Habe Win XP SP3 mit allen Updates und Malware Bytes.
Surfen ist fast nicht möglich. Eine Seite pro Minute bekomm ich hin.
Word und Excel zeigen keine Dateien mehr an.
Abgesicherter Modus startet und nach 3sek Reboot.

Habe nun Antivir und Malware Bytes suchen lassen und er hat ein zwei Sachen gefunden aber er spinnt immernoch.
Auch diverse Programme mit der Hirens Bootcd halfen nicht.

Wie gehe ich nun weiter vor ?

hi
was heißt 1 2 sachen, wo sind die berichte?

Habs leider gelöscht.
Habe nun ESET Scan gemacht und folgendes kam raus.

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=09c28595af39b242be91f287ebc0ab16
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-06-04 07:06:04
# local_time=2012-06-04 09:06:04 (+0100, Zentraleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=1792 16777175 100 0 0 0 0 0
# compatibility_mode=8192 67108863 100 0 74 74 0 0
# scanned=810125
# found=3
# cleaned=0
# scan_time=7759
C:\Dokumente und Einstellungen\*****\Eigene Dateien\Downloads\ESETN32v5.0.95de.rar	Win32/RiskWare.HackAV.DD application (unable to clean)	00000000000000000000000000000000	I
${Memory}	a variant of Win32/Gataka.B trojan	00000000000000000000000000000000	I
         

Und noch die OTL Logs

OTL logfile created on: 05.06.2012 03:27:33 - Run 2
OTL by OldTimer - Version 3.2.46.0     Folder = G:\
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,25 Gb Total Physical Memory | 2,42 Gb Available Physical Memory | 74,41% Memory free
5,09 Gb Paging File | 4,16 Gb Available in Paging File | 81,73% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 111,79 Gb Total Space | 37,79 Gb Free Space | 33,80% Space Free | Partition Type: NTFS
Drive D: | 128,00 Gb Total Space | 8,92 Gb Free Space | 6,97% Space Free | Partition Type: NTFS
Drive E: | 53,52 Gb Total Space | 16,20 Gb Free Space | 30,28% Space Free | Partition Type: NTFS
Drive F: | 51,37 Gb Total Space | 31,54 Gb Free Space | 61,39% Space Free | Partition Type: NTFS
Drive G: | 48,83 Gb Total Space | 18,49 Gb Free Space | 37,85% Space Free | Partition Type: NTFS
Drive H: | 48,83 Gb Total Space | 22,08 Gb Free Space | 45,21% Space Free | Partition Type: NTFS
Drive I: | 51,38 Gb Total Space | 24,81 Gb Free Space | 48,28% Space Free | Partition Type: NTFS
 
Computer Name: *****-8227EFF77 | User Name: ***** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.06.05 04:58:37 | 000,596,480 | ---- | M] (OldTimer Tools) -- G:\OTL.exe
PRC - [2012.05.02 01:42:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.02 00:34:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.05.02 00:31:35 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.04.24 02:11:55 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012.04.04 15:56:38 | 000,462,408 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2012.02.27 00:15:42 | 000,055,144 | ---- | M] (Apple Inc.) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2012.01.03 15:10:50 | 000,815,512 | ---- | M] (Adobe Systems Inc.) -- C:\Programme\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
PRC - [2011.03.04 13:45:28 | 002,741,616 | ---- | M] (Hewlett-Packard Company) -- C:\Programme\Gemeinsame Dateien\LightScribe\LightScribeControlPanel.exe
PRC - [2011.03.04 13:38:48 | 000,073,728 | ---- | M] (Hewlett-Packard Company) -- C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
PRC - [2011.01.26 10:48:12 | 000,240,640 | ---- | M] (Volkswagen AG) -- C:\ElsaWin\bin\LcSvrAdm.exe
PRC - [2011.01.26 10:45:56 | 000,335,360 | ---- | M] (Volkswagen AG) -- C:\ElsaWin\bin\LcSvrHis.exe
PRC - [2011.01.26 10:45:12 | 000,373,248 | ---- | M] (Volkswagen AG) -- C:\ElsaWin\bin\LcSvrSaz.exe
PRC - [2011.01.26 10:43:48 | 001,321,472 | ---- | M] (Volkswagen AG) -- C:\ElsaWin\bin\LcSvrAuf.exe
PRC - [2011.01.26 10:40:06 | 000,477,696 | ---- | M] (Volkswagen AG) -- C:\ElsaWin\bin\LcSvrPas.exe
PRC - [2011.01.26 10:38:56 | 000,392,704 | ---- | M] (Volkswagen AG) -- C:\ElsaWin\bin\LcSvrDba.exe
PRC - [2008.04.14 09:00:00 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008.04.04 14:38:04 | 000,417,792 | ---- | M] (Transaction Software, D 81829 Munich) -- D:\EWA net\database\TransBase WIS\tbmux32.exe
PRC - [2008.04.04 14:38:04 | 000,417,792 | ---- | M] (Transaction Software, D 81829 Munich) -- D:\EWA net\database\TransBase EWA\tbmux32.exe
PRC - [2008.04.04 14:37:50 | 002,387,968 | ---- | M] (Transaction Software, D 81829 Munich) -- D:\EWA net\database\TransBase EWA\tbkern32.exe
PRC - [2007.11.27 13:33:52 | 002,387,968 | ---- | M] (Transaction Software, D 81829 Munich) -- D:\EWA net\database\TransBase EPC\tbkern32.exe
PRC - [2007.11.27 13:33:52 | 000,417,792 | ---- | M] (Transaction Software, D 81829 Munich) -- D:\EWA net\database\TransBase EPC\tbmux32.exe
PRC - [2004.08.05 14:02:30 | 000,385,024 | ---- | M] (Transaction Software, D 81737 Munich) -- C:\BMWgroup\ETKLokal\transbase\tbmux32.exe
PRC - [2003.07.31 19:29:04 | 000,065,536 | ---- | M] (Alexandria Software Consulting) -- D:\EWA net\server\bin\tomcat.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.05.11 14:54:15 | 011,817,472 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web\7861cd979ea5db3fb7d30ed94fb0edd2\System.Web.ni.dll
MOD - [2012.05.11 14:53:21 | 000,971,264 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\3d5b7368bde0f65aa15d9f46b498cc89\System.Configuration.ni.dll
MOD - [2012.05.11 14:52:59 | 000,025,600 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Accessibility\016444dfc5f7e3d11c776f2fbc7a4594\Accessibility.ni.dll
MOD - [2012.05.11 14:46:06 | 005,450,752 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\3bba1b8b0b5ef0be238b011cc7a0575e\System.Xml.ni.dll
MOD - [2012.05.11 14:46:03 | 012,430,848 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\995fcf39ead2c2a53e084505c2c67d49\System.Windows.Forms.ni.dll
MOD - [2012.05.11 14:45:54 | 001,591,808 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\8ca00132a08c69697adf1cda32ebd835\System.Drawing.ni.dll
MOD - [2012.05.11 14:45:10 | 007,953,408 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\e4b5afc4da43b1c576f9322f9f2e1bfe\System.ni.dll
MOD - [2012.05.11 14:45:05 | 011,492,352 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\e337c89bc9f81b69d7237aa70e935900\mscorlib.ni.dll
MOD - [2012.05.11 14:44:44 | 000,303,104 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
MOD - [2012.04.16 23:11:02 | 000,398,288 | ---- | M] () -- C:\Programme\Avira\AntiVir Desktop\sqlite3.dll
MOD - [2012.04.04 07:53:56 | 000,301,056 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.DEU
MOD - [2012.02.14 22:45:52 | 000,270,336 | ---- | M] () -- C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
MOD - [2012.01.08 15:41:12 | 000,093,696 | ---- | M] () -- C:\Programme\FileZilla FTP Client\fzshellext.dll
MOD - [2012.01.03 15:10:54 | 000,123,904 | ---- | M] () -- C:\Programme\Adobe\Acrobat 10.0\Acrobat\Locale\de_DE\AcroIEFavClient.DEU
MOD - [2012.01.03 15:10:54 | 000,019,968 | ---- | M] () -- C:\Programme\Adobe\Acrobat 10.0\Acrobat\Locale\de_DE\AcroTray.DEU
MOD - [2011.11.02 00:26:32 | 000,087,912 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\zlib1.dll
MOD - [2011.11.02 00:26:12 | 001,242,472 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\libxml2.dll
MOD - [2011.03.23 12:33:28 | 000,147,456 | ---- | M] () -- D:\EWA net\apps\jre\private_jre\bin\server\jvm.dll
MOD - [2011.03.04 13:02:54 | 007,745,536 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\LightScribe\QtGui4.dll
MOD - [2011.03.04 13:02:52 | 000,135,168 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\LightScribe\plugins\imageformats\qjpeg4.dll
MOD - [2011.03.04 13:02:50 | 002,121,728 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\LightScribe\QtCore4.dll
MOD - [2011.01.26 10:44:22 | 000,025,088 | ---- | M] () -- C:\ElsaWin\bin\svraufps.dll
MOD - [2010.03.16 12:22:12 | 000,014,848 | ---- | M] () -- C:\Programme\ATI Technologies\ATI.ACE\Core-Static\AxInterop.WBOCXLib.dll
MOD - [2008.04.14 09:00:00 | 000,355,112 | ---- | M] () -- C:\WINDOWS\system32\msjetoledb40.dll
MOD - [2008.04.04 14:23:42 | 000,166,912 | ---- | M] () -- D:\EWA net\database\TransBase EWA\libmcrypt.dll
MOD - [2008.04.04 14:23:42 | 000,036,864 | ---- | M] () -- D:\EWA net\database\TransBase EWA\polycsr.dll
MOD - [2007.11.26 17:26:26 | 000,166,912 | ---- | M] () -- D:\EWA net\database\TransBase EPC\libmcrypt.dll
MOD - [2005.03.21 16:54:10 | 000,036,864 | ---- | M] () -- D:\EWA net\database\TransBase EPC\polycsr.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Disabled | Stopped] -- %SystemRoot%\System32\hidserv.dll -- (HidServ)
SRV - [2012.05.02 01:42:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.02 00:34:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.04.26 13:05:41 | 000,129,976 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012.04.02 12:07:00 | 000,253,600 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.02.29 08:50:48 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.02.27 00:15:42 | 000,055,144 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2011.09.23 19:37:42 | 000,641,832 | ---- | M] (Nero AG) [Disabled | Stopped] -- C:\Programme\Nero\Update\NASvc.exe -- (NAUpdate)
SRV - [2011.03.04 13:38:48 | 000,073,728 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe -- (LightScribeService)
SRV - [2011.01.26 10:48:12 | 000,240,640 | ---- | M] (Volkswagen AG) [Auto | Running] -- C:\ElsaWin\bin\LcSvrAdm.exe -- (LcSvrAdm)
SRV - [2011.01.26 10:45:56 | 000,335,360 | ---- | M] (Volkswagen AG) [Auto | Running] -- C:\ElsaWin\bin\LcSvrHis.exe -- (LcSvrHis)
SRV - [2011.01.26 10:45:12 | 000,373,248 | ---- | M] (Volkswagen AG) [Auto | Running] -- C:\ElsaWin\bin\LcSvrSaz.exe -- (LcSvrSaz)
SRV - [2011.01.26 10:43:48 | 001,321,472 | ---- | M] (Volkswagen AG) [On_Demand | Running] -- C:\ElsaWin\bin\LcSvrAuf.exe -- (LcSvrAuf)
SRV - [2011.01.26 10:40:06 | 000,477,696 | ---- | M] (Volkswagen AG) [Auto | Running] -- C:\ElsaWin\bin\LcSvrPas.exe -- (LcSvrPAS)
SRV - [2011.01.26 10:38:56 | 000,392,704 | ---- | M] (Volkswagen AG) [Auto | Running] -- C:\ElsaWin\bin\LcSvrDba.exe -- (LcSvrDba)
SRV - [2010.02.19 14:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2008.07.29 20:16:38 | 000,132,096 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing)
SRV - [2008.04.14 09:00:00 | 000,114,176 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\netdde.exe -- (NetDDEdsdm)
SRV - [2008.04.14 09:00:00 | 000,114,176 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\netdde.exe -- (NetDDE)
SRV - [2008.04.14 09:00:00 | 000,053,248 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\mprdim.dll -- (RemoteAccess)
SRV - [2008.04.14 09:00:00 | 000,033,792 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\msgsvc.dll -- (Messenger)
SRV - [2008.04.14 09:00:00 | 000,017,408 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\alrsvc.dll -- (Alerter)
SRV - [2008.04.04 14:38:04 | 000,417,792 | ---- | M] (Transaction Software, D 81829 Munich) [Auto | Running] -- D:\EWA net\database\TransBase WIS\tbmux32.exe -- (EWA net DB WIS)
SRV - [2008.04.04 14:38:04 | 000,417,792 | ---- | M] (Transaction Software, D 81829 Munich) [Auto | Running] -- D:\EWA net\database\TransBase EWA\tbmux32.exe -- (EWA net DB Core)
SRV - [2007.11.27 13:33:52 | 000,417,792 | ---- | M] (Transaction Software, D 81829 Munich) [Auto | Running] -- D:\EWA net\database\TransBase EPC\tbmux32.exe -- (EWA net DB EPC)
SRV - [2005.11.14 02:06:04 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1150\Intel 32\IDriverT.exe -- (IDriverT)
SRV - [2004.08.05 14:02:30 | 000,385,024 | ---- | M] (Transaction Software, D 81737 Munich) [Auto | Running] -- C:\BMWgroup\ETKLokal\transbase\tbmux32.exe -- (Transbase)
SRV - [2003.07.31 19:29:04 | 000,065,536 | ---- | M] (Alexandria Software Consulting) [Auto | Running] -- D:\EWA net\server\bin\tomcat.exe -- (EWA net Server)
SRV - [2001.04.06 08:11:00 | 000,118,784 | ---- | M] () [Auto | Stopped] -- C:\WINDOWS\system32\spnsrvnt.exe -- (SuperProServer)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] --  -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\oreans32.sys -- (oreans32)
DRV - File not found [Kernel | System | Stopped] --  -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] --  -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] --  -- (Changer)
DRV - File not found [Kernel | Boot | Stopped] --  -- (cerc6)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOKUME~1\*****\LOKALE~1\Temp\catchme.sys -- (catchme)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\adatadrv.sys -- (adatadrv)
DRV - [2012.04.27 10:20:04 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2012.04.25 00:32:27 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2012.04.16 21:17:40 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2012.04.04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2012.02.15 05:44:58 | 007,585,792 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2012.01.09 17:37:35 | 000,124,976 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SYMEVENT.SYS -- (SymEvent)
DRV - [2011.12.20 09:39:28 | 000,100,368 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AtihdXP3.sys -- (AtiHDAudioService)
DRV - [2010.06.17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2010.05.20 16:26:48 | 000,040,560 | ---- | M] (Paragon Software Group) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\hotcore3.sys -- (hotcore3)
DRV - [2009.05.22 17:37:50 | 005,082,624 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2009.05.20 08:00:50 | 000,038,400 | R--- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\l1e51x86.sys -- (L1e)
DRV - [2009.04.01 13:28:32 | 000,093,184 | ---- | M] (ATI Research Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV - [2008.11.23 11:23:06 | 000,097,792 | ---- | M] (T0r0 2008) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\NSHE.SYS -- (NSHE)
DRV - [2008.08.05 14:10:12 | 001,684,736 | ---- | M] (Creative) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Ambfilt.sys -- (Ambfilt)
DRV - [2008.07.11 08:05:00 | 000,037,088 | ---- | M] (SafeNet, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SNTNLUSB.SYS -- (SNTNLUSB)
DRV - [2008.04.14 09:00:00 | 000,800,384 | ---- | M] (Microsoft Corp., Veritas Software) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\dmboot.sys -- (dmboot)
DRV - [2008.04.14 09:00:00 | 000,120,576 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\pcmcia.sys -- (Pcmcia)
DRV - [2008.04.14 09:00:00 | 000,096,512 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\atapi.sys -- (atapi)
DRV - [2008.04.14 09:00:00 | 000,066,048 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\udfs.sys -- (Udfs)
DRV - [2008.04.14 09:00:00 | 000,013,952 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\cbidf2k.sys -- (cbidf2k)
DRV - [2008.04.14 09:00:00 | 000,012,160 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\acpiec.sys -- (ACPIEC)
DRV - [2008.02.19 15:39:44 | 000,191,424 | ---- | M] (Jungo) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\windrvr6.sys -- (WinDriver6)
DRV - [2006.11.22 11:01:48 | 000,693,760 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\hardlock.sys -- (Hardlock)
DRV - [2006.01.04 09:41:48 | 001,389,056 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Monfilt.sys -- (Monfilt)
DRV - [2005.06.10 11:01:00 | 000,007,140 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\cvintdrv.sys -- (cvintdrv)
DRV - [2004.08.13 04:56:20 | 000,005,810 | R--- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ASACPI.sys -- (MTsensor)
DRV - [2004.06.07 13:22:28 | 000,009,420 | ---- | M] (EVC electronic GmbH) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\simdrv.sys -- (simdrv)
DRV - [2004.06.07 13:21:12 | 000,011,456 | ---- | M] (EVC electronic GmbH) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\eprdrv.sys -- (eprdrv)
DRV - [2001.04.06 08:11:00 | 000,073,216 | ---- | M] () [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\drivers\SENTINEL.SYS -- (Sentinel)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default Font Size = 01 00 00 00  [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.yahoo.com/
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2851647
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 58.11.165.109:8080
 
========== FireFox ==========
 
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de"
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Programme\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Programme\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Programme\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Programme\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Programme\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Acrobat: C:\Programme\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\web2pdfextension@web2pdf.adobedotcom: C:\Programme\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2012.02.16 21:33:27 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{184AA5E6-741D-464a-820E-94B3ABC2F3B4}: C:\WINDOWS\system32\11013\install.rdf [2012.04.26 10:11:48 | 000,000,539 | ---- | M] ()
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.04.26 13:05:41 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{184AA5E6-741D-464a-820E-94B3ABC2F3B4}: C:\WINDOWS\system32\11013 [2012.04.13 17:40:06 | 000,000,000 | ---D | M]
 
[2011.12.21 02:23:05 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\*****\Anwendungsdaten\Mozilla\Extensions
[2012.04.01 01:10:19 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\*****\Anwendungsdaten\Mozilla\Firefox\Profiles\5gomvd8o.default\extensions
[2012.02.17 15:28:37 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.04.13 17:40:06 | 000,000,000 | ---D | M] (Java String Helper) -- C:\WINDOWS\SYSTEM32\11013
[2012.04.26 13:05:41 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2012.02.17 15:28:35 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.02.17 15:28:35 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2012.02.17 15:28:35 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2012.02.17 15:28:35 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.02.17 15:28:35 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.02.17 15:28:35 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2012.06.04 18:48:12 | 000,000,059 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: 127.0.0.1 activate.adobe.com
O2 - BHO: (no name) - {184AA5E6-741D-464a-820E-94B3ABC2F3B4} - No CLSID value found.
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Programme\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] C:\Programme\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS5.5ServiceManager] "C:\Programme\Gemeinsame Dateien\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin File not found
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [APSDaemon] C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [ATIModeChange] C:\WINDOWS\System32\Ati2mdxx.exe (ATI Technologies, Inc.)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [StartCCC] C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [SwitchBoard] C:\Programme\Gemeinsame Dateien\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKCU..\Run: [AdobeBridge]  File not found
O4 - HKCU..\Run: [LicenseValidator] C:\Dokumente und Einstellungen\*****\Anwendungsdaten\Identities\{97B77B6F-819B-4444-B50B-BB0AC1A30C5E}\LicenseValidator.exe ()
O4 - HKCU..\Run: [LightScribe Control Panel] C:\Programme\Gemeinsame Dateien\LightScribe\LightScribeControlPanel.exe (Hewlett-Packard Company)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://windowsupdate.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1323900541234 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1324063882328 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.254.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7DAECB49-89E1-444C-BCF8-0AE3E4FDAEC3}: DhcpNameServer = 192.168.254.254
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\vw-wi {0F3C833F-FB28-40EA-8CB9-6A55B996C3F6} - C:\ElsaWin\bin\wiprot.dll (TODO: <Company name>)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\WINDOWS\System32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011.12.14 23:46:41 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - F:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.06.04 23:53:50 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Adobe
[2012.06.04 18:55:30 | 000,000,000 | ---D | C] -- C:\Programme\ESET
[2012.06.04 18:55:14 | 002,322,184 | ---- | C] (ESET) -- C:\Dokumente und Einstellungen\*****\Desktop\esetsmartinstaller_enu.exe
[2012.06.04 03:22:53 | 000,000,000 | ---D | C] -- C:\Quarantine
[2012.06.04 02:28:47 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\*****\Anwendungsdaten\Avira
[2012.06.04 02:27:11 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Avira
[2012.06.04 02:27:08 | 000,137,928 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys
[2012.06.04 02:27:08 | 000,083,392 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntflt.sys
[2012.06.04 02:27:08 | 000,036,000 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avkmgr.sys
[2012.06.04 02:27:08 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\ssmdrv.sys
[2012.06.04 02:27:07 | 000,000,000 | ---D | C] -- C:\Programme\Avira
[2012.06.04 02:27:07 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avira
[2012.06.03 18:18:15 | 000,000,000 | ---D | C] -- C:\EPSON
[2012.06.03 18:14:36 | 000,049,152 | ---- | C] (SEIKO EPSON CORP.) -- C:\WINDOWS\System32\E_DCINST.DLL
[2012.06.03 18:14:35 | 000,079,679 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\WINDOWS\System32\E_FLMAEE.DLL
[2012.06.03 18:14:35 | 000,064,000 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\WINDOWS\System32\E_FBCBAEE.DLL
[2012.06.03 18:14:35 | 000,034,304 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\WINDOWS\System32\E_FBCHAEE.DLL
[2012.06.03 18:13:43 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\EPSON
[2012.06.03 18:05:15 | 000,032,128 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\usbccgp.sys
[2012.06.01 22:47:19 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\*****\Desktop\Gucci Mane - I'm Up
[2012.05.29 14:20:51 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\*****\Desktop\alex 5+er
[2012.05.28 23:33:43 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\*****\Desktop\MUSIC 2
[2012.05.27 13:15:20 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\*****\Desktop\M-Flight Nordschleife 26.05.2012
[2012.05.21 01:30:19 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\*****\Anwendungsdaten\dpdhl.versandhelfer
[2012.05.16 00:33:13 | 000,000,000 | ---D | C] -- C:\Programme\uTorrent
[2012.05.16 00:32:41 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\*****\Anwendungsdaten\uTorrent
[2012.05.15 19:36:08 | 000,077,824 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ODBCTL32.DLL
[2012.05.15 19:34:31 | 000,000,000 | ---D | C] -- C:\WINDOWS\hsperfdata_SYSTEM
[2012.05.15 19:34:02 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\RNBOSENT
[2012.05.15 19:33:54 | 000,306,688 | ---- | C] (InstallShield Software Corporation) -- C:\WINDOWS\IsUninst.exe
[2012.05.15 19:33:43 | 000,000,000 | ---D | C] -- C:\JSDK2.0
[2012.05.15 19:30:44 | 000,115,200 | ---- | C] (General Motors Corporation) -- C:\WINDOWS\System32\HMPCab.dll
[2012.05.10 23:16:14 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\*****\Eigene Dateien\Crysis2
[2012.05.10 23:12:06 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Electronic Arts
[2012.05.10 23:12:06 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\EA Core
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.06.05 03:23:15 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.06.05 03:22:54 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.06.05 02:33:00 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012.06.04 18:55:16 | 002,322,184 | ---- | M] (ESET) -- C:\Dokumente und Einstellungen\*****\Desktop\esetsmartinstaller_enu.exe
[2012.06.04 12:19:23 | 000,000,360 | RHS- | M] () -- C:\boot.ini
[2012.06.04 02:27:11 | 000,001,684 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Avira Control Center.lnk
[2012.06.01 22:46:58 | 078,996,372 | ---- | M] () -- C:\Dokumente und Einstellungen\*****\Desktop\DJ_Hood-Welcome_2_Atlanta-(RapGodFathers.info).zip
[2012.05.31 20:17:00 | 000,000,102 | ---- | M] () -- C:\Dokumente und Einstellungen\*****\.ewanapi_cookie
[2012.05.31 15:22:01 | 000,604,160 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\crypt32.dll
[2012.05.31 01:17:39 | 000,134,144 | ---- | M] () -- C:\Dokumente und Einstellungen\*****\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.05.21 14:41:07 | 000,448,898 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2012.05.21 14:41:07 | 000,432,784 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012.05.21 14:41:07 | 000,080,338 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2012.05.21 14:41:07 | 000,067,740 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012.05.18 22:03:34 | 000,004,161 | ---- | M] () -- C:\WINDOWS\ODBCINST.INI
[2012.05.18 22:02:16 | 000,001,030 | ---- | M] () -- C:\WINDOWS\ODBC.INI
[2012.05.16 11:35:26 | 000,000,139 | ---- | M] () -- C:\WINDOWS\ppdrv.ini
[2012.05.16 00:33:13 | 000,000,623 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\µTorrent.lnk
[2012.05.15 19:44:20 | 000,000,000 | ---- | M] () -- C:\WINDOWS\frontend.INI
[2012.05.13 15:21:19 | 000,000,132 | ---- | M] () -- C:\Dokumente und Einstellungen\*****\Anwendungsdaten\Adobe BMP Format CS5 Prefs
[2012.05.11 14:47:25 | 003,557,312 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012.05.11 14:45:08 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2012.05.09 15:27:15 | 000,049,758 | ---- | M] () -- C:\Dokumente und Einstellungen\*****\Desktop\Rechnung_Simons.pdf
[2012.05.06 19:25:48 | 086,222,207 | ---- | M] () -- C:\Dokumente und Einstellungen\*****\Desktop\Buena_Vista_Social_Club.rar
[2012.05.06 12:49:42 | 000,012,476 | ---- | M] () -- C:\Dokumente und Einstellungen\*****\Desktop\AF53AD9BA839CCBAA650D58BFE8D27FE29CED7F4.torrent
[2012.05.06 12:49:35 | 000,012,356 | ---- | M] () -- C:\Dokumente und Einstellungen\*****\Desktop\2CE67AFEA3C383F05DD4B827F4D82361EA55E5FB.torrent
[2012.05.06 12:49:27 | 000,014,008 | ---- | M] () -- C:\Dokumente und Einstellungen\*****\Desktop\782B6F87DDC2B638D359190D3FDC5729BAABEF35.torrent
[2012.05.06 12:48:59 | 000,012,991 | ---- | M] () -- C:\Dokumente und Einstellungen\*****\Desktop\544E30E0A42CE1D8F15B522B051E3D1330429367.torrent
[2012.05.06 12:48:09 | 000,013,277 | ---- | M] () -- C:\Dokumente und Einstellungen\*****\Desktop\E08B2A96342D724A5330A846D9564B01363B8E3F.torrent
[2012.05.06 12:47:58 | 000,014,834 | ---- | M] () -- C:\Dokumente und Einstellungen\*****\Desktop\2F2277D3871AB342E698E7180A002B983FD82FAA.torrent
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.06.04 02:27:11 | 000,001,684 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Avira Control Center.lnk
[2012.06.01 22:46:58 | 078,996,372 | ---- | C] () -- C:\Dokumente und Einstellungen\*****\Desktop\DJ_Hood-Welcome_2_Atlanta-(RapGodFathers.info).zip
[2012.05.16 00:33:13 | 000,000,623 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\µTorrent.lnk
[2012.05.15 19:44:20 | 000,000,000 | ---- | C] () -- C:\WINDOWS\frontend.INI
[2012.05.15 19:34:02 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\spnsrvnt.exe
[2012.05.15 19:34:02 | 000,073,216 | ---- | C] () -- C:\WINDOWS\System32\drivers\SENTINEL.SYS
[2012.05.15 19:34:02 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\SNTI386.DLL
[2012.05.09 15:27:15 | 000,049,758 | ---- | C] () -- C:\Dokumente und Einstellungen\*****\Desktop\Rechnung_Simons.pdf
[2012.05.09 12:48:22 | 000,000,132 | ---- | C] () -- C:\Dokumente und Einstellungen\*****\Anwendungsdaten\Adobe BMP Format CS5 Prefs
[2012.05.06 19:25:47 | 086,222,207 | ---- | C] () -- C:\Dokumente und Einstellungen\*****\Desktop\Buena_Vista_Social_Club.rar
[2012.05.06 12:49:42 | 000,012,476 | ---- | C] () -- C:\Dokumente und Einstellungen\*****\Desktop\AF53AD9BA839CCBAA650D58BFE8D27FE29CED7F4.torrent
[2012.05.06 12:49:35 | 000,012,356 | ---- | C] () -- C:\Dokumente und Einstellungen\*****\Desktop\2CE67AFEA3C383F05DD4B827F4D82361EA55E5FB.torrent
[2012.05.06 12:49:27 | 000,014,008 | ---- | C] () -- C:\Dokumente und Einstellungen\*****\Desktop\782B6F87DDC2B638D359190D3FDC5729BAABEF35.torrent
[2012.05.06 12:48:59 | 000,012,991 | ---- | C] () -- C:\Dokumente und Einstellungen\*****\Desktop\544E30E0A42CE1D8F15B522B051E3D1330429367.torrent
[2012.05.06 12:48:09 | 000,013,277 | ---- | C] () -- C:\Dokumente und Einstellungen\*****\Desktop\E08B2A96342D724A5330A846D9564B01363B8E3F.torrent
[2012.05.06 12:47:58 | 000,014,834 | ---- | C] () -- C:\Dokumente und Einstellungen\*****\Desktop\2F2277D3871AB342E698E7180A002B983FD82FAA.torrent
[2012.03.31 02:01:02 | 000,000,139 | ---- | C] () -- C:\WINDOWS\ppdrv.ini
[2012.03.17 13:50:00 | 000,000,132 | ---- | C] () -- C:\Dokumente und Einstellungen\*****\Anwendungsdaten\Adobe GIF Format CS5 Prefs
[2012.02.20 01:03:55 | 000,000,617 | ---- | C] () -- C:\WINDOWS\eReg.dat
[2012.02.14 21:02:48 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2012.02.11 19:29:19 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2012.02.11 19:29:19 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2012.02.11 19:29:19 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2012.02.11 19:29:19 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2012.02.11 19:29:19 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2012.02.01 19:26:42 | 000,246,784 | ---- | C] () -- C:\WINDOWS\UN160407.EXE
[2012.01.27 18:01:56 | 000,000,056 | ---- | C] () -- C:\WINDOWS\Acroread.ini
[2011.12.29 23:52:20 | 000,000,000 | ---- | C] () -- C:\WINDOWS\MTSTACK.INI
[2011.12.29 23:52:19 | 000,043,520 | ---- | C] () -- C:\WINDOWS\System32\MTSTACK.EXE
[2011.12.28 14:15:41 | 000,001,606 | ---- | C] () -- C:\WINDOWS\System32\font.ini
[2011.12.26 17:09:33 | 000,000,174 | ---- | C] () -- C:\WINDOWS\cedt.INI
[2011.12.22 15:19:06 | 000,031,910 | ---- | C] () -- C:\WINDOWS\MSUMLT0G.INI
[2011.12.19 15:22:54 | 000,000,169 | ---- | C] () -- C:\WINDOWS\ETKINST.INI
[2011.12.19 15:12:35 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\hlduinst.exe
[2011.12.19 15:12:35 | 000,006,836 | ---- | C] () -- C:\WINDOWS\System32\UNWISE.INI
[2011.12.19 14:38:06 | 000,436,736 | R--- | C] () -- C:\WINDOWS\System32\Autoserv.exe
[2011.12.16 21:37:50 | 000,001,030 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2011.12.15 00:38:08 | 000,134,144 | ---- | C] () -- C:\Dokumente und Einstellungen\*****\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.12.15 00:27:30 | 000,000,000 | ---- | C] () -- C:\WINDOWS\ativpsrm.bin
[2011.12.15 00:27:25 | 000,887,724 | ---- | C] () -- C:\WINDOWS\System32\ativva6x.dat
[2011.12.15 00:27:25 | 000,601,728 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.dat
[2011.12.15 00:27:25 | 000,000,003 | ---- | C] () -- C:\WINDOWS\System32\ativva5x.dat
[2011.12.15 00:05:43 | 000,000,552 | ---- | C] () -- C:\WINDOWS\System32\d3d8caps.dat
[2011.12.15 00:05:03 | 000,005,810 | R--- | C] () -- C:\WINDOWS\System32\drivers\ASACPI.sys
[2011.12.15 00:05:00 | 000,001,769 | ---- | C] () -- C:\WINDOWS\Language_trs.ini
[2011.12.15 00:04:56 | 000,022,450 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini
[2011.12.15 00:04:56 | 000,010,296 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2011.12.14 23:47:53 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2011.12.14 23:44:51 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2011.12.14 23:42:36 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2011.12.14 23:40:07 | 003,557,312 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011.11.09 23:39:44 | 000,059,904 | ---- | C] () -- C:\WINDOWS\System32\OpenVideo.dll
[2011.11.09 23:39:32 | 000,054,784 | ---- | C] () -- C:\WINDOWS\System32\OVDecode.dll
 
========== LOP Check ==========
 
[2012.05.10 23:12:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\EA Core
[2012.05.10 23:12:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Electronic Arts
[2012.06.03 18:13:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\EPSON
[2012.01.26 15:19:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Evc
[2011.12.15 01:09:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\expLauncher
[2011.12.27 23:12:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\launcher
[2011.12.19 14:33:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\LightScribe
[2011.12.19 14:46:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Martau
[2011.12.15 01:09:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Paragon
[2011.12.15 01:09:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\pat
[2012.05.04 00:06:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\regid.1986-12.com.adobe
[2011.12.18 22:04:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2012.03.19 02:52:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\*****\Anwendungsdaten\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2012.05.21 01:30:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\*****\Anwendungsdaten\dpdhl.versandhelfer
[2012.04.28 22:37:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\*****\Anwendungsdaten\Edkop
[2011.12.15 00:54:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\*****\Anwendungsdaten\ElevatedDiagnostics
[2012.04.28 22:36:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\*****\Anwendungsdaten\Elydb
[2012.04.27 18:33:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\*****\Anwendungsdaten\Erev
[2012.04.27 18:33:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\*****\Anwendungsdaten\Fiimwe
[2012.05.17 19:26:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\*****\Anwendungsdaten\FileZilla
[2012.04.26 23:52:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\*****\Anwendungsdaten\Ihxuul
[2011.12.27 14:42:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\*****\Anwendungsdaten\ImgBurn
[2012.03.31 15:50:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\*****\Anwendungsdaten\PriceGong
[2012.02.17 15:55:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\*****\Anwendungsdaten\Red Alert 3
[2012.02.07 16:02:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\*****\Anwendungsdaten\redsn0w
[2012.06.03 01:26:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\*****\Anwendungsdaten\TeamViewer
[2012.05.16 00:42:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\*****\Anwendungsdaten\uTorrent
 
========== Purity Check ==========
 
 

< End of report >
         

OTL Extras logfile created on: 05.06.2012 03:27:33 - Run 2
OTL by OldTimer - Version 3.2.46.0     Folder = G:\
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,25 Gb Total Physical Memory | 2,42 Gb Available Physical Memory | 74,41% Memory free
5,09 Gb Paging File | 4,16 Gb Available in Paging File | 81,73% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 111,79 Gb Total Space | 37,79 Gb Free Space | 33,80% Space Free | Partition Type: NTFS
Drive D: | 128,00 Gb Total Space | 8,92 Gb Free Space | 6,97% Space Free | Partition Type: NTFS
Drive E: | 53,52 Gb Total Space | 16,20 Gb Free Space | 30,28% Space Free | Partition Type: NTFS
Drive F: | 51,37 Gb Total Space | 31,54 Gb Free Space | 61,39% Space Free | Partition Type: NTFS
Drive G: | 48,83 Gb Total Space | 18,49 Gb Free Space | 37,85% Space Free | Partition Type: NTFS
Drive H: | 48,83 Gb Total Space | 22,08 Gb Free Space | 45,21% Space Free | Partition Type: NTFS
Drive I: | 51,38 Gb Total Space | 24,81 Gb Free Space | 48,28% Space Free | Partition Type: NTFS
 
Computer Name: *****-8227EFF77 | User Name: ***** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- C:\Programme\Adobe\Adobe Bridge CS5.1\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Programme\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Programme\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Programme\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 1
"FirewallDisableNotify" = 1
"UpdatesDisableNotify" = 1
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\explorer.exe" = %windir%\explorer.exe -- (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\Macromedia\Dreamweaver MX\Dreamweaver.exe" = C:\Programme\Macromedia\Dreamweaver MX\Dreamweaver.exe:*:Enabled:Dreamweaver MX -- (Macromedia, Inc.)
"C:\BMWgroup\ETKLokal\javaclient\jre1.5.0_11\bin\javaw.exe" = C:\BMWgroup\ETKLokal\javaclient\jre1.5.0_11\bin\javaw.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary -- (Sun Microsystems, Inc.)
"C:\BMWgroup\ETKLokal\javaclient\ETK.exe" = C:\BMWgroup\ETKLokal\javaclient\ETK.exe:*:Enabled:ETK -- ()
"C:\Programme\Google\Google Earth\client\googleearth.exe" = C:\Programme\Google\Google Earth\client\googleearth.exe:*:Enabled:Google Earth -- (Google)
"C:\Programme\Winamp\winamp.exe" = C:\Programme\Winamp\winamp.exe:*:Disabled:Winamp -- (Nullsoft, Inc.)
"C:\Programme\Java\jre6\bin\javaw.exe" = C:\Programme\Java\jre6\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Programme\EA Games\Command and Conquer Generals\game.dat" = C:\Programme\EA Games\Command and Conquer Generals\game.dat:*:Enabled:game
"C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\WebKit2WebProcess.exe" = C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\WebKit2WebProcess.exe:*:Enabled:WebKit -- (Apple Inc.)
"%windir%\explorer.exe" = %windir%\explorer.exe -- (Microsoft Corporation)
"C:\Programme\Electronic Arts\Crytek\Crysis 2\bin32\Crysis2.exe" = C:\Programme\Electronic Arts\Crytek\Crysis 2\bin32\Crysis2.exe:*:Disabled:Crysis2
"C:\Programme\uTorrent\uTorrent.exe" = C:\Programme\uTorrent\uTorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00989200-325C-4910-8D7C-708529685D64}" = EWA_net_WIS_CaseOnline_Importer
"{01E9B2FF-DAF4-4529-9CC9-2101625517C7}" = nero.prerequisites.msi
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{034DCAF9-96E7-4936-9A07-712F80B5181E}" = Nero RescueAgent 11
"{053A8677-8139-6869-0157-21F36368B5B2}" = CCC Help Danish
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{08ED1CD1-1CB1-B7CE-677E-110D0A118590}" = AMD Catalyst Install Manager
"{09713414-6CBB-F885-8784-E3202514A97D}" = CCC Help Chinese Traditional
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{11D3EF85-63E1-4AE4-A7C1-9241BDB16B51}" = Nero ControlCenter 11
"{16EB8FB7-A791-B483-FBF2-81E56AD1E936}" = Catalyst Control Center Localization All
"{1A47E3FB-A5FE-C27E-B080-8EAF73B782AC}" = Catalyst Control Center
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{207DE839-8CE6-F8E7-6E0A-D75AD84C1629}" = CCC Help Spanish
"{21659FCD-EA29-ABE9-2E19-0EA64C9FB37B}" = CCC Help Swedish
"{221F93A5-4ABE-BFB5-781E-E1E38A7102DB}" = CCC Help Portuguese
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{23B8A91D-680B-462B-87AD-3D70F7341731}" = iTunes
"{26A24AE4-039D-4CA4-87B4-2F83216030FF}" = Java(TM) 6 Update 30
"{278DB2A0-512A-4555-8BA0-C5D65E9DDC79}" = EWA_net_Client_Applications
"{2B4041FE-0E77-BE39-D31A-057B2F7F4CFF}" = CCC Help Chinese Standard
"{2C7946AF-8AE9-6369-0075-7A3419F59441}" = Catalyst Control Center InstallProxy
"{2ECA81CA-D932-4AD3-AD59-BF5CCF099C83}" = Catalyst Control Center - Branding
"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.(R) AR8121/AR8113/AR8114 Gigabit/Fast Ethernet Driver
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{33AEE368-3F04-27E3-39C2-F41E1C4611B6}" = CCC Help English
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3521BDBD-D453-5D9F-AA55-44B75D214629}" = Adobe Community Help
"{46192793-5011-565F-41A3-3712B5EC0608}" = CCC Help Finnish
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4D83E500-4D0C-11DF-A750-005056C00008}" = Paragon Alignment Tool™  2.0 
"{4E33D05D-76CF-5D3C-4D5D-7727530FA161}" = Adobe Content Viewer
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{53F7746A-96AA-49A5-86B8-59989680DAC5}" = Nero Burning ROM 11 Help (CHM)
"{5A9AA2C0-972F-4239-AA41-E409434194D5}" = MobileMe Control Panel
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{63CD0BBB-3F57-456A-8405-214E42616A0C}" = Performance Box
"{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}" = Nero Update
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{76AFBB49-1402-0FD2-E324-9B86A8029CA6}" = CCC Help Japanese
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7A65D944-399F-4665-BA27-318B3F91E881}" = Multisim 9
"{7A997C02-81D4-4FEC-9C1C-F916611F8360}" = EWA_net_EPC
"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime
"{7EB0954B-30A8-8414-092B-792BA3A82F20}" = ccc-utility
"{8B4AB829-DFD3-436D-B808-D9733D76C590}" = Macromedia Dreamweaver MX
"{8CF61023-24BD-1356-8B84-75863E711DA2}" = CCC Help Czech
"{8EE0102A-1D61-8631-B4B2-CDF6BDF2BDF6}" = CCC Help Thai
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90280407-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional mit FrontPage
"{903C704F-B35E-CB0C-6475-A851A82FE00E}" = CCC Help Hungarian
"{9158FF30-78D7-40EF-B83E-451AC5334640}" = Adobe Photoshop CS5.1
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9F0C2B61-2958-EC02-1852-83FBE7BF2992}" = CCC Help Dutch
"{A0568C61-9443-43F3-9938-E573A3BEFB7B}" = WinPEP 7
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A25FF1C0-80B6-4B8B-A551-DC525697A408}" = AMD APP SDK Runtime
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A35001F0-F1E4-11DD-A38B-005056C00008}" = Paragon Partition Manager™ 11 Professional
"{A5BA14E0-7384-11D4-BAE7-00409631A2C8}" = Macromedia Extension Manager
"{A6EE99EA-420C-4FA6-8A7C-FDB60D278855}" = VS10RuntimeWin32
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{AB23A8EF-1246-9E17-0C87-477B2C089E2B}" = CCC Help German
"{AC35BEC3-AC61-F2F5-217A-70FA16DFD3C8}" = Catalyst Control Center Graphics Previews Common
"{AC76BA86-1033-F400-7760-000000000005}" = Adobe Acrobat X Pro - English, Français, Deutsch
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.3) - Deutsch
"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger
"{B1846721-A8E6-46C7-83B6-0DCF7ADB4267}" = Nero Burning ROM 11
"{B3FED300-806C-11E0-A0D0-B8AC6F97B88E}" = Google Earth
"{B5ACA897-3570-F936-43DD-7E6B736B1A6F}" = CCC Help Korean
"{B6D38690-755E-4F40-A35A-23F8BC2B86AC}" = Microsoft_VC90_MFCLOC_x86
"{B8CB7B7D-C106-A95E-9E93-203BD81F4D4F}" = CCC Help Russian
"{BEBEE34D-84A2-4EDD-8BEA-96CC54371263}" = Nero Core Components 11
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C0F1D697-0C8F-4563-A406-830AE52BCE65}" = EWA_net_WIS
"{C927F550-AAAE-5653-73C0-F523951417B8}" = CCC Help French
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D01CE99A-8802-483C-A79F-298B691EB432}" = Nero RescueAgent 11 Help (CHM)
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call
"{D4D66270-9147-4BDF-9946-FCA2B303AA8F}" = Nero ControlCenter 11 Help (CHM)
"{D57FC112-312E-4D70-860F-2DB8FB6858F0}" = Adobe Creative Suite 5.5 Master Collection
"{D78A1468-84FD-4226-BB33-713A7EBE3028}" = Document_Installer
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DDE3EF07-816C-7D76-F7F1-E16262D4439F}" = CCC Help Italian
"{E0E55FC1-C53D-4F8D-B14B-B59C312747C8}" = LightScribe System Software
"{E167EA39-6D3B-D947-F8C4-2FCEEE41F803}" = CCC Help Polish
"{E656D89A-8CBB-497F-918F-8361A4071C26}" = Nero Burning ROM 11
"{E68C5783-A1E6-4D4C-83D4-99DD470F3D94}" = EWA_net_Server
"{EB879750-CCBD-4013-BFD5-0294D4DA5BD0}" = Apple Application Support
"{EC17C160-E2F0-47CC-86D4-140AE22EC38E}" = ETK (Lokal)
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.8
"{EFC04D3F-A152-47E7-8517-EE0F6201AFEF}" = Apple Mobile Device Support
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F41852C7-939E-49A3-A5A7-5E3A81C32A8B}" = EWA_net_Core
"{F49AFE1E-A8F1-4764-9138-C82C8E617E2B}" = EWA_net_Admin
"{F7FEEF47-4D61-93DB-5926-D9656DCC03CE}" = CCC Help Norwegian
"{F8EF8AC9-0CD7-56BF-B42A-8DFB9E85448E}" = CCC Help Turkish
"{FB150FB5-B153-6866-918D-3865C73152E5}" = CCC Help Greek
"5513-1208-7298-9440" = JDownloader 0.9
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe SVG Viewer" = Adobe SVG Viewer 3.0
"AutoCAD LT 97 - Deutsch Deinstaller" = AutoCAD LT 97 - Deutsch
"Avira AntiVir Desktop" = Avira Free Antivirus
"AVS Update Manager_is1" = AVS Update Manager 1.0
"AVS4YOU Software Navigator_is1" = AVS4YOU Software Navigator 1.4
"AVS4YOU Video Converter 7_is1" = AVS Video Converter 8
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"com.adobe.dmp.contentviewer" = Adobe Content Viewer
"Crimson Editor SVN286M" = Crimson Editor SVN286M
"DivX Setup" = DivX-Setup
"dreamboxEDIT" = dreamboxEDIT -- The one and only settings editor for your Dreambox
"ElsaWin" = ElsaWin
"ESET Online Scanner" = ESET Online Scanner v3
"ETKA7.3_Germany_2011" = ETKA 7.3 Germany 2011
"EWA net" = EWA net
"FileZilla Client" = FileZilla Client 3.5.3
"HaaliMkx" = Haali Media Splitter
"ie8" = Windows Internet Explorer 8
"ImgBurn" = ImgBurn
"InstallShield_{A0568C61-9443-43F3-9938-E573A3BEFB7B}" = WinPEP 7
"KONICA MINOLTA magicolor 1600W" = KONICA MINOLTA magicolor 1600W
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.61.0.1400
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox 12.0 (x86 de)" = Mozilla Firefox 12.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"PS3 Media Server" = PS3 Media Server
"Rainbow Sentinel Driver" = Sentinel System Driver
"Total Uninstall 5_is1" = Total Uninstall 5.10.1
"Unlocker" = Unlocker 1.9.1
"uTorrent" = µTorrent
"VLC media player" = VLC media player 2.0.1
"Winamp" = Winamp
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WinHTTrack Website Copier_is1" = WinHTTrack Website Copier 3.45-3
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinOls" = WinOls
"WinRAR archiver" = WinRAR 4.01 (32-bit)
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 03.06.2012 20:27:20 | Computer Name = *****-8227EFF77 | Source = crypt32 | ID = 131083
Description = Die Extrahierung der Drittanbieterstammlisten aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
 ist fehlgeschlagen mit dem Fehler: Ein erforderliches Zertifikat befindet sich 
nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel
 in der signierten Datei.  .
 
Error - 03.06.2012 20:27:20 | Computer Name = *****-8227EFF77 | Source = crypt32 | ID = 131083
Description = Die Extrahierung der Drittanbieterstammlisten aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
 ist fehlgeschlagen mit dem Fehler: Ein erforderliches Zertifikat befindet sich 
nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel
 in der signierten Datei.  .
 
Error - 04.06.2012 04:03:16 | Computer Name = *****-8227EFF77 | Source = SuperProServer | ID = 9
Description = 
 
Error - 04.06.2012 10:27:38 | Computer Name = *****-8227EFF77 | Source = SuperProServer | ID = 9
Description = 
 
Error - 04.06.2012 12:25:46 | Computer Name = *****-8227EFF77 | Source = SuperProServer | ID = 9
Description = 
 
Error - 04.06.2012 12:45:14 | Computer Name = *****-8227EFF77 | Source = SuperProServer | ID = 9
Description = 
 
Error - 04.06.2012 12:49:28 | Computer Name = *****-8227EFF77 | Source = SuperProServer | ID = 9
Description = 
 
Error - 04.06.2012 13:35:52 | Computer Name = *****-8227EFF77 | Source = .NET Runtime 2.0 Error Reporting | ID = 1000
Description = Faulting application mom.exe, version 2.0.0.0, stamp 49ef8e68, faulting
 module unknown, version 0.0.0.0, stamp 00000000, debug? 0, fault address 0x0385447b.
 
Error - 04.06.2012 13:35:58 | Computer Name = *****-8227EFF77 | Source = .NET Runtime 2.0 Error Reporting | ID = 1000
Description = Faulting application ccc.exe, version 2.0.0.0, stamp 4c90e454, faulting
 module unknown, version 0.0.0.0, stamp 00000000, debug? 0, fault address 0x010d447b.
 
Error - 04.06.2012 21:23:11 | Computer Name = *****-8227EFF77 | Source = SuperProServer | ID = 9
Description = 
 
[ System Events ]
Error - 04.06.2012 12:25:49 | Computer Name = *****-8227EFF77 | Source = Service Control Manager | ID = 7034
Description = Dienst "SentinelSuperProNet Server" wurde unerwartet beendet. Dies
 ist bereits 1 Mal passiert.
 
Error - 04.06.2012 12:45:14 | Computer Name = *****-8227EFF77 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Sentinel" wurde aufgrund folgenden Fehlers nicht gestartet:
   %%20
 
Error - 04.06.2012 12:45:17 | Computer Name = *****-8227EFF77 | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
   oreans32
 
Error - 04.06.2012 12:45:18 | Computer Name = *****-8227EFF77 | Source = Service Control Manager | ID = 7034
Description = Dienst "SentinelSuperProNet Server" wurde unerwartet beendet. Dies
 ist bereits 1 Mal passiert.
 
Error - 04.06.2012 12:49:30 | Computer Name = *****-8227EFF77 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Sentinel" wurde aufgrund folgenden Fehlers nicht gestartet:
   %%20
 
Error - 04.06.2012 12:49:31 | Computer Name = *****-8227EFF77 | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
   oreans32
 
Error - 04.06.2012 12:49:31 | Computer Name = *****-8227EFF77 | Source = Service Control Manager | ID = 7034
Description = Dienst "SentinelSuperProNet Server" wurde unerwartet beendet. Dies
 ist bereits 1 Mal passiert.
 
Error - 04.06.2012 21:23:11 | Computer Name = *****-8227EFF77 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Sentinel" wurde aufgrund folgenden Fehlers nicht gestartet:
   %%20
 
Error - 04.06.2012 21:23:13 | Computer Name = *****-8227EFF77 | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
   oreans32
 
Error - 04.06.2012 21:23:13 | Computer Name = *****-8227EFF77 | Source = Service Control Manager | ID = 7034
Description = Dienst "SentinelSuperProNet Server" wurde unerwartet beendet. Dies
 ist bereits 1 Mal passiert.
 
 
< End of report >
         

Der Rechner läuft jetzt 24h mit alle möglichen Suchprogrammen. Problem besteht weiterhin.
ESET sagt:
Arbeitsspeicher=explorer.exe(1988) - Variante von Win32/Gataka.B Trojaner - Säubern nicht möglich.

Der Rechner läuft jetzt 24h mit alle möglichen Suchprogrammen. Problem besteht weiterhin.
ESET sagt:
Arbeitsspeicher=explorer.exe(1988) - Variante von Win32/Gataka.B Trojaner - Säubern nicht möglich.

was ist mit den Malwarebytes logs

Nicht mehr da. Ich habe jetzt noch ESET NOD32 Antivirus installiert anstatt des blöden Avira, da der nichts findet. Ist ESET gut ?
Lasse gerade Malware nochmal scannen.

Wie kommt so ein Drecksding nur auf meinen PC. Hab Malware immer am laufen.

So, malware bytes findet nichts und die anderen Logs sind weg.
Abgesichter Modus geht nicht etc wie in meinem 1.Posting.

Bitte um Hilfe

dann setze neu auf.
1. Datenrettung:

• deaktiviere Autorun: http://www.trojaner-board.de/83238-a...sschalten.html
• dann sichere Daten auf nen externen datenträger: http://www.trojaner-board.de/82533-d...ted-magic.html
  Bilder, Dokumente, Musik Videos (persönliches) http://www.trojaner-board.de/71715-k...iendungen.html

2. Formatieren, Windows neu instalieren:

• nutzt du eine Windows CD: http://www.trojaner-board.de/51262-a...sicherung.html
• recovery cd oder recovery partition.
• falls dies ein fertig pc ist, nenne hersteller + typ.
• Keine Windows 7 DVD? http://www.trojaner-board.de/100776-...-download.html

3. PC absichern: http://www.trojaner-board.de/96344-a...-rechners.html
ich werde außerdem noch weitere punkte dazu posten.
4. alle Passwörter ändern!
5. nach PC Absicherung, die gesicherten Daten prüfen und falls sauber: zurückspielen.
6. werde ich dann noch was zum absichern von Onlinebanking mit Chip Card Reader + Star Money sagen.