKEY_USERS\S-1-5-21-1275210071-1993962763-1957994488-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{C424171E-592A-415A-9EB1-DFD6D95D3530} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C424171E-592A-415A-9EB1-DFD6D95D3530}\ not found.
Registry value HKEY_USERS\S-1-5-21-1275210071-1993962763-1957994488-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\HonorAutoRunSetting deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveAutoRun deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDrives deleted successfully.
Registry key HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry value HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveAutoRun deleted successfully.
Registry key HKEY_USERS\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry value HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun not found.
Registry value HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveAutoRun not found.
Registry key HKEY_USERS\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry value HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry key HKEY_USERS\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry value HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry key HKEY_USERS\S-1-5-21-1275210071-1993962763-1957994488-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel\ deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1275210071-1993962763-1957994488-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1275210071-1993962763-1957994488-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveAutoRun deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1275210071-1993962763-1957994488-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDrives deleted successfully.
mggmh removed from NetSvcs value successfully!
========== FILES ==========
C:\WINDOWS\System32\pouavgrhm.dll moved successfully.
C:\Programme\CheckPoint folder moved successfully.
C:\Dokumente und Einstellungen\test\Anwendungsdaten\CheckPoint\ZoneAlarm Toolbar\TrustChecker folder moved successfully.
C:\Dokumente und Einstellungen\test\Anwendungsdaten\CheckPoint\ZoneAlarm Toolbar\PTPCACHE folder moved successfully.
C:\Dokumente und Einstellungen\test\Anwendungsdaten\CheckPoint\ZoneAlarm Toolbar folder moved successfully.
C:\Dokumente und Einstellungen\test\Anwendungsdaten\CheckPoint folder moved successfully.
C:\Programme\Conduit\Community Alerts folder moved successfully.
C:\Programme\Conduit folder moved successfully.
C:\Dokumente und Einstellungen\test\Lokale Einstellungen\Anwendungsdaten\Conduit\Community Alerts\Log folder moved successfully.
C:\Dokumente und Einstellungen\test\Lokale Einstellungen\Anwendungsdaten\Conduit\Community Alerts\LanguagePacks folder moved successfully.
C:\Dokumente und Einstellungen\test\Lokale Einstellungen\Anwendungsdaten\Conduit\Community Alerts\Feeds folder moved successfully.
C:\Dokumente und Einstellungen\test\Lokale Einstellungen\Anwendungsdaten\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\light folder moved successfully.
C:\Dokumente und Einstellungen\test\Lokale Einstellungen\Anwendungsdaten\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\dark folder moved successfully.
C:\Dokumente und Einstellungen\test\Lokale Einstellungen\Anwendungsdaten\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images folder moved successfully.
C:\Dokumente und Einstellungen\test\Lokale Einstellungen\Anwendungsdaten\Conduit\Community Alerts\Dialogs\AppNotificationDialog folder moved successfully.
C:\Dokumente und Einstellungen\test\Lokale Einstellungen\Anwendungsdaten\Conduit\Community Alerts\Dialogs folder moved successfully.
C:\Dokumente und Einstellungen\test\Lokale Einstellungen\Anwendungsdaten\Conduit\Community Alerts folder moved successfully.
C:\Dokumente und Einstellungen\test\Lokale Einstellungen\Anwendungsdaten\Conduit folder moved successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CheckPoint\ZoneAlarm\Data folder moved successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CheckPoint\ZoneAlarm folder moved successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CheckPoint folder moved successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Babylon folder moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default User
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Jens
 
User: LocalService
->Temp folder emptied: 2203640 bytes
->Temporary Internet Files folder emptied: 32969 bytes
 
User: NetworkService
->Temp folder emptied: 2136488 bytes
->Temporary Internet Files folder emptied: 32902 bytes
 
User: test
->Temp folder emptied: 7788977 bytes
->Temporary Internet Files folder emptied: 5967544 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 132488295 bytes
->Flash cache emptied: 487 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2352202 bytes
%systemroot%\System32 .tmp files removed: 2951 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1826752 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 148,00 mb
 
 
[EMPTYFLASH]
 
User: All Users
 
User: Default User
 
User: Jens
 
User: LocalService
 
User: NetworkService
 
User: test
->Flash cache emptied: 0 bytes
 
Total Flash Files Cleaned = 0,00 mb
 
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.45.0 log created on 06062012_210127

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

Grüße - Ulrike

cosinus · 07.06.2012, 13:42

Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C

nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

28missi · 07.06.2012, 20:06

Hallo Arne

hier das Logfile von TDSS

Code:

ATTFilter

20:57:20.0396 2708	TDSS rootkit removing tool 2.7.36.0 May 21 2012 16:40:16
20:57:21.0077 2708	============================================================
20:57:21.0077 2708	Current date / time: 2012/06/07 20:57:21.0077
20:57:21.0077 2708	SystemInfo:
20:57:21.0077 2708	
20:57:21.0077 2708	OS Version: 5.1.2600 ServicePack: 3.0
20:57:21.0077 2708	Product type: Workstation
20:57:21.0077 2708	ComputerName: TEST-101EE4A811
20:57:21.0077 2708	UserName: test
20:57:21.0077 2708	Windows directory: C:\WINDOWS
20:57:21.0077 2708	System windows directory: C:\WINDOWS
20:57:21.0077 2708	Processor architecture: Intel x86
20:57:21.0077 2708	Number of processors: 1
20:57:21.0077 2708	Page size: 0x1000
20:57:21.0077 2708	Boot type: Normal boot
20:57:21.0077 2708	============================================================
20:57:24.0211 2708	Drive \Device\Harddisk0\DR0 - Size: 0x950A60000 (37.26 Gb), SectorSize: 0x200, Cylinders: 0x1300, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
20:57:24.0211 2708	============================================================
20:57:24.0211 2708	\Device\Harddisk0\DR0:
20:57:24.0211 2708	MBR partitions:
20:57:24.0211 2708	\Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x4A81400
20:57:24.0211 2708	============================================================
20:57:24.0261 2708	C: <-> \Device\Harddisk0\DR0\Partition0
20:57:24.0261 2708	============================================================
20:57:24.0261 2708	Initialize success
20:57:24.0261 2708	============================================================
20:57:48.0806 3484	============================================================
20:57:48.0806 3484	Scan started
20:57:48.0806 3484	Mode: Manual; SigCheck; TDLFS; 
20:57:48.0806 3484	============================================================
20:57:49.0077 3484	Abiosdsk - ok
20:57:49.0097 3484	abp480n5 - ok
20:57:49.0167 3484	ACPI            (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys
20:57:51.0290 3484	ACPI - ok
20:57:51.0340 3484	ACPIEC          (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
20:57:51.0490 3484	ACPIEC - ok
20:57:51.0631 3484	AdobeFlashPlayerUpdateSvc (76d5a3d2a50402a0b9b6ed13c4371e79) C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
20:57:51.0651 3484	AdobeFlashPlayerUpdateSvc - ok
20:57:51.0661 3484	adpu160m - ok
20:57:51.0721 3484	aec             (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
20:57:51.0871 3484	aec - ok
20:57:51.0951 3484	AFD             (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
20:57:52.0001 3484	AFD - ok
20:57:52.0151 3484	AgereSoftModem  (58041495e6d3650c02b1aec525d24089) C:\WINDOWS\system32\DRIVERS\AGRSM.sys
20:57:52.0312 3484	AgereSoftModem - ok
20:57:52.0322 3484	Aha154x - ok
20:57:52.0332 3484	aic78u2 - ok
20:57:52.0342 3484	aic78xx - ok
20:57:52.0402 3484	Alerter         (738d80cc01d7bc7584be917b7f544394) C:\WINDOWS\system32\alrsvc.dll
20:57:52.0702 3484	Alerter - ok
20:57:52.0742 3484	ALG             (190cd73d4984f94d823f9444980513e5) C:\WINDOWS\System32\alg.exe
20:57:52.0822 3484	ALG - ok
20:57:52.0832 3484	AliIde - ok
20:57:52.0842 3484	amsint - ok
20:57:52.0872 3484	AppMgmt         (d45960be52c3c610d361977057f98c54) C:\WINDOWS\System32\appmgmts.dll
20:57:52.0952 3484	AppMgmt - ok
20:57:52.0972 3484	Arp1394         (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
20:57:53.0093 3484	Arp1394 - ok
20:57:53.0103 3484	asc - ok
20:57:53.0113 3484	asc3350p - ok
20:57:53.0123 3484	asc3550 - ok
20:57:53.0243 3484	aspnet_state    (0e5e4957549056e2bf2c49f4f6b601ad) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
20:57:53.0273 3484	aspnet_state - ok
20:57:53.0293 3484	AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
20:57:53.0453 3484	AsyncMac - ok
20:57:53.0513 3484	atapi           (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
20:57:53.0643 3484	atapi - ok
20:57:53.0653 3484	Atdisk - ok
20:57:53.0704 3484	Atmarpc         (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
20:57:53.0864 3484	Atmarpc - ok
20:57:53.0914 3484	AudioSrv        (58ed0d5452df7be732193e7999c6b9a4) C:\WINDOWS\System32\audiosrv.dll
20:57:54.0084 3484	AudioSrv - ok
20:57:54.0144 3484	audstub         (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
20:57:54.0294 3484	audstub - ok
20:57:54.0354 3484	bcm4sbxp        (f5c0d3c93235a455cdd13c954adf1a80) C:\WINDOWS\system32\DRIVERS\bcm4sbxp.sys
20:57:54.0405 3484	bcm4sbxp - ok
20:57:54.0465 3484	Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
20:57:54.0615 3484	Beep - ok
20:57:54.0695 3484	BITS            (d6f603772a789bb3228f310d650b8bd1) C:\WINDOWS\system32\qmgr.dll
20:57:55.0126 3484	BITS - ok
20:57:55.0176 3484	bizVSerial      (66f655b08eed3230e059d197c8a1969b) C:\WINDOWS\system32\drivers\bizVSerialNT.sys
20:57:55.0196 3484	bizVSerial ( UnsignedFile.Multi.Generic ) - warning
20:57:55.0196 3484	bizVSerial - detected UnsignedFile.Multi.Generic (1)
20:57:55.0256 3484	Browser         (b42057f06bbb98b31876c0b3f2b54e33) C:\WINDOWS\System32\browser.dll
20:57:55.0396 3484	Browser - ok
20:57:55.0596 3484	catchme - ok
20:57:55.0636 3484	cbidf2k         (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
20:57:55.0756 3484	cbidf2k - ok
20:57:55.0767 3484	cd20xrnt - ok
20:57:55.0807 3484	Cdaudio         (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
20:57:55.0997 3484	Cdaudio - ok
20:57:56.0057 3484	Cdfs            (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
20:57:56.0257 3484	Cdfs - ok
20:57:56.0327 3484	Cdrom           (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
20:57:56.0528 3484	Cdrom - ok
20:57:56.0538 3484	Changer - ok
20:57:56.0578 3484	CHIPDRIVE USB SmartCardReader (aeee1fc75382147fe6afd2f1250b7c7c) C:\WINDOWS\system32\DRIVERS\TwkUsb2K.sys
20:57:56.0608 3484	CHIPDRIVE USB SmartCardReader ( UnsignedFile.Multi.Generic ) - warning
20:57:56.0608 3484	CHIPDRIVE USB SmartCardReader - detected UnsignedFile.Multi.Generic (1)
20:57:56.0638 3484	CiSvc           (28e3040d1f1ca2008cd6b29dfebc9a5e) C:\WINDOWS\system32\cisvc.exe
20:57:56.0818 3484	CiSvc - ok
20:57:56.0898 3484	cjpcsc          (8fee4423d682394eb436c975d0a3a994) C:\WINDOWS\system32\cjpcsc.exe
20:57:56.0988 3484	cjpcsc - ok
20:57:57.0028 3484	cjusb           (b0dfc4adb1ff150ac466f3dad323196a) C:\WINDOWS\system32\DRIVERS\cjusb.sys
20:57:57.0048 3484	cjusb - ok
20:57:57.0088 3484	ClipSrv         (778a30ed3c134eb7e406afc407e9997d) C:\WINDOWS\system32\clipsrv.exe
20:57:57.0309 3484	ClipSrv - ok
20:57:57.0409 3484	clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
20:57:57.0479 3484	clr_optimization_v2.0.50727_32 - ok
20:57:57.0539 3484	CmBatt          (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
20:57:57.0789 3484	CmBatt - ok
20:57:57.0799 3484	CmdIde - ok
20:57:57.0829 3484	Compbatt        (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
20:57:58.0130 3484	Compbatt - ok
20:57:58.0150 3484	COMSysApp - ok
20:57:58.0160 3484	Cpqarray - ok
20:57:58.0230 3484	CryptSvc        (611f824e5c703a5a899f84c5f1699e4d) C:\WINDOWS\System32\cryptsvc.dll
20:57:58.0370 3484	CryptSvc - ok
20:57:58.0430 3484	cs429x          (4f6e10a312e9b3bcd91bd3f801611c03) C:\WINDOWS\system32\drivers\cwawdm.sys
20:57:58.0470 3484	cs429x - ok
20:57:58.0470 3484	dac2w2k - ok
20:57:58.0480 3484	dac960nt - ok
20:57:58.0581 3484	DcomLaunch      (3127afbf2c1ed0ab14a1bbb7aaecb85b) C:\WINDOWS\system32\rpcss.dll
20:57:58.0701 3484	DcomLaunch - ok
20:57:58.0731 3484	Dhcp            (c29a1c9b75ba38fa37f8c44405dec360) C:\WINDOWS\System32\dhcpcsvc.dll
20:57:58.0981 3484	Dhcp - ok
20:57:59.0041 3484	Disk            (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
20:57:59.0292 3484	Disk - ok
20:57:59.0302 3484	dmadmin - ok
20:57:59.0402 3484	dmboot          (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys
20:57:59.0662 3484	dmboot - ok
20:57:59.0712 3484	dmio            (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys
20:57:59.0953 3484	dmio - ok
20:57:59.0993 3484	dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
20:58:00.0233 3484	dmload - ok
20:58:00.0263 3484	dmserver        (25c83ffbba13b554eb6d59a9b2e2ee78) C:\WINDOWS\System32\dmserver.dll
20:58:00.0483 3484	dmserver - ok
20:58:00.0553 3484	DMusic          (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
20:58:00.0704 3484	DMusic - ok
20:58:00.0704 3484	Dnscache - ok
20:58:00.0754 3484	Dot3svc         (676e36c4ff5bcea1900f44182b9723e6) C:\WINDOWS\System32\dot3svc.dll
20:58:00.0894 3484	Dot3svc - ok
20:58:00.0904 3484	dpti2o - ok
20:58:00.0924 3484	drmkaud         (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
20:58:01.0054 3484	drmkaud - ok
20:58:01.0104 3484	EapHost         (4e4f2fddab0a0736d7671134dcce91fb) C:\WINDOWS\System32\eapsvc.dll
20:58:01.0254 3484	EapHost - ok
20:58:01.0274 3484	ERSvc           (877c18558d70587aa7823a1a308ac96b) C:\WINDOWS\System32\ersvc.dll
20:58:01.0435 3484	ERSvc - ok
20:58:01.0495 3484	Eventlog        (a3edbe9053889fb24ab22492472b39dc) C:\WINDOWS\system32\services.exe
20:58:01.0535 3484	Eventlog - ok
20:58:01.0625 3484	EventSystem     (af4f6b5739d18ca7972ab53e091cbc74) C:\WINDOWS\system32\es.dll
20:58:01.0685 3484	EventSystem - ok
20:58:01.0725 3484	Fastfat         (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
20:58:01.0885 3484	Fastfat - ok
20:58:01.0945 3484	FastUserSwitchingCompatibility (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
20:58:02.0005 3484	FastUserSwitchingCompatibility - ok
20:58:02.0046 3484	Fdc             (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
20:58:02.0196 3484	Fdc - ok
20:58:02.0216 3484	Fips            (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys
20:58:02.0416 3484	Fips - ok
20:58:02.0436 3484	Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
20:58:02.0576 3484	Flpydisk - ok
20:58:02.0616 3484	FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
20:58:02.0757 3484	FltMgr - ok
20:58:02.0877 3484	FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
20:58:02.0887 3484	FontCache3.0.0.0 - ok
20:58:02.0927 3484	Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
20:58:03.0127 3484	Fs_Rec - ok
20:58:03.0137 3484	Ftdisk          (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
20:58:03.0327 3484	Ftdisk - ok
20:58:03.0357 3484	Gpc             (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
20:58:03.0558 3484	Gpc - ok
20:58:03.0628 3484	helpsvc         (cb66bf85bf599befd6c6a57c2e20357f) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
20:58:03.0808 3484	helpsvc - ok
20:58:03.0858 3484	HidServ         (b35da85e60c0103f2e4104532da2f12b) C:\WINDOWS\System32\hidserv.dll
20:58:04.0048 3484	HidServ - ok
20:58:04.0068 3484	HidUsb          (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
20:58:04.0259 3484	HidUsb - ok
20:58:04.0299 3484	hkmsvc          (ed29f14101523a6e0e808107405d452c) C:\WINDOWS\System32\kmsvc.dll
20:58:04.0479 3484	hkmsvc - ok
20:58:04.0519 3484	Hotkey          (8b566ea71d5b76157a9cdb78f25a5731) C:\WINDOWS\system32\drivers\Hotkey.sys
20:58:04.0529 3484	Hotkey ( UnsignedFile.Multi.Generic ) - warning
20:58:04.0529 3484	Hotkey - detected UnsignedFile.Multi.Generic (1)
20:58:04.0539 3484	hpn - ok
20:58:04.0599 3484	HPZid412        (30ca91e657cede2f95359d6ef186f650) C:\WINDOWS\system32\DRIVERS\HPZid412.sys
20:58:04.0830 3484	HPZid412 - ok
20:58:04.0860 3484	HPZipr12        (efd31afa752aa7c7bbb57bcbe2b01c78) C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
20:58:04.0970 3484	HPZipr12 - ok
20:58:05.0000 3484	HPZius12        (7ac43c38ca8fd7ed0b0a4466f753e06e) C:\WINDOWS\system32\DRIVERS\HPZius12.sys
20:58:05.0060 3484	HPZius12 - ok
20:58:05.0130 3484	HTTP            (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
20:58:05.0200 3484	HTTP - ok
20:58:05.0250 3484	HTTPFilter      (9e4adb854cebcfb81a4b36718feecd16) C:\WINDOWS\System32\w3ssl.dll
20:58:05.0561 3484	HTTPFilter - ok
20:58:05.0571 3484	i2omgmt - ok
20:58:05.0581 3484	i2omp - ok
20:58:05.0631 3484	i8042prt        (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
20:58:05.0771 3484	i8042prt - ok
20:58:05.0861 3484	ialm            (84651cab3cad040df1614cd2df408741) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys
20:58:05.0991 3484	ialm - ok
20:58:06.0171 3484	idsvc           (c01ac32dc5c03076cfb852cb5da5229c) c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
20:58:06.0252 3484	idsvc - ok
20:58:06.0422 3484	Imapi           (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
20:58:06.0662 3484	Imapi - ok
20:58:06.0712 3484	ImapiService    (d4b413aa210c21e46aedd2ba5b68d38e) C:\WINDOWS\system32\imapi.exe
20:58:06.0983 3484	ImapiService - ok
20:58:06.0993 3484	ini910u - ok
20:58:07.0063 3484	IntelIde        (69c4e3c9e67a1f103b94e14fdd5f3213) C:\WINDOWS\system32\DRIVERS\intelide.sys
20:58:07.0193 3484	IntelIde - ok
20:58:07.0253 3484	intelppm        (4c7d2750158ed6e7ad642d97bffae351) C:\WINDOWS\system32\DRIVERS\intelppm.sys
20:58:07.0373 3484	intelppm - ok
20:58:07.0403 3484	Ip6Fw           (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
20:58:07.0523 3484	Ip6Fw - ok
20:58:07.0594 3484	IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
20:58:07.0734 3484	IpFilterDriver - ok
20:58:07.0744 3484	IpInIp          (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
20:58:07.0874 3484	IpInIp - ok
20:58:07.0914 3484	IpNat           (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
20:58:08.0074 3484	IpNat - ok
20:58:08.0134 3484	IPSec           (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
20:58:08.0274 3484	IPSec - ok
20:58:08.0295 3484	irda            (aca5e7b54409f9cb5eed97ed0c81120e) C:\WINDOWS\system32\DRIVERS\irda.sys
20:58:08.0365 3484	irda - ok
20:58:08.0415 3484	IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
20:58:08.0485 3484	IRENUM - ok
20:58:08.0515 3484	Irmon           (2efe1db1ec58a26b0c14bfda122e246f) C:\WINDOWS\System32\irmon.dll
20:58:08.0605 3484	Irmon - ok
20:58:08.0675 3484	isapnp          (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys
20:58:08.0835 3484	isapnp - ok
20:58:08.0996 3484	JavaQuickStarterService (9aa67569d5257462e230767510b0c815) C:\Programme\Java\jre6\bin\jqs.exe
20:58:09.0026 3484	JavaQuickStarterService - ok
20:58:09.0096 3484	Kbdclass        (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
20:58:09.0326 3484	Kbdclass - ok
20:58:09.0396 3484	kbdhid          (b6d6c117d771c98130497265f26d1882) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
20:58:09.0616 3484	kbdhid - ok
20:58:09.0677 3484	kmixer          (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
20:58:09.0907 3484	kmixer - ok
20:58:09.0967 3484	KSecDD          (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
20:58:10.0107 3484	KSecDD - ok
20:58:10.0167 3484	LanmanServer    (2bbdcb79900990f0716dfcb714e72de7) C:\WINDOWS\System32\srvsvc.dll
20:58:10.0237 3484	LanmanServer - ok
20:58:10.0247 3484	lbrtfdc - ok
20:58:10.0297 3484	libusb0         (86f4c6bb7e50e178df08e747ec5c18c3) C:\WINDOWS\system32\DRIVERS\libusb0.sys
20:58:10.0337 3484	libusb0 - ok
20:58:10.0388 3484	LmHosts         (636714b7d43c8d0c80449123fd266920) C:\WINDOWS\System32\lmhsvc.dll
20:58:10.0528 3484	LmHosts - ok
20:58:10.0598 3484	Messenger       (b7550a7107281d170ce85524b1488c98) C:\WINDOWS\System32\msgsvc.dll
20:58:10.0858 3484	Messenger - ok
20:58:10.0898 3484	mnmdd           (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
20:58:11.0079 3484	mnmdd - ok
20:58:11.0129 3484	mnmsrvc         (c2f1d365fd96791b037ee504868065d3) C:\WINDOWS\system32\mnmsrvc.exe
20:58:11.0349 3484	mnmsrvc - ok
20:58:11.0389 3484	Modem           (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys
20:58:11.0629 3484	Modem - ok
20:58:11.0649 3484	Mouclass        (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys
20:58:11.0880 3484	Mouclass - ok
20:58:11.0940 3484	mouhid          (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys
20:58:12.0160 3484	mouhid - ok
20:58:12.0190 3484	MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
20:58:12.0430 3484	MountMgr - ok
20:58:12.0501 3484	MozillaMaintenance (96aa8ba23142cc8e2b30f3cae0c80254) C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe
20:58:12.0531 3484	MozillaMaintenance - ok
20:58:12.0551 3484	mraid35x - ok
20:58:12.0591 3484	MRxDAV          (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
20:58:12.0821 3484	MRxDAV - ok
20:58:12.0901 3484	MRxSmb          (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
20:58:13.0021 3484	MRxSmb - ok
20:58:13.0081 3484	MSDTC           (35a031af38c55f92d28aa03ee9f12cc9) C:\WINDOWS\system32\msdtc.exe
20:58:13.0302 3484	MSDTC - ok
20:58:13.0352 3484	Msfs            (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
20:58:13.0612 3484	Msfs - ok
20:58:13.0622 3484	MSIServer - ok
20:58:13.0712 3484	MSKSSRV         (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
20:58:13.0873 3484	MSKSSRV - ok
20:58:13.0903 3484	MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
20:58:14.0023 3484	MSPCLOCK - ok
20:58:14.0043 3484	MSPQM           (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
20:58:14.0193 3484	MSPQM - ok
20:58:14.0233 3484	mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
20:58:14.0373 3484	mssmbios - ok
20:58:14.0433 3484	Mup             (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
20:58:14.0473 3484	Mup - ok
20:58:14.0594 3484	napagent        (46bb15ae2ac7d025d6d2567b876817bd) C:\WINDOWS\System32\qagentrt.dll
20:58:14.0754 3484	napagent - ok
20:58:14.0784 3484	NDIS            (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
20:58:14.0924 3484	NDIS - ok
20:58:14.0984 3484	NdisTapi        (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
20:58:15.0044 3484	NdisTapi - ok
20:58:15.0104 3484	Ndisuio         (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
20:58:15.0295 3484	Ndisuio - ok
20:58:15.0355 3484	NdisWan         (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
20:58:15.0545 3484	NdisWan - ok
20:58:15.0635 3484	NDProxy         (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
20:58:15.0695 3484	NDProxy - ok
20:58:15.0715 3484	NetBIOS         (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
20:58:15.0936 3484	NetBIOS - ok
20:58:15.0976 3484	NetBT           (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
20:58:16.0206 3484	NetBT - ok
20:58:16.0266 3484	NetDDE          (8ace4251bffd09ce75679fe940e996cc) C:\WINDOWS\system32\netdde.exe
20:58:16.0486 3484	NetDDE - ok
20:58:16.0526 3484	NetDDEdsdm      (8ace4251bffd09ce75679fe940e996cc) C:\WINDOWS\system32\netdde.exe
20:58:16.0747 3484	NetDDEdsdm - ok
20:58:16.0787 3484	Netlogon        (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
20:58:16.0917 3484	Netlogon - ok
20:58:16.0987 3484	Netman          (e6d88f1f6745bf00b57e7855a2ab696c) C:\WINDOWS\System32\netman.dll
20:58:17.0127 3484	Netman - ok
20:58:17.0257 3484	NetTcpPortSharing (d34612c5d02d026535b3095d620626ae) c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
20:58:17.0277 3484	NetTcpPortSharing - ok
20:58:17.0307 3484	NIC1394         (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
20:58:17.0468 3484	NIC1394 - ok
20:58:17.0548 3484	Nla             (f1b67b6b0751ae0e6e964b02821206a3) C:\WINDOWS\System32\mswsock.dll
20:58:17.0688 3484	Nla - ok
20:58:17.0718 3484	Npfs            (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
20:58:17.0888 3484	Npfs - ok
20:58:17.0938 3484	NSCIRDA         (2adc0ca9945c65284b3d19bc18765974) C:\WINDOWS\system32\DRIVERS\nscirda.sys
20:58:18.0029 3484	NSCIRDA - ok
20:58:18.0119 3484	Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
20:58:18.0429 3484	Ntfs - ok
20:58:18.0439 3484	NtLmSsp         (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
20:58:18.0659 3484	NtLmSsp - ok
20:58:18.0720 3484	NtmsSvc         (56af4064996fa5bac9c449b1514b4770) C:\WINDOWS\system32\ntmssvc.dll
20:58:19.0000 3484	NtmsSvc - ok
20:58:19.0060 3484	Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
20:58:19.0290 3484	Null - ok
20:58:19.0330 3484	NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
20:58:19.0561 3484	NwlnkFlt - ok
20:58:19.0591 3484	NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
20:58:19.0831 3484	NwlnkFwd - ok
20:58:19.0901 3484	ohci1394        (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
20:58:20.0112 3484	ohci1394 - ok
20:58:20.0172 3484	Parport         (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\DRIVERS\parport.sys
20:58:20.0382 3484	Parport - ok
20:58:20.0402 3484	PartMgr         (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
20:58:20.0602 3484	PartMgr - ok
20:58:20.0652 3484	ParVdm          (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys
20:58:20.0792 3484	ParVdm - ok
20:58:20.0853 3484	PCI             (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys
20:58:20.0983 3484	PCI - ok
20:58:20.0993 3484	PCIDump - ok
20:58:21.0003 3484	PCIIde          (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\DRIVERS\pciide.sys
20:58:21.0133 3484	PCIIde - ok
20:58:21.0213 3484	Pcmcia          (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\DRIVERS\pcmcia.sys
20:58:21.0343 3484	Pcmcia - ok
20:58:21.0353 3484	PDCOMP - ok
20:58:21.0363 3484	PDFRAME - ok
20:58:21.0373 3484	PDRELI - ok
20:58:21.0373 3484	PDRFRAME - ok
20:58:21.0383 3484	perc2 - ok
20:58:21.0393 3484	perc2hib - ok
20:58:21.0453 3484	PlugPlay        (a3edbe9053889fb24ab22492472b39dc) C:\WINDOWS\system32\services.exe
20:58:21.0473 3484	PlugPlay - ok
20:58:21.0534 3484	Pml Driver HPZ12 (d31f88c5f19eefa366a415d6bc5f2abc) C:\WINDOWS\system32\HPZipm12.exe
20:58:21.0534 3484	Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
20:58:21.0534 3484	Pml Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
20:58:21.0544 3484	PolicyAgent     (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
20:58:21.0684 3484	PolicyAgent - ok
20:58:21.0724 3484	PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
20:58:21.0894 3484	PptpMiniport - ok
20:58:21.0904 3484	ProtectedStorage (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
20:58:22.0064 3484	ProtectedStorage - ok
20:58:22.0094 3484	PSched          (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
20:58:22.0265 3484	PSched - ok
20:58:22.0315 3484	Ptilink         (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
20:58:22.0475 3484	Ptilink - ok
20:58:22.0475 3484	ql1080 - ok
20:58:22.0485 3484	Ql10wnt - ok
20:58:22.0495 3484	ql12160 - ok
20:58:22.0505 3484	ql1240 - ok
20:58:22.0515 3484	ql1280 - ok
20:58:22.0525 3484	RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
20:58:22.0665 3484	RasAcd - ok
20:58:22.0685 3484	RasAuto         (f5ba6caccdb66c8f048e867563203246) C:\WINDOWS\System32\rasauto.dll
20:58:22.0835 3484	RasAuto - ok
20:58:22.0885 3484	Rasirda         (0207d26ddf796a193ccd9f83047bb5fc) C:\WINDOWS\system32\DRIVERS\rasirda.sys
20:58:22.0946 3484	Rasirda - ok
20:58:22.0966 3484	Rasl2tp         (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
20:58:23.0126 3484	Rasl2tp - ok
20:58:23.0156 3484	RasMan          (f9a7b66ea345726edb5862a46b1eccd5) C:\WINDOWS\System32\rasmans.dll
20:58:23.0286 3484	RasMan - ok
20:58:23.0316 3484	RasPppoe        (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
20:58:23.0466 3484	RasPppoe - ok
20:58:23.0476 3484	Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
20:58:23.0607 3484	Raspti - ok
20:58:23.0677 3484	Rdbss           (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
20:58:23.0797 3484	Rdbss - ok
20:58:23.0797 3484	RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
20:58:23.0927 3484	RDPCDD - ok
20:58:23.0957 3484	rdpdr           (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
20:58:24.0097 3484	rdpdr - ok
20:58:24.0167 3484	RDPWD           (5b3055daa788bd688594d2f5981f2a83) C:\WINDOWS\system32\drivers\RDPWD.sys
20:58:24.0187 3484	RDPWD - ok
20:58:24.0237 3484	RDSessMgr       (263af18af0f3db99f574c95f284ccec9) C:\WINDOWS\system32\sessmgr.exe
20:58:24.0378 3484	RDSessMgr - ok
20:58:24.0438 3484	redbook         (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys
20:58:24.0578 3484	redbook - ok
20:58:24.0648 3484	RemoteAccess    (0e97ec96d6942ceec2d188cc2eb69a01) C:\WINDOWS\System32\mprdim.dll
20:58:24.0828 3484	RemoteAccess - ok
20:58:24.0878 3484	RemoteRegistry  (e4cd1f3d84e1c2ca0b8cf7501e201593) C:\WINDOWS\system32\regsvc.dll
20:58:25.0049 3484	RemoteRegistry - ok
20:58:25.0099 3484	RpcLocator      (2a02e21867497df20b8fc95631395169) C:\WINDOWS\system32\locator.exe
20:58:25.0299 3484	RpcLocator - ok
20:58:25.0379 3484	RpcSs           (3127afbf2c1ed0ab14a1bbb7aaecb85b) C:\WINDOWS\System32\rpcss.dll
20:58:25.0479 3484	RpcSs - ok
20:58:25.0559 3484	RSVP            (4bdd71b4b521521499dfd14735c4f398) C:\WINDOWS\system32\rsvp.exe
20:58:25.0740 3484	RSVP - ok
20:58:25.0750 3484	s24trans - ok
20:58:25.0790 3484	SamSs           (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
20:58:25.0970 3484	SamSs - ok
20:58:26.0030 3484	SCardSvr        (dcec079fad95d36c8dd5cb6d779dfe32) C:\WINDOWS\System32\SCardSvr.exe
20:58:26.0260 3484	SCardSvr - ok
20:58:26.0320 3484	Schedule        (a050194a44d7fa8d7186ed2f4e8367ae) C:\WINDOWS\system32\schedsvc.dll
20:58:26.0561 3484	Schedule - ok
20:58:26.0631 3484	SE27bus         (59a9eb4073a39895af314780d0a032fa) C:\WINDOWS\system32\DRIVERS\SE27bus.sys
20:58:26.0641 3484	SE27bus ( UnsignedFile.Multi.Generic ) - warning
20:58:26.0641 3484	SE27bus - detected UnsignedFile.Multi.Generic (1)
20:58:26.0681 3484	SE27mdfl        (d53e7e53107d1796825540129f8fe89f) C:\WINDOWS\system32\DRIVERS\SE27mdfl.sys
20:58:26.0721 3484	SE27mdfl ( UnsignedFile.Multi.Generic ) - warning
20:58:26.0721 3484	SE27mdfl - detected UnsignedFile.Multi.Generic (1)
20:58:26.0751 3484	SE27mdm         (2afa2f65a6e91da5b5070e734769827e) C:\WINDOWS\system32\DRIVERS\SE27mdm.sys
20:58:26.0801 3484	SE27mdm ( UnsignedFile.Multi.Generic ) - warning
20:58:26.0801 3484	SE27mdm - detected UnsignedFile.Multi.Generic (1)
20:58:26.0841 3484	SE27mgmt        (5a33a8d7b44c7bd8abe248b4dcd1ff3c) C:\WINDOWS\system32\DRIVERS\SE27mgmt.sys
20:58:26.0851 3484	SE27mgmt ( UnsignedFile.Multi.Generic ) - warning
20:58:26.0851 3484	SE27mgmt - detected UnsignedFile.Multi.Generic (1)
20:58:26.0891 3484	Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
20:58:26.0991 3484	Secdrv - ok
20:58:27.0051 3484	seclogon        (bee4cfd1d48c23b44cf4b974b0b79b2b) C:\WINDOWS\System32\seclogon.dll
20:58:27.0362 3484	seclogon - ok
20:58:27.0392 3484	SENS            (2aac9b6ed9eddffb721d6452e34d67e3) C:\WINDOWS\system32\sens.dll
20:58:27.0532 3484	SENS - ok
20:58:27.0592 3484	Serenum         (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
20:58:27.0742 3484	Serenum - ok
20:58:27.0773 3484	Serial          (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\drivers\Serial.sys
20:58:27.0903 3484	Serial - ok
20:58:27.0973 3484	Sfloppy         (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
20:58:28.0113 3484	Sfloppy - ok
20:58:28.0183 3484	SharedAccess    (cad058d5f8b889a87ca3eb3cf624dcef) C:\WINDOWS\System32\ipnathlp.dll
20:58:28.0383 3484	SharedAccess - ok
20:58:28.0443 3484	ShellHWDetection (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
20:58:28.0464 3484	ShellHWDetection - ok
20:58:28.0474 3484	Simbad - ok
20:58:28.0494 3484	Sparrow - ok
20:58:28.0544 3484	splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
20:58:28.0724 3484	splitter - ok
20:58:28.0774 3484	Spooler         (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe
20:58:28.0814 3484	Spooler - ok
20:58:28.0864 3484	sr              (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys
20:58:28.0954 3484	sr - ok
20:58:28.0984 3484	srservice       (fe77a85495065f3ad59c5c65b6c54182) C:\WINDOWS\system32\srsvc.dll
20:58:29.0074 3484	srservice - ok
20:58:29.0144 3484	Srv             (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
20:58:29.0245 3484	Srv - ok
20:58:29.0295 3484	SSDPSRV         (4df5b05dfaec29e13e1ed6f6ee12c500) C:\WINDOWS\System32\ssdpsrv.dll
20:58:29.0385 3484	SSDPSRV - ok
20:58:29.0455 3484	stisvc          (bc2c5985611c5356b24aeb370953ded9) C:\WINDOWS\system32\wiaservc.dll
20:58:29.0765 3484	stisvc - ok
20:58:29.0805 3484	swenum          (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
20:58:29.0946 3484	swenum - ok
20:58:30.0006 3484	swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
20:58:30.0146 3484	swmidi - ok
20:58:30.0146 3484	SwPrv - ok
20:58:30.0156 3484	symc810 - ok
20:58:30.0166 3484	symc8xx - ok
20:58:30.0176 3484	sym_hi - ok
20:58:30.0186 3484	sym_u3 - ok
20:58:30.0206 3484	sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
20:58:30.0326 3484	sysaudio - ok
20:58:30.0346 3484	SysmonLog       (2903fffa2523926d6219428040dce6b9) C:\WINDOWS\system32\smlogsvc.exe
20:58:30.0496 3484	SysmonLog - ok
20:58:30.0526 3484	TapiSrv         (05903cac4b98908d55ea5774775b382e) C:\WINDOWS\System32\tapisrv.dll
20:58:30.0677 3484	TapiSrv - ok
20:58:30.0737 3484	Tcpip           (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
20:58:30.0767 3484	Tcpip - ok
20:58:30.0817 3484	TDPIPE          (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
20:58:30.0947 3484	TDPIPE - ok
20:58:30.0967 3484	TDTCP           (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
20:58:31.0117 3484	TDTCP - ok
20:58:31.0177 3484	TermDD          (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
20:58:31.0348 3484	TermDD - ok
20:58:31.0448 3484	TermService     (b7de02c863d8f5a005a7bf375375a6a4) C:\WINDOWS\System32\termsrv.dll
20:58:31.0628 3484	TermService - ok
20:58:31.0678 3484	Themes          (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
20:58:31.0698 3484	Themes - ok
20:58:31.0748 3484	TlntSvr         (03681a1ce77f51586903869a5ab1deab) C:\WINDOWS\system32\tlntsvr.exe
20:58:31.0828 3484	TlntSvr - ok
20:58:31.0838 3484	TosIde - ok
20:58:31.0888 3484	TrkWks          (626504572b175867f30f3215c04b3e2f) C:\WINDOWS\system32\trkwks.dll
20:58:32.0089 3484	TrkWks - ok
20:58:32.0139 3484	TwkMs           (8c7d0928b76dc2b8235995a01ce33037) C:\WINDOWS\system32\drivers\TwkMs.sys
20:58:32.0159 3484	TwkMs ( UnsignedFile.Multi.Generic ) - warning
20:58:32.0159 3484	TwkMs - detected UnsignedFile.Multi.Generic (1)
20:58:32.0209 3484	TWKSER2K        (be910aceab65fa3ae67ae98b19fcac4b) C:\WINDOWS\system32\DRIVERS\TWKSER2K.sys
20:58:32.0239 3484	TWKSER2K ( UnsignedFile.Multi.Generic ) - warning
20:58:32.0239 3484	TWKSER2K - detected UnsignedFile.Multi.Generic (1)
20:58:32.0269 3484	Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
20:58:32.0479 3484	Udfs - ok
20:58:32.0479 3484	ultra - ok
20:58:32.0860 3484	Update          (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
20:58:33.0160 3484	Update - ok
20:58:33.0230 3484	Update-Service  (91263b03ef2e1c42a563adb4c9a62e22) C:\WINDOWS\System32\UpdSvc.dll
20:58:33.0270 3484	Update-Service - ok
20:58:33.0331 3484	upnphost        (1dfd8975d8c89214b98d9387c1125b49) C:\WINDOWS\System32\upnphost.dll
20:58:33.0511 3484	upnphost - ok
20:58:33.0551 3484	UPS             (9b11e6118958e63e1fef129466e2bda7) C:\WINDOWS\System32\ups.exe
20:58:33.0681 3484	UPS - ok
20:58:33.0711 3484	usb2vcom        (76a5050be71eeb611e8c2c9642ca2b0f) C:\WINDOWS\system32\DRIVERS\usb2vcom.sys
20:58:33.0711 3484	usb2vcom ( UnsignedFile.Multi.Generic ) - warning
20:58:33.0711 3484	usb2vcom - detected UnsignedFile.Multi.Generic (1)
20:58:33.0771 3484	usbccgp         (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
20:58:33.0901 3484	usbccgp - ok
20:58:33.0971 3484	USBCCID         (baf8295318980e8528825082dfed85d6) C:\WINDOWS\system32\DRIVERS\Rts5161ccid.sys
20:58:34.0011 3484	USBCCID - ok
20:58:34.0062 3484	usbehci         (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
20:58:34.0202 3484	usbehci - ok
20:58:34.0232 3484	usbhub          (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
20:58:34.0402 3484	usbhub - ok
20:58:34.0432 3484	usbprint        (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
20:58:34.0602 3484	usbprint - ok
20:58:34.0652 3484	usbscan         (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
20:58:34.0803 3484	usbscan - ok
20:58:34.0853 3484	USBSTOR         (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
20:58:35.0023 3484	USBSTOR - ok
20:58:35.0053 3484	usbuhci         (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
20:58:35.0203 3484	usbuhci - ok
20:58:35.0233 3484	VgaSave         (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
20:58:35.0383 3484	VgaSave - ok
20:58:35.0393 3484	ViaIde - ok
20:58:35.0424 3484	VolSnap         (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys
20:58:35.0574 3484	VolSnap - ok
20:58:35.0814 3484	VSS             (68f106273be29e7b7ef8266977268e78) C:\WINDOWS\System32\vssvc.exe
20:58:35.0894 3484	VSS - ok
20:58:36.0044 3484	w22n51          (4c009d4352849d79bf347846b6e03bfd) C:\WINDOWS\system32\DRIVERS\w22n51.sys
20:58:36.0245 3484	w22n51 - ok
20:58:36.0445 3484	W32Time         (7b353059e665f8b7ad2bbeaef597cf45) C:\WINDOWS\system32\w32time.dll
20:58:36.0765 3484	W32Time - ok
20:58:36.0836 3484	Wanarp          (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
20:58:36.0966 3484	Wanarp - ok
20:58:37.0026 3484	WBMS            (712e3a81069e30158a4df4f5daf29dd6) C:\WINDOWS\system32\Drivers\WBMS.SYS
20:58:37.0056 3484	WBMS - ok
20:58:37.0086 3484	WBSD            (b0892439d499fd39b02e772ede714027) C:\WINDOWS\system32\Drivers\WBSD.SYS
20:58:37.0136 3484	WBSD - ok
20:58:37.0146 3484	Wbutton - ok
20:58:37.0196 3484	wceusbsh        (46a247f6617526afe38b6f12f5512120) C:\WINDOWS\system32\DRIVERS\wceusbsh.sys
20:58:37.0276 3484	wceusbsh - ok
20:58:37.0286 3484	WDICA - ok
20:58:37.0316 3484	wdmaud          (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
20:58:37.0547 3484	wdmaud - ok
20:58:37.0747 3484	WebClient       (81727c9873e3905a2ffc1ebd07265002) C:\WINDOWS\System32\webclnt.dll
20:58:37.0897 3484	WebClient - ok
20:58:38.0027 3484	winmgmt         (6f3f3973d97714cc5f906a19fe883729) C:\WINDOWS\system32\wbem\WMIsvc.dll
20:58:38.0167 3484	winmgmt - ok
20:58:38.0218 3484	WmdmPmSN        (6e18978b749f0696a774de3f2cb142dd) C:\WINDOWS\system32\mspmsnsv.dll
20:58:38.0398 3484	WmdmPmSN - ok
20:58:38.0478 3484	Wmi             (ffa4d901d46d07a5bab2d8307fbb51a6) C:\WINDOWS\System32\advapi32.dll
20:58:38.0538 3484	Wmi - ok
20:58:38.0598 3484	WmiApSrv        (93908111ba57a6e60ec2fa2de202105c) C:\WINDOWS\system32\wbem\wmiapsrv.exe
20:58:38.0808 3484	WmiApSrv - ok
20:58:38.0858 3484	wscsvc          (300b3e84faf1a5c1f791c159ba28035d) C:\WINDOWS\system32\wscsvc.dll
20:58:39.0129 3484	wscsvc - ok
20:58:39.0189 3484	wuauserv        (7b4fe05202aa6bf9f4dfd0e6a0d8a085) C:\WINDOWS\system32\wuauserv.dll
20:58:39.0339 3484	wuauserv - ok
20:58:39.0409 3484	WZCSVC          (c4f109c005f6725162d2d12ca751e4a7) C:\WINDOWS\System32\wzcsvc.dll
20:58:39.0610 3484	WZCSVC - ok
20:58:39.0650 3484	xmlprov         (0ada34871a2e1cd2caafed1237a47750) C:\WINDOWS\System32\xmlprov.dll
20:58:39.0850 3484	xmlprov - ok
20:58:39.0890 3484	MBR (0x1B8)     (72b8ce41af0de751c946802b3ed844b4) \Device\Harddisk0\DR0
20:58:40.0581 3484	\Device\Harddisk0\DR0 - ok
20:58:40.0591 3484	Boot (0x1200)   (11bb28619ecfa1286ba29737821ce7bd) \Device\Harddisk0\DR0\Partition0
20:58:40.0591 3484	\Device\Harddisk0\DR0\Partition0 - ok
20:58:40.0601 3484	============================================================
20:58:40.0601 3484	Scan finished
20:58:40.0601 3484	============================================================
20:58:40.0731 3440	Detected object count: 11
20:58:40.0731 3440	Actual detected object count: 11
20:59:27.0929 3440	bizVSerial ( UnsignedFile.Multi.Generic ) - skipped by user
20:59:27.0929 3440	bizVSerial ( UnsignedFile.Multi.Generic ) - User select action: Skip 
20:59:27.0939 3440	CHIPDRIVE USB SmartCardReader ( UnsignedFile.Multi.Generic ) - skipped by user
20:59:27.0939 3440	CHIPDRIVE USB SmartCardReader ( UnsignedFile.Multi.Generic ) - User select action: Skip 
20:59:27.0939 3440	Hotkey ( UnsignedFile.Multi.Generic ) - skipped by user
20:59:27.0939 3440	Hotkey ( UnsignedFile.Multi.Generic ) - User select action: Skip 
20:59:27.0939 3440	Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
20:59:27.0939 3440	Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip 
20:59:27.0939 3440	SE27bus ( UnsignedFile.Multi.Generic ) - skipped by user
20:59:27.0949 3440	SE27bus ( UnsignedFile.Multi.Generic ) - User select action: Skip 
20:59:27.0949 3440	SE27mdfl ( UnsignedFile.Multi.Generic ) - skipped by user
20:59:27.0949 3440	SE27mdfl ( UnsignedFile.Multi.Generic ) - User select action: Skip 
20:59:27.0949 3440	SE27mdm ( UnsignedFile.Multi.Generic ) - skipped by user
20:59:27.0949 3440	SE27mdm ( UnsignedFile.Multi.Generic ) - User select action: Skip 
20:59:27.0949 3440	SE27mgmt ( UnsignedFile.Multi.Generic ) - skipped by user
20:59:27.0949 3440	SE27mgmt ( UnsignedFile.Multi.Generic ) - User select action: Skip 
20:59:27.0949 3440	TwkMs ( UnsignedFile.Multi.Generic ) - skipped by user
20:59:27.0949 3440	TwkMs ( UnsignedFile.Multi.Generic ) - User select action: Skip 
20:59:27.0949 3440	TWKSER2K ( UnsignedFile.Multi.Generic ) - skipped by user
20:59:27.0949 3440	TWKSER2K ( UnsignedFile.Multi.Generic ) - User select action: Skip 
20:59:27.0959 3440	usb2vcom ( UnsignedFile.Multi.Generic ) - skipped by user
20:59:27.0959 3440	usb2vcom ( UnsignedFile.Multi.Generic ) - User select action: Skip

Ist ja erschreckend! Wie jetzt weiter?

Vielen Dank und viele Grüße
Ulrike

cosinus · 07.06.2012, 21:26

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop.

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

28missi · 08.06.2012, 20:24

Hallo Arne

hier das Logfile von Combofix

Code:

ATTFilter

ComboFix 12-06-07.04 - test 08.06.2012   6:58.2.1 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.49.1031.18.1270.924 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\test\Desktop\ComboFix.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2012-05-08 bis 2012-06-08  ))))))))))))))))))))))))))))))
.
.
2012-06-06 19:01 . 2012-06-06 19:01	--------	d-----w-	C:\_OTL
2012-06-04 17:23 . 2012-06-04 17:23	--------	d-----w-	c:\programme\ESET
2012-06-04 14:17 . 2012-06-04 14:17	--------	d-----w-	c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2012-05-21 18:34 . 2012-05-21 18:34	--------	d-----w-	c:\dokumente und einstellungen\test\Downloads
2012-05-09 11:58 . 2012-05-09 11:58	--------	d-----w-	c:\dokumente und einstellungen\All Users\Anwendungsdaten\Kaspersky SDK
2012-05-09 11:20 . 2012-06-04 11:25	--------	d--h--w-	c:\windows\$hf_mig$
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-31 13:22 . 2008-04-14 12:00	604160	----a-w-	c:\windows\system32\crypt32.dll
2012-05-06 13:42 . 2012-04-05 07:34	419488	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2012-05-06 13:42 . 2011-05-24 12:15	70304	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2012-04-11 13:51 . 2008-04-14 07:30	2071424	----a-w-	c:\windows\system32\ntkrnlpa.exe
2012-04-11 13:51 . 2008-04-14 12:00	1862400	----a-w-	c:\windows\system32\win32k.sys
2012-04-11 13:51 . 2008-04-14 12:00	2194944	----a-w-	c:\windows\system32\ntoskrnl.exe
2012-01-23 09:49 . 2012-01-23 09:35	39401336	----a-w-	c:\programme\QuickTimeInstaller.exe
2011-12-07 12:58 . 2011-12-07 12:58	541544	----a-w-	c:\programme\7z920.exe
2010-04-11 20:36 . 2010-04-11 19:43	152882016	----a-w-	c:\programme\OOo_3.2.0_Win32Intel_install_de.exe
2010-02-05 08:27 . 2010-02-05 08:27	918816	----a-w-	c:\programme\jxpiinstall(2).exe
2010-02-05 08:25 . 2010-02-05 08:25	918816	----a-w-	c:\programme\jxpiinstall.exe
2009-04-27 13:50 . 2009-04-27 13:47	7456256	----a-w-	c:\programme\irfanview_plugins_422_setup.exe
2009-04-27 13:45 . 2009-04-25 12:35	1345024	----a-w-	c:\programme\iview423_setup.exe
2009-04-25 12:34 . 2009-04-25 12:27	17194560	----a-w-	c:\programme\cibpdfbrewer.exe
2012-04-21 01:18 . 2011-10-25 12:19	97208	----a-w-	c:\programme\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((   SnapShot@2012-01-02_18.29.35   )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-06-08 04:45 . 2012-06-08 04:45	16384              c:\windows\Temp\Perflib_Perfdata_7e4.dat
+ 2011-10-29 10:58 . 2007-05-31 07:38	27648              c:\windows\system32\win32com.dll
- 2011-10-29 10:58 . 2007-05-31 05:38	27648              c:\windows\system32\win32com.dll
+ 2009-04-17 16:12 . 2009-01-07 17:20	26144              c:\windows\system32\spupdsvc.exe
+ 2009-04-17 16:12 . 2009-01-07 17:20	18464              c:\windows\system32\spmsg.dll
+ 2012-01-23 09:01 . 2010-11-27 08:11	28144              c:\windows\system32\ReinstallBackups\0013\DriverFiles\cjusbW6X86.sys
+ 2008-04-14 12:00 . 2009-03-08 03:31	46592              c:\windows\system32\pngfilt.dll
+ 2008-04-14 12:00 . 2012-05-09 17:37	68094              c:\windows\system32\perfc009.dat
- 2008-04-14 12:00 . 2011-11-08 20:08	68094              c:\windows\system32\perfc009.dat
+ 2008-04-14 12:00 . 2012-05-09 17:37	92732              c:\windows\system32\perfc007.dat
+ 2008-04-14 12:00 . 2011-11-20 06:12	61952              c:\windows\system32\packager.exe
- 2011-10-29 10:58 . 2007-05-31 05:38	41472              c:\windows\system32\ocfpcsc1.dll
+ 2011-10-29 10:58 . 2007-05-31 07:38	41472              c:\windows\system32\ocfpcsc1.dll
- 2006-06-29 06:05 . 2006-06-29 06:05	23552              c:\windows\system32\normaliz.dll
+ 2006-06-29 06:05 . 2009-01-07 17:20	23552              c:\windows\system32\normaliz.dll
+ 2006-06-28 15:59 . 2009-01-07 17:20	24576              c:\windows\system32\nlsdl.dll
- 2006-06-28 15:59 . 2006-06-28 15:59	24576              c:\windows\system32\nlsdl.dll
+ 2008-04-14 12:00 . 2009-03-08 03:31	48128              c:\windows\system32\mshtmler.dll
- 2008-04-14 12:00 . 2007-08-13 16:01	48128              c:\windows\system32\mshtmler.dll
+ 2008-04-14 12:00 . 2012-03-01 11:00	66560              c:\windows\system32\mshtmled.dll
- 2008-04-14 12:00 . 2007-08-13 16:32	45568              c:\windows\system32\mshta.exe
+ 2008-04-14 12:00 . 2009-03-08 03:31	45568              c:\windows\system32\mshta.exe
+ 2007-08-13 16:36 . 2009-03-08 03:31	13312              c:\windows\system32\msfeedssync.exe
+ 2007-08-13 16:54 . 2012-03-01 11:00	55296              c:\windows\system32\msfeedsbs.dll
+ 2008-04-14 12:00 . 2011-10-14 14:47	23040              c:\windows\system32\mciseq.dll
- 2008-04-14 12:00 . 2008-04-14 12:00	23040              c:\windows\system32\mciseq.dll
+ 2012-02-21 13:46 . 2012-02-21 13:46	98304              c:\windows\system32\Macromed\Shockwave 10\SwOnce.dll
- 2011-11-22 15:50 . 2011-11-22 15:50	98304              c:\windows\system32\Macromed\Shockwave 10\SwOnce.dll
- 2011-11-22 15:50 . 2011-11-22 15:50	86016              c:\windows\system32\Macromed\Shockwave 10\SwMenuX.dll
+ 2012-02-21 13:46 . 2012-02-21 13:46	86016              c:\windows\system32\Macromed\Shockwave 10\SwMenuX.dll
+ 2012-02-21 13:46 . 2012-02-21 13:46	77824              c:\windows\system32\Macromed\Shockwave 10\SwInit.exe
- 2011-11-22 15:50 . 2011-11-22 15:50	77824              c:\windows\system32\Macromed\Shockwave 10\SwInit.exe
+ 2012-02-21 13:46 . 2012-02-21 13:46	73408              c:\windows\system32\Macromed\Shockwave 10\gtapi.dll
- 2011-12-25 11:03 . 2011-12-25 11:03	60344              c:\windows\system32\Macromed\Shockwave 10\gt.exe
+ 2012-02-21 13:46 . 2012-04-24 15:03	60344              c:\windows\system32\Macromed\Shockwave 10\gt.exe
- 2011-11-22 15:50 . 2011-11-22 15:50	64512              c:\windows\system32\Macromed\Shockwave 10\gcapi_dll.dll
+ 2012-02-21 13:46 . 2012-02-21 13:46	64512              c:\windows\system32\Macromed\Shockwave 10\gcapi_dll.dll
- 2011-11-22 15:50 . 2011-11-22 15:50	24576              c:\windows\system32\Macromed\Shockwave 10\DynaPlayer.dll
+ 2012-02-21 13:46 . 2012-02-21 13:46	24576              c:\windows\system32\Macromed\Shockwave 10\DynaPlayer.dll
+ 2008-04-14 12:00 . 2012-03-01 11:00	43520              c:\windows\system32\licmgr10.dll
+ 2008-04-14 12:00 . 2012-03-01 11:00	25600              c:\windows\system32\jsproxy.dll
+ 2008-04-14 12:00 . 2009-03-08 03:32	94720              c:\windows\system32\inseng.dll
+ 2008-04-14 12:00 . 2009-03-08 03:31	34816              c:\windows\system32\imgutil.dll
+ 2007-08-13 16:39 . 2009-03-08 03:32	36864              c:\windows\system32\ieudinit.exe
+ 2008-04-14 12:00 . 2009-03-08 03:32	71680              c:\windows\system32\iesetup.dll
+ 2008-04-14 12:00 . 2009-03-08 03:32	55808              c:\windows\system32\iernonce.dll
+ 2006-06-29 06:05 . 2009-01-07 17:20	26112              c:\windows\system32\idndl.dll
- 2006-06-29 06:05 . 2006-06-29 06:05	26112              c:\windows\system32\idndl.dll
+ 2007-08-13 16:36 . 2009-03-08 03:31	59904              c:\windows\system32\icardie.dll
+ 2012-01-23 09:01 . 2011-03-29 11:08	28144              c:\windows\system32\DRVSTORE\cjusbw6_4700D9DF22037BF2BDFF3EA7D5E1B6832F30954B\cjusbW6X86.sys
+ 2012-01-23 09:01 . 2011-03-29 10:50	34672              c:\windows\system32\DRVSTORE\cjusbw6_4700D9DF22037BF2BDFF3EA7D5E1B6832F30954B\cjusbW6X64.sys
- 2011-10-29 10:58 . 2010-11-27 08:11	28144              c:\windows\system32\drivers\cjusb.sys
+ 2011-10-29 10:58 . 2011-03-29 11:08	28144              c:\windows\system32\drivers\cjusb.sys
- 2011-10-29 10:58 . 2007-05-31 05:38	14949              c:\windows\system32\drivers\bizVSerialNT.sys
+ 2011-10-29 10:58 . 2007-05-31 07:38	14949              c:\windows\system32\drivers\bizVSerialNT.sys
+ 2012-01-20 14:26 . 2012-03-01 11:00	12800              c:\windows\system32\dllcache\xpshims.dll
+ 2008-04-14 12:00 . 2009-03-08 03:31	46592              c:\windows\system32\dllcache\pngfilt.dll
+ 2008-04-14 12:00 . 2011-11-20 06:12	61952              c:\windows\system32\dllcache\packager.exe
- 2008-04-14 12:00 . 2007-08-13 16:01	48128              c:\windows\system32\dllcache\mshtmler.dll
+ 2008-04-14 12:00 . 2009-03-08 03:31	48128              c:\windows\system32\dllcache\mshtmler.dll
+ 2008-04-14 12:00 . 2012-03-01 11:00	66560              c:\windows\system32\dllcache\mshtmled.dll
- 2008-04-14 12:00 . 2007-08-13 16:32	45568              c:\windows\system32\dllcache\mshta.exe
+ 2008-04-14 12:00 . 2009-03-08 03:31	45568              c:\windows\system32\dllcache\mshta.exe
+ 2009-02-20 16:49 . 2012-03-01 11:00	55296              c:\windows\system32\dllcache\msfeedsbs.dll
- 2008-04-14 12:00 . 2008-04-14 12:00	23040              c:\windows\system32\dllcache\mciseq.dll
+ 2008-04-14 12:00 . 2011-10-14 14:47	23040              c:\windows\system32\dllcache\mciseq.dll
+ 2008-04-14 12:00 . 2012-03-01 11:00	43520              c:\windows\system32\dllcache\licmgr10.dll
+ 2008-04-14 12:00 . 2012-03-01 11:00	25600              c:\windows\system32\dllcache\jsproxy.dll
+ 2008-04-14 12:00 . 2009-03-08 03:32	94720              c:\windows\system32\dllcache\inseng.dll
+ 2008-04-14 12:00 . 2009-03-08 03:31	34816              c:\windows\system32\dllcache\imgutil.dll
+ 2008-04-14 12:00 . 2009-03-08 03:32	71680              c:\windows\system32\dllcache\iesetup.dll
+ 2008-04-14 12:00 . 2009-03-08 03:32	55808              c:\windows\system32\dllcache\iernonce.dll
+ 2009-02-20 16:49 . 2009-03-08 03:31	59904              c:\windows\system32\dllcache\icardie.dll
+ 2009-04-17 14:04 . 2009-03-08 03:24	68608              c:\windows\system32\dllcache\hmmapi.dll
+ 2008-04-14 12:00 . 2009-03-08 03:33	18944              c:\windows\system32\dllcache\corpol.dll
+ 2008-04-14 12:00 . 2009-03-08 03:32	72704              c:\windows\system32\dllcache\admparse.dll
+ 2008-04-14 12:00 . 2009-03-08 03:33	18944              c:\windows\system32\corpol.dll
+ 2011-10-29 10:58 . 2007-05-31 07:38	53248              c:\windows\system32\cjtrm.dll
- 2011-10-29 10:58 . 2007-05-31 05:38	53248              c:\windows\system32\cjtrm.dll
+ 2011-10-29 10:58 . 2011-07-22 07:49	63408              c:\windows\system32\cjpcscli.exe
+ 2011-10-29 10:58 . 2011-07-22 07:49	53680              c:\windows\system32\cjKbBase.dll
+ 2010-05-22 12:55 . 2012-02-18 17:40	87942              c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
+ 2012-02-02 13:49 . 2012-02-02 13:49	86016              c:\windows\system32\Adobe\Shockwave 11\SwMenu.dll
+ 2012-02-02 13:32 . 2012-02-02 13:32	73408              c:\windows\system32\Adobe\Shockwave 11\gtapi.dll
+ 2012-02-02 13:32 . 2012-02-02 13:32	64512              c:\windows\system32\Adobe\Shockwave 11\gcapi_dll.dll
+ 2012-02-02 13:50 . 2012-02-02 13:50	12800              c:\windows\system32\Adobe\Shockwave 11\DynaPlayer.dll
+ 2008-04-14 12:00 . 2009-03-08 03:32	72704              c:\windows\system32\admparse.dll
+ 2011-12-25 02:49 . 2011-12-25 02:49	31504              c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe
+ 2012-05-09 11:49 . 2012-05-09 11:49	62464              c:\windows\Installer\90b1f.msi
+ 2012-01-05 15:58 . 2012-01-05 15:58	10134              c:\windows\Installer\{612C34C7-5E90-47D8-9B5C-0F717DD82726}\ARPPRODUCTICON.exe
+ 2011-06-06 11:55 . 2011-06-06 11:55	17304              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010\10.1.0\ViewerPS.dll
+ 2011-06-06 11:55 . 2011-06-06 11:55	35736              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010\10.1.0\reader_sl.exe
+ 2011-06-06 11:55 . 2011-06-06 11:55	88992              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010\10.1.0\PDFPrevHndlr.dll
+ 2011-06-06 11:55 . 2011-06-06 11:55	94608              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010\10.1.0\eula.exe
+ 2011-06-06 11:55 . 2011-06-06 11:55	49064              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010\10.1.0\acrotextextractor.exe
+ 2011-06-06 11:55 . 2011-06-06 11:55	17824              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010\10.1.0\AcroRd32Info.exe
+ 2011-06-06 11:55 . 2011-06-06 11:55	63912              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010\10.1.0\acroiehelpershim.dll
+ 2011-06-06 11:55 . 2011-06-06 11:55	64928              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010\10.1.0\AcroIEHelper.dll
+ 2011-06-06 11:55 . 2011-06-06 11:55	63384              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010\10.1.0\Acrofx32.dll
+ 2012-01-20 14:42 . 2009-03-08 03:33	12288              c:\windows\ie8updates\KB982381-IE8\xpshims.dll
+ 2012-01-20 14:42 . 2009-03-08 03:31	55296              c:\windows\ie8updates\KB982381-IE8\msfeedsbs.dll
+ 2012-01-20 14:42 . 2009-03-08 03:33	25600              c:\windows\ie8updates\KB982381-IE8\jsproxy.dll
+ 2012-04-12 13:43 . 2011-12-17 19:43	12800              c:\windows\ie8updates\KB2675157-IE8\xpshims.dll
+ 2012-04-12 13:43 . 2011-12-17 19:43	66560              c:\windows\ie8updates\KB2675157-IE8\mshtmled.dll
+ 2012-04-12 13:43 . 2011-12-17 19:43	55296              c:\windows\ie8updates\KB2675157-IE8\msfeedsbs.dll
+ 2012-04-12 13:43 . 2011-12-17 19:43	43520              c:\windows\ie8updates\KB2675157-IE8\licmgr10.dll
+ 2012-04-12 13:43 . 2011-12-17 19:43	25600              c:\windows\ie8updates\KB2675157-IE8\jsproxy.dll
+ 2012-02-15 13:08 . 2011-11-04 19:13	12800              c:\windows\ie8updates\KB2647516-IE8\xpshims.dll
+ 2012-02-15 13:08 . 2011-11-04 19:13	66560              c:\windows\ie8updates\KB2647516-IE8\mshtmled.dll
+ 2012-02-15 13:08 . 2011-11-04 19:13	55296              c:\windows\ie8updates\KB2647516-IE8\msfeedsbs.dll
+ 2012-02-15 13:08 . 2011-11-04 19:13	43520              c:\windows\ie8updates\KB2647516-IE8\licmgr10.dll
+ 2012-02-15 13:08 . 2011-11-04 19:13	25600              c:\windows\ie8updates\KB2647516-IE8\jsproxy.dll
+ 2012-01-20 14:43 . 2010-05-06 10:31	12800              c:\windows\ie8updates\KB2618444-IE8\xpshims.dll
+ 2012-01-20 14:43 . 2009-03-08 03:31	66560              c:\windows\ie8updates\KB2618444-IE8\mshtmled.dll
+ 2012-01-20 14:43 . 2010-05-06 10:31	55296              c:\windows\ie8updates\KB2618444-IE8\msfeedsbs.dll
+ 2012-01-20 14:43 . 2009-03-08 03:34	43008              c:\windows\ie8updates\KB2618444-IE8\licmgr10.dll
+ 2012-01-20 14:43 . 2010-05-06 10:31	25600              c:\windows\ie8updates\KB2618444-IE8\jsproxy.dll
+ 2012-01-20 14:35 . 2009-03-08 18:18	58464              c:\windows\ie8\spuninst\iecustom.dll
+ 2012-01-20 14:32 . 2011-10-31 23:36	44544              c:\windows\ie8\pngfilt.dll
+ 2012-01-20 14:32 . 2007-08-13 16:01	48128              c:\windows\ie8\mshtmler.dll
+ 2012-01-20 14:32 . 2007-08-13 16:32	45568              c:\windows\ie8\mshta.exe
+ 2012-01-20 14:32 . 2007-08-13 16:36	12288              c:\windows\ie8\msfeedssync.exe
+ 2012-01-20 14:32 . 2011-10-31 23:36	52224              c:\windows\ie8\msfeedsbs.dll
+ 2012-01-20 14:32 . 2007-08-13 16:44	40960              c:\windows\ie8\licmgr10.dll
+ 2012-01-20 14:32 . 2011-10-31 23:36	27648              c:\windows\ie8\jsproxy.dll
+ 2012-01-20 14:32 . 2007-08-13 16:39	92672              c:\windows\ie8\inseng.dll
+ 2012-01-20 14:32 . 2007-08-13 16:36	36352              c:\windows\ie8\imgutil.dll
+ 2012-01-20 14:32 . 2007-08-13 16:39	55296              c:\windows\ie8\iesetup.dll
+ 2012-01-20 14:32 . 2011-10-31 23:36	44544              c:\windows\ie8\iernonce.dll
+ 2012-01-20 14:32 . 2011-10-31 23:36	78336              c:\windows\ie8\ieencode.dll
+ 2012-01-20 14:32 . 2011-10-31 20:56	70656              c:\windows\ie8\ie4uinit.exe
+ 2012-01-20 14:32 . 2011-10-31 23:36	63488              c:\windows\ie8\icardie.dll
+ 2012-01-20 14:32 . 2007-08-13 16:18	60416              c:\windows\ie8\hmmapi.dll
+ 2012-01-20 14:32 . 2011-10-31 23:36	17408              c:\windows\ie8\corpol.dll
+ 2012-01-20 14:32 . 2007-08-13 16:39	71680              c:\windows\ie8\admparse.dll
+ 2012-05-11 12:40 . 2012-05-11 12:40	60928              c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationProvider\f121ccced1aa14badb316d8d9be5154d\UIAutomationProvider.ni.dll
+ 2012-05-11 12:48 . 2012-05-11 12:48	37888              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Pres#\316e223f2ab8c69cd6a5a06de21650ec\System.Windows.Presentation.ni.dll
+ 2012-05-11 12:47 . 2012-05-11 12:47	36864              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\7aac1fe67890463655aeeb3b8e4f2884\System.Web.DynamicData.Design.ni.dll
+ 2012-05-11 12:43 . 2012-05-11 12:43	94208              c:\windows\assembly\NativeImages_v2.0.50727_32\System.ComponentMod#\34c988dea48c291b4e648941207e83fb\System.ComponentModel.DataAnnotations.ni.dll
+ 2012-05-11 12:43 . 2012-05-11 12:43	82944              c:\windows\assembly\NativeImages_v2.0.50727_32\System.AddIn.Contra#\7bb7e51275fa19f8b4894c772bdb1e10\System.AddIn.Contract.ni.dll
+ 2012-05-09 17:40 . 2012-05-09 17:40	47104              c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\f0c4a4528f130ef2ff1ae63dd7b39075\PresentationFontCache.ni.exe
+ 2012-05-09 17:39 . 2012-05-09 17:39	39424              c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationCFFRast#\53931181e5a5e194da82605613cda6af\PresentationCFFRasterizer.ni.dll
+ 2012-05-11 12:46 . 2012-05-11 12:46	55296              c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Vsa\f2be3ad4cda6853d7959a84cec0414c5\Microsoft.Vsa.ni.dll
+ 2012-05-11 12:43 . 2012-05-11 12:43	65024              c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\8fab9cd28bbc860a34feec119512664d\Microsoft.Build.Framework.ni.dll
+ 2012-05-11 12:43 . 2012-05-11 12:43	74752              c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\0eac132c7c36f1c100ae23c956b379e7\Microsoft.Build.Framework.ni.dll
+ 2012-05-11 12:43 . 2012-05-11 12:43	14336              c:\windows\assembly\NativeImages_v2.0.50727_32\dfsvc\d66bc03eb7eae89b4dde2d09eda1414f\dfsvc.ni.exe
+ 2012-05-11 12:43 . 2012-05-11 12:43	25600              c:\windows\assembly\NativeImages_v2.0.50727_32\Accessibility\016444dfc5f7e3d11c776f2fbc7a4594\Accessibility.ni.dll
- 2011-10-16 08:17 . 2011-10-16 08:17	77824              c:\windows\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
+ 2012-05-09 17:35 . 2012-05-09 17:35	77824              c:\windows\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
- 2011-10-16 08:17 . 2011-10-16 08:17	81920              c:\windows\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
+ 2012-05-09 17:35 . 2012-05-09 17:35	81920              c:\windows\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
- 2011-10-16 08:19 . 2011-10-16 08:19	81920              c:\windows\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36	81920              c:\windows\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
+ 2012-05-09 17:35 . 2012-05-09 17:35	32768              c:\windows\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
- 2011-10-16 08:18 . 2011-10-16 08:18	32768              c:\windows\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36	12800              c:\windows\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
- 2011-10-16 08:18 . 2011-10-16 08:18	12800              c:\windows\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36	28672              c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
- 2011-10-16 08:18 . 2011-10-16 08:18	28672              c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
- 2011-10-16 08:18 . 2011-10-16 08:18	77824              c:\windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36	77824              c:\windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36	36864              c:\windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
- 2011-10-16 08:18 . 2011-10-16 08:18	36864              c:\windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
- 2011-10-16 08:18 . 2011-10-16 08:18	77824              c:\windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
+ 2012-05-09 17:35 . 2012-05-09 17:35	77824              c:\windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
- 2011-10-16 08:18 . 2011-10-16 08:18	13312              c:\windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
+ 2012-05-09 17:35 . 2012-05-09 17:35	13312              c:\windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
- 2011-10-16 08:18 . 2011-10-16 08:18	10752              c:\windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
+ 2012-05-09 17:35 . 2012-05-09 17:35	10752              c:\windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
- 2011-10-16 08:18 . 2011-10-16 08:18	72192              c:\windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36	72192              c:\windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
- 2011-10-16 08:18 . 2011-10-16 08:18	69120              c:\windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
+ 2012-05-09 17:35 . 2012-05-09 17:35	69120              c:\windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
- 2011-10-16 08:18 . 2011-10-16 08:18	8192              c:\windows\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e\IEExecRemote.dll
+ 2012-05-09 17:35 . 2012-05-09 17:35	8192              c:\windows\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e\IEExecRemote.dll
+ 2012-02-15 12:11 . 2012-01-11 19:06	3072              c:\windows\system32\iacenc.dll
+ 2012-01-20 14:26 . 2011-08-16 10:45	6144              c:\windows\system32\dllcache\iecompat.dll
+ 2012-02-15 12:11 . 2012-01-11 19:06	3072              c:\windows\system32\dllcache\iacenc.dll
+ 2012-01-20 14:43 . 2009-03-08 03:35	2048              c:\windows\ie8updates\KB2598845-IE8\iecompat.dll
+ 2012-05-09 17:35 . 2012-05-09 17:35	7168              c:\windows\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
- 2011-10-16 08:18 . 2011-10-16 08:18	7168              c:\windows\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
- 2011-10-16 08:19 . 2011-10-16 08:19	5632              c:\windows\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
+ 2012-05-09 17:36 . 2012-05-09 17:36	5632              c:\windows\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
- 2011-10-16 08:18 . 2011-10-16 08:18	6656              c:\windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
+ 2012-05-09 17:35 . 2012-05-09 17:35	6656              c:\windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
- 2011-10-16 08:18 . 2011-10-16 08:18	8192              c:\windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll
+ 2012-05-09 17:35 . 2012-05-09 17:35	8192              c:\windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36	113664              c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
- 2011-10-16 08:18 . 2011-10-16 08:18	113664              c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
- 2011-10-16 08:18 . 2011-10-16 08:18	258048              c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36	258048              c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
+ 2008-07-29 03:23 . 2008-07-29 03:23	626688              c:\windows\WinSxS\amd64_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_a17e7c1e\msvcr90.dll
+ 2008-07-29 03:23 . 2008-07-29 03:23	856576              c:\windows\WinSxS\amd64_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_a17e7c1e\msvcp90.dll
+ 2008-07-29 01:51 . 2008-07-29 01:51	245760              c:\windows\WinSxS\amd64_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_a17e7c1e\msvcm90.dll
+ 2011-10-29 10:58 . 2011-07-22 07:50	359856              c:\windows\system32\zkasigct.dll
+ 2012-04-05 21:13 . 2012-04-05 21:13	299080              c:\windows\system32\XPSViewer\XPSViewer.exe
- 2008-04-14 12:00 . 2008-04-14 12:00	121856              c:\windows\system32\xmllite.dll
+ 2008-04-14 12:00 . 2009-01-07 17:21	121856              c:\windows\system32\xmllite.dll
- 2008-04-14 12:00 . 2009-12-24 06:59	177664              c:\windows\system32\wintrust.dll
+ 2008-04-14 12:00 . 2012-02-29 14:09	177664              c:\windows\system32\wintrust.dll
- 2008-04-14 12:00 . 2011-06-20 17:44	293888              c:\windows\system32\winsrv.dll
+ 2008-04-14 12:00 . 2011-11-25 21:57	293888              c:\windows\system32\winsrv.dll
+ 2008-04-14 12:00 . 2011-10-14 14:47	178176              c:\windows\system32\winmm.dll
- 2008-04-14 12:00 . 2008-04-14 12:00	178176              c:\windows\system32\winmm.dll
+ 2008-04-14 12:00 . 2012-03-01 11:00	916992              c:\windows\system32\wininet.dll
- 2008-04-14 12:00 . 2009-08-25 09:17	354816              c:\windows\system32\winhttp.dll
+ 2008-04-14 12:00 . 2011-11-16 14:21	354816              c:\windows\system32\winhttp.dll
+ 2007-08-13 16:45 . 2009-03-08 03:34	208384              c:\windows\system32\WinFXDocObj.exe
+ 2008-04-14 12:00 . 2009-03-08 03:34	236544              c:\windows\system32\webcheck.dll
+ 2008-04-14 12:00 . 2011-03-04 06:36	420864              c:\windows\system32\vbscript.dll
+ 2008-04-14 12:00 . 2012-03-01 11:00	105984              c:\windows\system32\url.dll
- 2011-10-29 10:58 . 2007-11-07 10:20	344064              c:\windows\system32\SetupHBCI.exe
+ 2011-10-29 10:58 . 2007-11-07 12:20	344064              c:\windows\system32\SetupHBCI.exe
+ 2011-10-29 10:58 . 2007-05-31 07:38	167936              c:\windows\system32\SerialXP.dll
- 2011-10-29 10:58 . 2007-05-31 05:38	167936              c:\windows\system32\SerialXP.dll
+ 2008-04-14 12:00 . 2011-11-16 14:21	152064              c:\windows\system32\schannel.dll
+ 2011-10-29 10:58 . 2007-11-07 12:20	196608              c:\windows\system32\rsct_pnp.exe
- 2011-10-29 10:58 . 2007-11-07 10:20	196608              c:\windows\system32\rsct_pnp.exe
- 2011-10-29 10:58 . 2010-02-10 17:39	269824              c:\windows\system32\rsct_pnp.dll
+ 2011-10-29 10:58 . 2010-02-10 19:39	269824              c:\windows\system32\rsct_pnp.dll
+ 2008-04-14 12:00 . 2011-11-03 15:28	387072              c:\windows\system32\qdvd.dll
- 2008-04-14 12:00 . 2008-04-14 12:00	387072              c:\windows\system32\qdvd.dll
- 2008-04-14 12:00 . 2011-11-08 20:08	433138              c:\windows\system32\perfh009.dat
+ 2008-04-14 12:00 . 2012-05-09 17:37	433138              c:\windows\system32\perfh009.dat
+ 2008-04-14 12:00 . 2012-05-09 17:37	479376              c:\windows\system32\perfh007.dat
- 2011-10-29 10:58 . 2007-05-31 05:38	151552              c:\windows\system32\OcfCopy.exe
+ 2011-10-29 10:58 . 2007-05-31 07:38	151552              c:\windows\system32\OcfCopy.exe
+ 2008-04-14 12:00 . 2012-03-01 11:00	206848              c:\windows\system32\occache.dll
+ 2011-10-29 10:58 . 2007-05-31 07:38	434252              c:\windows\system32\MSVCRTD.DLL
- 2011-10-29 10:58 . 2007-05-31 05:38	434252              c:\windows\system32\MSVCRTD.DLL
+ 2008-04-14 12:00 . 2012-03-01 11:00	611840              c:\windows\system32\mstime.dll
+ 2008-04-14 12:00 . 2009-03-08 03:34	193536              c:\windows\system32\msrating.dll
- 2008-04-14 12:00 . 2007-08-13 16:54	156160              c:\windows\system32\msls31.dll
+ 2008-04-14 12:00 . 2009-03-08 03:22	156160              c:\windows\system32\msls31.dll
+ 2007-08-13 16:54 . 2012-03-01 11:00	602112              c:\windows\system32\msfeeds.dll
+ 2009-01-07 17:20 . 2009-01-07 17:20	265720              c:\windows\system32\msdbg2.dll
+ 2012-02-21 13:46 . 2012-02-21 13:46	279992              c:\windows\system32\Macromed\Shockwave 10\SymCCIS.dll
- 2011-11-22 15:50 . 2011-11-22 15:50	279992              c:\windows\system32\Macromed\Shockwave 10\SymCCIS.dll
- 2011-11-22 15:50 . 2011-11-22 15:50	180224              c:\windows\system32\Macromed\Shockwave 10\Proj.dll
+ 2012-02-21 13:46 . 2012-02-21 13:46	180224              c:\windows\system32\Macromed\Shockwave 10\Proj.dll
+ 2012-02-21 13:46 . 2012-02-21 13:46	475136              c:\windows\system32\Macromed\Shockwave 10\PluginPing.dll
- 2011-11-22 15:50 . 2011-11-22 15:50	475136              c:\windows\system32\Macromed\Shockwave 10\PluginPing.dll
- 2011-11-22 15:50 . 2011-11-22 15:50	339968              c:\windows\system32\Macromed\Shockwave 10\Plugin.dll
+ 2012-02-21 13:46 . 2012-02-21 13:46	339968              c:\windows\system32\Macromed\Shockwave 10\Plugin.dll
+ 2012-02-21 13:46 . 2012-02-21 13:46	606208              c:\windows\system32\Macromed\Shockwave 10\iml32X.dll
- 2011-11-22 15:50 . 2011-11-22 15:50	606208              c:\windows\system32\Macromed\Shockwave 10\iml32X.dll
+ 2012-02-21 13:46 . 2012-02-21 13:46	471040              c:\windows\system32\Macromed\Shockwave 10\Control.dll
- 2011-11-22 15:50 . 2011-11-22 15:50	471040              c:\windows\system32\Macromed\Shockwave 10\Control.dll
+ 2012-05-06 13:42 . 2012-05-06 13:42	351904              c:\windows\system32\Macromed\Flash\FlashUtil32_11_2_202_235_Plugin.exe
+ 2012-05-06 09:41 . 2012-05-06 09:41	351904              c:\windows\system32\Macromed\Flash\FlashUtil32_11_2_202_235_ActiveX.exe
+ 2012-05-06 09:41 . 2012-05-06 09:41	424096              c:\windows\system32\Macromed\Flash\FlashUtil32_11_2_202_235_ActiveX.dll
+ 2012-04-05 07:34 . 2012-05-06 13:42	257696              c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
+ 2008-04-14 12:00 . 2011-03-04 06:36	726528              c:\windows\system32\jscript.dll
+ 2012-01-23 11:13 . 2011-11-10 04:54	157472              c:\windows\system32\javaws.exe
+ 2012-01-23 11:13 . 2011-11-10 04:54	149280              c:\windows\system32\javaw.exe
+ 2012-01-23 11:13 . 2011-11-10 04:54	149280              c:\windows\system32\java.exe
+ 2008-04-14 12:00 . 2012-02-29 14:09	148480              c:\windows\system32\imagehlp.dll
+ 2007-08-13 16:54 . 2009-03-08 03:22	164352              c:\windows\system32\ieui.dll
+ 2008-04-14 12:00 . 2012-03-01 11:00	184320              c:\windows\system32\iepeers.dll
+ 2008-04-14 12:00 . 2012-03-01 11:00	387584              c:\windows\system32\iedkcs32.dll
+ 2007-07-11 10:27 . 2009-03-08 03:11	445952              c:\windows\system32\ieapfltr.dll
+ 2008-04-14 12:00 . 2009-03-08 03:32	163840              c:\windows\system32\ieakui.dll
+ 2008-04-14 12:00 . 2009-03-08 03:33	229376              c:\windows\system32\ieaksie.dll
+ 2008-04-14 12:00 . 2009-03-08 03:33	125952              c:\windows\system32\ieakeng.dll
+ 2008-04-14 12:00 . 2012-02-29 12:17	174080              c:\windows\system32\ie4uinit.exe
- 2011-10-29 10:58 . 2009-03-09 15:17	274224              c:\windows\system32\gkapi.dll
+ 2011-10-29 10:58 . 2009-03-09 17:17	274224              c:\windows\system32\gkapi.dll
- 2009-04-17 14:51 . 2011-12-14 12:16	126912              c:\windows\system32\FNTCACHE.DAT
+ 2012-06-01 06:08 . 2012-06-01 06:08	126912              c:\windows\system32\FNTCACHE.DAT
+ 2008-04-14 12:00 . 2009-03-08 03:31	216064              c:\windows\system32\dxtrans.dll
+ 2008-04-14 12:00 . 2009-03-08 03:31	348160              c:\windows\system32\dxtmsft.dll
+ 2009-04-17 14:02 . 2012-01-09 16:20	139784              c:\windows\system32\drivers\rdpwd.sys
- 2008-04-14 12:00 . 2009-12-24 06:59	177664              c:\windows\system32\dllcache\wintrust.dll
+ 2008-04-14 12:00 . 2012-02-29 14:09	177664              c:\windows\system32\dllcache\wintrust.dll
- 2008-04-14 12:00 . 2011-06-20 17:44	293888              c:\windows\system32\dllcache\winsrv.dll
+ 2008-04-14 12:00 . 2011-11-25 21:57	293888              c:\windows\system32\dllcache\winsrv.dll
- 2008-04-14 12:00 . 2008-04-14 12:00	178176              c:\windows\system32\dllcache\winmm.dll
+ 2008-04-14 12:00 . 2011-10-14 14:47	178176              c:\windows\system32\dllcache\winmm.dll
+ 2008-04-14 12:00 . 2012-03-01 11:00	916992              c:\windows\system32\dllcache\wininet.dll
+ 2008-04-14 12:00 . 2011-11-16 14:21	354816              c:\windows\system32\dllcache\winhttp.dll
- 2008-04-14 12:00 . 2009-08-25 09:17	354816              c:\windows\system32\dllcache\winhttp.dll
+ 2008-04-14 12:00 . 2009-03-08 03:34	236544              c:\windows\system32\dllcache\webcheck.dll
+ 2009-04-17 14:05 . 2011-04-30 03:01	758784              c:\windows\system32\dllcache\vgx.dll
+ 2008-04-14 12:00 . 2011-03-04 06:36	420864              c:\windows\system32\dllcache\vbscript.dll
+ 2008-04-14 12:00 . 2012-03-01 11:00	105984              c:\windows\system32\dllcache\url.dll
+ 2009-01-07 17:20 . 2009-01-07 17:20	134144              c:\windows\system32\dllcache\sqmapi.dll
+ 2008-04-14 12:00 . 2011-11-16 14:21	152064              c:\windows\system32\dllcache\schannel.dll
+ 2009-04-17 14:02 . 2012-01-09 16:20	139784              c:\windows\system32\dllcache\rdpwd.sys
+ 2008-04-14 12:00 . 2011-11-03 15:28	387072              c:\windows\system32\dllcache\qdvd.dll
- 2008-04-14 12:00 . 2008-04-14 12:00	387072              c:\windows\system32\dllcache\qdvd.dll
+ 2008-04-14 12:00 . 2012-03-01 11:00	206848              c:\windows\system32\dllcache\occache.dll
+ 2008-04-14 12:00 . 2012-03-01 11:00	611840              c:\windows\system32\dllcache\mstime.dll
+ 2008-04-14 12:00 . 2009-03-08 03:34	193536              c:\windows\system32\dllcache\msrating.dll
- 2008-04-14 12:00 . 2007-08-13 16:54	156160              c:\windows\system32\dllcache\msls31.dll
+ 2008-04-14 12:00 . 2009-03-08 03:22	156160              c:\windows\system32\dllcache\msls31.dll
+ 2009-02-20 16:49 . 2012-03-01 11:00	602112              c:\windows\system32\dllcache\msfeeds.dll
+ 2008-04-14 12:00 . 2011-03-04 06:36	726528              c:\windows\system32\dllcache\jscript.dll
+ 2008-04-14 12:00 . 2012-02-29 14:09	148480              c:\windows\system32\dllcache\imagehlp.dll
+ 2009-04-17 14:04 . 2009-03-08 13:09	638816              c:\windows\system32\dllcache\iexplore.exe
+ 2012-01-20 14:26 . 2012-03-01 11:00	247808              c:\windows\system32\dllcache\ieproxy.dll
+ 2008-04-14 12:00 . 2012-03-01 11:00	184320              c:\windows\system32\dllcache\iepeers.dll
+ 2012-01-20 14:26 . 2012-03-01 11:00	743424              c:\windows\system32\dllcache\iedvtool.dll
+ 2008-04-14 12:00 . 2012-03-01 11:00	387584              c:\windows\system32\dllcache\iedkcs32.dll
+ 2009-02-20 16:49 . 2009-03-08 03:11	445952              c:\windows\system32\dllcache\ieapfltr.dll
+ 2008-04-14 12:00 . 2009-03-08 03:32	163840              c:\windows\system32\dllcache\ieakui.dll
+ 2008-04-14 12:00 . 2009-03-08 03:33	229376              c:\windows\system32\dllcache\ieaksie.dll
+ 2008-04-14 12:00 . 2009-03-08 03:33	125952              c:\windows\system32\dllcache\ieakeng.dll
+ 2008-04-14 12:00 . 2012-02-29 12:17	174080              c:\windows\system32\dllcache\ie4uinit.exe
+ 2008-04-14 12:00 . 2009-03-08 03:31	216064              c:\windows\system32\dllcache\dxtrans.dll
+ 2008-04-14 12:00 . 2009-03-08 03:31	348160              c:\windows\system32\dllcache\dxtmsft.dll
+ 2008-04-14 12:00 . 2012-05-31 13:22	604160              c:\windows\system32\dllcache\crypt32.dll
- 2008-04-14 12:00 . 2011-09-28 07:06	604160              c:\windows\system32\dllcache\crypt32.dll
+ 2008-04-14 12:00 . 2009-03-08 03:32	128512              c:\windows\system32\dllcache\advpack.dll
+ 2012-01-23 11:13 . 2011-11-10 04:54	472808              c:\windows\system32\deployJava1.dll
- 2011-10-29 10:58 . 2010-11-28 20:03	351664              c:\windows\system32\ctrsct32.dll
+ 2011-10-29 10:58 . 2011-07-22 07:49	351664              c:\windows\system32\ctrsct32.dll
+ 2011-10-29 10:58 . 2011-07-22 07:49	208816              c:\windows\system32\cjppa32.dll
+ 2011-10-29 10:58 . 2011-07-22 07:49	713136              c:\windows\system32\cjpcscui.exe
+ 2011-10-29 10:58 . 2011-07-22 07:49	785328              c:\windows\system32\cjpcsc32.dll
+ 2011-10-29 10:58 . 2011-07-22 07:49	511920              c:\windows\system32\cjpcsc.exe
+ 2011-10-29 10:58 . 2011-07-22 07:48	212912              c:\windows\system32\cjeca32.dll
+ 2008-04-14 12:00 . 2009-03-08 03:32	128512              c:\windows\system32\advpack.dll
+ 2012-02-02 13:32 . 2012-02-02 13:32	279992              c:\windows\system32\Adobe\Shockwave 11\SymCCIS.dll
+ 2012-02-02 13:49 . 2012-02-02 13:49	114176              c:\windows\system32\Adobe\Shockwave 11\SwInit.exe
+ 2012-02-02 13:50 . 2012-02-02 13:50	434176              c:\windows\system32\Adobe\Shockwave 11\Proj.dll
+ 2012-02-02 13:49 . 2012-02-02 13:49	365056              c:\windows\system32\Adobe\Shockwave 11\Plugin.dll
+ 2012-02-02 13:36 . 2012-02-02 13:36	990208              c:\windows\system32\Adobe\Shockwave 11\iml32.dll
+ 2012-02-02 13:49 . 2012-02-02 13:49	543232              c:\windows\system32\Adobe\Shockwave 11\Control.dll
+ 2012-02-02 13:56 . 2012-02-02 13:56	113592              c:\windows\system32\Adobe\Director\SWDNLD.EXE
+ 2012-02-02 13:56 . 2012-02-02 13:56	281016              c:\windows\system32\Adobe\Director\SwDir.dll
+ 2012-02-02 13:49 . 2012-02-02 13:49	145920              c:\windows\system32\Adobe\Director\np32dsw.dll
+ 2012-04-05 21:52 . 2012-04-05 21:52	131168              c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationHostDLL.dll
+ 2011-12-25 02:49 . 2011-12-25 02:49	436496              c:\windows\Microsoft.NET\Framework\v2.0.50727\webengine.dll
+ 2012-01-31 01:38 . 2012-01-31 01:38	630784              c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Drawing.dll
+ 2011-12-25 01:50 . 2011-12-25 01:50	389888              c:\windows\Microsoft.NET\Framework\v2.0.50727\SOS.dll
+ 2011-12-25 01:50 . 2011-12-25 01:50	364816              c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
+ 2011-12-25 01:50 . 2011-12-25 01:50	989968              c:\windows\Microsoft.NET\Framework\v2.0.50727\mscordacwks.dll
+ 2012-01-23 11:18 . 2012-01-23 11:18	203776              c:\windows\Installer\654ead.msi
+ 2012-01-05 15:58 . 2012-01-05 15:58	430592              c:\windows\Installer\5ec3a.msi
+ 2012-02-02 21:56 . 2012-02-02 21:56	963584              c:\windows\Installer\5787b5.msp
+ 2011-12-25 04:40 . 2011-12-25 04:40	819200              c:\windows\Installer\551d5b.msp
+ 2011-12-22 14:50 . 2011-12-22 14:50	256000              c:\windows\Installer\132e6ff.msp
+ 2011-06-06 11:55 . 2011-06-06 11:55	249232              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010\10.1.0\sqlite.dll
+ 2011-06-06 11:55 . 2011-06-06 11:55	394136              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010\10.1.0\pdfshell.dll
+ 2011-06-06 11:55 . 2011-06-06 11:55	103848              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010\10.1.0\PDFPrevHndlrShim.exe
+ 2011-06-06 11:55 . 2011-06-06 11:55	183696              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010\10.1.0\nppdf32.dll
+ 2011-06-06 11:55 . 2011-06-06 11:55	104344              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010\10.1.0\AiodLite.dll
+ 2011-06-06 11:55 . 2011-06-06 11:55	937920              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010\10.1.0\adobearm.exe
+ 2011-06-06 11:55 . 2011-06-06 11:55	102808              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010\10.1.0\AcroRdIF.dll
+ 2011-06-06 11:55 . 2011-06-06 11:55	755088              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010\10.1.0\AcroPDF.dll
+ 2011-06-06 11:55 . 2011-06-06 11:55	296344              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010\10.1.0\acrobroker.exe
+ 2011-06-06 11:55 . 2011-06-06 11:55	205720              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010\10.1.0\a3dutils.dll
+ 2012-01-20 14:42 . 2009-03-08 03:34	914944              c:\windows\ie8updates\KB982381-IE8\wininet.dll
+ 2012-01-20 14:42 . 2010-02-22 14:22	388984              c:\windows\ie8updates\KB982381-IE8\spuninst\updspapi.dll
+ 2012-01-20 14:42 . 2008-07-08 13:00	234872              c:\windows\ie8updates\KB982381-IE8\spuninst\spuninst.exe
+ 2012-01-20 14:42 . 2009-03-08 03:34	109568              c:\windows\ie8updates\KB982381-IE8\occache.dll
+ 2012-01-20 14:42 . 2009-03-08 03:32	611840              c:\windows\ie8updates\KB982381-IE8\mstime.dll
+ 2012-01-20 14:42 . 2009-03-08 03:32	594432              c:\windows\ie8updates\KB982381-IE8\msfeeds.dll
+ 2012-01-20 14:42 . 2009-03-08 03:33	246784              c:\windows\ie8updates\KB982381-IE8\ieproxy.dll
+ 2012-01-20 14:42 . 2009-03-08 03:31	183808              c:\windows\ie8updates\KB982381-IE8\iepeers.dll
+ 2012-01-20 14:42 . 2009-03-08 03:35	742912              c:\windows\ie8updates\KB982381-IE8\iedvtool.dll
+ 2012-01-20 14:42 . 2009-03-08 13:09	391536              c:\windows\ie8updates\KB982381-IE8\iedkcs32.dll
+ 2012-01-20 14:42 . 2009-03-08 03:32	173056              c:\windows\ie8updates\KB982381-IE8\ie4uinit.exe
+ 2012-04-12 13:43 . 2011-12-17 19:43	916992              c:\windows\ie8updates\KB2675157-IE8\wininet.dll
+ 2012-04-12 13:43 . 2011-12-17 19:43	105984              c:\windows\ie8updates\KB2675157-IE8\url.dll
+ 2012-04-12 13:43 . 2010-07-05 13:14	388984              c:\windows\ie8updates\KB2675157-IE8\spuninst\updspapi.dll
+ 2012-04-12 13:43 . 2010-07-05 13:14	234872              c:\windows\ie8updates\KB2675157-IE8\spuninst\spuninst.exe
+ 2012-04-12 13:43 . 2011-12-17 19:43	206848              c:\windows\ie8updates\KB2675157-IE8\occache.dll
+ 2012-04-12 13:43 . 2011-12-17 19:43	611840              c:\windows\ie8updates\KB2675157-IE8\mstime.dll
+ 2012-04-12 13:43 . 2011-12-17 19:43	602112              c:\windows\ie8updates\KB2675157-IE8\msfeeds.dll
+ 2012-04-12 13:43 . 2011-12-17 19:43	247808              c:\windows\ie8updates\KB2675157-IE8\ieproxy.dll
+ 2012-04-12 13:43 . 2011-12-17 19:43	184320              c:\windows\ie8updates\KB2675157-IE8\iepeers.dll
+ 2012-04-12 13:43 . 2011-12-17 19:43	743424              c:\windows\ie8updates\KB2675157-IE8\iedvtool.dll
+ 2012-04-12 13:43 . 2011-12-17 19:43	387584              c:\windows\ie8updates\KB2675157-IE8\iedkcs32.dll
+ 2012-04-12 13:43 . 2011-12-16 12:23	174080              c:\windows\ie8updates\KB2675157-IE8\ie4uinit.exe
+ 2012-02-15 13:08 . 2011-11-04 19:13	105984              c:\windows\ie8updates\KB2647516-IE8\url.dll
+ 2012-02-15 13:08 . 2010-07-05 13:14	388984              c:\windows\ie8updates\KB2647516-IE8\spuninst\updspapi.dll
+ 2012-02-15 13:08 . 2010-07-05 13:14	234872              c:\windows\ie8updates\KB2647516-IE8\spuninst\spuninst.exe
+ 2012-02-15 13:08 . 2011-11-04 19:13	206848              c:\windows\ie8updates\KB2647516-IE8\occache.dll
+ 2012-02-15 13:08 . 2011-11-04 19:13	611840              c:\windows\ie8updates\KB2647516-IE8\mstime.dll
+ 2012-02-15 13:08 . 2011-11-04 19:13	602112              c:\windows\ie8updates\KB2647516-IE8\msfeeds.dll
+ 2012-02-15 13:08 . 2011-11-04 19:13	247808              c:\windows\ie8updates\KB2647516-IE8\ieproxy.dll
+ 2012-02-15 13:08 . 2011-11-04 19:13	184320              c:\windows\ie8updates\KB2647516-IE8\iepeers.dll
+ 2012-02-15 13:08 . 2011-11-04 19:13	743424              c:\windows\ie8updates\KB2647516-IE8\iedvtool.dll
+ 2012-02-15 13:08 . 2011-11-04 19:13	387584              c:\windows\ie8updates\KB2647516-IE8\iedkcs32.dll
+ 2012-02-15 13:08 . 2011-11-04 11:24	174080              c:\windows\ie8updates\KB2647516-IE8\ie4uinit.exe
+ 2012-01-20 14:43 . 2010-05-06 10:31	916480              c:\windows\ie8updates\KB2618444-IE8\wininet.dll
+ 2012-01-20 14:43 . 2009-03-08 03:34	105984              c:\windows\ie8updates\KB2618444-IE8\url.dll
+ 2012-01-20 14:44 . 2010-07-05 13:14	388984              c:\windows\ie8updates\KB2618444-IE8\spuninst\updspapi.dll
+ 2012-01-20 14:44 . 2010-07-05 13:14	234872              c:\windows\ie8updates\KB2618444-IE8\spuninst\spuninst.exe
+ 2012-01-20 14:43 . 2010-05-06 10:31	206848              c:\windows\ie8updates\KB2618444-IE8\occache.dll
+ 2012-01-20 14:43 . 2010-05-06 10:31	611840              c:\windows\ie8updates\KB2618444-IE8\mstime.dll
+ 2012-01-20 14:43 . 2010-05-06 10:31	599040              c:\windows\ie8updates\KB2618444-IE8\msfeeds.dll
+ 2012-01-20 14:43 . 2010-05-06 10:31	247808              c:\windows\ie8updates\KB2618444-IE8\ieproxy.dll
+ 2012-01-20 14:43 . 2010-05-06 10:31	184320              c:\windows\ie8updates\KB2618444-IE8\iepeers.dll
+ 2012-01-20 14:43 . 2010-05-06 10:31	743424              c:\windows\ie8updates\KB2618444-IE8\iedvtool.dll
+ 2012-01-20 14:43 . 2010-05-06 10:31	387584              c:\windows\ie8updates\KB2618444-IE8\iedkcs32.dll
+ 2012-01-20 14:43 . 2010-05-05 13:30	173056              c:\windows\ie8updates\KB2618444-IE8\ie4uinit.exe
+ 2012-01-20 14:43 . 2010-07-05 13:14	388984              c:\windows\ie8updates\KB2598845-IE8\spuninst\updspapi.dll
+ 2012-01-20 14:43 . 2010-07-05 13:14	234872              c:\windows\ie8updates\KB2598845-IE8\spuninst\spuninst.exe
+ 2012-01-22 13:20 . 2009-03-08 03:33	759296              c:\windows\ie8updates\KB2544521-IE8\vgx.dll
+ 2012-01-22 13:20 . 2010-07-05 13:14	388984              c:\windows\ie8updates\KB2544521-IE8\spuninst\updspapi.dll
+ 2012-01-22 13:20 . 2010-07-05 13:14	234872              c:\windows\ie8updates\KB2544521-IE8\spuninst\spuninst.exe
+ 2012-01-22 13:20 . 2009-03-08 03:33	420352              c:\windows\ie8updates\KB2510531-IE8\vbscript.dll
+ 2012-01-22 13:20 . 2010-07-05 13:14	388984              c:\windows\ie8updates\KB2510531-IE8\spuninst\updspapi.dll
+ 2012-01-22 13:20 . 2010-07-05 13:14	234872              c:\windows\ie8updates\KB2510531-IE8\spuninst\spuninst.exe
+ 2012-01-22 13:20 . 2009-03-08 03:33	726528              c:\windows\ie8updates\KB2510531-IE8\jscript.dll
+ 2012-01-20 14:32 . 2011-10-31 23:36	832512              c:\windows\ie8\wininet.dll
+ 2012-01-20 14:32 . 2007-08-13 16:45	206336              c:\windows\ie8\winfxdocobj.exe
+ 2012-01-20 14:32 . 2011-10-31 23:36	233472              c:\windows\ie8\webcheck.dll
+ 2012-01-20 14:32 . 2011-04-30 08:50	766464              c:\windows\ie8\vgx.dll
+ 2012-01-20 14:32 . 2011-03-04 06:44	434176              c:\windows\ie8\vbscript.dll
+ 2012-01-20 14:32 . 2011-10-31 23:36	106496              c:\windows\ie8\url.dll
+ 2012-01-20 14:35 . 2009-01-07 17:20	388640              c:\windows\ie8\spuninst\updspapi.dll
+ 2012-01-20 14:35 . 2009-01-07 17:20	235040              c:\windows\ie8\spuninst\spuninst.exe
+ 2012-01-20 14:32 . 2006-09-06 15:42	217312              c:\windows\ie8\spuninst.exe
+ 2012-01-20 14:32 . 2011-10-31 23:36	102912              c:\windows\ie8\occache.dll
+ 2012-01-20 14:32 . 2011-10-31 23:36	671232              c:\windows\ie8\mstime.dll
+ 2012-01-20 14:32 . 2011-10-31 23:36	193024              c:\windows\ie8\msrating.dll
+ 2012-01-20 14:32 . 2007-08-13 16:54	156160              c:\windows\ie8\msls31.dll
+ 2012-01-20 14:32 . 2011-10-31 23:36	478720              c:\windows\ie8\mshtmled.dll
+ 2012-01-20 14:32 . 2011-10-31 23:36	468480              c:\windows\ie8\msfeeds.dll
+ 2012-01-20 14:32 . 2011-03-04 06:44	512000              c:\windows\ie8\jscript.dll
+ 2012-01-20 14:32 . 2011-10-31 10:46	634504              c:\windows\ie8\iexplore.exe
+ 2012-01-20 14:32 . 2007-08-13 16:54	180736              c:\windows\ie8\ieui.dll
+ 2012-01-20 14:32 . 2011-10-31 23:36	268288              c:\windows\ie8\iertutil.dll
+ 2012-01-20 14:32 . 2007-08-13 16:54	287744              c:\windows\ie8\ieproxy.dll
+ 2012-01-20 14:32 . 2011-10-31 23:36	192512              c:\windows\ie8\iepeers.dll
+ 2012-01-20 14:32 . 2011-10-31 23:36	384512              c:\windows\ie8\iedkcs32.dll
+ 2012-01-20 14:32 . 2011-10-31 23:36	380928              c:\windows\ie8\ieapfltr.dll
+ 2012-01-20 14:32 . 2011-10-27 12:49	161792              c:\windows\ie8\ieakui.dll
+ 2012-01-20 14:32 . 2011-10-31 23:36	230400              c:\windows\ie8\ieaksie.dll
+ 2012-01-20 14:32 . 2011-10-31 23:36	153088              c:\windows\ie8\ieakeng.dll
+ 2012-01-20 14:32 . 2011-10-31 23:36	214528              c:\windows\ie8\dxtrans.dll
+ 2012-01-20 14:32 . 2011-10-31 23:36	347136              c:\windows\ie8\dxtmsft.dll
+ 2012-01-20 14:32 . 2011-10-31 23:36	124928              c:\windows\ie8\advpack.dll
+ 2012-05-11 12:43 . 2012-05-11 12:43	321536              c:\windows\assembly\NativeImages_v2.0.50727_32\WsatConfig\ac4fc3032c19946f9b2729468888206d\WsatConfig.ni.exe
+ 2012-05-11 12:40 . 2012-05-11 12:40	240128              c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\6198de2c5b8f7d89404c2ba39d69ae56\WindowsFormsIntegration.ni.dll
+ 2012-05-11 12:40 . 2012-05-11 12:40	187904              c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationTypes\be27ab5913cec2b292a019c2a13ec701\UIAutomationTypes.ni.dll
+ 2012-05-11 12:40 . 2012-05-11 12:40	447488              c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClient\04e5e2be34a70ee7f4c87550238095a0\UIAutomationClient.ni.dll
+ 2012-05-11 12:48 . 2012-05-11 12:48	400896              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml.Linq\1c13b08593e99d6f5bef49ae7939c78b\System.Xml.Linq.ni.dll
+ 2012-05-11 12:47 . 2012-05-11 12:47	129536              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Routing\8bffbaa5d5abe40674d0bc124dfe8622\System.Web.Routing.ni.dll
+ 2012-05-11 12:47 . 2012-05-11 12:47	202240              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\6c7765c10516d375e9ddedad2dbab848\System.Web.RegularExpressions.ni.dll
+ 2012-05-11 12:47 . 2012-05-11 12:47	859648              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\a7908debe80c209b599529685a159fa0\System.Web.Extensions.Design.ni.dll
+ 2012-05-11 12:47 . 2012-05-11 12:47	328704              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Entity\44ecb9f7be54a2ba46e6102d343e2e7e\System.Web.Entity.ni.dll
+ 2012-05-11 12:47 . 2012-05-11 12:47	301056              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Entity.D#\fee8237aa2daa36e48aec379ee642422\System.Web.Entity.Design.ni.dll
+ 2012-05-11 12:47 . 2012-05-11 12:47	547328              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\40d90d2c1484164b786067320ce778f4\System.Web.DynamicData.ni.dll
+ 2012-05-11 12:47 . 2012-05-11 12:47	141312              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Abstract#\6b4ce8cf2c3307b75ea7ebe77258bb26\System.Web.Abstractions.ni.dll
+ 2012-05-11 12:47 . 2012-05-11 12:47	627200              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\41f6f6dd0c8427d4a8e6fd3915505a6b\System.Transactions.ni.dll
+ 2012-05-11 12:47 . 2012-05-11 12:47	212992              c:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\8dc4a28c456f81ee7399da21bd9d55aa\System.ServiceProcess.ni.dll
+ 2012-05-11 12:43 . 2012-05-11 12:43	679936              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Security\129b15861e200613ff78ae15581f9093\System.Security.ni.dll
+ 2012-05-11 12:46 . 2012-05-11 12:46	311296              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\a644ec04e18202b60f9d828bc207972b\System.Runtime.Serialization.Formatters.Soap.ni.dll
+ 2012-05-11 12:46 . 2012-05-11 12:46	621056              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Net\4a9eb43005a041959ddc5c7e586ab746\System.Net.ni.dll
+ 2012-05-11 12:46 . 2012-05-11 12:46	998400              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Management\9080c8e8e7b6dfb502c1328673d636f8\System.Management.ni.dll
+ 2012-05-11 12:46 . 2012-05-11 12:46	330752              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Management.I#\3182a049ba953010dec649cf290a9e90\System.Management.Instrumentation.ni.dll
+ 2012-05-11 12:42 . 2012-05-11 12:42	381440              c:\windows\assembly\NativeImages_v2.0.50727_32\System.IO.Log\8991f21d4b3676bf6f779110db8d4ac9\System.IO.Log.ni.dll
+ 2012-05-11 12:43 . 2012-05-11 12:43	212992              c:\windows\assembly\NativeImages_v2.0.50727_32\System.IdentityMode#\cd9c60a35d4958e94d2e3dd2f778e2e9\System.IdentityModel.Selectors.ni.dll
+ 2012-05-11 12:46 . 2012-05-11 12:46	280064              c:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\29bce0113d611084a9329349e33528ac\System.EnterpriseServices.Wrapper.dll
+ 2012-05-11 12:46 . 2012-05-11 12:46	627712              c:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\29bce0113d611084a9329349e33528ac\System.EnterpriseServices.ni.dll
+ 2012-05-11 12:39 . 2012-05-11 12:39	208384              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing.Desi#\88aa4f80c7e5ac25f06f8950e42a1678\System.Drawing.Design.ni.dll
+ 2012-05-11 12:46 . 2012-05-11 12:46	455680              c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\ca484772955bc4db03b5dcb611c09423\System.DirectoryServices.Protocols.ni.dll
+ 2012-05-11 12:46 . 2012-05-11 12:46	881152              c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\8ba5e68dddfd3279a8469d39eded48f3\System.DirectoryServices.AccountManagement.ni.dll
+ 2012-05-11 12:46 . 2012-05-11 12:46	354816              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Service#\a0109fce606a3110a5e7f9a4773f517e\System.Data.Services.Design.ni.dll
+ 2012-05-11 12:46 . 2012-05-11 12:46	939008              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Service#\3a68d0441f509ffa6f8f0fb9cfcc5780\System.Data.Services.Client.ni.dll
+ 2012-05-11 12:46 . 2012-05-11 12:46	756736              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Entity.#\04440b3dd5d822da4973a525ee04b05d\System.Data.Entity.Design.ni.dll
+ 2012-05-11 12:43 . 2012-05-11 12:43	135680              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.DataSet#\7bbb5d9e3b161b4d4b968e590442d3ae\System.Data.DataSetExtensions.ni.dll
+ 2012-05-11 12:43 . 2012-05-11 12:43	971264              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\3d5b7368bde0f65aa15d9f46b498cc89\System.Configuration.ni.dll
+ 2012-05-11 12:46 . 2012-05-11 12:46	141312              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\bf7d6af03e1230ccad546a8659245ae9\System.Configuration.Install.ni.dll
+ 2012-05-11 12:43 . 2012-05-11 12:43	634368              c:\windows\assembly\NativeImages_v2.0.50727_32\System.AddIn\931a2bece4668863db4f852401c828cf\System.AddIn.ni.dll
+ 2012-05-11 12:42 . 2012-05-11 12:42	366080              c:\windows\assembly\NativeImages_v2.0.50727_32\SMSvcHost\6762f1ee780fa9c0b4ef66b285c64844\SMSvcHost.ni.exe
+ 2012-05-11 12:42 . 2012-05-11 12:42	256000              c:\windows\assembly\NativeImages_v2.0.50727_32\SMDiagnostics\660c4d6dd69ef22bc05587e1998cd135\SMDiagnostics.ni.dll
+ 2012-05-11 12:42 . 2012-05-11 12:42	320512              c:\windows\assembly\NativeImages_v2.0.50727_32\ServiceModelReg\47ed5bc9f42ea0054ce9acfde5e640b8\ServiceModelReg.ni.exe
+ 2012-05-11 12:38 . 2012-05-11 12:38	258048              c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\a4706b850df9a3483f2fc439b6abe616\PresentationFramework.Royale.ni.dll
+ 2012-05-11 12:38 . 2012-05-11 12:38	539648              c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\8b873631a0855fb6aa0ad25f1d9de7fe\PresentationFramework.Luna.ni.dll
+ 2012-05-11 12:38 . 2012-05-11 12:38	224768              c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\7416fe825e6e49a87fa8ff60c8971813\PresentationFramework.Classic.ni.dll
+ 2012-05-11 12:38 . 2012-05-11 12:38	368128              c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\186c27fbd7b38b5551889274f6fa2ccd\PresentationFramework.Aero.ni.dll
+ 2012-05-11 12:43 . 2012-05-11 12:43	133632              c:\windows\assembly\NativeImages_v2.0.50727_32\MSBuild\5a121969a115d11b6256eb960c145686\MSBuild.ni.exe
+ 2012-05-11 12:42 . 2012-05-11 12:42	386560              c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\97c613d3899b320a6765793bdf490272\Microsoft.Transactions.Bridge.Dtc.ni.dll
+ 2012-05-11 12:43 . 2012-05-11 12:43	175104              c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\dec22fb7d6b8929a41380e5359741a07\Microsoft.Build.Utilities.v3.5.ni.dll
+ 2012-05-11 12:43 . 2012-05-11 12:43	144384              c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\1009b31c86a1b798fffa9e0127cec29c\Microsoft.Build.Utilities.ni.dll
+ 2012-05-11 12:43 . 2012-05-11 12:43	839680              c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\21d88631ef629715d3eecdd08e62e0b8\Microsoft.Build.Engine.ni.dll
+ 2012-05-11 12:43 . 2012-05-11 12:43	222720              c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Con#\a0f38c6478cca8297fb160291346c1c9\Microsoft.Build.Conversion.v3.5.ni.dll
+ 2012-05-11 12:43 . 2012-05-11 12:43	220672              c:\windows\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\bb26dd100d656605c576881a1a823667\CustomMarshalers.ni.dll
+ 2012-05-11 12:42 . 2012-05-11 12:42	410112              c:\windows\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\9869c02d18825fdd32e64135a3e7246b\ComSvcConfig.ni.exe
+ 2012-05-11 12:43 . 2012-05-11 12:43	842240              c:\windows\assembly\NativeImages_v2.0.50727_32\AspNetMMCExt\e414683ec4cff1cac0c77aaefd67144e\AspNetMMCExt.ni.dll
- 2011-10-16 08:17 . 2011-10-16 08:17	839680              c:\windows\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll
+ 2012-05-09 17:35 . 2012-05-09 17:35	839680              c:\windows\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll
- 2011-10-16 08:17 . 2011-10-16 08:17	835584              c:\windows\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
+ 2012-05-09 17:35 . 2012-05-09 17:35	835584              c:\windows\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
- 2011-10-16 08:18 . 2011-10-16 08:18	114688              c:\windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
+ 2012-05-09 17:35 . 2012-05-09 17:35	114688              c:\windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
- 2011-10-16 08:18 . 2011-10-16 08:18	258048              c:\windows\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36	258048              c:\windows\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36	131072              c:\windows\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
- 2011-10-16 08:18 . 2011-10-16 08:18	131072              c:\windows\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36	303104              c:\windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
- 2011-10-16 08:18 . 2011-10-16 08:18	303104              c:\windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36	258048              c:\windows\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll
- 2011-10-16 08:18 . 2011-10-16 08:18	258048              c:\windows\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll
- 2011-10-16 08:18 . 2011-10-16 08:18	372736              c:\windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36	372736              c:\windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36	630784              c:\windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
- 2011-10-16 08:18 . 2011-10-16 08:18	401408              c:\windows\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
+ 2012-05-09 17:35 . 2012-05-09 17:35	401408              c:\windows\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
- 2011-10-16 08:18 . 2011-10-16 08:18	188416              c:\windows\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll
+ 2012-05-09 17:35 . 2012-05-09 17:35	188416              c:\windows\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36	970752              c:\windows\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
- 2011-10-16 08:19 . 2011-10-16 08:19	970752              c:\windows\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36	745472              c:\windows\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
- 2011-10-16 08:19 . 2011-10-16 08:19	745472              c:\windows\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
- 2011-10-16 08:19 . 2011-10-16 08:19	425984              c:\windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36	425984              c:\windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
- 2009-08-14 19:47 . 2009-08-14 19:47	163840              c:\windows\assembly\GAC_MSIL\System.AddIn\3.5.0.0__b77a5c561934e089\System.AddIn.dll
+ 2012-05-09 17:42 . 2012-05-09 17:42	163840              c:\windows\assembly\GAC_MSIL\System.AddIn\3.5.0.0__b77a5c561934e089\System.AddIn.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36	110592              c:\windows\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll
- 2011-10-16 08:19 . 2011-10-16 08:19	110592              c:\windows\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll
+ 2012-05-09 17:29 . 2012-05-09 17:29	532480              c:\windows\assembly\GAC_MSIL\ReachFramework\3.0.0.0__31bf3856ad364e35\ReachFramework.dll
- 2011-10-16 08:18 . 2011-10-16 08:18	659456              c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
+ 2012-05-09 17:35 . 2012-05-09 17:35	659456              c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36	372736              c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll
- 2011-10-16 08:18 . 2011-10-16 08:18	372736              c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll
- 2011-10-16 08:18 . 2011-10-16 08:18	110592              c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36	110592              c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36	749568              c:\windows\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
- 2011-10-16 08:18 . 2011-10-16 08:18	749568              c:\windows\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36	655360              c:\windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll
- 2011-10-16 08:18 . 2011-10-16 08:18	655360              c:\windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36	348160              c:\windows\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
- 2011-10-16 08:18 . 2011-10-16 08:18	348160              c:\windows\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
+ 2012-05-09 17:35 . 2012-05-09 17:35	507904              c:\windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll
- 2011-10-16 08:17 . 2011-10-16 08:17	507904              c:\windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36	261632              c:\windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
- 2011-10-16 08:18 . 2011-10-16 08:18	261632              c:\windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
+ 2012-05-09 17:29 . 2012-05-09 17:29	368640              c:\windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\System.Printing.dll
- 2009-08-14 19:46 . 2009-08-14 19:46	368640              c:\windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\System.Printing.dll
- 2011-10-16 08:18 . 2011-10-16 08:18	113664              c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36	113664              c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36	258048              c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
- 2011-10-16 08:18 . 2011-10-16 08:18	258048              c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36	486400              c:\windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
- 2011-10-16 08:19 . 2011-10-16 08:19	486400              c:\windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
+ 2012-05-09 11:51 . 2012-02-09 15:43	1748992              c:\windows\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.6002.22791_x-ww_c8dff154\GdiPlus.dll
+ 2008-04-14 12:00 . 2012-03-01 11:00	1212416              c:\windows\system32\urlmon.dll
+ 2008-04-14 12:00 . 2011-11-03 15:28	1297920              c:\windows\system32\quartz.dll
+ 2008-04-14 12:00 . 2012-03-01 11:00	5978624              c:\windows\system32\mshtml.dll
+ 2012-02-21 13:46 . 2012-02-21 13:46	1225216              c:\windows\system32\Macromed\Shockwave 10\gi.dll
- 2011-11-22 15:50 . 2011-11-22 15:50	1503232              c:\windows\system32\Macromed\Shockwave 10\dirapiX.dll
+ 2012-02-21 13:46 . 2012-02-21 13:46	1503232              c:\windows\system32\Macromed\Shockwave 10\dirapiX.dll
+ 2012-05-06 13:42 . 2012-05-06 13:42	8797856              c:\windows\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll
+ 2007-08-13 16:34 . 2012-03-01 11:00	2000384              c:\windows\system32\iertutil.dll
+ 2007-02-12 14:10 . 2009-02-06 20:07	3698584              c:\windows\system32\ieapfltr.dat
+ 2008-04-14 12:00 . 2012-04-11 13:51	1862400              c:\windows\system32\dllcache\win32k.sys
+ 2008-04-14 12:00 . 2012-03-01 11:00	1212416              c:\windows\system32\dllcache\urlmon.dll
+ 2008-04-14 12:00 . 2011-11-03 15:28	1297920              c:\windows\system32\dllcache\quartz.dll
+ 2009-04-17 16:45 . 2012-04-11 13:51	2194944              c:\windows\system32\dllcache\ntoskrnl.exe
+ 2009-04-17 16:45 . 2012-04-11 13:51	2029056              c:\windows\system32\dllcache\ntkrpamp.exe
+ 2009-02-10 17:03 . 2012-04-11 13:51	2071424              c:\windows\system32\dllcache\ntkrnlpa.exe
+ 2009-04-17 16:45 . 2012-04-11 13:51	2150912              c:\windows\system32\dllcache\ntkrnlmp.exe
+ 2008-04-14 12:00 . 2012-03-01 11:00	5978624              c:\windows\system32\dllcache\mshtml.dll
+ 2009-02-20 16:49 . 2012-03-01 11:00	2000384              c:\windows\system32\dllcache\iertutil.dll
+ 2008-07-09 14:25 . 2009-02-06 20:07	3698584              c:\windows\system32\dllcache\ieapfltr.dat
+ 2012-02-02 13:56 . 2012-02-02 13:56	1041848              c:\windows\system32\Adobe\Shockwave 11\SwHelper_1164634.exe
+ 2011-12-15 10:53 . 2011-12-15 10:53	1040824              c:\windows\system32\Adobe\Shockwave 11\SwHelper_1163633.exe
+ 2012-02-02 13:32 . 2012-02-02 13:32	1224704              c:\windows\system32\Adobe\Shockwave 11\gi.dll
+ 2012-02-02 13:38 . 2012-02-02 13:38	1742336              c:\windows\system32\Adobe\Shockwave 11\dirapi.dll
- 2011-03-25 04:15 . 2011-03-25 04:15	5025792              c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Windows.Forms.dll
+ 2011-12-25 01:50 . 2011-12-25 01:50	5025792              c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Windows.Forms.dll
+ 2011-12-25 02:50 . 2011-12-25 02:50	5246976              c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Web.dll
+ 2011-12-25 01:50 . 2011-12-25 01:50	3186688              c:\windows\Microsoft.NET\Framework\v2.0.50727\System.dll
+ 2011-12-25 01:50 . 2011-12-25 01:50	5913360              c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
- 2011-07-07 03:18 . 2011-07-07 03:18	4550656              c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll
+ 2011-12-25 01:50 . 2011-12-25 01:50	4550656              c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll
+ 2012-01-23 11:44 . 2012-01-23 11:44	2310656              c:\windows\Installer\90c2d2.msi
+ 2012-01-23 10:57 . 2012-01-23 10:57	9474048              c:\windows\Installer\654e96.msi
+ 2011-12-26 08:59 . 2011-12-26 08:59	4368896              c:\windows\Installer\551d54.msp
+ 2011-10-30 21:54 . 2011-10-30 21:54	2748416              c:\windows\Installer\3bc822.msp
+ 2011-06-06 11:55 . 2011-06-06 11:55	2215312              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010\10.1.0\rt3d.dll
+ 2011-06-06 11:55 . 2011-06-06 11:55	1189004              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010\10.1.0\JSByteCodeWin.bin
+ 2011-06-06 11:55 . 2011-06-06 11:55	6543768              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010\10.1.0\authplay.dll
+ 2011-06-06 11:55 . 2011-06-06 11:55	1240992              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010\10.1.0\AdobeCollabSync.exe
+ 2011-06-06 11:55 . 2011-06-06 11:55	1480600              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010\10.1.0\AcroRd32.exe
+ 2012-01-20 14:42 . 2009-03-08 03:34	1206784              c:\windows\ie8updates\KB982381-IE8\urlmon.dll
+ 2012-01-20 14:42 . 2009-03-08 03:41	5937152              c:\windows\ie8updates\KB982381-IE8\mshtml.dll
+ 2012-01-20 14:42 . 2009-03-08 03:32	1985024              c:\windows\ie8updates\KB982381-IE8\iertutil.dll
+ 2012-04-12 13:43 . 2011-12-17 19:43	1212416              c:\windows\ie8updates\KB2675157-IE8\urlmon.dll
+ 2012-04-12 13:43 . 2011-12-17 19:43	5979136              c:\windows\ie8updates\KB2675157-IE8\mshtml.dll
+ 2012-04-12 13:43 . 2011-12-17 19:43	2000384              c:\windows\ie8updates\KB2675157-IE8\iertutil.dll
+ 2012-02-15 13:08 . 2011-11-04 19:13	1212416              c:\windows\ie8updates\KB2647516-IE8\urlmon.dll
+ 2012-02-15 13:08 . 2011-11-04 19:13	5978112              c:\windows\ie8updates\KB2647516-IE8\mshtml.dll
+ 2012-02-15 13:08 . 2011-11-04 19:13	2000384              c:\windows\ie8updates\KB2647516-IE8\iertutil.dll
+ 2012-01-20 14:43 . 2010-05-06 10:31	1209344              c:\windows\ie8updates\KB2618444-IE8\urlmon.dll
+ 2012-01-20 14:43 . 2010-05-06 10:31	5950976              c:\windows\ie8updates\KB2618444-IE8\mshtml.dll
+ 2012-01-20 14:43 . 2010-05-06 10:31	1985536              c:\windows\ie8updates\KB2618444-IE8\iertutil.dll
+ 2012-01-20 14:32 . 2011-10-31 23:36	1168896              c:\windows\ie8\urlmon.dll
+ 2012-01-20 14:32 . 2011-11-04 15:14	3616256              c:\windows\ie8\mshtml.dll
+ 2012-01-20 14:32 . 2011-10-31 23:36	6076416              c:\windows\ie8\ieframe.dll
+ 2012-01-20 14:32 . 2009-06-29 08:33	2452872              c:\windows\ie8\ieapfltr.dat
+ 2009-04-17 16:45 . 2012-04-11 13:51	2194944              c:\windows\Driver Cache\i386\ntoskrnl.exe
+ 2009-04-17 16:45 . 2012-04-11 13:51	2029056              c:\windows\Driver Cache\i386\ntkrpamp.exe
+ 2009-02-10 17:03 . 2012-04-11 13:51	2071424              c:\windows\Driver Cache\i386\ntkrnlpa.exe
+ 2009-04-17 16:45 . 2012-04-11 13:51	2150912              c:\windows\Driver Cache\i386\ntkrnlmp.exe
+ 2012-05-09 17:39 . 2012-05-09 17:39	3325440              c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\6d8bef0d008389874e55c0308f0c18e5\WindowsBase.ni.dll
+ 2012-05-11 12:40 . 2012-05-11 12:40	1049600              c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClients#\41a81b97625c113b591ed082c95276e2\UIAutomationClientsideProviders.ni.dll
+ 2012-05-09 17:39 . 2012-05-09 17:39	7953408              c:\windows\assembly\NativeImages_v2.0.50727_32\System\e4b5afc4da43b1c576f9322f9f2e1bfe\System.ni.dll
+ 2012-05-11 12:40 . 2012-05-11 12:40	5450752              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\3bba1b8b0b5ef0be238b011cc7a0575e\System.Xml.ni.dll
+ 2012-05-11 12:48 . 2012-05-11 12:48	1356288              c:\windows\assembly\NativeImages_v2.0.50727_32\System.WorkflowServ#\33fa6a2055bf857bff2e31020279b5e9\System.WorkflowServices.ni.dll
+ 2012-05-11 12:48 . 2012-05-11 12:48	1908224              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Run#\5eccf6fef6bee8a2f93bc65ff33699bb\System.Workflow.Runtime.ni.dll
+ 2012-05-11 12:48 . 2012-05-11 12:48	4514304              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Com#\62bd2e1bf98b04ceca2102c8f54aab9d\System.Workflow.ComponentModel.ni.dll
+ 2012-05-11 12:48 . 2012-05-11 12:48	2992640              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Act#\8215548b3d4aabbaa0557ab747700778\System.Workflow.Activities.ni.dll
+ 2012-05-11 12:47 . 2012-05-11 12:47	1840640              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Services\3e11aea7d742b5eddbd0b6bd1012f7df\System.Web.Services.ni.dll
+ 2012-05-11 12:47 . 2012-05-11 12:47	2209280              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\ff995dde9cd34ff1e8ac7ab55fc92d32\System.Web.Mobile.ni.dll
+ 2012-05-11 12:47 . 2012-05-11 12:47	2405888              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\8899d1091e64a4d0b6ae69060197091a\System.Web.Extensions.ni.dll
+ 2012-05-11 12:39 . 2012-05-11 12:39	1917440              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Speech\5efb50c91f3c5e49be2079f625d933b7\System.Speech.ni.dll
+ 2012-05-11 12:47 . 2012-05-11 12:47	1706496              c:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel#\97d635f5c656ae43d94b55e67fc4ab50\System.ServiceModel.Web.ni.dll
+ 2012-05-11 12:42 . 2012-05-11 12:42	2345472              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\505e12638acd6fdb22e1fd2d4c6fc232\System.Runtime.Serialization.ni.dll
+ 2012-05-11 12:39 . 2012-05-11 12:39	1035776              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Printing\1d6707a5a9da16c1d1b88529837884d6\System.Printing.ni.dll
+ 2012-05-11 12:42 . 2012-05-11 12:42	1070080              c:\windows\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\e09496ddb2bf6f3b69707924f2e6b5ff\System.IdentityModel.ni.dll
+ 2012-05-11 12:39 . 2012-05-11 12:39	1591808              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\8ca00132a08c69697adf1cda32ebd835\System.Drawing.ni.dll
+ 2012-05-11 12:46 . 2012-05-11 12:46	1116672              c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\b55887436d2cfbe1fb32dd18d554185b\System.DirectoryServices.ni.dll
+ 2012-05-11 12:46 . 2012-05-11 12:46	1801216              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Deployment\832196527f0497078f085eaf9189265f\System.Deployment.ni.dll
+ 2012-05-11 12:39 . 2012-05-11 12:39	6616576              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data\12c6fe8d4dd78f9bddf847d3b2821c03\System.Data.ni.dll
+ 2012-05-11 12:43 . 2012-05-11 12:43	2510336              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.SqlXml\982b508698278c6ffb3d143bbe1e8bb8\System.Data.SqlXml.ni.dll
+ 2012-05-11 12:46 . 2012-05-11 12:46	1328128              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Services\2de7666b1cd0a1bc363726c9553dc39c\System.Data.Services.ni.dll
+ 2012-05-11 12:39 . 2012-05-11 12:39	2516480              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Linq\44a5fc9e7c71b1fe1e2c79b03ecc3bc7\System.Data.Linq.ni.dll
+ 2012-05-11 12:45 . 2012-05-11 12:45	9924096              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Entity\772c94f595cd87b7fa187d592ef46fcf\System.Data.Entity.ni.dll
+ 2012-05-11 12:39 . 2012-05-11 12:39	2295296              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Core\38d07a5ac34b99d94fd14f42e779f625\System.Core.ni.dll
+ 2012-05-11 12:38 . 2012-05-11 12:38	2146304              c:\windows\assembly\NativeImages_v2.0.50727_32\ReachFramework\2ecefd16184a78f19aaf0f02cc0a7e1f\ReachFramework.ni.dll
+ 2012-05-11 12:38 . 2012-05-11 12:38	1657856              c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationUI\51204805c71113e0db2103faa064b313\PresentationUI.ni.dll
+ 2012-05-09 17:39 . 2012-05-09 17:39	1451008              c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationBuildTa#\8c509044eea2ab22689ea43926b30108\PresentationBuildTasks.ni.dll
+ 2012-05-11 12:43 . 2012-05-11 12:43	1712128              c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\b49dd780ba8e3501b0adcf108b431e7b\Microsoft.VisualBasic.ni.dll
+ 2012-05-11 12:42 . 2012-05-11 12:42	1093120              c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\42145ebf75f77cabad442f0801a81c64\Microsoft.Transactions.Bridge.ni.dll
+ 2012-05-11 12:46 . 2012-05-11 12:46	2332160              c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.JScript\cfe15312373b4668398404b5822bab7d\Microsoft.JScript.ni.dll
+ 2012-05-11 12:43 . 2012-05-11 12:43	1966080              c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\f3fcd65eca42d13b746cf3f5bd993ee0\Microsoft.Build.Tasks.v3.5.ni.dll
+ 2012-05-11 12:43 . 2012-05-11 12:43	1620992              c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\2091903cd9b359e96f05ac2d6d25ef4e\Microsoft.Build.Tasks.ni.dll
+ 2012-05-11 12:43 . 2012-05-11 12:43	1888768              c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\5aa63a1cb41e3a5e1e8ed17072e60ec3\Microsoft.Build.Engine.ni.dll
- 2011-01-29 13:23 . 2011-01-29 13:23	1249280              c:\windows\assembly\GAC_MSIL\WindowsBase\3.0.0.0__31bf3856ad364e35\WindowsBase.dll
+ 2012-05-09 17:29 . 2012-05-09 17:29	1249280              c:\windows\assembly\GAC_MSIL\WindowsBase\3.0.0.0__31bf3856ad364e35\WindowsBase.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36	3186688              c:\windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
- 2011-10-16 08:19 . 2011-10-16 08:19	2048000              c:\windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36	2048000              c:\windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll
- 2011-10-16 08:17 . 2011-10-16 08:17	5025792              c:\windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
+ 2012-05-09 17:35 . 2012-05-09 17:35	5025792              c:\windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
- 2011-01-29 13:24 . 2011-01-29 13:24	1277952              c:\windows\assembly\GAC_MSIL\System.Web.Extensions\3.5.0.0__31bf3856ad364e35\System.Web.Extensions.dll
+ 2012-01-11 20:31 . 2012-01-11 20:31	1277952              c:\windows\assembly\GAC_MSIL\System.Web.Extensions\3.5.0.0__31bf3856ad364e35\System.Web.Extensions.dll
+ 2012-04-13 10:23 . 2012-04-13 10:23	5967872              c:\windows\assembly\GAC_MSIL\System.ServiceModel\3.0.0.0__b77a5c561934e089\System.ServiceModel.dll
- 2011-01-29 13:09 . 2011-01-29 13:09	5967872              c:\windows\assembly\GAC_MSIL\System.ServiceModel\3.0.0.0__b77a5c561934e089\System.ServiceModel.dll
- 2011-10-16 08:17 . 2011-10-16 08:17	5062656              c:\windows\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll
+ 2012-05-09 17:35 . 2012-05-09 17:35	5062656              c:\windows\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll
+ 2012-05-09 17:29 . 2012-05-09 17:29	5283840              c:\windows\assembly\GAC_MSIL\PresentationFramework\3.0.0.0__31bf3856ad364e35\PresentationFramework.dll
+ 2012-05-09 17:35 . 2012-05-09 17:35	5246976              c:\windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll
- 2011-10-16 08:19 . 2011-10-16 08:19	2933248              c:\windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36	2933248              c:\windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
+ 2012-05-09 17:29 . 2012-05-09 17:29	4214784              c:\windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\PresentationCore.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36	4550656              c:\windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
- 2011-10-16 08:18 . 2011-10-16 08:18	4550656              c:\windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
+ 2009-04-17 16:54 . 2012-05-09 17:38	55656824              c:\windows\system32\MRT.exe
+ 2007-08-13 16:54 . 2012-03-02 04:00	11082752              c:\windows\system32\ieframe.dll
+ 2012-03-02 04:00 . 2012-03-02 04:00	11082752              c:\windows\system32\dllcache\ieframe.dll
+ 2012-01-03 17:44 . 2012-01-03 17:44	15929344              c:\windows\Installer\90c2d3.msp
+ 2012-04-04 13:32 . 2012-04-04 13:32	16613376              c:\windows\Installer\140b97.msp
+ 2012-04-06 00:12 . 2012-04-06 00:12	15709696              c:\windows\Installer\132e706.msp
+ 2012-01-04 00:25 . 2012-01-04 00:25	17751552              c:\windows\Installer\132e6f8.msp
+ 2012-04-06 01:13 . 2012-04-06 01:13	16527872              c:\windows\Installer\132e6eb.msp
+ 2011-06-06 11:55 . 2011-06-06 11:55	24731544              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010\10.1.0\AcroRd32.dll
+ 2012-01-20 14:42 . 2009-03-08 03:39	11063808              c:\windows\ie8updates\KB982381-IE8\ieframe.dll
+ 2012-04-12 13:43 . 2011-12-18 13:43	11082240              c:\windows\ie8updates\KB2675157-IE8\ieframe.dll
+ 2012-02-15 13:08 . 2011-11-04 19:13	11081728              c:\windows\ie8updates\KB2647516-IE8\ieframe.dll
+ 2012-05-09 17:33 . 2012-05-09 17:33	12218368              c:\windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP65.tmp\PresentationCore.dll
+ 2012-05-09 17:42 . 2012-05-09 17:42	14329856              c:\windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP14A.tmp\PresentationFramework.dll
+ 2012-05-11 12:39 . 2012-05-11 12:40	12430848              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\995fcf39ead2c2a53e084505c2c67d49\System.Windows.Forms.ni.dll
+ 2012-05-11 12:47 . 2012-05-11 12:47	11817472              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web\7861cd979ea5db3fb7d30ed94fb0edd2\System.Web.ni.dll
+ 2012-05-11 12:42 . 2012-05-11 12:42	17403904              c:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel\bc254d2fa26664898ae21d45643bc194\System.ServiceModel.ni.dll
+ 2012-05-11 12:39 . 2012-05-11 12:39	10683392              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Design\a9256d2ad7e4be2bbb4e9b18c3997b84\System.Design.ni.dll
+ 2012-05-11 12:37 . 2012-05-11 12:37	14329856              c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\5b8ff47c1db373a2a4c638ca31988bd2\PresentationFramework.ni.dll
+ 2012-05-09 17:40 . 2012-05-09 17:40	12218368              c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\4eb3cd1f1d5a83617524a9dfb96a657d\PresentationCore.ni.dll
+ 2012-05-09 17:38 . 2012-05-09 17:38	11492352              c:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\e337c89bc9f81b69d7237aa70e935900\mscorlib.ni.dll
.
-- Snapshot auf jetziges Datum zurückgesetzt --
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-05-12 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-05-13 118784]
"AGRSMMSG"="AGRSMMSG.exe" [2003-02-14 88107]
"LtMoh"="c:\programme\ltmoh\Ltmoh.exe" [2002-11-25 172032]
"LaunchAp"="c:\programme\Launch Manager\LaunchAp.exe" [2003-05-12 32768]
"HotkeyApp"="c:\programme\Launch Manager\HotkeyApp.exe" [2003-09-04 40960]
"CtrlVol"="c:\programme\Launch Manager\CtrlVol.exe" [2003-08-22 20480]
"LMgrOSD"="c:\programme\Launch Manager\OSD.exe" [2003-06-25 204800]
"Wbutton"="c:\programme\Launch Manager\Wbutton.exe" [2003-09-08 65536]
"TkBellExe"="c:\programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" [2010-02-18 202256]
"QuickTime Task"="c:\programme\QuickTime\qttask.exe" [2011-10-24 421888]
"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2011-06-09 254696]
"Adobe ARM"="c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\
Microsoft-Indexerstellung.lnk - c:\programme\Microsoft Office\Office\FINDFAST.EXE [1997-10-18 111376]
Office-Start.lnk - c:\programme\Microsoft Office\Office\OSA.EXE [1997-10-18 51984]
VR-NetWorld Auftragsprüfung.lnk - c:\programme\VR-NetWorld\vrtoolcheckorder.exe [2011-10-26 1137152]
WISO Mein Steuer-Sparbuch heute.lnk - c:\programme\WISO\Steuersoftware 2012\mshaktuell.exe [2012-1-3 1380464]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
.
R0 TwkMs;CHIPDRIVE Mouse Adapter;c:\windows\system32\drivers\TWKMS.sys [24.04.2003 02:14 4828]
R1 bizVSerial;Franson VSerial;c:\windows\system32\drivers\bizVSerialNT.sys [29.10.2011 12:58 14949]
R2 cjpcsc;cyberJack PC/SC COM Service ;c:\windows\system32\cjpcsc.exe [29.10.2011 12:58 511920]
R2 Update-Service;Update-Service;c:\windows\System32\svchost.exe -k Update-Service [14.04.2008 14:00 14336]
R3 WBMS;Winbond Memory Stick Storage (MS) Device Driver;c:\windows\system32\drivers\wbms.sys [17.04.2009 17:56 30464]
R3 WBSD;Winbond Secure Digital Storage (SD/MMC) Device Driver;c:\windows\system32\drivers\wbsd.sys [17.04.2009 17:56 26240]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [05.04.2012 09:34 257696]
S3 CHIPDRIVE USB SmartCardReader;CHIPDRIVE USB SmartCardReader;c:\windows\system32\drivers\TwkUsb2K.sys [19.09.2005 03:07 35275]
S3 cjusb;REINER SCT cyberJack USB Driver;c:\windows\system32\drivers\cjusb.sys [29.10.2011 12:58 28144]
S3 libusb0;LibUsb-Win32 - Kernel Driver 09/17/2010, 1.2.1.0;c:\windows\system32\drivers\libusb0.sys [06.11.2010 14:11 35008]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\programme\Mozilla Maintenance Service\maintenanceservice.exe [01.05.2012 15:30 129976]
S3 TWKSER2K;CHIPDRIVE Serial SmartCardReader;c:\windows\system32\drivers\TWKSER2K.sys [25.08.2004 15:06 185611]
S3 usb2vcom;USB Data Cable;c:\windows\system32\drivers\usb2vcom.sys [28.09.2009 13:31 29152]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Update-Service-Installer-Service	REG_MULTI_SZ   	Update-Service-Installer-Service
Update-Service	REG_MULTI_SZ   	Update-Service
.
Inhalt des "geplante Tasks" Ordners
.
2012-06-07 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-05 13:42]
.
2010-05-22 c:\windows\Tasks\Install.job
- c:\windows\system32\Adobe\Shockwave 11\nssstub.exe [2010-05-22 21:14]
.
2012-06-08 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1275210071-1993962763-1957994488-1003.job
- c:\programme\Real\RealUpgrade\realupgrade.exe [2010-02-09 17:38]
.
2012-06-08 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1275210071-1993962763-1957994488-1003.job
- c:\programme\Real\RealUpgrade\realupgrade.exe [2010-02-09 17:38]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = 
uInternet Settings,ProxyOverride = <local>
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\dokumente und einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\
FF - prefs.js: browser.search.selectedEngine - Bing
FF - prefs.js: browser.startup.homepage - hxxp://www.web.de/
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=110819&tl=gbn193052&tt=050412_30b
FF - user.js: extensions.BabylonToolbar_i.babExt - 
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar_i.id - 4c9fa22b000000000000000e356ecbd5
FF - user.js: extensions.BabylonToolbar_i.hardId - 4c9fa22b000000000000000e356ecbd5
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15435
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1720:50
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar_i.tlbrId - tb9
FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
AddRemove-{09FF4DB8-7DE9-4D47-B7DB-915DB7D9A8CA} - c:\dokumente und einstellungen\All Users\Anwendungsdaten\{6AD8E59C-250C-4201-B5BA-56ADEF76FF46}\bm_installer.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-06-08 07:04
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse... 
.
Scanne versteckte Autostarteinträge... 
.
Scanne versteckte Dateien... 
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'explorer.exe'(3928)
c:\windows\system32\webcheck.dll
.
Zeit der Fertigstellung: 2012-06-08  07:07:24
ComboFix-quarantined-files.txt  2012-06-08 05:07
ComboFix2.txt  2012-01-02 18:32
.
Vor Suchlauf: 13 Verzeichnis(se), 27.001.122.816 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 27.072.839.680 Bytes frei
.
- - End Of File - - EB617F35A930A81573F6FB7760309645

Viele Grüße
Ulrike

04.06.2012, 21:27	#6
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Trojaner / Malware ? Mail Account hat Spam Mails verschickt Hätte da mal zwei Fragen bevor es weiter geht 1.) Geht der normale Modus von Windows (wieder) uneingeschränkt? 2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden? __________________ --> Trojaner / Malware ? Mail Account hat Spam Mails verschickt

Trojaner / Malware ? Mail Account hat Spam Mails verschickt

Plagegeister aller Art und deren Bekämpfung: Trojaner / Malware ? Mail Account hat Spam Mails verschickt