| |  TR/Injector.gi in C:\Dokumente und Einstellungen\Test\Lokale Einstellungen\Temp\qxtndqxofj.pre
 Hallo und danke schon mal im Vorraus!
Mein Avira hat beim allwöchentlichen Scan den oben genannten Fund gemacht. Nach einigem googlen kam ich auf eure Website. Ich habe die ersten 3 Schritte schon gemacht.
Bei Defogger kam es zu einer Fehlermeldung mit Abbruch Zitat:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 11:08 on 01/06/2013 (Test)
Checking for autostart values...
Unable to open HKCU\~\Run key (5)
HKCU\~\Run values retrieved.
Unable to open HKLM\~\Run key (5)
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
| Hier die Ergebnisse von OTL
OTL.txt Zitat:
OTL logfile created on: 1.6.2013 11:10:57 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Dokumente und Einstellungen\Test\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: d.M.yyyy
1023,48 Mb Total Physical Memory | 491,65 Mb Available Physical Memory | 48,04% Memory free
2,40 Gb Paging File | 1,87 Gb Available in Paging File | 77,60% Paging File free
Paging file location(s): c:\pagefile.sys 1536 3072 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 64,21 Gb Total Space | 42,66 Gb Free Space | 66,44% Space Free | Partition Type: NTFS
Drive D: | 132,84 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive E: | 10,32 Gb Total Space | 7,34 Gb Free Space | 71,11% Space Free | Partition Type: NTFS
Drive G: | 298,02 Gb Total Space | 78,91 Gb Free Space | 26,48% Space Free | Partition Type: FAT32
Drive H: | 61,49 Mb Total Space | 51,25 Mb Free Space | 83,33% Space Free | Partition Type: FAT32
Computer Name: ARBEITSZIMMER | User Name: Test | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2013.06.01 11:09:59 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Test\Desktop\OTL.exe
PRC - [2013.05.02 11:25:41 | 000,562,744 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avwebgrd.exe
PRC - [2013.05.02 11:25:37 | 000,345,312 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2013.03.30 16:58:21 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2013.03.30 16:57:47 | 000,079,584 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2013.03.30 16:57:41 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2013.02.11 13:19:52 | 000,663,184 | ---- | M] (Star Finanz-Software Entwicklung und Vertriebs GmbH) -- C:\Programme\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe
PRC - [2012.12.21 15:48:08 | 000,699,680 | ---- | M] (Star Finanz - Software Entwicklung und Vertriebs GmbH) -- C:\Programme\StarMoney 8.0\ouservice\StarMoneyOnlineUpdate.exe
PRC - [2012.11.23 15:48:42 | 000,161,768 | ---- | M] (Oracle Corporation) -- C:\Programme\Java\jre7\bin\jqs.exe
PRC - [2012.06.20 13:18:08 | 001,568,976 | ---- | M] (Ask) -- C:\Programme\Ask.com\Updater\Updater.exe
PRC - [2012.05.20 22:00:07 | 001,823,672 | ---- | M] (Bandoo Media, inc) -- C:\Programme\Searchqu Toolbar\Datamngr\datamngrUI.exe
PRC - [2012.03.19 21:58:12 | 000,514,128 | ---- | M] (REINER SCT) -- C:\WINDOWS\system32\cjpcsc.exe
PRC - [2011.11.17 10:15:28 | 000,008,704 | ---- | M] (Microsoft) -- C:\Programme\Freemake\CaptureLib\CaptureLibService.exe
PRC - [2010.03.29 17:13:26 | 000,602,624 | ---- | M] (Hauppauge Computer Works) -- C:\Programme\WinTV\TVServer\HauppaugeTVServer.exe
PRC - [2008.04.14 07:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Explorer.EXE
PRC - [2007.01.22 13:30:18 | 009,385,504 | ---- | M] (EMC Corporation) -- C:\Programme\Retrospect\Retrospect Express HD 2.0\RetroExpress.exe
PRC - [2007.01.22 13:30:18 | 000,108,064 | ---- | M] (EMC Corporation) -- C:\Programme\Retrospect\Retrospect Express HD 2.0\retrorun.exe
PRC - [2006.01.02 16:41:22 | 000,045,056 | ---- | M] (ATI Technologies Inc.) -- C:\Programme\ATI Technologies\ATI.ACE\CLI.exe
========== Modules (No Company Name) ==========
MOD - [2013.05.15 18:52:24 | 018,054,144 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceModel\77d51d287a12c482a1368515ac763f36\System.ServiceModel.ni.dll
MOD - [2013.05.15 18:51:39 | 001,077,760 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\e5c1fa6f921e7ced1cb600998e98994f\System.IdentityModel.ni.dll
MOD - [2013.05.15 18:49:14 | 001,020,928 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Runtime.Dura#\3c720ec622b80ab4733ca430fa03899c\System.Runtime.DurableInstancing.ni.dll
MOD - [2013.05.15 18:49:12 | 002,637,312 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Runtime.Seri#\e1e5fdef93d69dc13cb360d91fdcdf4c\System.Runtime.Serialization.ni.dll
MOD - [2013.05.15 18:39:59 | 012,433,920 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\81b85db6e9fe04e4d1c9547b993acfce\System.Windows.Forms.ni.dll
MOD - [2013.05.15 18:38:09 | 000,971,264 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\17440cd05eee7f87026b3c17119eed58\System.Configuration.ni.dll
MOD - [2013.05.15 18:34:27 | 000,372,736 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
MOD - [2013.05.15 18:24:47 | 000,980,480 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Configuration\2812eeab3ae456c112a3e3d768cf5ca4\System.Configuration.ni.dll
MOD - [2013.05.15 18:23:05 | 007,053,824 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\347f5b43b525120fe2f33d92d75337f2\System.Core.ni.dll
MOD - [2013.02.13 19:26:01 | 000,221,696 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceProce#\e534d8e15df8611bc3174e5f2377a093\System.ServiceProcess.ni.dll
MOD - [2013.02.13 19:25:29 | 000,148,480 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Configuratio#\636ef2392964b23b07e818cd8183a8a3\System.Configuration.Install.ni.dll
MOD - [2013.02.13 19:14:26 | 011,817,472 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web\e143370f0583abe015d8e3d2d536185e\System.Web.ni.dll
MOD - [2013.01.09 20:28:58 | 000,142,848 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\3b7f418545abc074940776fea9ad635e\SMDiagnostics.ni.dll
MOD - [2013.01.09 20:20:50 | 000,771,584 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\d7a2248a76f0e94d56c92c5bf96f5175\System.Runtime.Remoting.ni.dll
MOD - [2013.01.09 20:19:39 | 001,593,856 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\7782f356a838c403b4a8e9c80df5a577\System.Drawing.ni.dll
MOD - [2013.01.09 20:18:51 | 005,450,752 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\fe025743210c22bea2f009e1612c38bf\System.Xml.ni.dll
MOD - [2013.01.09 20:18:29 | 007,977,984 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aeac298c43c77d8860db8e7634d9f2eb\System.ni.dll
MOD - [2013.01.09 20:18:06 | 011,492,352 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\eab2340ead8e1a84bdf1a87868659979\mscorlib.ni.dll
MOD - [2013.01.09 20:00:49 | 005,618,176 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml\3d6d9da56c9f607615b55d6742d8427d\System.Xml.ni.dll
MOD - [2013.01.09 19:59:46 | 009,093,120 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\c182d7a0bd88caf2cddccb7491a5fa6e\System.ni.dll
MOD - [2013.01.09 19:59:32 | 014,412,800 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\mscorlib\3f95a6d480ed1ebe45cf27b770ba94ed\mscorlib.ni.dll
MOD - [2012.09.19 20:17:40 | 000,397,088 | ---- | M] () -- C:\Programme\Avira\AntiVir Desktop\sqlite3.dll
MOD - [2011.01.13 11:44:24 | 000,232,800 | ---- | M] () -- C:\Programme\StarMoney 9.0\ouservice\patchw32.dll
MOD - [2011.01.13 11:44:24 | 000,232,800 | ---- | M] () -- C:\Programme\StarMoney 8.0\ouservice\patchw32.dll
MOD - [2010.04.10 03:21:42 | 000,022,528 | ---- | M] () -- C:\Programme\WinTV\TVServer\HauppaugeTVServerps.dll
MOD - [2008.11.04 11:17:08 | 000,443,232 | ---- | M] () -- C:\Programme\Ashampoo\Ashampoo WinOptimizer 4\ContextHandler.dll
MOD - [2008.04.14 07:52:18 | 000,014,336 | ---- | M] () -- C:\WINDOWS\system32\msdmo.dll
MOD - [2007.05.31 07:38:16 | 000,167,936 | ---- | M] () -- C:\WINDOWS\system32\SerialXP.dll
MOD - [2007.01.22 12:19:00 | 004,972,544 | ---- | M] () -- C:\Programme\Retrospect\Retrospect Express HD 2.0\de\RetroExpress.resources.dll
MOD - [2006.12.06 09:18:24 | 001,683,456 | R--- | M] () -- C:\WINDOWS\system32\LTCLR13n.dll
========== Services (SafeList) ==========
SRV - [2013.05.12 00:26:17 | 000,117,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013.05.02 11:25:41 | 000,562,744 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avwebgrd.exe -- (AntiVirWebService)
SRV - [2013.04.21 12:06:31 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013.04.21 12:01:59 | 000,474,112 | ---- | M] () [Auto | Stopped] -- C:\Programme\SoftwareUpdater\SystemStore.exe -- (SystemStoreService)
SRV - [2013.03.30 16:58:21 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2013.03.30 16:57:41 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2013.02.11 13:19:52 | 000,663,184 | ---- | M] (Star Finanz-Software Entwicklung und Vertriebs GmbH) [Auto | Running] -- C:\Programme\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe -- (StarMoney 9.0 OnlineUpdate)
SRV - [2012.12.21 15:48:08 | 000,699,680 | ---- | M] (Star Finanz - Software Entwicklung und Vertriebs GmbH) [Auto | Running] -- C:\Programme\StarMoney 8.0\ouservice\StarMoneyOnlineUpdate.exe -- (StarMoney 8.0 OnlineUpdate)
SRV - [2012.11.23 15:48:42 | 000,161,768 | ---- | M] (Oracle Corporation) [Auto | Running] -- C:\Programme\Java\jre7\bin\jqs.exe -- (JavaQuickStarterService)
SRV - [2012.03.19 21:58:12 | 000,514,128 | ---- | M] (REINER SCT) [Auto | Running] -- C:\WINDOWS\system32\cjpcsc.exe -- (cjpcsc)
SRV - [2011.11.17 10:15:28 | 000,008,704 | ---- | M] (Microsoft) [Auto | Running] -- C:\Programme\Freemake\CaptureLib\CaptureLibService.exe -- (FreemakeVideoCapture)
SRV - [2011.07.07 08:49:42 | 000,376,352 | ---- | M] (Soluto) [Auto | Stopped] -- C:\Programme\Soluto\SolutoService.exe -- (SolutoService)
SRV - [2010.03.29 17:13:26 | 000,602,624 | ---- | M] (Hauppauge Computer Works) [Auto | Running] -- C:\Programme\WinTV\TVServer\HauppaugeTVServer.exe -- (HauppaugeTVServer)
SRV - [2009.06.02 10:10:08 | 000,637,952 | ---- | M] (Nokia.) [On_Demand | Stopped] -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2007.01.22 13:30:20 | 000,128,544 | ---- | M] (EMC Corporation) [Auto | Stopped] -- C:\Programme\Retrospect\Retrospect Express HD 2.0\rthlpsvc.exe -- (RetroExp Helper)
SRV - [2007.01.22 13:30:18 | 000,108,064 | ---- | M] (EMC Corporation) [Auto | Running] -- C:\Programme\Retrospect\Retrospect Express HD 2.0\retrorun.exe -- (RetroExpLauncher)
SRV - [2003.07.28 12:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
========== Driver Services (SafeList) ==========
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\2CD.tmp -- (MEMSWEEP2)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - File not found [Kernel | Auto | Stopped] -- System32\Drivers\Ca1528av.sys -- (Ca1528av)
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\Drivers\Bulk1528.sys -- (Bulk1528)
DRV - [2013.03.30 16:58:28 | 000,135,136 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2013.03.30 16:58:28 | 000,084,744 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2013.03.30 16:58:28 | 000,037,352 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2012.08.27 16:50:24 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2012.01.18 15:55:56 | 000,016,472 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\pwdrvio.sys -- (pwdrvio)
DRV - [2012.01.18 15:55:54 | 000,011,104 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\pwdspio.sys -- (pwdspio)
DRV - [2011.07.29 13:54:56 | 000,013,192 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\epmntdrv.sys -- (epmntdrv)
DRV - [2011.07.29 13:54:56 | 000,008,456 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\EuGdiDrv.sys -- (EuGdiDrv)
DRV - [2011.07.07 08:34:08 | 000,051,144 | ---- | M] (Soluto LTD.) [File_System | Boot | Stopped] -- C:\WINDOWS\system32\drivers\Soluto.sys -- (Soluto)
DRV - [2011.03.29 11:08:08 | 000,028,144 | ---- | M] (REINER SCT) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\cjusb.sys -- (cjusb)
DRV - [2011.02.14 02:42:36 | 000,020,864 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lgusbdiag.sys -- (UsbDiag)
DRV - [2011.02.14 02:42:34 | 000,025,216 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lgusbmodem.sys -- (USBModem)
DRV - [2011.02.14 02:42:32 | 000,013,056 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lgusbbus.sys -- (usbbus)
DRV - [2011.02.11 22:23:34 | 000,035,088 | ---- | M] (CACE Technologies, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\npf.sys -- (npf)
DRV - [2010.01.27 19:56:48 | 000,054,016 | R--- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\hcw17bda.sys -- (hcw17bda)
DRV - [2009.10.27 12:02:14 | 000,023,936 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motmodem.sys -- (motmodem)
DRV - [2009.09.29 08:11:22 | 000,012,160 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\lgbtport.sys -- (LgBttPort)
DRV - [2009.09.29 08:11:20 | 000,012,928 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\lgvmodem.sys -- (LGVMODEM)
DRV - [2009.09.29 08:11:20 | 000,010,496 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\lgbtbus.sys -- (lgbusenum)
DRV - [2008.09.15 07:56:34 | 000,008,064 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys -- (UsbserFilt)
DRV - [2008.09.15 07:56:24 | 000,022,016 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ccdcmbo.sys -- (nmwcdc)
DRV - [2008.09.15 07:56:24 | 000,017,664 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ccdcmb.sys -- (nmwcd)
DRV - [2008.09.15 07:56:24 | 000,008,064 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbser_lowerflt.sys -- (upperdev)
DRV - [2008.08.30 04:39:32 | 000,039,296 | ---- | M] (SCM Microsystems Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SCR24X2K.sys -- (SCR24X2K)
DRV - [2008.08.26 10:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2008.04.14 00:16:24 | 000,015,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mpe.sys -- (MPE)
DRV - [2008.04.14 00:15:30 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)
DRV - [2008.04.01 09:58:18 | 000,039,472 | ---- | M] (Paragon Software Group) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\hotcore3.sys -- (hotcore3)
DRV - [2007.05.31 07:38:16 | 000,014,949 | ---- | M] (franson.biz) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\bizVSerialNT.sys -- (bizVSerial)
DRV - [2006.11.10 15:05:00 | 000,018,688 | ---- | M] (Arcsoft, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\afc.sys -- (Afc)
DRV - [2006.02.21 20:46:26 | 001,505,792 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2005.09.19 03:07:00 | 000,035,275 | ---- | M] (SCM Microsystems Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\TwkUsb2K.sys -- (CHIPDRIVE USB SmartCardReader)
DRV - [2004.08.25 15:06:00 | 000,185,611 | ---- | M] (SCM Microsystems Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\TWKSER2K.sys -- (TWKSER2K)
DRV - [2003.04.24 02:14:00 | 000,004,828 | ---- | M] (Towitoko AG) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\TWKMS.sys -- (TwkMs)
DRV - [2002.04.22 00:00:00 | 000,093,594 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\IdeChnDr.sys -- (IdeChnDr)
DRV - [2002.04.22 00:00:00 | 000,013,782 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\IdeBusDr.sys -- (IdeBusDr)
DRV - [2002.02.26 19:55:36 | 000,123,984 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\STAC97.sys -- (STAC97)
DRV - [2001.08.18 04:26:24 | 000,065,406 | ---- | M] (Compaq Computer Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NetFlx3.sys -- (netflx3)
DRV - [2001.08.17 14:00:04 | 000,002,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\msmpu401.sys -- (ms_mpu401)
DRV - [2001.04.12 15:55:26 | 000,007,197 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\flash.sys -- (flash)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{2AB2BABC-BDD8-4866-B375-5E899C9DBE52}: "URL" = hxxp://de.search.yahoo.com/search?ei=utf-8&fr=chr-greentree_ie&type=302398&ilc=12&p={searchTerms}
IE - HKCU\..\SearchScopes\{71725B48-50F1-4824-85FD-61C8C68634BF}: "URL" = hxxp://websearch.ask.com/custom/java/redirect?client=ie&tb=ORJ&o=100000026&src=crm&q={searchTerms}&locale=&apn_ptnrs=U3&apn_dtid=OSJ000
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2613550
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..browser.search.defaultengine: "Ask.com Search"
FF - prefs.js..browser.search.defaultenginename: "Ask.com Search"
FF - prefs.js..browser.search.order.1: "Ask.com Search"
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=302398&ilc=12"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "hxxp://willems-metallbau.de/"
FF - prefs.js..extensions.enabledAddons: %7B33e0daa6-3af3-d8b5-6752-10e949c61516%7D:1.1
FF - prefs.js..extensions.enabledAddons: toolbar%40web.de:2.6.1
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:21.0
FF - prefs.js..keyword.URL: "hxxp://dts.search-results.com/sr?src=ffb&appid=342&systemid=406&sr=0&q="
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_6_602_180.dll ()
FF - HKLM\Software\MozillaPlugins\@checkpoint.com/FFApi: C:\Programme\CheckPoint\ZAForceField\TrustChecker\bin\npFFApi.dll File not found
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Programme\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Programme\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Programme\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Programme\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\bkmrksync@nokia.com: C:\Programme\Nokia\Nokia PC Suite 7\bkmrksync\ [2009.07.12 18:57:12 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Programme\Mozilla Firefox\components [2013.05.24 07:38:42 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2013.05.24 07:38:20 | 000,000,000 | ---D | M]
[2012.05.21 11:03:43 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Test\Anwendungsdaten\Mozilla\Extensions
[2013.05.26 10:27:43 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Test\Anwendungsdaten\Mozilla\Firefox\Profiles\2z6wwl31.default\extensions
[2013.04.21 12:09:01 | 000,000,000 | ---D | M] (Complitly - Speed up your search with your personal search suggestions tool) -- C:\Dokumente und Einstellungen\Test\Anwendungsdaten\Mozilla\Firefox\Profiles\2z6wwl31.default\extensions\{33e0daa6-3af3-d8b5-6752-10e949c61516}
[2012.05.21 11:04:12 | 000,000,000 | ---D | M] (Searchqu Toolbar) -- C:\Dokumente und Einstellungen\Test\Anwendungsdaten\Mozilla\Firefox\Profiles\2z6wwl31.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}
[2013.02.11 10:42:13 | 000,000,000 | ---D | M] (CCC003 Community Toolbar) -- C:\Dokumente und Einstellungen\Test\Anwendungsdaten\Mozilla\Firefox\Profiles\2z6wwl31.default\extensions\{fc2b76fc-2132-4d80-a9a3-1f5c6e49066b}
[2013.05.26 10:27:43 | 000,620,338 | ---- | M] () (No name found) -- C:\Dokumente und Einstellungen\Test\Anwendungsdaten\Mozilla\Firefox\Profiles\2z6wwl31.default\extensions\toolbar@web.de.xpi
[2013.05.12 11:04:18 | 000,870,680 | ---- | M] () (No name found) -- C:\Dokumente und Einstellungen\Test\Anwendungsdaten\Mozilla\Firefox\Profiles\2z6wwl31.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2012.12.08 04:35:54 | 000,005,283 | ---- | M] () (No name found) -- C:\Dokumente und Einstellungen\Test\Anwendungsdaten\Mozilla\Firefox\Profiles\2z6wwl31.default\extensions\{33e0daa6-3af3-d8b5-6752-10e949c61516}\,MaheshmadhukardhondAcPro.xpi
[2012.02.01 12:04:28 | 000,000,933 | ---- | M] () -- C:\Dokumente und Einstellungen\Test\Anwendungsdaten\Mozilla\Firefox\Profiles\2z6wwl31.default\searchplugins\11-suche.xml
[2012.11.23 15:59:23 | 000,002,306 | ---- | M] () -- C:\Dokumente und Einstellungen\Test\Anwendungsdaten\Mozilla\Firefox\Profiles\2z6wwl31.default\searchplugins\askcomsearch.xml
[2011.12.21 11:27:10 | 000,002,419 | ---- | M] () -- C:\Dokumente und Einstellungen\Test\Anwendungsdaten\Mozilla\Firefox\Profiles\2z6wwl31.default\searchplugins\englische-ergebnisse.xml
[2011.12.21 11:27:10 | 000,010,525 | ---- | M] () -- C:\Dokumente und Einstellungen\Test\Anwendungsdaten\Mozilla\Firefox\Profiles\2z6wwl31.default\searchplugins\gmx-suche.xml
[2011.12.21 11:27:10 | 000,002,457 | ---- | M] () -- C:\Dokumente und Einstellungen\Test\Anwendungsdaten\Mozilla\Firefox\Profiles\2z6wwl31.default\searchplugins\lastminute.xml
[2012.05.21 11:02:29 | 000,002,519 | ---- | M] () -- C:\Dokumente und Einstellungen\Test\Anwendungsdaten\Mozilla\Firefox\Profiles\2z6wwl31.default\searchplugins\Search_Results.xml
[2011.12.21 11:27:10 | 000,005,508 | ---- | M] () -- C:\Dokumente und Einstellungen\Test\Anwendungsdaten\Mozilla\Firefox\Profiles\2z6wwl31.default\searchplugins\webde-suche.xml
[2013.05.24 07:38:42 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2013.05.30 09:26:24 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\browser\extensions
[2013.05.30 09:26:24 | 000,000,000 | ---D | M] (Default) -- C:\Programme\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2010.02.07 11:23:08 | 000,075,208 | ---- | M] (Foxit Software Company) -- C:\Programme\mozilla firefox\plugins\npFoxitReaderPlugin.dll
[2012.05.21 11:02:29 | 000,002,519 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\Search_Results.xml
O1 HOSTS File: ([2001.08.18 12:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Complitly) - {0FB6A909-6086-458F-BD92-1F8EE10042A0} - C:\Dokumente und Einstellungen\Test\Anwendungsdaten\Complitly\Complitly.dll (SimplyGen)
O2 - BHO: (HistoryTriggerBHO Class) - {21A88CB9-84D2-4020-A2D1-B25A21034884} - C:\Programme\LG Electronics\LG PC Suite IV\LinkAir\LinkAirBrowserHelper.dll (LG Electronics)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - Reg Error: Value error. File not found
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - I:\SPYBOT~1\SDHelper.dll File not found
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Programme\Searchqu Toolbar\Datamngr\ToolBar\searchqudtx.dll ()
O2 - BHO: (DataMngr) - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\Programme\Searchqu Toolbar\Datamngr\BrowserConnection.dll (Bandoo Media, inc)
O2 - BHO: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Programme\Searchqu Toolbar\Datamngr\ToolBar\searchqudtx.dll ()
O3 - HKLM\..\Toolbar: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {00000000-0000-0000-0000-000000000000} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - No CLSID value found.
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [ApnUpdater] C:\Programme\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [ATICCC] C:\Programme\ATI Technologies\ATI.ACE\cli.exe (ATI Technologies Inc.)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation)
O4 - HKLM..\Run: [DATAMNGR] C:\Programme\Searchqu Toolbar\Datamngr\datamngrUI.exe (Bandoo Media, inc)
O4 - HKLM..\Run: [DWQueuedReporting] C:\Programme\Gemeinsame Dateien\Microsoft Shared\DW\DWTRIG20.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [RetroExpress] C:\Programme\Retrospect\Retrospect Express HD 2.0\RetroExpress.exe (EMC Corporation)
O4 - HKLM..\Run: [StarMoneyRunEntry] C:\Programme\StarMoney Business 3.0 S-Edition\oflagent.exe (Star Finanz - Software Entwicklung und Vertriebs GmbH)
O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre7\bin\jusched.exe" File not found
O4 - HKCU..\Run: [EPSON Stylus DX5000 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBVE.EXE (SEIKO EPSON CORPORATION)
O4 - HKCU..\Run: [exujcjje] C:\DOKUME~1\Test\LOKALE~1\Temp\Fnof\wmfwccjje.exe File not found
O4 - HKCU..\Run: [memdu] -autorun File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: MaxGPOScriptWait = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideShutdownScripts = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://F:\OFFICE11\EXCEL.EXE/3000 File not found
O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - Reg Error: Key error. File not found
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - I:\SPYBOT~1\SDHelper.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O16 - DPF: {05CA9FB0-3E3E-4b36-BF41-0E3A5CAA8CD8} hxxp://go.microsoft.com/fwlink/?linkid=58813 (Office Genuine Advantage Validation Tool)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab (Reg Error: Key error.)
O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} hxxp://catalog.update.microsoft.com/v7/site/ClientControl/en/x86/MuCatalogWebControl.cab?1191420098671 (MUCatalogWebControl Class)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1123705518796 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1348680049722 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_09-windows-i586.cab (Java Plug-in 1.7.0_09)
O16 - DPF: {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} hxxp://office.microsoft.com/officeupdate/content/opuc4.cab (Office Update Installation Engine)
O16 - DPF: {CAFEEFAC-0017-0000-0009-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_09-windows-i586.cab (Java Plug-in 1.7.0_09)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_09-windows-i586.cab (Java Plug-in 1.7.0_09)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{549F0ACB-A744-4711-9526-9CF0F2BE8336}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A1053C54-2977-4DC8-A372-74975274EACF}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\SEARCH~1\Datamngr\datamngr.dll) - C:\Programme\Searchqu Toolbar\Datamngr\datamngr.dll (Bandoo Media, inc)
O20 - AppInit_DLLs: (C:\PROGRA~1\SEARCH~1\Datamngr\IEBHO.dll) - C:\Programme\Searchqu Toolbar\Datamngr\IEBHO.dll (Bandoo Media, inc)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.EXE (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Programme\Soluto\soluto.exe /userinit) - File not found
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\igfxcui: DllName - (igfxsrvc.dll) - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008.06.10 09:16:28 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2007.06.14 11:24:57 | 000,000,037 | R--- | M] () - D:\Autorun.inf -- [ CDFS ]
O32 - AutoRun File - [2012.04.26 21:31:56 | 000,000,000 | ---D | M] - G:\Autodesk -- [ FAT32 ]
O33 - MountPoints2\{4409c3f5-c390-11e0-b878-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{4409c3f5-c390-11e0-b878-806d6172696f}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{4409c3f5-c390-11e0-b878-806d6172696f}\Shell\AutoRun\command - "" = D:\TenadoInstaller.exe -- [2008.10.09 14:16:19 | 000,544,768 | R--- | M] (Technobox GmbH)
O33 - MountPoints2\{7d221dd0-ab9d-11e0-89f9-00158315a310}\Shell - "" = AutoRun
O33 - MountPoints2\{7d221dd0-ab9d-11e0-89f9-00158315a310}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{7d221dd0-ab9d-11e0-89f9-00158315a310}\Shell\AutoRun\command - "" = H:\LGAutoRun.exe
O33 - MountPoints2\{c4878906-79ec-11df-8957-0000e27a5d26}\Shell - "" = AutoRun
O33 - MountPoints2\{c4878906-79ec-11df-8957-0000e27a5d26}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{c4878906-79ec-11df-8957-0000e27a5d26}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
========== Files/Folders - Created Within 30 Days ==========
[2013.06.01 11:09:58 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Test\Desktop\OTL.exe
[2013.05.30 09:26:27 | 000,000,000 | ---D | C] -- C:\Programme\Mozilla Maintenance Service
[2013.05.24 07:38:08 | 000,000,000 | ---D | C] -- C:\Programme\Mozilla Firefox
[12 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2013.06.01 11:18:00 | 000,000,228 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2013.06.01 11:09:59 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Test\Desktop\OTL.exe
[2013.06.01 11:08:37 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\Test\defogger_reenable
[2013.06.01 11:05:35 | 000,050,477 | ---- | M] () -- C:\Dokumente und Einstellungen\Test\Desktop\Defogger.exe
[2013.06.01 10:49:00 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013.05.31 17:00:30 | 000,000,448 | ---- | M] () -- C:\WINDOWS\tasks\Software Updater Ui.job
[2013.05.31 16:00:00 | 000,000,588 | ---- | M] () -- C:\WINDOWS\tasks\Software Updater.job
[2013.05.30 09:26:29 | 000,000,696 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Mozilla Firefox.lnk
[2013.05.29 12:18:24 | 000,001,396 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2013.05.29 12:15:39 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2013.05.29 12:15:29 | 1073,270,784 | -HS- | M] () -- C:\hiberfil.sys
[2013.05.29 12:12:34 | 000,000,012 | ---- | M] () -- C:\WINDOWS\bthservsdp.dat
[2013.05.28 16:52:19 | 000,001,756 | -H-- | M] () -- C:\Dokumente und Einstellungen\Test\Eigene Dateien\Default.rdp
[2013.05.15 19:00:15 | 000,336,256 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2013.05.15 18:36:20 | 000,497,990 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2013.05.15 18:36:20 | 000,477,482 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2013.05.15 18:36:20 | 000,092,950 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2013.05.15 18:36:20 | 000,077,922 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[12 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
========== Files Created - No Company Name ==========
[2013.06.01 11:08:37 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Test\defogger_reenable
[2013.06.01 11:05:34 | 000,050,477 | ---- | C] () -- C:\Dokumente und Einstellungen\Test\Desktop\Defogger.exe
[2013.05.30 09:26:29 | 000,000,702 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Mozilla Firefox.lnk
[2013.05.30 09:26:29 | 000,000,696 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Mozilla Firefox.lnk
[2013.05.29 12:13:06 | 000,900,032 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
[2013.04.21 12:08:45 | 000,016,384 | ---- | C] () -- C:\WINDOWS\Launcher.exe
[2012.09.16 11:09:50 | 000,167,936 | ---- | C] () -- C:\WINDOWS\System32\SerialXP.dll
[2012.09.16 11:09:49 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\win32com.dll
[2012.04.27 15:51:17 | 002,469,760 | ---- | C] () -- C:\WINDOWS\System32\BootMan.exe
[2012.04.27 15:51:17 | 000,086,408 | ---- | C] () -- C:\WINDOWS\System32\setupempdrv03.exe
[2012.04.27 15:51:17 | 000,019,840 | ---- | C] () -- C:\WINDOWS\System32\EuEpmGdi.dll
[2012.04.27 15:51:17 | 000,013,192 | ---- | C] () -- C:\WINDOWS\System32\epmntdrv.sys
[2012.04.27 15:51:17 | 000,008,456 | ---- | C] () -- C:\WINDOWS\System32\EuGdiDrv.sys
[2012.03.03 15:50:15 | 000,922,184 | ---- | C] () -- C:\WINDOWS\System32\pwNative.exe
[2012.03.03 15:50:13 | 000,016,472 | ---- | C] () -- C:\WINDOWS\System32\pwdrvio.sys
[2012.03.03 15:50:13 | 000,011,104 | ---- | C] () -- C:\WINDOWS\System32\pwdspio.sys
[2012.02.16 06:46:18 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2011.11.18 18:47:46 | 000,308,286 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-System.dat
[2011.11.03 19:06:05 | 000,000,841 | ---- | C] () -- C:\Dokumente und Einstellungen\Test\.recently-used.xbel
[2011.10.15 14:21:06 | 000,008,192 | ---- | C] () -- C:\Dokumente und Einstellungen\Test\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.08.15 16:01:08 | 000,000,762 | ---- | C] () -- C:\WINDOWS\CVMiniViewer.ini
[2011.08.14 21:38:36 | 000,178,176 | ---- | C] () -- C:\WINDOWS\System32\StellarProfile.dll
[2011.08.14 21:38:36 | 000,000,070 | ---- | C] () -- C:\WINDOWS\spwdrhag.INI
[2011.07.01 01:18:21 | 000,000,085 | -HS- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\.zreglib
[2011.06.13 22:47:15 | 000,000,012 | ---- | C] () -- C:\WINDOWS\bthservsdp.dat
[2011.02.03 15:03:48 | 000,000,185 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft.SqlServer.Compact.351.32.bc
[2008.11.04 10:38:53 | 000,008,608 | RHS- | C] () -- C:\Dokumente und Einstellungen\All Users\ntuser.pol
========== ZeroAccess Check ==========
[2008.06.10 12:39:40 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll -- [2009.01.07 18:20:26 | 001,497,088 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009.02.09 12:51:44 | 000,473,600 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008.04.14 07:52:34 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
========== LOP Check ==========
[2012.01.20 15:26:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AllDup
[2008.11.15 18:19:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Ashampoo
[2012.11.23 15:59:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Ask
[2011.06.23 15:58:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avery
[2011.11.16 11:46:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CheckPoint
[2012.08.17 15:14:57 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Common Files
[2008.11.11 19:24:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\EPSON
[2012.04.26 21:55:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\explauncher
[2011.07.20 20:11:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Freemake
[2010.01.23 15:43:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\IEConfiguration1und1
[2009.05.10 09:44:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Installations
[2012.04.26 21:55:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\launcher
[2011.07.19 17:19:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MAGIX
[2008.11.16 20:07:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MailFrontier
[2008.12.23 19:49:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NFS Underground
[2013.04.23 12:18:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Package Cache
[2009.05.10 10:03:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Suite
[2012.04.26 21:55:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\redistpart
[2012.09.16 11:09:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\REINER SCT
[2013.06.01 11:19:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RetroExp
[2011.02.03 14:59:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Soluto
[2012.08.22 15:57:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\StarMoney 8.0
[2013.03.28 16:00:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\StarMoney 9.0
[2012.06.06 13:59:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
[2012.08.17 15:16:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software
[2012.08.17 15:14:57 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{32364CEA-7855-4A3C-B674-53D8E9B97936}
[2011.10.30 14:31:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Test\Anwendungsdaten\ACD Systems
[2012.01.20 15:26:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Test\Anwendungsdaten\AllDup
[2012.05.08 10:22:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Test\Anwendungsdaten\CheckPoint
[2013.04.21 12:09:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Test\Anwendungsdaten\Complitly
[2012.04.27 21:02:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Test\Anwendungsdaten\DynaGeo
[2011.08.31 19:29:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Test\Anwendungsdaten\Foxit Software
[2011.10.30 14:43:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Test\Anwendungsdaten\gtk-2.0
[2011.08.14 14:51:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Test\Anwendungsdaten\Leadertech
[2011.08.14 10:15:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Test\Anwendungsdaten\PC Suite
[2012.08.23 11:01:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Test\Anwendungsdaten\searchquband
[2012.09.26 19:15:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Test\Anwendungsdaten\searchqutoolbar
[2011.10.05 13:05:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Test\Anwendungsdaten\TeamViewer
[2012.06.06 15:14:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Test\Anwendungsdaten\Technobox
[2012.08.17 15:16:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Test\Anwendungsdaten\TuneUp Software
========== Purity Check ==========
========== Alternate Data Streams ==========
@Alternate Data Stream - 139 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:C3AE45C9
@Alternate Data Stream - 108 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:CB0AACC9
< End of report >
| Extra.txt Zitat:
OTL Extras logfile created on: 1.6.2013 11:10:57 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Dokumente und Einstellungen\Test\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: d.M.yyyy
1023,48 Mb Total Physical Memory | 491,65 Mb Available Physical Memory | 48,04% Memory free
2,40 Gb Paging File | 1,87 Gb Available in Paging File | 77,60% Paging File free
Paging file location(s): c:\pagefile.sys 1536 3072 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 64,21 Gb Total Space | 42,66 Gb Free Space | 66,44% Space Free | Partition Type: NTFS
Drive D: | 132,84 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive E: | 10,32 Gb Total Space | 7,34 Gb Free Space | 71,11% Space Free | Partition Type: NTFS
Drive G: | 298,02 Gb Total Space | 78,91 Gb Free Space | 26,48% Space Free | Partition Type: FAT32
Drive H: | 61,49 Mb Total Space | 51,25 Mb Free Space | 83,33% Space Free | Partition Type: FAT32
Computer Name: ARBEITSZIMMER | User Name: Test | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [openNew] -- explorer %1 (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
"FirstRunDisabled" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"C:\Programme\Retrospect\Retrospect Express HD 2.0\Retrospect.exe" = C:\Programme\Retrospect\Retrospect Express HD 2.0\Retrospect.exe:*:Enabled:Retrospect Express HD -- (EMC Corporation)
"C:\Programme\Retrospect\Retrospect Express HD 2.0\RETRORUN.EXE" = C:\Programme\Retrospect\Retrospect Express HD 2.0\RETRORUN.EXE:*:Enabled:Retrospect Express HD Launcher service -- (EMC Corporation)
"C:\Programme\Iomega\Discovery Tool Home\Discovery Tool Home\Discovery Home.exe" = C:\Programme\Iomega\Discovery Tool Home\Discovery Tool Home\Discovery Home.exe:*:Enabled iscovery Home -- ()
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
"C:\Programme\Searchqu Toolbar\Datamngr\ToolBar\dtUser.exe" = C:\Programme\Searchqu Toolbar\Datamngr\ToolBar\dtUser.exe:*:EnabledTX broker -- (Visicom Media Inc.)
"D:\DVD-Start.exe" = D:\DVD-Start.exe:*:Enabled:Schnellstart-DVD
"C:\Programme\StarMoney 8.0\ouservice\StarMoneyOnlineUpdate.exe" = C:\Programme\StarMoney 8.0\ouservice\StarMoneyOnlineUpdate.exe:*:Enabled:StarMoney 8.0 OnlineUpdate -- (Star Finanz - Software Entwicklung und Vertriebs GmbH)
"C:\Programme\StarMoney 8.0\app\StarMoney.exe" = C:\Programme\StarMoney 8.0\app\StarMoney.exe:*:Enabled:StarMoney 8.0 -- (Star Finanz - Software Entwicklung und Vertriebs GmbH)
"C:\Programme\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe" = C:\Programme\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe:*:Enabled:StarMoney 9.0 OnlineUpdate -- (Star Finanz-Software Entwicklung und Vertriebs GmbH)
"C:\Programme\StarMoney 9.0\app\StarMoney.exe" = C:\Programme\StarMoney 9.0\app\StarMoney.exe:*:Enabled:StarMoney 9.0 -- (Star Finanz-Software Entwicklung und Vertriebs GmbH)
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{01892453-6095-4825-BB73-78BE918B42CB}" = Soluto
"{02E89EFC-7B07-4D5A-AA03-9EC0902914EE}" = VC 9.0 Runtime
"{088348F9-1E7B-4269-A6A2-621FEC00DBB7}" = Iomega Discovery Tool Home
"{0C973594-7DDF-4BD0-84ED-3517F7622037}" = PC Connectivity Solution
"{0DD140D3-9563-481E-AA75-BA457CBDAEF2}" = PC Inspector File Recovery
"{0F3A02CF-09B1-4B49-BE02-A70790F18B56}" = StarMoney
"{1EA29840-1D27-11D5-93E8-00E0181A27BD}" = Magic Keyboard
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86
"{26A24AE4-039D-4CA4-87B4-2F83217009FF}" = Java 7 Update 9
"{27306E26-01EC-461A-9719-7E2660C2CB68}" = Tenado Metall 2009
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D39E775-DDDA-4327-B747-0BDC5F191331}" = Nokia PC Suite
"{47879FA7-BC8F-4D7F-8057-86D0416579FA}" = StarMoney
"{49CC1A6A-3A1A-4EE7-913F-8106B51B59D1}" = Paragon Partition Manager 8.5
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4FFBB818-B13C-11E0-931D-B2664824019B}_is1" = Complitly
"{570C2A84-A145-4DF0-AE9D-012584DF09DC}" = SPCA1528 PC Driver
"{5A6DB7C1-E646-4842-A562-49C5EB8F2B47}" = StarMoney
"{5D652EC3-8AC0-41E7-B337-162BC7B01148}" = Retrospect Express HD 2.0
"{5D75999D-C878-497A-AD60-855563233BF9}" = StarMoney Business 3.0 S-Edition
"{65022ED9-65A8-4EE8-B6EC-9E92D34F70EA}" = Tenado Metall TREPCAD-Schnittstelle 2009
"{66D6C49D-B4F4-423A-85EA-3AF843115A91}" = StarMoney
"{6E4ABE94-D4DF-497A-B61B-2C5E8957DD67}" = SCR24X PCMCIA Smart Card Reader
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{74EAA5ED-7DDF-4647-8F90-C746BEB246F8}" = LG United Mobile Drivers
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel(R) 845G Chipset Graphics Driver Software
"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{90FF23FE-0E1B-40DF-A22E-B4C0372E5936}" = Iomega Product Registration
"{98420797-89A5-4387-833F-E306F38E4E35}" = Foxit PDF IFilter
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{AA898D01-D4E3-43C6-8E25-70CA660B9F16}" = CHIPDRIVE extern/intern/micro treiber 3.1
"{AC75CE92-9343-4A91-B38F-9AE6F00880B9}" = StarMoney 8.0
"{AC7EE5F1-0DE4-4256-8E43-92B73C8E6019}" = LG Bluetooth Drivers
"{B3933FE8-14C3-4E73-A742-A56C6AF10934}" = StarMoney 9.0
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C99B97CA-D67B-4896-9A2E-01A62C17C0ED}" = MAGIX Web Designer 6 Silver
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{EA9FAF16-0E5C-42C4-9742-9AF8D5F6D69B}" = ATI Catalyst Control Center
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F68CAF19-0D47-4871-9165-70B6CDD4267F}" = Tenado CAD-Symbols 2009
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F902AB2B-7816-4CBD-A385-F2549F62956B}" = StarMoney
"{FC338210-F594-11D3-BA24-00001C3AB4DF}" = cyberJack Base Components
"{FD5FE115-8AC3-4A22-9C4E-F4AAE9177393}" = Tenado Metall Geländermodul 2009
"504244733D18C8F63FF584AEB290E3904E791693" = Windows-Treiberpaket - Nokia pccsmcfd (08/22/2008 7.0.0.0)
"7-Zip" = 7-Zip 4.57
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"All ATI Software" = ATI - Software Uninstall Utility
"AllDup_is1" = AllDup 3.3.25
"Ashampoo WinOptimizer 4 FREE_is1" = Ashampoo WinOptimizer 4 FREE
"ATI Display Driver" = ATI Display Driver
"Avira AntiVir Desktop" = Avira Free Antivirus
"CloneDVD2" = CloneDVD2
"DeInst_d2vexcrdTop50 Viewer (Build 1.1.5.596)" = Top50 Viewer
"DynaGeo_is1" = DynaGeo 3.6e
"EASEUS Partition Master Home Edition_is1" = EASEUS Partition Master 9.1.1 Home Edition
"EPSON Printer and Utilities" = EPSON-Drucker-Software
"EPSON Scanner" = EPSON Scan
"F779F5541ABD99C95C03B0FD5E3C058B22DA0FF7" = Windows-Treiberpaket - Nokia Modem (06/01/2009 7.01.0.3)
"Foxit Creator" = Foxit Creator
"Foxit Reader" = Foxit Reader
"Freemake Video Downloader_is1" = Freemake Video Downloader
"Hauppauge WinTV 7" = Hauppauge WinTV 7
"Hauppauge WinTV Infrared Remote" = Hauppauge WinTV Infrared Remote
"ie8" = Windows Internet Explorer 8
"ImgBurn" = ImgBurn
"KeyFinder_is1" = Magical Jelly Bean KeyFinder
"LG PC Suite IV" = LG PC Suite IV
"MAGIX_MSI_Web_Designer_6_Silver" = MAGIX Web Designer 6 Silver
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mozilla Firefox 21.0 (x86 de)" = Mozilla Firefox 21.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NirSoft Mail PassView" = NirSoft Mail PassView
"Nokia PC Suite" = Nokia PC Suite
"ODBC" = ODBC
"Picasa 3" = Picasa 3
"PROSet" = Intel(R) PRO Ethernet Adapter and Software
"Recuva" = Recuva
"Searchqu Toolbar" = Searchqu Toolbar
"Sigel PhotoDruck-Assistent" = Sigel PhotoDruck-Assistent
"Stellar Phoenix Windows Data Recovery-Home_is1" = Stellar Phoenix Windows Data Recovery-Home
"Trojancheck_is1" = Trojancheck 6
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WinPcapInst" = WinPcap 4.1.2
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{79A765E1-C399-405B-85AF-466F52E918B0}" = Avira SearchFree Toolbar plus Web Protection Updater
"Cimaware OfficeFIX 6.xx" = Cimaware OfficeFIX 6.xx
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 27.5.2012 04:43:31 | Computer Name = ARBEITSZIMMER | Source = MsiInstaller | ID = 11324
Description = Produkt: Tenado Metall 2009 -- Fehler 1324. Der Ordnerpfad "Tenado
Metall 2009" enthält ein ungültiges Zeichen.
Error - 27.5.2012 04:44:56 | Computer Name = ARBEITSZIMMER | Source = MsiInstaller | ID = 11324
Description = Produkt: Tenado Metall 2009 -- Fehler 1324. Der Ordnerpfad "Tenado
Metall 2009" enthält ein ungültiges Zeichen.
Error - 27.5.2012 04:47:19 | Computer Name = ARBEITSZIMMER | Source = MsiInstaller | ID = 11324
Description = Produkt: Tenado Metall 2009 -- Fehler 1324. Der Ordnerpfad "Tenado
Metall 2009" enthält ein ungültiges Zeichen.
Error - 27.5.2012 04:53:47 | Computer Name = ARBEITSZIMMER | Source = MsiInstaller | ID = 11324
Description = Produkt: Tenado Metall 2009 -- Fehler 1324. Der Ordnerpfad "Tenado
Metall 2009" enthält ein ungültiges Zeichen.
Error - 29.5.2012 12:27:58 | Computer Name = ARBEITSZIMMER | Source = MsiInstaller | ID = 11324
Description = Produkt: Tenado CAD-Symbols 2009 -- Fehler 1324. Der Ordnerpfad "tenado
2009" enthält ein ungültiges Zeichen.
Error - 15.6.2012 12:55:44 | Computer Name = ARBEITSZIMMER | Source = .NET Runtime Optimization Service | ID = 1103
Description = .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32)
- Tried to start a service that wasn't the latest version of CLR Optimization service.
Will shutdown
Error - 9.1.2013 14:39:15 | Computer Name = ARBEITSZIMMER | Source = .NET Runtime Optimization Service | ID = 1103
Description = .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32)
- Tried to start a service that wasn't the latest version of CLR Optimization service.
Will shutdown
Error - 30.3.2013 11:05:00 | Computer Name = ARBEITSZIMMER | Source = Avira Antivirus | ID = 4115
Description = Eine Programmdatei von AntiVir (C:\Programme\Avira\AntiVir Desktop\avshadow.exe)
ist nicht vorhanden oder wurde verändert bzw. zerstört! Fehlercode: 0x0
Error - 30.3.2013 11:05:02 | Computer Name = ARBEITSZIMMER | Source = Avira Antivirus | ID = 4122
Description = Die Datei AvShadow konnte nicht geladen werden. Fehlercode: 0x2
Error - 15.5.2013 13:03:40 | Computer Name = ARBEITSZIMMER | Source = .NET Runtime Optimization Service | ID = 1103
Description = .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32)
- Tried to start a service that wasn't the latest version of CLR Optimization service.
Will shutdown
[ System Events ]
Error - 28.5.2013 05:52:44 | Computer Name = ARBEITSZIMMER | Source = Service Control Manager | ID = 7009
Description = Zeitüberschreitung (30000 ms) beim Verbindungsversuch mit Dienst System
Store.
Error - 28.5.2013 05:52:44 | Computer Name = ARBEITSZIMMER | Source = Service Control Manager | ID = 7000
Description = Der Dienst "System Store" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error - 28.5.2013 05:53:14 | Computer Name = ARBEITSZIMMER | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
Soluto
Error - 29.5.2013 06:17:51 | Computer Name = ARBEITSZIMMER | Source = Service Control Manager | ID = 7000
Description = Der Dienst "SPCA1528 Video Camera Service" wurde aufgrund folgenden
Fehlers nicht gestartet: %%2
Error - 29.5.2013 06:17:51 | Computer Name = ARBEITSZIMMER | Source = Service Control Manager | ID = 7009
Description = Zeitüberschreitung (30000 ms) beim Verbindungsversuch mit Dienst Soluto
PCGenome Core Service.
Error - 29.5.2013 06:17:51 | Computer Name = ARBEITSZIMMER | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Soluto PCGenome Core Service" wurde aufgrund folgenden
Fehlers nicht gestartet: %%1053
Error - 29.5.2013 06:17:51 | Computer Name = ARBEITSZIMMER | Source = Service Control Manager | ID = 7009
Description = Zeitüberschreitung (30000 ms) beim Verbindungsversuch mit Dienst System
Store.
Error - 29.5.2013 06:17:51 | Computer Name = ARBEITSZIMMER | Source = Service Control Manager | ID = 7000
Description = Der Dienst "System Store" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error - 29.5.2013 06:18:01 | Computer Name = ARBEITSZIMMER | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
Soluto
Error - 31.5.2013 15:06:36 | Computer Name = ARBEITSZIMMER | Source = DCOM | ID = 10010
Description = Der Server "{D61A27C6-8F53-11D0-BFA0-00A024151983}" konnte innerhalb
des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
< End of report >
| Bei der Ausführung von GMER kam es nach einiger Testzeit zu einem Bluescreen und einem Neustart des Systems. Leider habe ich keine weiteren Details zu dem Bluescreen, da er zu schnell wieder weg war.
Liebe Grüße MTW
|
01.06.2013, 11:20
So funktioniert es:
AdwCleaner auf deinen Desktop.
SecurityCheck und:
