Hallo zusammen,

bei antivir sind grad die alarmglocken losgegangen
Adware-browsefox hab ich mir eingefangen




Könnt ihr mir bitte mal beim beseitigen zur Seite stehen, danke

Ich war so frei, und habe schon farbar drüber gejagt

wie gehts weiter?

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 02-03-2015
Ran by Alexander (administrator) on ALEX on 03-03-2015 19:16:48
Running from C:\Dokumente und Einstellungen\Alexander\Desktop
Loaded Profiles: Alexander (Available profiles: Alexander)
Platform: Microsoft Windows XP Professional Service Pack 3 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 7 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\WINXP\system32\smss.exe
(Microsoft Corporation) C:\WINXP\system32\csrss.exe
(Microsoft Corporation) C:\WINXP\system32\winlogon.exe
(Microsoft Corporation) C:\WINXP\system32\services.exe
(Microsoft Corporation) C:\WINXP\system32\lsass.exe
(Microsoft Corporation) C:\WINXP\system32\svchost.exe
(Microsoft Corporation) C:\WINXP\system32\svchost.exe
(Microsoft Corporation) C:\WINXP\system32\svchost.exe
(Microsoft Corporation) C:\WINXP\system32\svchost.exe
(Microsoft Corporation) C:\WINXP\system32\svchost.exe
(Microsoft Corporation) C:\WINXP\system32\svchost.exe
(Microsoft Corporation) C:\WINXP\system32\spoolsv.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\sched.exe
(Microsoft Corporation) D:\Programme\Microsoft Office\Office12\GrooveMonitor.exe
(shbox.de) C:\Programme\FreePDF_XP\fpassist.exe
(CANON INC.) C:\Programme\Canon\MyPrinter\BJMYPRT.EXE
(Motorola Inc.) C:\WINXP\sm56hlpr.exe
(Oracle Corporation) C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\My Avira\Avira.OE.Systray.exe
(Google Inc.) C:\Programme\Google\Update\GoogleUpdate.exe
(Microsoft Corporation) C:\WINXP\system32\ctfmon.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Programme\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\WINXP\system32\svchost.exe
(Microsoft Corporation) C:\WINXP\system32\svchost.exe
(Palm) C:\Programme\Palm, Inc\novacomd\x86\novacomd.exe
(NVIDIA Corporation) C:\WINXP\system32\nvsvc32.exe
(Microsoft Corporation) C:\WINXP\system32\svchost.exe
(Microsoft Corporation) C:\WINXP\system32\svchost.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corporation) C:\WINXP\system32\wbem\wmiprvse.exe
(Microsoft Corporation) C:\WINXP\system32\wbem\unsecapp.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\avshadow.exe
(Apple Inc.) C:\Programme\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\WINXP\system32\wscntfy.exe
(Microsoft Corporation) C:\WINXP\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
(Microsoft Corporation) C:\WINXP\system32\alg.exe
(Microsoft Corporation) C:\WINXP\system32\svchost.exe
(Oracle Corporation) C:\Programme\Gemeinsame Dateien\Java\Java Update\jucheck.exe
(Microsoft Corporation) C:\WINXP\explorer.exe
(Microsoft Corporation) C:\WINXP\system32\dllhost.exe
(Microsoft Corporation) C:\WINXP\system32\msdtc.exe
(Mozilla Corporation) D:\Firefox\firefox.exe
(Microsoft Corporation) C:\WINXP\system32\wbem\wmiprvse.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [GrooveMonitor] => D:\Programme\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-27] (Microsoft Corporation)
HKLM\...\Run: [NvCplDaemon] => RUNDLL32.EXE C:\WINXP\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [nwiz] => nwiz.exe /install
HKLM\...\Run: [BluetoothAuthenticationAgent] => rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
HKLM\...\Run: [FreePDF Assistant] => C:\Programme\FreePDF_XP\fpassist.exe [385024 2009-09-05] (shbox.de)
HKLM\...\Run: [DivXUpdate] => "C:\Programme\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
HKLM\...\Run: [CanonMyPrinter] => C:\Programme\Canon\MyPrinter\BJMyPrt.exe [2516296 2010-03-25] (CANON INC.)
HKLM\...\Run: [CanonSolutionMenuEx] => C:\Programme\Canon\Solution Menu EX\CNSEMAIN.EXE [1185112 2010-04-02] (CANON INC.)
HKLM\...\Run: [QuickTime Task] => C:\Programme\QuickTime\QTTask.exe [421888 2012-04-18] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Programme\iTunes\iTunesHelper.exe [152392 2013-02-20] (Apple Inc.)
HKLM\...\Run: [SMSERIAL] => C:\WINXP\sm56hlpr.exe [557056 2005-09-16] (Motorola Inc.)
HKLM\...\Run: [Adobe ARM] => C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe [959904 2014-05-08] (Adobe Systems Incorporated)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation)
HKLM\...\Run: [avgnt] => C:\Programme\Avira\AntiVir Desktop\avgnt.exe [703280 2015-03-03] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [Avira Systray] => C:\Programme\Avira\My Avira\Avira.OE.Systray.exe [126712 2014-12-31] (Avira Operations GmbH & Co. KG)
HKLM\...\Winlogon: [Userinit] C:\WINXP\System32\Userinit.exe,
HKLM\...\Winlogon: [Shell] explorer.exe [x ] ()
HKLM\...\Winlogon: [UIHost] C:\WINXP\system32\logonui.exe [515072 2008-04-14] (Microsoft Corporation)
Winlogon\Notify\crypt32chain: C:\WINXP\system32\crypt32.dll (Microsoft Corporation)
Winlogon\Notify\cryptnet: C:\WINXP\system32\cryptnet.dll (Microsoft Corporation)
Winlogon\Notify\cscdll: C:\WINXP\system32\cscdll.dll (Microsoft Corporation)
Winlogon\Notify\dimsntfy: C:\WINXP\System32\dimsntfy.dll (Microsoft Corporation)
Winlogon\Notify\ScCertProp: C:\WINXP\system32\wlnotify.dll (Microsoft Corporation)
Winlogon\Notify\Schedule: C:\WINXP\system32\wlnotify.dll (Microsoft Corporation)
Winlogon\Notify\sclgntfy: C:\WINXP\system32\sclgntfy.dll (Microsoft Corporation)
Winlogon\Notify\SensLogn: C:\WINXP\system32\WlNotify.dll (Microsoft Corporation)
Winlogon\Notify\termsrv: C:\WINXP\system32\wlnotify.dll (Microsoft Corporation)
Winlogon\Notify\WgaLogon: C:\WINXP\system32\WgaLogon.dll (Microsoft Corporation)
Winlogon\Notify\wlballoon: C:\WINXP\system32\wlnotify.dll (Microsoft Corporation)
HKU\S-1-5-19\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINXP\System32\logon.scr [220672 2008-04-14] (Microsoft Corporation)
HKU\S-1-5-20\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINXP\System32\logon.scr [220672 2008-04-14] (Microsoft Corporation)
HKU\S-1-5-21-1935655697-1229272821-1417001333-1003\...\Run: [DAEMON Tools Lite] => D:\DAEMON Tools Lite\DTLite.exe [3672384 2012-04-11] (DT Soft Ltd)
HKU\S-1-5-21-1935655697-1229272821-1417001333-1003\...\Run: [ctfmon.exe] => C:\WINXP\system32\ctfmon.exe [15360 2008-04-14] (Microsoft Corporation)
HKU\S-1-5-21-1935655697-1229272821-1417001333-1003\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINXP\system32\logon.scr [220672 2008-04-14] (Microsoft Corporation)
HKU\S-1-5-18\...\Run: [CTFMON.EXE] => C:\WINXP\system32\CTFMON.EXE [15360 2008-04-14] (Microsoft Corporation)
HKU\S-1-5-18\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINXP\system32\logon.scr [220672 2008-04-14] (Microsoft Corporation)
SSODL: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\WINXP\system32\CbFsMntNtf3.dll (EldoS Corporation)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Dokumente und Einstellungen\Alexander\Anwendungsdaten\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Dokumente und Einstellungen\Alexander\Anwendungsdaten\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Dokumente und Einstellungen\Alexander\Anwendungsdaten\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Dokumente und Einstellungen\Alexander\Anwendungsdaten\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [EldosIconOverlay] -> {5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC} => C:\WINXP\system32\CbFsMntNtf3.dll (EldoS Corporation)
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 1 (GFS Unread Stub)] -> {99FD978C-D287-4F50-827F-B2C658EDA8E7} => D:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 2 (GFS Stub)] -> {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} => D:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)] -> {920E6DB1-9907-4370-B3A0-BAFC03D81399} => D:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 3 (GFS Folder)] -> {16F3DD56-1AF5-4347-846D-7C10C4192619} => D:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 4 (GFS Unread Mark)] -> {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} => D:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-1935655697-1229272821-1417001333-1003\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1935655697-1229272821-1417001333-1003\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINXP\system32\blank.htm
HKU\S-1-5-21-1935655697-1229272821-1417001333-1003\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs,Tabs: "www.google.com" <======= ATTENTION
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-1935655697-1229272821-1417001333-1003 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
SearchScopes: HKU\S-1-5-21-1935655697-1229272821-1417001333-1003 -> {853106B3-C3EB-414B-B7BE-77F3506B532A} URL = hxxp://www.google.de/search?q={searchTerms}
BHO: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Programme\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> D:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Programme\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Programme\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Programme\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Toolbar: HKU\S-1-5-21-1935655697-1229272821-1417001333-1003 -> Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Programme\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Handler: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINXP\system32\urlmon.dll (Microsoft Corporation)
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Handler: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
Handler: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: vw-wi - {0F3C833F-FB28-40EA-8CB9-6A55B996C3F6} - g:\elsawin\installation\bin\wiProt.dll No File
Handler: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINXP\system32\wiascr.dll (Microsoft Corporation)
Filter: text/webviewhtml - {733AC4CB-F1A4-11d0-B951-00A0C90312E1} - C:\WINXP\system32\SHELL32.dll (Microsoft Corporation)
ShellExecuteHooks:  - {AEB6717E-7E19-11d0-97EE-00C04FD91972} -  No File [ ]
Winsock: Catalog5 01 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog5 02 C:\WINXP\system32\winrnr.dll [16896] (Microsoft Corporation)
Winsock: Catalog5 03 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog5 04 C:\Programme\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Winsock: Catalog5 05 C:\WINXP\system32\wshbth.dll [108032] (Microsoft Corporation)
Winsock: Catalog9 01 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 02 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 03 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 04 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 05 C:\WINXP\system32\rsvpsp.dll [92672] (Microsoft Corporation)
Winsock: Catalog9 06 C:\WINXP\system32\rsvpsp.dll [92672] (Microsoft Corporation)
Winsock: Catalog9 07 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 08 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 09 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 10 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 11 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 12 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 13 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 14 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 15 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 16 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 17 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 18 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 19 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 20 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 21 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 22 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 23 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 24 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 25 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 26 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 27 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 28 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 29 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 30 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 31 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 32 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 33 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 34 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Dokumente und Einstellungen\Alexander\Anwendungsdaten\Mozilla\Firefox\Profiles\0qgqdyu2.default
FF NewTab: hxxp://www.google.de/
FF DefaultSearchUrl: hxxp://www.google.com/search?btnG=Google+Search&q=
FF SearchEngineOrder.1: Google
FF Homepage: https://www.google.de/
FF Keyword.URL: hxxp://www.google.com/search?btnG=Google+Search&q=
FF Plugin: @adobe.com/FlashPlayer -> C:\WINXP\system32\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Programme\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 -> C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll No File
FF Plugin: @java.com/DTPlugin,version=11.25.2 -> C:\Programme\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.25.2 -> C:\Programme\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Programme\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\WINXP\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @pages.tvunetworks.com/WebPlayer -> C:\WINXP\system32\TVUAx\npTVUAx.dll (TVU networks)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Programme\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Programme\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @veetle.com/veetleCorePlugin,version=0.9.18 -> C:\Programme\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF Plugin: @veetle.com/veetlePlayerPlugin,version=0.9.18 -> C:\Programme\Veetle\Player\npvlc.dll (Veetle Inc)
FF Plugin: Adobe Reader -> C:\Programme\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1935655697-1229272821-1417001333-1003: @unity3d.com/UnityPlayer,version=1.0 -> C:\Dokumente und Einstellungen\Alexander\Lokale Einstellungen\Anwendungsdaten\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Extension: Avira Browser Safety - C:\Dokumente und Einstellungen\Alexander\Anwendungsdaten\Mozilla\Firefox\Profiles\0qgqdyu2.default\Extensions\abs@avira.com [2015-03-02]
FF Extension: TVU Web Player - C:\Dokumente und Einstellungen\Alexander\Anwendungsdaten\Mozilla\Firefox\Profiles\0qgqdyu2.default\Extensions\firefox@tvunetworks.com [2010-12-07]
FF Extension: Tab Utilities - C:\Dokumente und Einstellungen\Alexander\Anwendungsdaten\Mozilla\Firefox\Profiles\0qgqdyu2.default\Extensions\tabutils@ithinc.cn.xpi [2013-01-08]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\WINXP\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\WINXP\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2010-10-15]
StartMenuInternet: FIREFOX.EXE - D:\Firefox\firefox.exe

Chrome: 
=======
CHR Profile: C:\Dokumente und Einstellungen\Alexander\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Dokumente und Einstellungen\Alexander\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-06-25]
CHR Extension: (Google Drive) - C:\Dokumente und Einstellungen\Alexander\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-06-25]
CHR Extension: (YouTube) - C:\Dokumente und Einstellungen\Alexander\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-04-17]
CHR Extension: (Google Search) - C:\Dokumente und Einstellungen\Alexander\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-04-17]
CHR Extension: (Google Wallet) - C:\Dokumente und Einstellungen\Alexander\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-10-05]
CHR Extension: (Gmail) - C:\Dokumente und Einstellungen\Alexander\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-04-17]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

Locked "ec3cd53c469d9e2a" service could not be unlocked. <===== ATTENTION

S4 Alerter; C:\WINXP\system32\alrsvc.dll [17408 2008-04-14] (Microsoft Corporation)
R3 ALG; C:\WINXP\System32\alg.exe [44544 2008-04-14] (Microsoft Corporation)
R2 AntiVirSchedulerService; C:\Programme\Avira\AntiVir Desktop\sched.exe [432888 2015-03-03] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Programme\Avira\AntiVir Desktop\avguard.exe [432888 2015-03-03] (Avira Operations GmbH & Co. KG)
S3 AppMgmt; C:\WINXP\System32\appmgmts.dll [175616 2008-04-14] (Microsoft Corporation)
S3 aspnet_state; C:\WINXP\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [35160 2010-03-18] (Microsoft Corporation)
R2 AudioSrv; C:\WINXP\System32\audiosrv.dll [42496 2008-04-14] (Microsoft Corporation)
R2 Avira.OE.ServiceHost; C:\Programme\Avira\My Avira\Avira.OE.ServiceHost.exe [178424 2014-12-31] (Avira Operations GmbH & Co. KG)
U2 BITS; C:\WINXP\system32\qmgr.dll [409088 2008-04-14] (Microsoft Corporation)
R2 Bonjour Service; C:\Programme\Bonjour\mDNSResponder.exe [390504 2011-08-30] (Apple Inc.)
R2 Browser; C:\WINXP\System32\browser.dll [77824 2008-04-14] (Microsoft Corporation)
R2 BthServ; C:\WINXP\System32\bthserv.dll [30208 2008-04-14] (Microsoft Corporation)
S3 CiSvc; C:\WINXP\system32\cisvc.exe [5632 2008-04-14] (Microsoft Corporation)
S4 ClipSrv; C:\WINXP\system32\clipsrv.exe [33280 2008-04-14] (Microsoft Corporation)
S4 clr_optimization_v2.0.50727_32; C:\WINXP\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [69632 2008-07-25] (Microsoft Corporation)
S2 clr_optimization_v4.0.30319_32; C:\WINXP\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [130384 2010-03-18] (Microsoft Corporation)
R2 CryptSvc; C:\WINXP\System32\cryptsvc.dll [62464 2008-04-14] (Microsoft Corporation)
R2 DcomLaunch; C:\WINXP\system32\rpcss.dll [399360 2008-04-14] (Microsoft Corporation)
R2 Dhcp; C:\WINXP\System32\dhcpcsvc.dll [127488 2008-04-14] (Microsoft Corporation)
S3 dmadmin; C:\WINXP\System32\dmadmin.exe [225280 2008-04-14] (Microsoft Corp., Veritas Software)
R2 dmserver; C:\WINXP\System32\dmserver.dll [24064 2008-04-14] (Microsoft Corp.)
R2 Dnscache; C:\WINXP\System32\dnsrslvr.dll [45568 2008-04-14] (Microsoft Corporation)
S3 Dot3svc; C:\WINXP\System32\dot3svc.dll [133120 2008-04-14] (Microsoft Corporation)
S3 EapHost; C:\WINXP\System32\eapsvc.dll [33792 2008-04-14] (Microsoft Corporation)
R2 ERSvc; C:\WINXP\System32\ersvc.dll [23040 2008-04-14] (Microsoft Corporation)
R2 Eventlog; C:\WINXP\system32\services.exe [109056 2008-04-14] (Microsoft Corporation)
R3 EventSystem; C:\WINXP\system32\es.dll [253952 2008-12-10] (Microsoft Corporation)
R3 FastUserSwitchingCompatibility; C:\WINXP\System32\shsvcs.dll [135168 2008-04-14] (Microsoft Corporation)
S3 FontCache3.0.0.0; C:\WINXP\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [46104 2008-07-29] (Microsoft Corporation)
S2 gupdate; C:\Programme\Google\Update\GoogleUpdate.exe [116648 2013-04-17] (Google Inc.)
S3 gupdatem; C:\Programme\Google\Update\GoogleUpdate.exe [116648 2013-04-17] (Google Inc.)
R2 helpsvc; C:\WINXP\PCHealth\HelpCtr\Binaries\pchsvc.dll [38400 2008-04-14] (Microsoft Corporation)
R2 HidServ; C:\WINXP\System32\hidserv.dll [21504 2008-04-14] (Microsoft Corporation)
S3 hkmsvc; C:\WINXP\System32\kmsvc.dll [61440 2008-04-14] (Microsoft Corporation)
R3 HTTPFilter; C:\WINXP\System32\w3ssl.dll [15872 2008-04-14] (Microsoft Corporation)
S3 idsvc; C:\WINXP\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [881664 2008-07-29] (Microsoft Corporation)
S3 ImapiService; C:\WINXP\system32\imapi.exe [150528 2008-04-14] (Microsoft Corporation)
R3 iPod Service; C:\Programme\iPod\bin\iPodService.exe [553288 2013-02-20] (Apple Inc.)
R2 LanmanServer; C:\WINXP\System32\srvsvc.dll [96768 2008-04-14] (Microsoft Corporation)
R2 lanmanworkstation; C:\WINXP\System32\wkssvc.dll [132096 2008-04-14] (Microsoft Corporation)
R2 LmHosts; C:\WINXP\System32\lmhsvc.dll [13824 2008-04-14] (Microsoft Corporation)
S4 Messenger; C:\WINXP\System32\msgsvc.dll [33792 2008-04-14] (Microsoft Corporation)
S3 Microsoft Office Groove Audit Service; D:\Programme\Microsoft Office\Office12\GrooveAuditService.exe [65824 2006-10-27] (Microsoft Corporation)
S3 mnmsrvc; C:\WINXP\system32\mnmsrvc.exe [32768 2008-04-14] (Microsoft Corporation)
S3 MozillaMaintenance; C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe [119408 2014-06-24] (Mozilla Foundation)
R3 MSDTC; C:\WINXP\system32\msdtc.exe [6144 2008-04-14] (Microsoft Corporation)
S3 MSIServer; C:\WINXP\System32\msiexec.exe [95744 2008-05-19] (Microsoft Corporation)
S3 napagent; C:\WINXP\System32\qagentrt.dll [294400 2008-04-14] (Microsoft Corporation)
S3 NBService; C:\Programme\Nero\Nero 7\Nero BackItUp\NBService.exe [800040 2007-11-28] (Nero AG)
R2 Net Driver HPZ12; C:\WINXP\system32\HPZinw12.dll [44032 2010-04-07] (Hewlett-Packard) [File not signed]
S4 NetDDE; C:\WINXP\system32\netdde.exe [114176 2008-04-14] (Microsoft Corporation)
S4 NetDDEdsdm; C:\WINXP\system32\netdde.exe [114176 2008-04-14] (Microsoft Corporation)
S3 Netlogon; C:\WINXP\system32\lsass.exe [13312 2008-04-14] (Microsoft Corporation)
R3 Netman; C:\WINXP\System32\netman.dll [198144 2008-04-14] (Microsoft Corporation)
S4 NetTcpPortSharing; C:\WINXP\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [124240 2010-03-18] (Microsoft Corporation)
R3 Nla; C:\WINXP\System32\mswsock.dll [247296 2008-04-14] (Microsoft Corporation)
S4 NMIndexingService; C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe [275752 2008-01-22] (Nero AG)
R2 NovacomD; C:\Programme\Palm, Inc\novacomd\x86\novacomd.exe [61440 2011-06-24] (Palm) [File not signed]
S3 NtLmSsp; C:\WINXP\system32\lsass.exe [13312 2008-04-14] (Microsoft Corporation)
S3 NtmsSvc; C:\WINXP\system32\ntmssvc.dll [438272 2008-04-14] (Microsoft Corporation)
R2 NVSvc; C:\WINXP\system32\nvsvc32.exe [168004 2009-01-30] (NVIDIA Corporation)
S3 odserv; C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE [441136 2006-10-26] (Microsoft Corporation)
S3 ose; C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE [145184 2006-10-26] (Microsoft Corporation)
R2 PlugPlay; C:\WINXP\system32\services.exe [109056 2008-04-14] (Microsoft Corporation)
R2 Pml Driver HPZ12; C:\WINXP\system32\HPZipm12.dll [53760 2010-04-07] (Hewlett-Packard) [File not signed]
R2 PolicyAgent; C:\WINXP\system32\lsass.exe [13312 2008-04-14] (Microsoft Corporation)
R2 ProtectedStorage; C:\WINXP\system32\lsass.exe [13312 2008-04-14] (Microsoft Corporation)
S3 RasAuto; C:\WINXP\System32\rasauto.dll [88576 2008-04-14] (Microsoft Corporation)
R3 RasMan; C:\WINXP\System32\rasmans.dll [186368 2008-04-14] (Microsoft Corporation)
S3 RDSessMgr; C:\WINXP\system32\sessmgr.exe [143360 2008-04-14] (Microsoft Corporation)
S4 RemoteAccess; C:\WINXP\System32\mprdim.dll [53248 2008-04-14] (Microsoft Corporation)
R2 RemoteRegistry; C:\WINXP\system32\regsvc.dll [59904 2008-04-14] (Microsoft Corporation)
S3 RpcLocator; C:\WINXP\system32\locator.exe [75264 2008-04-14] (Microsoft Corporation)
R2 RpcSs; C:\WINXP\System32\rpcss.dll [399360 2008-04-14] (Microsoft Corporation)
S3 RSVP; C:\WINXP\system32\rsvp.exe [132608 2008-04-14] (Microsoft Corporation)
R2 SamSs; C:\WINXP\system32\lsass.exe [13312 2008-04-14] (Microsoft Corporation)
S3 SCardSvr; C:\WINXP\System32\SCardSvr.exe [99840 2008-04-14] (Microsoft Corporation)
R2 Schedule; C:\WINXP\system32\schedsvc.dll [193536 2008-04-14] (Microsoft Corporation)
R2 seclogon; C:\WINXP\System32\seclogon.dll [18944 2008-04-14] (Microsoft Corporation)
R2 SENS; C:\WINXP\system32\sens.dll [39424 2008-04-14] (Microsoft Corporation)
R2 SharedAccess; C:\WINXP\System32\ipnathlp.dll [334336 2008-04-14] (Microsoft Corporation)
R2 ShellHWDetection; C:\WINXP\System32\shsvcs.dll [135168 2008-04-14] (Microsoft Corporation)
R2 Spooler; C:\WINXP\system32\spoolsv.exe [57856 2008-04-14] (Microsoft Corporation)
R2 srservice; C:\WINXP\system32\srsvc.dll [171520 2008-04-14] (Microsoft Corporation)
R3 SSDPSRV; C:\WINXP\System32\ssdpsrv.dll [71680 2008-04-14] (Microsoft Corporation)
R2 stisvc; C:\WINXP\system32\wiaservc.dll [334336 2008-04-14] (Microsoft Corporation)
S3 SysmonLog; C:\WINXP\system32\smlogsvc.exe [94208 2008-04-14] (Microsoft Corporation)
R3 TapiSrv; C:\WINXP\System32\tapisrv.dll [249856 2008-04-14] (Microsoft Corporation)
R3 TermService; C:\WINXP\System32\termsrv.dll [297472 2008-04-14] (Microsoft Corporation)
R2 Themes; C:\WINXP\System32\shsvcs.dll [135168 2008-04-14] (Microsoft Corporation)
S3 TlntSvr; C:\WINXP\system32\tlntsvr.exe [75264 2008-04-14] (Microsoft Corporation)
R2 TrkWks; C:\WINXP\system32\trkwks.dll [90112 2008-04-14] (Microsoft Corporation)
R3 upnphost; C:\WINXP\System32\upnphost.dll [186880 2008-04-14] (Microsoft Corporation)
S3 UPS; C:\WINXP\System32\ups.exe [18432 2008-04-14] (Microsoft Corporation)
S3 VSS; C:\WINXP\System32\vssvc.exe [292864 2008-04-14] (Microsoft Corporation)
R2 W32Time; C:\WINXP\system32\w32time.dll [177152 2008-04-14] (Microsoft Corporation)
U2 WebClient; C:\WINXP\System32\webclnt.dll [68096 2008-04-14] (Microsoft Corporation)
R2 winmgmt; C:\WINXP\system32\wbem\WMIsvc.dll [145408 2008-04-14] (Microsoft Corporation)
S3 WmdmPmSN; C:\WINXP\system32\mspmsnsv.dll [27136 2008-12-10] (Microsoft Corporation)
S3 Wmi; C:\WINXP\System32\advapi32.dll [678400 2008-04-14] (Microsoft Corporation)
S3 WmiApSrv; C:\WINXP\system32\wbem\wmiapsrv.exe [126464 2008-04-14] (Microsoft Corporation)
S3 WMPNetworkSvc; C:\Programme\Windows Media Player\WMPNetwk.exe [920576 2006-11-03] (Microsoft Corporation)
R3 WPFFontCache_v0400; C:\WINXP\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [753504 2010-03-18] (Microsoft Corporation)
R2 wscsvc; C:\WINXP\system32\wscsvc.dll [80896 2008-04-14] (Microsoft Corporation)
U2 wuauserv; C:\WINXP\system32\wuauserv.dll [6656 2008-04-14] (Microsoft Corporation)
R2 WudfSvc; C:\WINXP\System32\WUDFSvc.dll [55296 2008-01-19] (Microsoft Corporation)
R2 WZCSVC; C:\WINXP\System32\wzcsvc.dll [483840 2008-12-10] (Microsoft Corporation)
S3 xmlprov; C:\WINXP\System32\xmlprov.dll [129024 2008-04-14] (Microsoft Corporation)
S2 LcSvrAdm; g:\elsawin\installation\bin\LcSvrAdm.exe [X]
S3 LcSvrAuf; g:\elsawin\installation\bin\LcSvrAuf.exe [X]
S2 LcSvrDba; g:\elsawin\installation\bin\LcSvrDba.exe [X]
S2 LcSvrHis; g:\elsawin\installation\bin\LcSvrHis.exe [X]
S2 LcSvrPAS; g:\elsawin\installation\bin\LcSvrPas.exe [X]
S2 LcSvrSaz; g:\elsawin\installation\bin\LcSvrSaz.exe [X]
S3 SwPrv; C:\WINXP\system32\dllhost.exe /Processid:{754E7D9E-E094-4527-B77E-79F9E5C6619D}

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 ACPI; C:\WINXP\System32\DRIVERS\ACPI.sys [188800 2008-04-14] (Microsoft Corporation)
R0 ACPIEC; C:\WINXP\System32\DRIVERS\ACPIEC.sys [12160 2008-04-14] (Microsoft Corporation)
S3 aec; C:\WINXP\System32\drivers\aec.sys [142592 2008-04-13] (Microsoft Corporation)
R1 AFD; C:\WINXP\System32\drivers\afd.sys [138496 2008-12-10] (Microsoft Corporation)
R3 Arp1394; C:\WINXP\System32\DRIVERS\arp1394.sys [60800 2008-12-10] (Microsoft Corporation)
S3 AsyncMac; C:\WINXP\System32\DRIVERS\asyncmac.sys [14336 2008-04-14] (Microsoft Corporation)
R0 atapi; C:\WINXP\System32\DRIVERS\atapi.sys [96512 2008-04-14] (Microsoft Corporation)
S3 Atmarpc; C:\WINXP\System32\DRIVERS\atmarpc.sys [59904 2008-04-14] (Microsoft Corporation)
R3 audstub; C:\WINXP\System32\DRIVERS\audstub.sys [3072 2001-08-17] (Microsoft Corporation)
S2 avgntflt; C:\WINXP\System32\DRIVERS\avgntflt.sys [105864 2015-02-04] (Avira Operations GmbH & Co. KG)
S1 avipbb; C:\WINXP\System32\DRIVERS\avipbb.sys [136216 2015-02-04] (Avira Operations GmbH & Co. KG)
S1 avkmgr; C:\WINXP\System32\DRIVERS\avkmgr.sys [37352 2015-02-04] (Avira Operations GmbH & Co. KG)
R1 Beep; C:\WINXP\system32\Drivers\Beep.sys [4224 2008-04-14] (Microsoft Corporation)
S3 BthEnum; C:\WINXP\System32\DRIVERS\BthEnum.sys [17024 2008-04-13] (Microsoft Corporation)
S3 BTHMODEM; C:\WINXP\System32\DRIVERS\bthmodem.sys [37888 2008-04-13] (Microsoft Corporation)
S3 BthPan; C:\WINXP\System32\DRIVERS\bthpan.sys [101120 2008-04-13] (Microsoft Corporation)
S3 BTHPORT; C:\WINXP\System32\Drivers\BTHport.sys [273024 2008-12-10] (Microsoft Corporation)
S3 BTHUSB; C:\WINXP\System32\Drivers\BTHUSB.sys [18944 2008-04-13] (Microsoft Corporation)
R3 cbfs3; C:\WINXP\System32\DRIVERS\cbfs3.sys [299024 2012-04-09] (EldoS Corporation)
S4 cbidf2k; C:\WINXP\system32\Drivers\cbidf2k.sys [13952 2008-04-14] (Microsoft Corporation)
S1 Cdaudio; C:\WINXP\system32\Drivers\Cdaudio.sys [18688 2008-12-10] (Microsoft Corporation)
R4 Cdfs; C:\WINXP\system32\Drivers\Cdfs.sys [63744 2008-04-14] (Microsoft Corporation)
R1 Cdrom; C:\WINXP\System32\DRIVERS\cdrom.sys [62976 2008-04-14] (Microsoft Corporation)
R3 CmBatt; C:\WINXP\System32\DRIVERS\CmBatt.sys [13952 2008-04-14] (Microsoft Corporation)
R0 Compbatt; C:\WINXP\System32\DRIVERS\compbatt.sys [10240 2008-04-14] (Microsoft Corporation)
R0 Disk; C:\WINXP\System32\DRIVERS\disk.sys [36352 2008-04-14] (Microsoft Corporation)
S4 dmboot; C:\WINXP\System32\drivers\dmboot.sys [800384 2008-04-14] (Microsoft Corp., Veritas Software)
R0 dmio; C:\WINXP\System32\drivers\dmio.sys [154112 2008-04-14] (Microsoft Corp., Veritas Software)
R0 dmload; C:\WINXP\System32\drivers\dmload.sys [5888 2008-04-14] (Microsoft Corp., Veritas Software.)
S3 DMusic; C:\WINXP\System32\drivers\DMusic.sys [52864 2008-04-13] (Microsoft Corporation)
S3 drmkaud; C:\WINXP\System32\drivers\drmkaud.sys [2944 2008-04-13] (Microsoft Corporation)
R1 dtsoftbus01; C:\WINXP\System32\DRIVERS\dtsoftbus01.sys [242240 2012-06-21] (DT Soft Ltd)
S4 exFat; C:\WINXP\system32\Drivers\exFat.sys [133632 2008-09-29] (Microsoft Corporation)
R4 Fastfat; C:\WINXP\system32\Drivers\Fastfat.sys [143744 2008-04-14] (Microsoft Corporation)
S1 Fdc; C:\WINXP\system32\Drivers\Fdc.sys [27392 2008-04-14] (Microsoft Corporation)
R1 Fips; C:\WINXP\system32\Drivers\Fips.sys [44672 2008-04-14] (Microsoft Corporation)
S1 Flpydisk; C:\WINXP\system32\Drivers\Flpydisk.sys [20480 2008-04-14] (Microsoft Corporation)
R0 FltMgr; C:\WINXP\System32\drivers\fltmgr.sys [129792 2008-04-14] (Microsoft Corporation)
U1 Fs_Rec; C:\WINXP\system32\Drivers\Fs_Rec.sys [9216 2008-09-29] (Microsoft Corporation)
R0 Ftdisk; C:\WINXP\System32\DRIVERS\ftdisk.sys [126336 2008-04-14] (Microsoft Corporation)
R3 GEARAspiWDM; C:\WINXP\System32\DRIVERS\GEARAspiWDM.sys [26840 2012-08-21] (GEAR Software Inc.)
R3 Gpc; C:\WINXP\System32\DRIVERS\msgpc.sys [35072 2008-04-14] (Microsoft Corporation)
R2 Hardlock; C:\WINXP\system32\drivers\hardlock.sys [693760 2006-11-22] (Aladdin Knowledge Systems Ltd.)
R3 HDAudBus; C:\WINXP\System32\DRIVERS\HDAudBus.sys [144384 2008-04-14] (Windows (R) Server 2003 DDK provider)
R3 HidUsb; C:\WINXP\System32\DRIVERS\hidusb.sys [10368 2008-04-13] (Microsoft Corporation)
R0 hotcore3; C:\WINXP\System32\DRIVERS\hotcore3.sys [40560 2010-05-20] (Paragon Software Group)
R3 HTTP; C:\WINXP\System32\Drivers\HTTP.sys [264832 2008-04-14] (Microsoft Corporation)
R1 i8042prt; C:\WINXP\System32\DRIVERS\i8042prt.sys [52992 2008-04-14] (Microsoft Corporation)
R0 iaStor; C:\WINXP\System32\DRIVERS\iaStor.sys [330264 2010-01-05] (Intel Corporation)
R1 Imapi; C:\WINXP\System32\DRIVERS\imapi.sys [42112 2008-04-14] (Microsoft Corporation)
R3 IntcAzAudAddService; C:\WINXP\System32\drivers\RtkHDAud.sys [4241920 2006-02-27] (Realtek Semiconductor Corp.)
R1 intelppm; C:\WINXP\System32\DRIVERS\intelppm.sys [40448 2008-04-14] (Microsoft Corporation)
S3 Ip6Fw; C:\WINXP\System32\drivers\ip6fw.sys [36608 2008-04-14] (Microsoft Corporation)
S3 IpFilterDriver; C:\WINXP\System32\DRIVERS\ipfltdrv.sys [32896 2008-04-14] (Microsoft Corporation)
S3 IpInIp; C:\WINXP\System32\DRIVERS\ipinip.sys [20864 2008-04-14] (Microsoft Corporation)
R3 IpNat; C:\WINXP\System32\DRIVERS\ipnat.sys [152832 2008-04-14] (Microsoft Corporation)
R1 IPSec; C:\WINXP\System32\DRIVERS\ipsec.sys [75264 2008-04-14] (Microsoft Corporation)
S3 IRENUM; C:\WINXP\System32\DRIVERS\irenum.sys [11264 2008-04-14] (Microsoft Corporation)
R0 isapnp; C:\WINXP\System32\DRIVERS\isapnp.sys [37632 2008-04-14] (Microsoft Corporation)
R1 Kbdclass; C:\WINXP\System32\DRIVERS\kbdclass.sys [25216 2008-04-14] (Microsoft Corporation)
R1 kbdhid; C:\WINXP\System32\DRIVERS\kbdhid.sys [14720 2008-04-14] (Microsoft Corporation)
R3 kmixer; C:\WINXP\System32\drivers\kmixer.sys [172416 2008-04-13] (Microsoft Corporation)
R0 KSecDD; C:\WINXP\system32\Drivers\KSecDD.sys [92288 2008-04-14] (Microsoft Corporation)
R1 mnmdd; C:\WINXP\system32\Drivers\mnmdd.sys [4224 2008-04-14] (Microsoft Corporation)
R3 Modem; C:\WINXP\system32\Drivers\Modem.sys [30336 2008-12-10] (Microsoft Corporation)
R1 Mouclass; C:\WINXP\System32\DRIVERS\mouclass.sys [23552 2008-12-10] (Microsoft Corporation)
R3 mouhid; C:\WINXP\System32\DRIVERS\mouhid.sys [12288 2001-08-18] (Microsoft Corporation)
R0 MountMgr; C:\WINXP\system32\Drivers\MountMgr.sys [42368 2008-04-14] (Microsoft Corporation)
R3 MRxDAV; C:\WINXP\System32\DRIVERS\mrxdav.sys [180608 2008-04-14] (Microsoft Corporation)
R1 MRxSmb; C:\WINXP\System32\DRIVERS\mrxsmb.sys [455936 2008-12-10] (Microsoft Corporation)
R1 Msfs; C:\WINXP\system32\Drivers\Msfs.sys [19072 2008-04-14] (Microsoft Corporation)
S3 MSKSSRV; C:\WINXP\System32\drivers\MSKSSRV.sys [7552 2008-04-13] (Microsoft Corporation)
S3 MSPCLOCK; C:\WINXP\System32\drivers\MSPCLOCK.sys [5376 2008-04-13] (Microsoft Corporation)
S3 MSPQM; C:\WINXP\System32\drivers\MSPQM.sys [4992 2008-04-13] (Microsoft Corporation)
R3 mssmbios; C:\WINXP\System32\DRIVERS\mssmbios.sys [15488 2008-12-10] (Microsoft Corporation)
R0 Mup; C:\WINXP\system32\Drivers\Mup.sys [105344 2008-04-14] (Microsoft Corporation)
R0 NDIS; C:\WINXP\system32\Drivers\NDIS.sys [182656 2008-04-14] (Microsoft Corporation)
R3 NdisTapi; C:\WINXP\System32\DRIVERS\ndistapi.sys [10112 2008-04-14] (Microsoft Corporation)
R3 Ndisuio; C:\WINXP\System32\DRIVERS\ndisuio.sys [14592 2008-12-10] (Microsoft Corporation)
R3 NdisWan; C:\WINXP\System32\DRIVERS\ndiswan.sys [91520 2008-04-14] (Microsoft Corporation)
R3 NDProxy; C:\WINXP\system32\Drivers\NDProxy.sys [40576 2008-04-14] (Microsoft Corporation)
R1 NetBIOS; C:\WINXP\System32\DRIVERS\netbios.sys [34688 2008-04-14] (Microsoft Corporation)
R1 NetBT; C:\WINXP\System32\DRIVERS\netbt.sys [162816 2008-04-14] (Microsoft Corporation)
R3 NETw3x32; C:\WINXP\System32\DRIVERS\NETw3x32.sys [1709696 2006-09-27] (Intel® Corporation)
R3 NIC1394; C:\WINXP\System32\DRIVERS\nic1394.sys [61824 2008-12-10] (Microsoft Corporation)
R1 Npfs; C:\WINXP\system32\Drivers\Npfs.sys [30848 2008-04-14] (Microsoft Corporation)
R2 NSHE; C:\WINXP\system32\Drivers\NSHE.SYS [97792 2008-11-23] (T0r0 2008) [File not signed]
R4 Ntfs; C:\WINXP\system32\Drivers\Ntfs.sys [574976 2008-04-14] (Microsoft Corporation)
R1 Null; C:\WINXP\system32\Drivers\Null.sys [2944 2008-04-14] (Microsoft Corporation)
R3 nv; C:\WINXP\System32\DRIVERS\nv4_mini.sys [6250848 2009-01-30] (NVIDIA Corporation)
S3 NwlnkFlt; C:\WINXP\System32\DRIVERS\nwlnkflt.sys [12416 2008-04-14] (Microsoft Corporation)
S3 NwlnkFwd; C:\WINXP\System32\DRIVERS\nwlnkfwd.sys [32512 2008-04-14] (Microsoft Corporation)
R0 ohci1394; C:\WINXP\System32\DRIVERS\ohci1394.sys [61696 2008-04-14] (Microsoft Corporation)
S3 Parport; C:\WINXP\system32\Drivers\Parport.sys [80384 2008-12-10] (Microsoft Corporation)
R0 PartMgr; C:\WINXP\system32\Drivers\PartMgr.sys [19712 2008-04-14] (Microsoft Corporation)
S2 ParVdm; C:\WINXP\system32\Drivers\ParVdm.sys [7040 2008-04-14] (Microsoft Corporation)
R0 PCI; C:\WINXP\System32\DRIVERS\pci.sys [68224 2008-04-14] (Microsoft Corporation)
R0 PCIIde; C:\WINXP\System32\DRIVERS\pciide.sys [3328 2001-08-18] (Microsoft Corporation)
S4 Pcmcia; C:\WINXP\system32\Drivers\Pcmcia.sys [120576 2008-04-14] (Microsoft Corporation)
R3 PptpMiniport; C:\WINXP\System32\DRIVERS\raspptp.sys [48384 2008-04-14] (Microsoft Corporation)
R3 PSched; C:\WINXP\System32\DRIVERS\psched.sys [69120 2008-04-14] (Microsoft Corporation)
R3 Ptilink; C:\WINXP\System32\DRIVERS\ptilink.sys [17792 2008-04-14] (Parallel Technologies, Inc.)
S3 pwdrvio; C:\WINXP\system32\pwdrvio.sys [16472 2012-01-18] ()
S3 pwdspio; C:\WINXP\system32\pwdspio.sys [11104 2012-01-18] ()
R0 PxHelp20; C:\WINXP\System32\Drivers\PxHelp20.sys [45648 2010-08-12] (Sonic Solutions)
R1 RasAcd; C:\WINXP\System32\DRIVERS\rasacd.sys [8832 2008-04-14] (Microsoft Corporation)
R3 Rasl2tp; C:\WINXP\System32\DRIVERS\rasl2tp.sys [51328 2008-04-14] (Microsoft Corporation)
R3 RasPppoe; C:\WINXP\System32\DRIVERS\raspppoe.sys [41472 2008-04-14] (Microsoft Corporation)
R3 Raspti; C:\WINXP\System32\DRIVERS\raspti.sys [16512 2008-04-14] (Microsoft Corporation)
R1 Rdbss; C:\WINXP\System32\DRIVERS\rdbss.sys [175744 2008-04-14] (Microsoft Corporation)
R1 RDPCDD; C:\WINXP\System32\DRIVERS\RDPCDD.sys [4224 2008-04-14] (Microsoft Corporation)
R3 rdpdr; C:\WINXP\System32\DRIVERS\rdpdr.sys [196224 2008-04-14] (Microsoft Corporation)
S3 RDPWD; C:\WINXP\system32\Drivers\RDPWD.sys [139656 2008-04-14] (Microsoft Corporation)
R1 redbook; C:\WINXP\System32\DRIVERS\redbook.sys [57728 2008-04-14] (Microsoft Corporation)
S3 RFCOMM; C:\WINXP\System32\DRIVERS\rfcomm.sys [59136 2008-04-13] (Microsoft Corporation)
R3 RTL8023xp; C:\WINXP\System32\DRIVERS\Rtnicxp.sys [78720 2005-09-30] (Realtek Semiconductor Corporation                           )
S3 Secdrv; C:\WINXP\System32\DRIVERS\secdrv.sys [20480 2008-04-14] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
S2 Serial; C:\WINXP\system32\Drivers\Serial.sys [65536 2008-04-14] (Microsoft Corporation)
S1 Sfloppy; C:\WINXP\system32\Drivers\Sfloppy.sys [11392 2008-04-14] (Microsoft Corporation)
R3 smserial; C:\WINXP\System32\DRIVERS\smserial.sys [846792 2005-09-16] (Motorola Inc.)
S3 splitter; C:\WINXP\System32\drivers\splitter.sys [6272 2008-04-13] (Microsoft Corporation)
R0 sr; C:\WINXP\System32\DRIVERS\sr.sys [73472 2008-04-14] (Microsoft Corporation)
R3 Srv; C:\WINXP\System32\DRIVERS\srv.sys [333824 2008-12-10] (Microsoft Corporation)
S1 ssmdrv; C:\WINXP\System32\DRIVERS\ssmdrv.sys [28520 2015-02-04] (Avira GmbH)
R3 swenum; C:\WINXP\System32\DRIVERS\swenum.sys [4352 2008-12-10] (Microsoft Corporation)
S3 swmidi; C:\WINXP\System32\drivers\swmidi.sys [56576 2008-04-13] (Microsoft Corporation)
R3 sysaudio; C:\WINXP\System32\drivers\sysaudio.sys [60800 2008-04-13] (Microsoft Corporation)
R1 Tcpip; C:\WINXP\System32\DRIVERS\tcpip.sys [361344 2008-04-14] (Microsoft Corporation)
S3 TDPIPE; C:\WINXP\system32\Drivers\TDPIPE.sys [12040 2008-04-14] (Microsoft Corporation)
S3 TDTCP; C:\WINXP\system32\Drivers\TDTCP.sys [21896 2008-04-14] (Microsoft Corporation)
R1 TermDD; C:\WINXP\System32\DRIVERS\termdd.sys [40840 2008-04-14] (Microsoft Corporation)
S4 Udfs; C:\WINXP\system32\Drivers\Udfs.sys [66048 2008-04-14] (Microsoft Corporation)
R3 Update; C:\WINXP\System32\DRIVERS\update.sys [384768 2008-04-14] (Microsoft Corporation)
S3 USBAAPL; C:\WINXP\System32\Drivers\usbaapl.sys [45056 2012-12-13] (Apple, Inc.) [File not signed]
R3 usbccgp; C:\WINXP\System32\DRIVERS\usbccgp.sys [32128 2008-04-13] (Microsoft Corporation)
R3 usbehci; C:\WINXP\System32\DRIVERS\usbehci.sys [30208 2008-04-14] (Microsoft Corporation)
R3 usbhub; C:\WINXP\System32\DRIVERS\usbhub.sys [59520 2008-04-14] (Microsoft Corporation)
S3 usbprint; C:\WINXP\System32\DRIVERS\usbprint.sys [25856 2008-04-13] (Microsoft Corporation)
S3 usbscan; C:\WINXP\System32\DRIVERS\usbscan.sys [15104 2008-04-13] (Microsoft Corporation)
R3 USBSTOR; C:\WINXP\System32\DRIVERS\USBSTOR.SYS [26368 2008-04-13] (Microsoft Corporation)
R3 usbuhci; C:\WINXP\System32\DRIVERS\usbuhci.sys [20608 2008-04-14] (Microsoft Corporation)
R1 VgaSave; C:\WINXP\System32\drivers\vga.sys [20992 2008-04-14] (Microsoft Corporation)
R0 VolSnap; C:\WINXP\system32\Drivers\VolSnap.sys [53760 2008-04-14] (Microsoft Corporation)
R3 Wanarp; C:\WINXP\System32\DRIVERS\wanarp.sys [34560 2008-04-14] (Microsoft Corporation)
S3 wceusbsh; C:\WINXP\System32\DRIVERS\wceusbsh.sys [28672 2006-11-06] (Microsoft Corporation)
S3 Wdf01000; C:\WINXP\System32\Drivers\wdf01000.sys [444136 2009-07-14] (Microsoft Corporation)
R3 wdmaud; C:\WINXP\System32\drivers\wdmaud.sys [83072 2008-04-13] (Microsoft Corporation)
S3 WinUSB; C:\WINXP\System32\DRIVERS\WinUSB.sys [34944 2009-07-13] (Microsoft Corporation)
R1 WmiAcpi; C:\WINXP\System32\DRIVERS\wmiacpi.sys [8832 2008-04-14] (Microsoft Corporation)
S3 WpdUsb; C:\WINXP\System32\DRIVERS\wpdusb.sys [38528 2008-12-10] (Microsoft Corporation)
R1 WS2IFSL; C:\WINXP\System32\drivers\ws2ifsl.sys [12032 2008-04-14] (Microsoft Corporation)
R0 WudfPf; C:\WINXP\System32\DRIVERS\WudfPf.sys [77696 2008-01-18] (Microsoft Corporation)
S3 WudfRd; C:\WINXP\System32\DRIVERS\wudfrd.sys [83328 2008-01-18] (Microsoft Corporation)
S3 catchme; \??\C:\DOKUME~1\ALEXAN~1\LOKALE~1\Temp\catchme.sys [X]
S4 IntelIde; No ImagePath
U5 ScsiPort; C:\WINXP\system32\drivers\scsiport.sys [96384 2008-04-14] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-03 19:16 - 2015-03-03 19:17 - 00047812 _____ () C:\Dokumente und Einstellungen\Alexander\Desktop\FRST.txt
2015-03-03 19:10 - 2015-03-03 19:10 - 00834762 _____ () C:\Dokumente und Einstellungen\Alexander\Desktop\Unbenannt999.bmp
2015-03-03 18:10 - 2015-03-03 18:10 - 01388333 _____ (Thisisu) C:\Dokumente und Einstellungen\Alexander\Desktop\JRT.exe
2015-03-03 17:50 - 2015-03-03 17:57 - 00000000 ____D () C:\AdwCleaner
2015-03-03 17:50 - 2015-03-03 17:50 - 02126848 _____ () C:\Dokumente und Einstellungen\Alexander\Desktop\AdwCleaner_4.111.exe
2015-03-03 17:29 - 2015-03-03 17:45 - 00114904 _____ (Malwarebytes Corporation) C:\WINXP\system32\Drivers\536154D9.sys
2015-03-03 17:29 - 2015-03-03 17:29 - 00114904 _____ (Malwarebytes Corporation) C:\WINXP\system32\Drivers\35A5549B.sys
2015-03-03 17:28 - 2015-03-03 17:28 - 00110296 _____ (Malwarebytes Corporation) C:\WINXP\system32\Drivers\47067E77.sys
2015-03-03 17:25 - 2015-03-03 17:25 - 00110296 _____ (Malwarebytes Corporation) C:\WINXP\system32\Drivers\48230029.sys
2015-03-03 17:16 - 2015-03-03 17:16 - 00000529 _____ () C:\Dokumente und Einstellungen\Alexander\Desktop\Revo Uninstaller.lnk
2015-03-03 17:13 - 2015-03-03 19:16 - 00000000 ____D () C:\FRST
2015-03-03 17:13 - 2015-03-03 17:13 - 01132032 _____ (Farbar) C:\Dokumente und Einstellungen\Alexander\Desktop\FRST.exe
2015-03-02 19:39 - 2015-03-02 19:39 - 00275294 _____ () C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-S-1-5-21-1935655697-1229272821-1417001333-1003-0.dat
2015-03-02 18:32 - 2015-03-02 18:32 - 00000836 _____ () C:\Dokumente und Einstellungen\All Users\Desktop\Avira.lnk
2015-03-02 18:20 - 2015-03-02 19:40 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Package Cache
2015-03-02 18:20 - 2015-03-02 18:20 - 00000000 ____D () C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Avira
2015-03-02 18:20 - 2015-03-02 18:20 - 00000000 ____D () C:\Dokumente und Einstellungen\Alexander\Anwendungsdaten\Avira
2015-03-02 18:19 - 2015-03-02 18:32 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Avira
2015-03-02 18:19 - 2015-03-02 18:19 - 00001673 _____ () C:\Dokumente und Einstellungen\All Users\Desktop\Avira Control Center.lnk
2015-03-02 18:18 - 2015-02-04 17:51 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\WINXP\system32\Drivers\avipbb.sys
2015-03-02 18:18 - 2015-02-04 17:51 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\WINXP\system32\Drivers\avkmgr.sys
2015-03-02 18:18 - 2015-02-04 17:51 - 00028520 _____ (Avira GmbH) C:\WINXP\system32\Drivers\ssmdrv.sys
2015-03-02 18:17 - 2015-03-02 18:32 - 00000000 ____D () C:\Programme\Avira
2015-03-02 18:17 - 2015-03-02 18:21 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avira

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-03 19:17 - 2014-06-19 15:29 - 00000000 ____D () C:\Dokumente und Einstellungen\Alexander\Lokale Einstellungen\Temp
2015-03-03 19:12 - 2014-06-19 15:29 - 00000000 ____D () C:\WINXP\Temp
2015-03-03 19:09 - 2013-04-17 19:36 - 00001096 _____ () C:\WINXP\Tasks\GoogleUpdateTaskMachineUA.job
2015-03-03 19:08 - 2010-01-13 23:38 - 00000069 _____ () C:\WINXP\NeroDigital.ini
2015-03-03 18:56 - 2014-06-30 17:56 - 00000424 _____ () C:\WINXP\Tasks\At2.job
2015-03-03 18:43 - 2014-07-08 17:51 - 00000000 ____D () C:\WINXP\system32\NtmsData
2015-03-03 18:42 - 2014-06-19 14:17 - 00356903 _____ () C:\WINXP\WindowsUpdate.log
2015-03-03 18:42 - 2010-01-05 23:21 - 00013311 _____ () C:\WINXP\wmsetup.log
2015-03-03 18:25 - 2010-01-05 23:21 - 00000000 ____D () C:\WINXP\Registration
2015-03-03 18:22 - 2012-02-29 19:07 - 00000000 ____D () C:\WINXP\SxsCaPendDel
2015-03-03 18:21 - 2012-07-09 18:28 - 00000000 ____D () C:\Programme\Gemeinsame Dateien\Apple
2015-03-03 18:15 - 2010-01-05 22:53 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme
2015-03-03 17:59 - 2010-01-05 22:55 - 00000159 _____ () C:\WINXP\wiadebug.log
2015-03-03 17:59 - 2010-01-05 22:55 - 00000050 _____ () C:\WINXP\wiaservc.log
2015-03-03 17:58 - 2013-04-17 19:36 - 00001092 _____ () C:\WINXP\Tasks\GoogleUpdateTaskMachineCore.job
2015-03-03 17:58 - 2010-01-06 01:04 - 00202011 _____ () C:\WINXP\system32\nvapps.xml
2015-03-03 17:58 - 2010-01-05 23:42 - 00000006 ____H () C:\WINXP\Tasks\SA.DAT
2015-03-03 17:57 - 2013-02-12 14:53 - 00275294 _____ () C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-System.dat
2015-03-03 17:57 - 2010-01-05 23:48 - 00000190 ___SH () C:\Dokumente und Einstellungen\Alexander\ntuser.ini
2015-03-03 17:57 - 2010-01-05 23:42 - 00032274 _____ () C:\WINXP\SchedLgU.Txt
2015-03-03 17:21 - 2010-01-05 22:53 - 00000000 ____D () C:\Programme
2015-03-03 17:16 - 2010-01-05 23:48 - 00000000 ___RD () C:\Dokumente und Einstellungen\Alexander\Startmenü\Programme
2015-03-02 18:52 - 2014-07-06 23:40 - 00359515 _____ () C:\WINXP\setupapi.log
2015-03-02 18:52 - 2010-01-05 23:46 - 00000000 ____D () C:\WINXP\repair
2015-03-02 18:20 - 2010-01-05 23:42 - 00000000 __SHD () C:\Dokumente und Einstellungen\LocalService
2015-03-02 18:15 - 2008-04-14 14:30 - 00002206 _____ () C:\WINXP\system32\wpa.dbl
2015-02-04 17:51 - 2010-01-08 13:20 - 00105864 _____ (Avira Operations GmbH & Co. KG) C:\WINXP\system32\Drivers\avgntflt.sys
2015-02-03 16:51 - 2010-01-05 22:52 - 00207683 _____ () C:\WINXP\setupact.log

==================== Files in the root of some directories =======

2012-05-28 08:59 - 2012-05-28 08:59 - 0002528 _____ () C:\Dokumente und Einstellungen\Alexander\Anwendungsdaten\$_hpcst$.hpc
2014-07-06 15:55 - 2014-07-07 11:55 - 0000038 _____ () C:\Dokumente und Einstellungen\Alexander\Anwendungsdaten\WB.CFG
2010-01-08 13:04 - 2014-12-22 22:45 - 0032256 _____ () C:\Dokumente und Einstellungen\Alexander\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

Some content of TEMP:
====================
C:\Dokumente und Einstellungen\Alexander\Lokale Einstellungen\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\WINXP\explorer.exe => File is digitally signed
C:\WINXP\system32\winlogon.exe => File is digitally signed
C:\WINXP\system32\svchost.exe => File is digitally signed
C:\WINXP\system32\services.exe => File is digitally signed
C:\WINXP\system32\User32.dll => File is digitally signed
C:\WINXP\system32\userinit.exe => File is digitally signed
C:\WINXP\system32\rpcss.dll => File is digitally signed
C:\WINXP\system32\Drivers\volsnap.sys => File is digitally signed

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 02-03-2015
Ran by Alexander at 2015-03-03 19:18:40
Running from C:\Dokumente und Einstellungen\Alexander\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Disabled - Up to date) {AD166499-45F9-482A-A743-FDD3350758C7}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

32 Bit HP CIO Components Installer (Version: 7.1.5 - Hewlett-Packard) Hidden
7-Zip 4.65 (HKLM\...\7-Zip) (Version:  - )
Adobe AIR (HKLM\...\Adobe AIR) (Version: 3.2.0.2070 - Adobe Systems Incorporated)
Adobe Download Assistant (HKLM\...\com.adobe.downloadassistant.AdobeDownloadAssistant) (Version: 1.2 - Adobe Systems Incorporated)
Adobe Flash Player 14 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Flash Player 14 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Media Player (HKLM\...\com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 1.1 - Adobe Systems Incorporated)
Adobe Photoshop Lightroom 3.2 (HKLM\...\{EDD235BB-9FB4-4604-85ED-1B14A256F4E0}) (Version: 3.2.1 - Adobe)
Adobe Reader XI (11.0.08) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.08 - Adobe Systems Incorporated)
Avidemux 2.5 (32-bit) (HKLM\...\Avidemux 2.5) (Version: 2.5.6.7716 - )
Avira (HKLM\...\{2c18809c-4097-4b51-a4d0-3deade730ef3}) (Version: 1.1.29.22350 - Avira Operations & Co. KG)
Avira (Version: 1.1.29.22350 - Avira Operations & Co. KG) Hidden
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 15.0.8.650 - Avira)
Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
Canon Easy-WebPrint EX (HKLM\...\Easy-WebPrint EX) (Version:  - )
Canon MP Navigator EX 4.0 (HKLM\...\MP Navigator EX 4.0) (Version:  - )
Canon MP495 series Benutzerregistrierung (HKLM\...\Canon MP495 series Benutzerregistrierung) (Version:  - )
Canon MP495 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP495_series) (Version:  - )
Canon My Printer (HKLM\...\CanonMyPrinter) (Version:  - )
Canon Solution Menu EX (HKLM\...\CanonSolutionMenuEX) (Version:  - )
CrystalDiskInfo 6.0.4 (HKLM\...\CrystalDiskInfo_is1) (Version: 6.0.4 - Crystal Dew World)
DAEMON Tools Lite (HKLM\...\DAEMON Tools Lite) (Version: 4.45.4.0314 - DT Soft Ltd)
dBpoweramp Music Converter (HKLM\...\dBpoweramp Music Converter) (Version: Release 13.3 - Illustrate)
DivX-Setup (HKLM\...\DivX Setup.divx.com) (Version: 2.0.0.86 - DivX, Inc. )
Dropbox (HKU\S-1-5-21-1935655697-1229272821-1417001333-1003\...\Dropbox) (Version: 2.4.11 - Dropbox, Inc.)
ESET Online Scanner v3 (HKLM\...\ESET Online Scanner) (Version:  - )
FileZilla Client 3.3.3 (HKLM\...\FileZilla Client) (Version: 3.3.3 - )
FILSHtray (HKLM\...\{5928359F-BF46-4646-BF19-B64E55171EB5}) (Version: 0.12 - FILSH Media GmbH)
Free AVI Video Converter version 5.0.39.430 (HKLM\...\Free AVI Video Converter_is1) (Version: 5.0.39.430 - DVDVideoSoft Ltd.)
Free Video to iPad Converter version 5.0.38.423 (HKLM\...\Free Video to iPad Converter_is1) (Version: 5.0.38.423 - DVDVideoSoft Ltd.)
FreePDF (Remove only) (HKLM\...\FreePDF_XP) (Version:  - )
Google Chrome (HKLM\...\Google Chrome) (Version: 34.0.1847.137 - Google Inc.)
GPL Ghostscript 8.71 (HKLM\...\GPL Ghostscript 8.71) (Version:  - )
HD2 Toolkit Version 4.1 (HKLM\...\{12EE0B2A-84C6-494E-A7AC-6771E898F6A0}_is1) (Version: 4.1 - Kaushal Subedi (KSubedi))
Hotfix für Windows XP (KB942288-v3) (HKLM\...\KB942288-v3) (Version: 3 - Microsoft Corporation)
iExplorer 3.1.0.2 (HKLM\...\{7FD8B0C1-CDDA-4B4D-A577-B2E3570EA3A3}_is1) (Version:  - Macroplant LLC)
IrfanView (remove only) (HKLM\...\IrfanView) (Version:  - )
iTunes (HKLM\...\{268278CF-FB69-4D98-B70E-BFEC1CDCA225}) (Version: 11.0.2.26 - Apple Inc.)
Java 8 Update 25 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
JDownloader (HKLM\...\JDownloader) (Version: 0.89 - AppWork UG (haftungsbeschränkt))
Microsoft .NET Framework 2.0 Service Pack 2 (HKLM\...\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}) (Version: 2.2.30729 - Microsoft Corporation)
Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - DEU (HKLM\...\{C314CE45-3392-3B73-B4E1-139CD41CA933}) (Version: 2.2.30729 - Microsoft Corporation)
Microsoft .NET Framework 3.0 Service Pack 2 (HKLM\...\{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}) (Version: 3.2.30729 - Microsoft Corporation)
Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - DEU (HKLM\...\{C2C284D2-6BD7-3B34-B0C5-B2CAED168DF7}) (Version: 3.2.30729 - Microsoft Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (HKLM\...\ENTERPRISE) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.10411.0 - Microsoft Corporation)
Microsoft User-Mode Driver Framework Feature Pack 1.7 (HKLM\...\Wudf01007) (Version:  - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft WinUsb 1.0 (HKLM\...\winusb0100) (Version:  - Microsoft Corporation)
Microsoft WinUsb 2.0 (HKLM\...\winusb0200) (Version:  - Microsoft Corporation)
Motorola SM56 Data Fax Modem (HKLM\...\SMSERIAL) (Version:  - )
Mozilla Firefox 30.0 (x86 de) (HKLM\...\Mozilla Firefox 30.0 (x86 de)) (Version: 30.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 30.0 - Mozilla)
Nero 7 Ultra Edition (HKLM\...\{22FB6750-ADDF-4726-B67F-6901E1991031}) (Version: 7.03.0993 - Nero AG)
Novacomd (HKLM\...\{BA9A297F-0198-4EE8-90CB-F5036C180E1D}) (Version: 1.0.0.76 - Palm, Inc.)
Nur Entfernen der CopyTrans Suite möglich (HKU\S-1-5-21-1935655697-1229272821-1417001333-1003\...\CopyTrans Suite) (Version: 2.37 - WindSolutions)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.3 - NVIDIA Corporation)
NVIDIA PhysX (HKLM\...\{8AAB4176-A747-493A-A42C-B63CFADFD8E3}) (Version: 9.09.0010 - NVIDIA Corporation)
Paint.NET v3.5.5 (HKLM\...\{F0E2B312-D7FD-4349-A9B6-E90B36DB1BD0}) (Version: 3.55.0 - dotPDN LLC)
Paragon Partition Manager™ 11 Professional (HKLM\...\{A35001F0-F1E4-11DD-A38B-005056C00008}) (Version: 90.00.0003 - Paragon Software)
PhotoFiltre (HKU\S-1-5-21-1935655697-1229272821-1417001333-1003\...\PhotoFiltre) (Version:  - )
QuickTime (HKLM\...\{0E64B098-8018-4256-BA23-C316A43AD9B0}) (Version: 7.72.80.56 - Apple Inc.)
REALTEK Gigabit and Fast Ethernet NIC Driver (HKLM\...\{94FB906A-CF42-4128-A509-D353026A607E}) (Version: 1.80 - REALTEK Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 2.04 - Realtek Semiconductor Corp.)
RedMon - Redirection Port Monitor (HKLM\...\Redirection Port Monitor) (Version:  - )
Revo Uninstaller 1.95 (HKLM\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
SDFormatter (HKLM\...\{15EB20D6-5F13-41D0-BEF9-C9C44D6AC620}) (Version: 3.0.0 - SD Association)
Sicherheitsupdate für Windows Internet Explorer 7 (KB938127-v2) (HKLM\...\KB938127-v2-IE7) (Version: 2 - Microsoft Corporation)
Sicherheitsupdate für Windows Internet Explorer 7 (KB958215) (HKLM\...\KB958215-IE7) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows Media Player 11 (KB954154) (HKLM\...\KB954154_WM11) (Version:  - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB923789) (HKLM\...\KB923789) (Version:  - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB941569) (HKLM\...\KB941569) (Version:  - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB956391) (HKLM\...\KB956391) (Version: 1 - Microsoft Corporation)
SUPER © v2012.build.51 (April 7, 2012) Version v2012.build.51 (HKLM\...\{B93DCF58-AA57-41EC-8D69-B05C66C6312D}_is1) (Version: v2012.build.51 - eRightSoft)
Syncios Version 2.0.3 (HKLM\...\{068A5D84-8419-4BDE-9689-FE65F412EFBB}_is1) (Version: 2.0.3 - Anvsoft, Inc.)
Unity Web Player (HKU\S-1-5-21-1935655697-1229272821-1417001333-1003\...\UnityWebPlayer) (Version: 2.6.1f3_31223 - Unity Technologies ApS)
Update für Windows XP (KB943729) (HKLM\...\KB943729) (Version:  - Microsoft Corporation)
Update für Windows XP (KB955704) (HKLM\...\KB955704) (Version: 1 - Microsoft Corporation)
VC80CRTRedist - 8.0.50727.4053 (Version: 1.1.0 - DivX, Inc) Hidden
Veetle TV 0.9.18 (HKLM\...\Veetle TV) (Version: 0.9.18 - Veetle, Inc)
Vegas Movie Studio HD Platinum 11.0 (HKLM\...\{4A62FED1-759A-11E0-8248-0013D3D69929}) (Version: 11.0.220 - Sony)
VisualLightBox (HKLM\...\VisualLightBox) (Version:  - )
WebFldrs XP (Version: 9.50.7523 - Microsoft Corporation) Hidden
Winamp (HKLM\...\Winamp) (Version: 5.571  - Nullsoft, Inc)
Windows Driver Package - Intel (NETw3x32) net  (09/27/2006 10.5.1.68) (HKLM\...\BBAD1A7054D7B16ED03E62627C123F5CBA70A4E7) (Version: 09/27/2006 10.5.1.68 - Intel)
Windows Driver Package - Intel (w29n51) net  (06/26/2006 9.0.4.17) (HKLM\...\D16AA00FE65B9D2C6E0A57F54400303BF3259CC3) (Version: 06/26/2006 9.0.4.17 - Intel)
Windows Driver Package - Intel net  (10/30/2006 10.6.0.29) (HKLM\...\C805F03D733C5C658A973935646FBB5296D72B14) (Version: 10/30/2006 10.6.0.29 - Intel)
Windows Driver Package - Intel net  (11/01/2006 9.1.0.111) (HKLM\...\841F246A60607D129BAE7F771CB55E7B3EF8BCF8) (Version: 11/01/2006 9.1.0.111 - Intel)
Windows Driver Package - Palm (WinUSB) Palm Devices  (10/09/2009 1.0.1) (HKLM\...\332CCC08910F1AE2E4D90D25DEDE87E3EF797832) (Version: 10/09/2009 1.0.1 - Palm)
Windows Genuine Advantage Notifications (KB905474) (HKLM\...\WgaNotify) (Version: 1.8.0031.9 - Microsoft Corporation)
WinSetupFromUSB (HKU\S-1-5-21-1935655697-1229272821-1417001333-1003\...\WinSetupFromUSB) (Version:  - )
XML Paper Specification Shared Components Language Pack 1.0 (Version:  - Microsoft Corporation) Hidden
XP Codec Pack (HKLM\...\XP Codec Pack) (Version:  - )

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-1935655697-1229272821-1417001333-1003_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Dokumente und Einstellungen\Alexander\Anwendungsdaten\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1935655697-1229272821-1417001333-1003_Classes\CLSID\{00B7E0AB-817A-44AD-A04B-D1148D524136}\InprocServer32 -> C:\WINXP\system32\msxml4.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1935655697-1229272821-1417001333-1003_Classes\CLSID\{095A2EEC-F7FE-42E8-96FB-C20E53081908}\InprocServer32 -> C:\Dokumente und Einstellungen\Alexander\Lokale Einstellungen\Anwendungsdaten\Google\Update\1.3.21.9 (the data entry has 20 more characters).
CustomCLSID: HKU\S-1-5-21-1935655697-1229272821-1417001333-1003_Classes\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\InprocServer32 -> C:\Dokumente und Einstellungen\Alexander\Lokale Einstellungen\Anwendungsdaten\Unity\WebPlayer\loader\UnityWebPluginAX.ocx (Unity Technologies ApS)
CustomCLSID: HKU\S-1-5-21-1935655697-1229272821-1417001333-1003_Classes\CLSID\{7C6E29BC-8B8B-4C3D-859E-AF6CD158BE0F}\InprocServer32 -> C:\WINXP\system32\msxml4.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1935655697-1229272821-1417001333-1003_Classes\CLSID\{88D969C0-F192-11D4-A65F-0040963251E5}\InprocServer32 -> C:\WINXP\system32\msxml4.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1935655697-1229272821-1417001333-1003_Classes\CLSID\{88D969C1-F192-11D4-A65F-0040963251E5}\InprocServer32 -> C:\WINXP\system32\msxml4.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1935655697-1229272821-1417001333-1003_Classes\CLSID\{88D969C2-F192-11D4-A65F-0040963251E5}\InprocServer32 -> C:\WINXP\system32\msxml4.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1935655697-1229272821-1417001333-1003_Classes\CLSID\{88D969C3-F192-11D4-A65F-0040963251E5}\InprocServer32 -> C:\WINXP\system32\msxml4.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1935655697-1229272821-1417001333-1003_Classes\CLSID\{88D969C4-F192-11D4-A65F-0040963251E5}\InprocServer32 -> C:\WINXP\system32\msxml4.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1935655697-1229272821-1417001333-1003_Classes\CLSID\{88D969C5-F192-11D4-A65F-0040963251E5}\InprocServer32 -> C:\WINXP\system32\msxml4.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1935655697-1229272821-1417001333-1003_Classes\CLSID\{88D969C6-F192-11D4-A65F-0040963251E5}\InprocServer32 -> C:\WINXP\system32\msxml4.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1935655697-1229272821-1417001333-1003_Classes\CLSID\{88D969C8-F192-11D4-A65F-0040963251E5}\InprocServer32 -> C:\WINXP\system32\msxml4.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1935655697-1229272821-1417001333-1003_Classes\CLSID\{88D969C9-F192-11D4-A65F-0040963251E5}\InprocServer32 -> C:\WINXP\system32\msxml4.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1935655697-1229272821-1417001333-1003_Classes\CLSID\{88D969CA-F192-11D4-A65F-0040963251E5}\InprocServer32 -> C:\WINXP\system32\msxml4.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1935655697-1229272821-1417001333-1003_Classes\CLSID\{88D969D6-F192-11D4-A65F-0040963251E5}\InprocServer32 -> C:\WINXP\system32\msxml4.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1935655697-1229272821-1417001333-1003_Classes\CLSID\{E69341A3-E6D2-4175-B60C-C9D3D6FA40F6}\localserver32 -> C:\Dokumente und Einstellungen\Alexander\Anwendungsdaten\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1935655697-1229272821-1417001333-1003_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Dokumente und Einstellungen\Alexander\Anwendungsdaten\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1935655697-1229272821-1417001333-1003_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Dokumente und Einstellungen\Alexander\Anwendungsdaten\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1935655697-1229272821-1417001333-1003_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Dokumente und Einstellungen\Alexander\Anwendungsdaten\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1935655697-1229272821-1417001333-1003_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Dokumente und Einstellungen\Alexander\Anwendungsdaten\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)

==================== Restore Points  =========================

07-01-2015 22:55:11 Systemprüfpunkt
09-01-2015 14:58:46 Systemprüfpunkt
13-01-2015 20:49:11 Systemprüfpunkt
19-01-2015 19:52:13 Systemprüfpunkt
24-01-2015 15:41:33 Systemprüfpunkt
03-02-2015 17:29:47 Systemprüfpunkt
09-02-2015 16:33:57 Systemprüfpunkt
11-02-2015 20:01:50 Systemprüfpunkt
18-02-2015 21:43:31 Systemprüfpunkt
18-02-2015 20:10:22 Systemprüfpunkt
25-02-2015 18:15:32 Systemprüfpunkt
26-02-2015 18:26:08 Systemprüfpunkt
27-02-2015 19:10:41 Systemprüfpunkt
02-03-2015 17:52:49 Avira AntiVir Personal - 02.03.2015 17:52
03-03-2015 17:18:04 Revo Uninstaller's restore point - Apple Mobile Device Support
03-03-2015 17:21:35 Revo Uninstaller's restore point - Apple Software Update
03-03-2015 18:15:53 Revo Uninstaller's restore point - Apple Application Support
03-03-2015 18:20:39 Revo Uninstaller's restore point - Apple Application Support

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2008-04-14 14:30 - 2014-06-18 18:51 - 00000027 ____A C:\WINXP\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINXP\Tasks\At2.job => C:\DOKUME~1\ALEXAN~1\ANWEND~1\ROCKET~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\WINXP\Tasks\GoogleUpdateTaskMachineCore.job => C:\Programme\Google\Update\GoogleUpdate.exe
Task: C:\WINXP\Tasks\GoogleUpdateTaskMachineUA.job => C:\Programme\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) ==============

2010-08-24 18:15 - 2005-01-06 18:33 - 00116224 _____ () C:\WINXP\system32\redmonnt.dll
2014-07-08 23:20 - 2005-09-16 14:01 - 00069632 _____ () C:\WINXP\sm56eng.dll
2014-07-08 23:20 - 2005-09-16 14:01 - 00061440 _____ () C:\WINXP\sm56fra.dll
2014-07-08 23:20 - 2005-09-16 14:01 - 00069632 _____ () C:\WINXP\sm56brz.dll
2014-07-08 23:20 - 2005-09-16 14:01 - 00049152 _____ () C:\WINXP\sm56chs.dll
2014-07-08 23:20 - 2005-09-16 14:01 - 00049152 _____ () C:\WINXP\sm56cht.dll
2014-07-08 23:20 - 2005-09-16 14:01 - 00061440 _____ () C:\WINXP\sm56ger.dll
2014-07-08 23:20 - 2005-09-16 14:01 - 00069632 _____ () C:\WINXP\sm56itl.dll
2014-07-08 23:20 - 2005-09-16 14:01 - 00053248 _____ () C:\WINXP\sm56jpn.dll
2014-07-08 23:20 - 2005-09-16 14:01 - 00069632 _____ () C:\WINXP\sm56spn.dll
2010-06-14 02:24 - 2010-06-14 02:24 - 00094208 _____ () C:\Programme\FileZilla FTP Client\fzshellext.dll
2014-06-24 16:36 - 2014-06-24 16:36 - 03852912 _____ () D:\Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Dokumente und Einstellungen\Alexander\Eigene Dateien\Anni und ich_Bennys Geburtstag.JPG:com.dropbox.attributes
AlternateDataStreams: C:\Dokumente und Einstellungen\Alexander\Eigene Dateien\Mareike und ich_Bennys Geburtstag.JPG:com.dropbox.attributes

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1935655697-1229272821-1417001333-1003\Control Panel\Desktop\\Wallpaper -> 
DNS Servers: 192.168.0.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} => "C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe"
MSCONFIG\startupreg: NeroFilterCheck => C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe
MSCONFIG\startupreg: RTHDCPL => RTHDCPL.EXE
MSCONFIG\startupreg: WinampAgent => D:\Winamp\winampa.exe

==================== Accounts: =============================

Administrator (S-1-5-21-1935655697-1229272821-1417001333-500 - Administrator - Enabled)
Alexander (S-1-5-21-1935655697-1229272821-1417001333-1003 - Administrator - Enabled) => %SystemDrive%\Dokumente und Einstellungen\Alexander
ASPNET (S-1-5-21-1935655697-1229272821-1417001333-1004 - Limited - Enabled)
Gast (S-1-5-21-1935655697-1229272821-1417001333-501 - Limited - Disabled)
Hilfeassistent (S-1-5-21-1935655697-1229272821-1417001333-1000 - Limited - Disabled)
SUPPORT_388945a0 (S-1-5-21-1935655697-1229272821-1417001333-1002 - Limited - Disabled)

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (03/02/2015 08:02:03 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Stillstehende Anwendung avscan.exe, Version 15.0.8.616, Stillstandmodul hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.

Error: (03/02/2015 08:00:20 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Stillstehende Anwendung avcenter.exe, Version 15.0.8.616, Stillstandmodul hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.

Error: (03/02/2015 07:48:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlgeschlagene Anwendung avscan.exe, Version 15.0.8.616, fehlgeschlagenes Modul avscplr.dll, Version 15.0.8.538, Fehleradresse 0x0000528b.
Das medienspezifische Ereignis für [avscan.exe!ws!] wird verarbeitet.

Error: (03/02/2015 06:28:17 PM) (Source: crypt32) (EventID: 11) (User: )
Description: Die Extrahierung der Drittanbieterstammlisten aus der automatischen Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> ist fehlgeschlagen mit dem Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.

Error: (03/02/2015 06:28:17 PM) (Source: crypt32) (EventID: 11) (User: )
Description: Die Extrahierung der Drittanbieterstammlisten aus der automatischen Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> ist fehlgeschlagen mit dem Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.

Error: (02/27/2015 08:29:08 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 3984

Error: (02/27/2015 08:29:08 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 3984

Error: (02/27/2015 08:29:08 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (02/27/2015 08:29:06 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 1968

Error: (02/27/2015 08:29:06 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 1968


System errors:
=============
Error: (03/03/2015 06:56:00 PM) (Source: Schedule) (EventID: 7901) (User: )
Description: Der Befehl "At2.job" konnte aufgrund folgenden Fehlers nicht ausgeführt werden: 
%%2147942403

Error: (03/03/2015 05:59:22 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "ELSA APOSpro Server" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%3

Error: (03/03/2015 05:59:22 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "ELSA PASS Server" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%3

Error: (03/03/2015 05:59:22 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "ELSA Historie Server" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%3

Error: (03/03/2015 05:59:22 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "ELSA DBA Server" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%3

Error: (03/03/2015 05:59:22 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "ELSA Administration Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%3

Error: (03/03/2015 05:59:22 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "avgntflt" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%31

Error: (03/03/2015 05:56:00 PM) (Source: Schedule) (EventID: 7901) (User: )
Description: Der Befehl "At2.job" konnte aufgrund folgenden Fehlers nicht ausgeführt werden: 
%%2147942403

Error: (03/03/2015 05:45:19 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "MBAMSwissArmy" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%31

Error: (03/03/2015 05:43:12 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "ELSA APOSpro Server" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%3


Microsoft Office Sessions:
=========================

==================== Memory info =========================== 

Processor: Intel(R) Core(TM)2 CPU T5500 @ 1.66GHz
Percentage of memory in use: 56%
Total physical RAM: 1022.11 MB
Available physical RAM: 441.94 MB
Total Pagefile: 2458.29 MB
Available Pagefile: 1723.89 MB
Total Virtual: 2047.88 MB
Available Virtual: 1939.12 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:19.53 GB) (Free:4.77 GB) NTFS ==>[Drive with boot components (Windows XP)]
Drive d: (Software) (Fixed) (Total:11.9 GB) (Free:2.54 GB) NTFS
Drive e: (Musik) (Fixed) (Total:27.16 GB) (Free:8.03 GB) NTFS
Drive g: (Bilder) (Fixed) (Total:53.19 GB) (Free:9.69 GB) NTFS
Drive i: (HBCD 15.2) (CDROM) (Total:0.58 GB) (Free:0 GB) CDFS
Drive j: (Elements) (Fixed) (Total:465.64 GB) (Free:44.33 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 111.8 GB) (Disk ID: 7597FE3A)
Partition 1: (Active) - (Size=19.5 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=92.2 GB) - (Type=OF Extended)

========================================================
Disk: 1 (Size: 465.8 GB) (Disk ID: 8D399BC0)
Partition 1: (Not Active) - (Size=465.8 GB) - (Type=0C)

==================== End Of Log ============================
         

hi,

Windows XP??????


Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

• WICHTIG: Speichere Combofix auf deinem Desktop
• Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.
• Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
• Combofix wird überprüfen, ob die Microsoft Windows Wiederherstellungskonsole installiert ist.
  Ist diese nicht installiert, erlaube Combofix diese herunter zu laden und zu installieren. Folge dazu einfach den Anweisungen und aktzeptiere die Endbenutzer-Lizenz.
  Bei heutiger Malware ist dies sehr empfehlenswert, da diese uns eine Möglichkeit bietet, dein System zu reparieren, falls etwas schief geht.
  Bestätige die Information, dass die Wiederherstellungskonsole installiert wurde mit Ja.
  Hinweis: Ist diese bereits installiert, wird Combofix mit der Malwareentfernung fortfahren.
• Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
• Wenn Combofix fertig ist, wird es eine Logfile erstellen.
• Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Hier das Ergebnis

ComboFix 15-03-01.01 - Alexander 04.03.2015  18:37:39.1.2 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.49.1031.18.1022.295 [GMT 4,5:30]
ausgeführt von:: c:\dokumente und einstellungen\Alexander\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\dokume~1\ALEXAN~1\LOKALE~1\Temp\avgnt.exe\Avira.OE.ExtApi.dll
c:\dokumente und einstellungen\Alexander\Lokale Einstellungen\Temp\avgnt.exe\Avira.OE.ExtApi.dll
c:\winxp\system32\drivers\ec3cd53c469d9e2a.sys
J:\autorun.inf
.
.
(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_SYSHOST32
-------\Service_SYSHOST32
-------\Legacy_ec3cd53c469d9e2a
-------\Service_ec3cd53c469d9e2a
.
.
(((((((((((((((((((((((   Dateien erstellt von 2015-02-04 bis 2015-03-04  ))))))))))))))))))))))))))))))
.
.
2015-03-03 13:20 . 2015-03-03 13:27	--------	d-----w-	C:\AdwCleaner
2015-03-03 12:59 . 2015-03-03 13:15	114904	----a-w-	c:\winxp\system32\drivers\536154D9.sys
2015-03-03 12:59 . 2015-03-03 12:59	114904	----a-w-	c:\winxp\system32\drivers\35A5549B.sys
2015-03-03 12:58 . 2015-03-03 12:58	110296	----a-w-	c:\winxp\system32\drivers\47067E77.sys
2015-03-03 12:55 . 2015-03-03 12:55	110296	----a-w-	c:\winxp\system32\drivers\48230029.sys
2015-03-03 12:43 . 2015-03-03 14:49	--------	d-----w-	C:\FRST
2015-03-02 13:50 . 2015-03-02 13:50	--------	d-----w-	c:\dokumente und einstellungen\Alexander\Anwendungsdaten\Avira
2015-03-02 13:50 . 2015-03-02 15:10	--------	d-----w-	c:\dokumente und einstellungen\All Users\Anwendungsdaten\Package Cache
2015-03-02 13:50 . 2015-03-02 13:50	--------	d-----w-	c:\dokumente und einstellungen\LocalService\Anwendungsdaten\Avira
2015-03-02 13:50 . 2015-03-02 13:50	--------	d-----r-	c:\dokumente und einstellungen\LocalService\Favoriten
2015-03-02 13:48 . 2015-02-04 13:21	37352	----a-w-	c:\winxp\system32\drivers\avkmgr.sys
2015-03-02 13:48 . 2015-02-04 13:21	136216	----a-w-	c:\winxp\system32\drivers\avipbb.sys
2015-03-02 13:47 . 2015-03-02 14:02	--------	d-----w-	c:\programme\Avira
2015-03-02 13:47 . 2015-03-02 13:51	--------	d-----w-	c:\dokumente und einstellungen\All Users\Anwendungsdaten\Avira
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-02-04 13:21 . 2010-01-08 08:50	105864	----a-w-	c:\winxp\system32\drivers\avgntflt.sys
2015-01-02 07:13 . 2015-01-02 07:15	96680	----a-w-	c:\winxp\system32\WindowsAccessBridge.dll
2015-01-02 07:13 . 2015-01-02 07:15	146432	----a-w-	c:\winxp\system32\javacpl.cpl
2006-05-03 07:36	163328	--sha-r-	c:\winxp\system32\flvDX.dll
2007-02-21 09:17	31232	--sha-r-	c:\winxp\system32\msfDX.dll
2008-03-16 11:00	216064	--sha-r-	c:\winxp\system32\nbDX.dll
2010-01-06 19:30	107520	--sha-r-	c:\winxp\system32\TAKDSDecoder.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[7] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\atapi.sys
[7] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\winxp\system32\ReinstallBackups\0006\DriverFiles\i386\atapi.sys
[7] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\atapi.sys
[7] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\atapi.sys
[7] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\winxp\system32\drivers\atapi.sys
.
[7] 2008-04-14 . B153AFFAC761E7F5FCFA822B9C4E97BC . 14336 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\asyncmac.sys
[7] 2008-04-14 . B153AFFAC761E7F5FCFA822B9C4E97BC . 14336 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\asyncmac.sys
[7] 2008-04-14 . B153AFFAC761E7F5FCFA822B9C4E97BC . 14336 . . [5.1.2600.5512] . . c:\winxp\system32\drivers\asyncmac.sys
[7] 2008-04-13 . B153AFFAC761E7F5FCFA822B9C4E97BC . 14336 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\asyncmac.sys
.
[7] 2008-04-14 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\winxp\erdnt\cache\beep.sys
[7] 2008-04-14 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\winxp\system32\dllcache\beep.sys
[7] 2008-04-14 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\winxp\system32\drivers\beep.sys
.
[7] 2008-04-14 . 1704D8C4C8807B889E43C649B478A452 . 25216 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\kbdclass.sys
[7] 2008-04-14 . 1704D8C4C8807B889E43C649B478A452 . 25216 . . [5.1.2600.5512] . . c:\winxp\system32\drivers\kbdclass.sys
[7] 2008-04-14 . 1704D8C4C8807B889E43C649B478A452 . 25216 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\kbdclass.sys
.
[7] 2008-04-14 . 1DF7F42665C94B825322FAE71721130D . 182656 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\ndis.sys
[7] 2008-04-14 . 1DF7F42665C94B825322FAE71721130D . 182656 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\ndis.sys
[7] 2008-04-14 . 1DF7F42665C94B825322FAE71721130D . 182656 . . [5.1.2600.5512] . . c:\winxp\system32\drivers\ndis.sys
[7] 2008-04-13 . 1DF7F42665C94B825322FAE71721130D . 182656 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\ndis.sys
.
[7] 2008-04-14 . 78A08DD6A8D65E697C18E1DB01C5CDCA . 574976 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\ntfs.sys
[7] 2008-04-14 . 78A08DD6A8D65E697C18E1DB01C5CDCA . 574976 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\ntfs.sys
[7] 2008-04-14 . 78A08DD6A8D65E697C18E1DB01C5CDCA . 574976 . . [5.1.2600.5512] . . c:\winxp\system32\drivers\ntfs.sys
[7] 2008-04-13 . 78A08DD6A8D65E697C18E1DB01C5CDCA . 574976 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\ntfs.sys
.
[7] 2008-04-14 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\winxp\erdnt\cache\null.sys
[7] 2008-04-14 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\winxp\system32\dllcache\null.sys
[7] 2008-04-14 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\winxp\system32\drivers\null.sys
.
[7] 2008-04-14 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\tcpip.sys
[7] 2008-04-14 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\tcpip.sys
[7] 2008-04-14 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\winxp\system32\drivers\tcpip.sys
[7] 2008-04-13 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\tcpip.sys
.
[7] 2008-04-14 . B42057F06BBB98B31876C0B3F2B54E33 . 77824 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\browser.dll
[7] 2008-04-14 . B42057F06BBB98B31876C0B3F2B54E33 . 77824 . . [5.1.2600.5512] . . c:\winxp\system32\browser.dll
[7] 2008-04-14 . B42057F06BBB98B31876C0B3F2B54E33 . 77824 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\browser.dll
[7] 2008-04-14 . B42057F06BBB98B31876C0B3F2B54E33 . 77824 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\browser.dll
.
[7] 2008-04-14 . AFB8261B56CBA0D86AEB6DF682AF9785 . 13312 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\lsass.exe
[7] 2008-04-14 . AFB8261B56CBA0D86AEB6DF682AF9785 . 13312 . . [5.1.2600.5512] . . c:\winxp\system32\lsass.exe
[7] 2008-04-14 . AFB8261B56CBA0D86AEB6DF682AF9785 . 13312 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\lsass.exe
[7] 2008-04-14 . AFB8261B56CBA0D86AEB6DF682AF9785 . 13312 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\lsass.exe
.
[7] 2008-04-14 . E6D88F1F6745BF00B57E7855A2AB696C . 198144 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\netman.dll
[7] 2008-04-14 . E6D88F1F6745BF00B57E7855A2AB696C . 198144 . . [5.1.2600.5512] . . c:\winxp\system32\netman.dll
[7] 2008-04-14 . E6D88F1F6745BF00B57E7855A2AB696C . 198144 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\netman.dll
[7] 2008-04-14 . E6D88F1F6745BF00B57E7855A2AB696C . 198144 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\netman.dll
.
[7] 2008-04-14 10:00 . D0DE8A2EC95184E5193BB4B3112E29DF . 846848 . . [2001.12.4414.700] . . c:\winxp\erdnt\cache\comres.dll
[7] 2008-04-14 10:00 . D0DE8A2EC95184E5193BB4B3112E29DF . 846848 . . [2001.12.4414.700] . . c:\winxp\system32\comres.dll
[7] 2008-04-14 10:00 . D0DE8A2EC95184E5193BB4B3112E29DF . 846848 . . [2001.12.4414.700] . . c:\winxp\system32\dllcache\comres.dll
[7] 2008-04-14 03:22 . D0DE8A2EC95184E5193BB4B3112E29DF . 846848 . . [2001.12.4414.700] . . c:\winxp\ServicePackFiles\i386\comres.dll
.
[7] 2008-04-14 . D6F603772A789BB3228F310D650B8BD1 . 409088 . . [6.7.2600.5512] . . c:\winxp\erdnt\cache\qmgr.dll
[7] 2008-04-14 . D6F603772A789BB3228F310D650B8BD1 . 409088 . . [6.7.2600.5512] . . c:\winxp\system32\qmgr.dll
[7] 2008-04-14 . D6F603772A789BB3228F310D650B8BD1 . 409088 . . [6.7.2600.5512] . . c:\winxp\system32\dllcache\qmgr.dll
[7] 2008-04-14 . D6F603772A789BB3228F310D650B8BD1 . 409088 . . [6.7.2600.5512] . . c:\winxp\ServicePackFiles\i386\qmgr.dll
[7] 2008-04-14 . D6F603772A789BB3228F310D650B8BD1 . 409088 . . [6.7.2600.5512] . . c:\winxp\system32\bits\qmgr.dll
.
[7] 2008-04-14 . E970C2296916BF4A2F958680016FE312 . 399360 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\rpcss.dll
[7] 2008-04-14 . E970C2296916BF4A2F958680016FE312 . 399360 . . [5.1.2600.5512] . . c:\winxp\system32\rpcss.dll
[7] 2008-04-14 . E970C2296916BF4A2F958680016FE312 . 399360 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\rpcss.dll
[7] 2008-04-14 . E970C2296916BF4A2F958680016FE312 . 399360 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\rpcss.dll
.
[7] 2008-04-14 . 4BB6A83640F1D1792AD21CE767B621C6 . 109056 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\services.exe
[7] 2008-04-14 . 4BB6A83640F1D1792AD21CE767B621C6 . 109056 . . [5.1.2600.5512] . . c:\winxp\system32\services.exe
[7] 2008-04-14 . 4BB6A83640F1D1792AD21CE767B621C6 . 109056 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\services.exe
[7] 2008-04-14 . 4BB6A83640F1D1792AD21CE767B621C6 . 109056 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\services.exe
.
[7] 2008-04-14 . 39356A9CDB6753A6D13A4072A9F5A4BB . 57856 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\spoolsv.exe
[7] 2008-04-14 . 39356A9CDB6753A6D13A4072A9F5A4BB . 57856 . . [5.1.2600.5512] . . c:\winxp\system32\spoolsv.exe
[7] 2008-04-14 . 39356A9CDB6753A6D13A4072A9F5A4BB . 57856 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\spoolsv.exe
[7] 2008-04-14 . 39356A9CDB6753A6D13A4072A9F5A4BB . 57856 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\spoolsv.exe
.
[7] 2008-04-14 . F09A527B422E25C478E38CAA0E44417A . 513024 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\winlogon.exe
[7] 2008-04-14 . F09A527B422E25C478E38CAA0E44417A . 513024 . . [5.1.2600.5512] . . c:\winxp\system32\winlogon.exe
[7] 2008-04-14 . F09A527B422E25C478E38CAA0E44417A . 513024 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\winlogon.exe
[7] 2008-04-14 . F09A527B422E25C478E38CAA0E44417A . 513024 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\winlogon.exe
.
[7] 2008-04-14 . 65E60C18DDB0215C201FF75E32D564C8 . 111616 . . [5.4.3790.5512] . . c:\winxp\ServicePackFiles\i386\wuauclt.exe
[7] 2007-04-16 . 3A83A45E7DD5276315AA20245E7C32BF . 53080 . . [7.0.6000.374] . . c:\winxp\erdnt\cache\wuauclt.exe
[7] 2007-04-16 . 3A83A45E7DD5276315AA20245E7C32BF . 53080 . . [7.0.6000.374] . . c:\winxp\system32\wuauclt.exe
[7] 2007-04-16 . 3A83A45E7DD5276315AA20245E7C32BF . 53080 . . [7.0.6000.374] . . c:\winxp\system32\dllcache\wuauclt.exe
.
[7] 2008-04-14 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\ipsec.sys
[7] 2008-04-14 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\ipsec.sys
[7] 2008-04-14 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\winxp\system32\drivers\ipsec.sys
[7] 2008-04-13 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\ipsec.sys
.
[7] 2008-04-14 . AD28671D1B83A386B070DC451A113C13 . 617472 . . [5.82] . . c:\winxp\erdnt\cache\comctl32.dll
[7] 2008-04-14 . AD28671D1B83A386B070DC451A113C13 . 617472 . . [5.82] . . c:\winxp\system32\comctl32.dll
[7] 2008-04-14 . AD28671D1B83A386B070DC451A113C13 . 617472 . . [5.82] . . c:\winxp\system32\dllcache\comctl32.dll
[7] 2008-04-14 . 3C93CE6C6985C55952B7BE6673E9FD15 . 1054208 . . [6.0] . . c:\winxp\WinSxS\InstallTemp\8170452\comctl32.dll
[7] 2008-04-14 . AEF3D788DBF40C7C4D204EA45EB0C505 . 921088 . . [6.0] . . c:\winxp\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll
[7] 2008-04-14 . AD28671D1B83A386B070DC451A113C13 . 617472 . . [5.82] . . c:\winxp\ServicePackFiles\i386\comctl32.dll
[7] 2008-04-14 . 3C93CE6C6985C55952B7BE6673E9FD15 . 1054208 . . [6.0] . . c:\winxp\WinSxS\InstallTemp\1964498\comctl32.dll
[7] 2008-04-14 . 3C93CE6C6985C55952B7BE6673E9FD15 . 1054208 . . [6.0] . . c:\winxp\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
.
[7] 2008-04-14 . 611F824E5C703A5A899F84C5F1699E4D . 62464 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\cryptsvc.dll
[7] 2008-04-14 . 611F824E5C703A5A899F84C5F1699E4D . 62464 . . [5.1.2600.5512] . . c:\winxp\system32\cryptsvc.dll
[7] 2008-04-14 . 611F824E5C703A5A899F84C5F1699E4D . 62464 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\cryptsvc.dll
[7] 2008-04-14 . 611F824E5C703A5A899F84C5F1699E4D . 62464 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\cryptsvc.dll
.
[7] 2008-12-10 15:31 . ADA7241C16F3F42C7F210539FAD5F3AA . 253952 . . [2001.12.4414.706] . . c:\winxp\erdnt\cache\es.dll
[7] 2008-12-10 15:31 . ADA7241C16F3F42C7F210539FAD5F3AA . 253952 . . [2001.12.4414.706] . . c:\winxp\system32\es.dll
[7] 2008-12-10 15:31 . ADA7241C16F3F42C7F210539FAD5F3AA . 253952 . . [2001.12.4414.706] . . c:\winxp\system32\dllcache\es.dll
[7] 2008-04-14 03:22 . 0F3EDAEE1EF97CF3DB2BE23A7289B78C . 246272 . . [2001.12.4414.701] . . c:\winxp\ServicePackFiles\i386\es.dll
.
[7] 2008-04-14 . F9954695D246B33A5BF105029A4C6AB6 . 110080 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\imm32.dll
[7] 2008-04-14 . F9954695D246B33A5BF105029A4C6AB6 . 110080 . . [5.1.2600.5512] . . c:\winxp\system32\imm32.dll
[7] 2008-04-14 . F9954695D246B33A5BF105029A4C6AB6 . 110080 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\imm32.dll
[7] 2008-04-14 . F9954695D246B33A5BF105029A4C6AB6 . 110080 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\imm32.dll
.
[7] 2008-04-14 . 4C897C69754D88F496339B1A666907C1 . 1063424 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\kernel32.dll
[7] 2008-04-14 . 4C897C69754D88F496339B1A666907C1 . 1063424 . . [5.1.2600.5512] . . c:\winxp\system32\kernel32.dll
[7] 2008-04-14 . 4C897C69754D88F496339B1A666907C1 . 1063424 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\kernel32.dll
[7] 2008-04-14 . 4C897C69754D88F496339B1A666907C1 . 1063424 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\kernel32.dll
.
[7] 2008-04-14 . 5543A9D4A1D0F9F84092482A9373A024 . 19968 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\linkinfo.dll
[7] 2008-04-14 . 5543A9D4A1D0F9F84092482A9373A024 . 19968 . . [5.1.2600.5512] . . c:\winxp\system32\linkinfo.dll
[7] 2008-04-14 . 5543A9D4A1D0F9F84092482A9373A024 . 19968 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\linkinfo.dll
[7] 2008-04-14 . 5543A9D4A1D0F9F84092482A9373A024 . 19968 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\linkinfo.dll
.
[7] 2008-04-14 . F38F3C47BBFFD748C1359AB171C3A630 . 22016 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\lpk.dll
[7] 2008-04-14 . F38F3C47BBFFD748C1359AB171C3A630 . 22016 . . [5.1.2600.5512] . . c:\winxp\system32\lpk.dll
[7] 2008-04-14 . F38F3C47BBFFD748C1359AB171C3A630 . 22016 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\lpk.dll
[7] 2008-04-14 . F38F3C47BBFFD748C1359AB171C3A630 . 22016 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\lpk.dll
.
[7] 2008-10-16 . AB864B71DF01CC98EAE726DF4BAF73D2 . 3593216 . . [7.00.6000.16762] . . c:\winxp\erdnt\cache\mshtml.dll
[7] 2008-10-16 . AB864B71DF01CC98EAE726DF4BAF73D2 . 3593216 . . [7.00.6000.16762] . . c:\winxp\system32\mshtml.dll
[7] 2008-10-16 . AB864B71DF01CC98EAE726DF4BAF73D2 . 3593216 . . [7.00.6000.16762] . . c:\winxp\system32\dllcache\mshtml.dll
[7] 2008-10-16 . C998B6D5E64E11CE8EA8BB22A51CA570 . 3595264 . . [7.00.6000.20935] . . c:\winxp\$hf_mig$\KB958215-IE7\SP2QFE\mshtml.dll
[7] 2008-04-14 . 72AE55A9FFBC60650339CB12E35C7DD5 . 3066880 . . [6.00.2900.5512] . . c:\winxp\ServicePackFiles\i386\mshtml.dll
.
[7] 2008-04-14 . C6A6E53A0C34EC87883137A6CB87AE5E . 343040 . . [7.0.2600.5512] . . c:\winxp\erdnt\cache\msvcrt.dll
[7] 2008-04-14 . C6A6E53A0C34EC87883137A6CB87AE5E . 343040 . . [7.0.2600.5512] . . c:\winxp\system32\msvcrt.dll
[7] 2008-04-14 . C6A6E53A0C34EC87883137A6CB87AE5E . 343040 . . [7.0.2600.5512] . . c:\winxp\system32\dllcache\msvcrt.dll
[7] 2008-04-14 . 4200BE3808F6406DBE45A7B88DAE5035 . 322560 . . [7.0.2600.0] . . c:\winxp\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a\msvcrt.dll
[7] 2008-04-14 . C6A6E53A0C34EC87883137A6CB87AE5E . 343040 . . [7.0.2600.5512] . . c:\winxp\ServicePackFiles\i386\msvcrt.dll
[7] 2008-04-14 . C536AAD8A71608FE33CD956214EDD366 . 343040 . . [7.0.2600.5512] . . c:\winxp\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.5512_x-ww_3fd60d63\msvcrt.dll
.
[7] 2008-04-14 . F12B9D9A069331877D006CC81B4735F9 . 247296 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\mswsock.dll
[7] 2008-04-14 . F12B9D9A069331877D006CC81B4735F9 . 247296 . . [5.1.2600.5512] . . c:\winxp\system32\mswsock.dll
[7] 2008-04-14 . F12B9D9A069331877D006CC81B4735F9 . 247296 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\mswsock.dll
[7] 2008-04-14 . F12B9D9A069331877D006CC81B4735F9 . 247296 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\mswsock.dll
.
[7] 2008-04-14 . 0098D35F91DEAB9C127360A877F2CF84 . 407040 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\netlogon.dll
[7] 2008-04-14 . 0098D35F91DEAB9C127360A877F2CF84 . 407040 . . [5.1.2600.5512] . . c:\winxp\system32\netlogon.dll
[7] 2008-04-14 . 0098D35F91DEAB9C127360A877F2CF84 . 407040 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\netlogon.dll
[7] 2008-04-14 . 0098D35F91DEAB9C127360A877F2CF84 . 407040 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\netlogon.dll
.
[7] 2008-04-14 . C8C0BDABC966B6C24D337DF0A0A399E1 . 17408 . . [6.00.2900.5512] . . c:\winxp\erdnt\cache\powrprof.dll
[7] 2008-04-14 . C8C0BDABC966B6C24D337DF0A0A399E1 . 17408 . . [6.00.2900.5512] . . c:\winxp\system32\powrprof.dll
[7] 2008-04-14 . C8C0BDABC966B6C24D337DF0A0A399E1 . 17408 . . [6.00.2900.5512] . . c:\winxp\system32\dllcache\powrprof.dll
[7] 2008-04-14 . C8C0BDABC966B6C24D337DF0A0A399E1 . 17408 . . [6.00.2900.5512] . . c:\winxp\ServicePackFiles\i386\powrprof.dll
.
[7] 2008-04-14 . 5132443DF6FC3771A17AB4AE55DCBC28 . 187904 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\scecli.dll
[7] 2008-04-14 . 5132443DF6FC3771A17AB4AE55DCBC28 . 187904 . . [5.1.2600.5512] . . c:\winxp\system32\scecli.dll
[7] 2008-04-14 . 5132443DF6FC3771A17AB4AE55DCBC28 . 187904 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\scecli.dll
[7] 2008-04-14 . 5132443DF6FC3771A17AB4AE55DCBC28 . 187904 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\scecli.dll
.
[7] 2008-04-14 . 44161A59DC33AC2EA9C95438ADFFFB7F . 5120 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\sfc.dll
[7] 2008-04-14 . 44161A59DC33AC2EA9C95438ADFFFB7F . 5120 . . [5.1.2600.5512] . . c:\winxp\system32\sfc.dll
[7] 2008-04-14 . 44161A59DC33AC2EA9C95438ADFFFB7F . 5120 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\sfc.dll
[7] 2008-04-14 . 44161A59DC33AC2EA9C95438ADFFFB7F . 5120 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\sfc.dll
.
[7] 2008-04-14 . 4FBC75B74479C7A6F829E0CA19DF3366 . 14336 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\svchost.exe
[7] 2008-04-14 . 4FBC75B74479C7A6F829E0CA19DF3366 . 14336 . . [5.1.2600.5512] . . c:\winxp\system32\svchost.exe
[7] 2008-04-14 . 4FBC75B74479C7A6F829E0CA19DF3366 . 14336 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\svchost.exe
[7] 2008-04-14 . 4FBC75B74479C7A6F829E0CA19DF3366 . 14336 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\svchost.exe
.
[7] 2008-04-14 . 05903CAC4B98908D55EA5774775B382E . 249856 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\tapisrv.dll
[7] 2008-04-14 . 05903CAC4B98908D55EA5774775B382E . 249856 . . [5.1.2600.5512] . . c:\winxp\system32\tapisrv.dll
[7] 2008-04-14 . 05903CAC4B98908D55EA5774775B382E . 249856 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\tapisrv.dll
[7] 2008-04-14 . 05903CAC4B98908D55EA5774775B382E . 249856 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\tapisrv.dll
.
[7] 2008-04-14 . B0050CC5340E3A0760DD8B417FF7AEBD . 580096 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\user32.dll
[7] 2008-04-14 . B0050CC5340E3A0760DD8B417FF7AEBD . 580096 . . [5.1.2600.5512] . . c:\winxp\system32\user32.dll
[7] 2008-04-14 . B0050CC5340E3A0760DD8B417FF7AEBD . 580096 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\user32.dll
[7] 2008-04-14 . B0050CC5340E3A0760DD8B417FF7AEBD . 580096 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\user32.dll
.
[7] 2008-04-14 . 788F95312E26389D596C0FA55834E106 . 26624 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\userinit.exe
[7] 2008-04-14 . 788F95312E26389D596C0FA55834E106 . 26624 . . [5.1.2600.5512] . . c:\winxp\system32\userinit.exe
[7] 2008-04-14 . 788F95312E26389D596C0FA55834E106 . 26624 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\userinit.exe
[7] 2008-04-14 . 788F95312E26389D596C0FA55834E106 . 26624 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\userinit.exe
.
[7] 2008-10-16 . 5A1F997EC096EF26F3A3880347F5F9D8 . 827904 . . [7.00.6000.20935] . . c:\winxp\$hf_mig$\KB958215-IE7\SP2QFE\wininet.dll
[7] 2008-10-16 . CBAAEBDFC6F9291D2D31E36FE1AD19AC . 826368 . . [7.00.6000.16762] . . c:\winxp\erdnt\cache\wininet.dll
[7] 2008-10-16 . CBAAEBDFC6F9291D2D31E36FE1AD19AC . 826368 . . [7.00.6000.16762] . . c:\winxp\system32\wininet.dll
[7] 2008-10-16 . CBAAEBDFC6F9291D2D31E36FE1AD19AC . 826368 . . [7.00.6000.16762] . . c:\winxp\system32\dllcache\wininet.dll
[7] 2008-04-14 . B4AEE98A48917B274FACFB78BBE0BC84 . 671744 . . [6.00.2900.5512] . . c:\winxp\ServicePackFiles\i386\wininet.dll
.
[7] 2008-04-14 . 6A35E2D6F5F052C84EC2CEB296389439 . 82432 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\ws2_32.dll
[7] 2008-04-14 . 6A35E2D6F5F052C84EC2CEB296389439 . 82432 . . [5.1.2600.5512] . . c:\winxp\system32\ws2_32.dll
[7] 2008-04-14 . 6A35E2D6F5F052C84EC2CEB296389439 . 82432 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\ws2_32.dll
[7] 2008-04-14 . 6A35E2D6F5F052C84EC2CEB296389439 . 82432 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\ws2_32.dll
.
[7] 2008-04-14 . C7D8A0517CBF16B84F657DE87EBE9D4B . 19968 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\ws2help.dll
[7] 2008-04-14 . C7D8A0517CBF16B84F657DE87EBE9D4B . 19968 . . [5.1.2600.5512] . . c:\winxp\system32\ws2help.dll
[7] 2008-04-14 . C7D8A0517CBF16B84F657DE87EBE9D4B . 19968 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\ws2help.dll
[7] 2008-04-14 . C7D8A0517CBF16B84F657DE87EBE9D4B . 19968 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\ws2help.dll
.
[7] 2008-04-14 . 418045A93CD87A352098AB7DABE1B53E . 1036800 . . [6.00.2900.5512] . . c:\winxp\explorer.exe
[7] 2008-04-14 . 418045A93CD87A352098AB7DABE1B53E . 1036800 . . [6.00.2900.5512] . . c:\winxp\erdnt\cache\explorer.exe
[7] 2008-04-14 . 418045A93CD87A352098AB7DABE1B53E . 1036800 . . [6.00.2900.5512] . . c:\winxp\system32\dllcache\explorer.exe
[7] 2008-04-14 . 418045A93CD87A352098AB7DABE1B53E . 1036800 . . [6.00.2900.5512] . . c:\winxp\ServicePackFiles\i386\explorer.exe
.
[7] 2008-04-14 . AD9226BF3CED13636083BB9C76E9D2A2 . 153600 . . [5.1.2600.5512] . . c:\winxp\regedit.exe
[7] 2008-04-14 . AD9226BF3CED13636083BB9C76E9D2A2 . 153600 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\regedit.exe
[7] 2008-04-14 . AD9226BF3CED13636083BB9C76E9D2A2 . 153600 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\regedit.exe
[7] 2008-04-14 . AD9226BF3CED13636083BB9C76E9D2A2 . 153600 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\regedit.exe
.
[7] 2008-04-14 . E08D638BA3D3DD6DF6E31216AB66AE0B . 1287680 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\ole32.dll
[7] 2008-04-14 . E08D638BA3D3DD6DF6E31216AB66AE0B . 1287680 . . [5.1.2600.5512] . . c:\winxp\system32\ole32.dll
[7] 2008-04-14 . E08D638BA3D3DD6DF6E31216AB66AE0B . 1287680 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\ole32.dll
[7] 2008-04-14 . E08D638BA3D3DD6DF6E31216AB66AE0B . 1287680 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\ole32.dll
.
[7] 2008-04-14 . 052F968390A85D37D5EE8BE3AB2A83A2 . 406016 . . [1.0420.2600.5512] . . c:\winxp\erdnt\cache\usp10.dll
[7] 2008-04-14 . 052F968390A85D37D5EE8BE3AB2A83A2 . 406016 . . [1.0420.2600.5512] . . c:\winxp\system32\usp10.dll
[7] 2008-04-14 . 052F968390A85D37D5EE8BE3AB2A83A2 . 406016 . . [1.0420.2600.5512] . . c:\winxp\system32\dllcache\usp10.dll
[7] 2008-04-14 . 052F968390A85D37D5EE8BE3AB2A83A2 . 406016 . . [1.0420.2600.5512] . . c:\winxp\ServicePackFiles\i386\usp10.dll
.
[7] 2008-04-14 . 671ABB33C712B1585A5BF7ADD36AD96E . 4096 . . [5.3.2600.5512] . . c:\winxp\ServicePackFiles\i386\ksuser.dll
[7] 2008-04-14 . 671ABB33C712B1585A5BF7ADD36AD96E . 4096 . . [5.3.2600.5512] . . c:\winxp\erdnt\cache\ksuser.dll
[7] 2008-04-14 . 671ABB33C712B1585A5BF7ADD36AD96E . 4096 . . [5.3.2600.5512] . . c:\winxp\system32\ksuser.dll
[7] 2008-04-14 . 671ABB33C712B1585A5BF7ADD36AD96E . 4096 . . [5.3.2600.5512] . . c:\winxp\system32\dllcache\ksuser.dll
.
[7] 2008-04-14 . 01B4E6E990B6C5EA8856D96C7FD044B2 . 15360 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\ctfmon.exe
[7] 2008-04-14 . 01B4E6E990B6C5EA8856D96C7FD044B2 . 15360 . . [5.1.2600.5512] . . c:\winxp\system32\ctfmon.exe
[7] 2008-04-14 . 01B4E6E990B6C5EA8856D96C7FD044B2 . 15360 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\ctfmon.exe
[7] 2008-04-14 . 01B4E6E990B6C5EA8856D96C7FD044B2 . 15360 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\ctfmon.exe
.
[7] 2008-04-14 . 40602EBFBE06AA075C8E4560743F6883 . 135168 . . [6.00.2900.5512] . . c:\winxp\erdnt\cache\shsvcs.dll
[7] 2008-04-14 . 40602EBFBE06AA075C8E4560743F6883 . 135168 . . [6.00.2900.5512] . . c:\winxp\system32\shsvcs.dll
[7] 2008-04-14 . 40602EBFBE06AA075C8E4560743F6883 . 135168 . . [6.00.2900.5512] . . c:\winxp\system32\dllcache\shsvcs.dll
[7] 2008-04-14 . 40602EBFBE06AA075C8E4560743F6883 . 135168 . . [6.00.2900.5512] . . c:\winxp\ServicePackFiles\i386\shsvcs.dll
.
[7] 2008-04-14 . DC4E223F5813150073FB5CC63D13293B . 4608 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\msimg32.dll
[7] 2008-04-14 . DC4E223F5813150073FB5CC63D13293B . 4608 . . [5.1.2600.5512] . . c:\winxp\system32\msimg32.dll
[7] 2008-04-14 . DC4E223F5813150073FB5CC63D13293B . 4608 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\msimg32.dll
[7] 2008-04-14 . DC4E223F5813150073FB5CC63D13293B . 4608 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\msimg32.dll
.
[7] 2008-04-14 . FE77A85495065F3AD59C5C65B6C54182 . 171520 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\srsvc.dll
[7] 2008-04-14 . FE77A85495065F3AD59C5C65B6C54182 . 171520 . . [5.1.2600.5512] . . c:\winxp\system32\srsvc.dll
[7] 2008-04-14 . FE77A85495065F3AD59C5C65B6C54182 . 171520 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\srsvc.dll
[7] 2008-04-14 . FE77A85495065F3AD59C5C65B6C54182 . 171520 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\srsvc.dll
.
[7] 2008-04-14 . EDAFBE25FB6480CE68F688BA691890DC . 13824 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\wscntfy.exe
[7] 2008-04-14 . EDAFBE25FB6480CE68F688BA691890DC . 13824 . . [5.1.2600.5512] . . c:\winxp\system32\wscntfy.exe
[7] 2008-04-14 . EDAFBE25FB6480CE68F688BA691890DC . 13824 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\wscntfy.exe
[7] 2008-04-14 . EDAFBE25FB6480CE68F688BA691890DC . 13824 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\wscntfy.exe
.
[7] 2008-04-14 . 0ADA34871A2E1CD2CAAFED1237A47750 . 129024 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\xmlprov.dll
[7] 2008-04-14 . 0ADA34871A2E1CD2CAAFED1237A47750 . 129024 . . [5.1.2600.5512] . . c:\winxp\system32\xmlprov.dll
[7] 2008-04-14 . 0ADA34871A2E1CD2CAAFED1237A47750 . 129024 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\xmlprov.dll
[7] 2008-04-14 . 0ADA34871A2E1CD2CAAFED1237A47750 . 129024 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\xmlprov.dll
.
[7] 2008-04-14 . 95092EFBE367A108ECDD5D6E439754C3 . 731648 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\ntdll.dll
[7] 2008-04-14 . 95092EFBE367A108ECDD5D6E439754C3 . 731648 . . [5.1.2600.5512] . . c:\winxp\system32\ntdll.dll
[7] 2008-04-14 . 95092EFBE367A108ECDD5D6E439754C3 . 731648 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\ntdll.dll
[7] 2008-04-14 . 95092EFBE367A108ECDD5D6E439754C3 . 731648 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\ntdll.dll
.
[7] 2008-04-14 . 275CAC40038A2643833B5F48FB474857 . 177152 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\MSCTFIME.IME
[7] 2008-04-14 . 275CAC40038A2643833B5F48FB474857 . 177152 . . [5.1.2600.5512] . . c:\winxp\system32\MSCTFIME.IME
[7] 2008-04-14 . 275CAC40038A2643833B5F48FB474857 . 177152 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\msctfime.ime
[7] 2008-04-14 . 275CAC40038A2643833B5F48FB474857 . 177152 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\msctfime.ime
.
[7] 2008-04-14 . 04955AA695448C181B367D964AF158AA . 56320 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\eventlog.dll
[7] 2008-04-14 . 04955AA695448C181B367D964AF158AA . 56320 . . [5.1.2600.5512] . . c:\winxp\system32\eventlog.dll
[7] 2008-04-14 . 04955AA695448C181B367D964AF158AA . 56320 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\eventlog.dll
[7] 2008-04-14 . 04955AA695448C181B367D964AF158AA . 56320 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\eventlog.dll
.
[7] 2008-04-14 . 5251425B86EA4A3532B8BB8D14044E61 . 1571840 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\sfcfiles.dll
[7] 2008-04-14 . 5251425B86EA4A3532B8BB8D14044E61 . 1571840 . . [5.1.2600.5512] . . c:\winxp\system32\sfcfiles.dll
.
[7] 2008-04-14 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\ipsec.sys
[7] 2008-04-14 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\ipsec.sys
[7] 2008-04-14 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\winxp\system32\drivers\ipsec.sys
[7] 2008-04-13 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\ipsec.sys
.
[7] 2008-04-14 . E4CD1F3D84E1C2CA0B8CF7501E201593 . 59904 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\regsvc.dll
[7] 2008-04-14 . E4CD1F3D84E1C2CA0B8CF7501E201593 . 59904 . . [5.1.2600.5512] . . c:\winxp\system32\regsvc.dll
[7] 2008-04-14 . E4CD1F3D84E1C2CA0B8CF7501E201593 . 59904 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\regsvc.dll
[7] 2008-04-14 . E4CD1F3D84E1C2CA0B8CF7501E201593 . 59904 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\regsvc.dll
.
[7] 2008-04-14 . A050194A44D7FA8D7186ED2F4E8367AE . 193536 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\schedsvc.dll
[7] 2008-04-14 . A050194A44D7FA8D7186ED2F4E8367AE . 193536 . . [5.1.2600.5512] . . c:\winxp\system32\schedsvc.dll
[7] 2008-04-14 . A050194A44D7FA8D7186ED2F4E8367AE . 193536 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\schedsvc.dll
[7] 2008-04-14 . A050194A44D7FA8D7186ED2F4E8367AE . 193536 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\schedsvc.dll
.
[7] 2008-04-14 . 4DF5B05DFAEC29E13E1ED6F6EE12C500 . 71680 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\ssdpsrv.dll
[7] 2008-04-14 . 4DF5B05DFAEC29E13E1ED6F6EE12C500 . 71680 . . [5.1.2600.5512] . . c:\winxp\system32\ssdpsrv.dll
[7] 2008-04-14 . 4DF5B05DFAEC29E13E1ED6F6EE12C500 . 71680 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\ssdpsrv.dll
[7] 2008-04-14 . 4DF5B05DFAEC29E13E1ED6F6EE12C500 . 71680 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\ssdpsrv.dll
.
[7] 2008-04-14 . B7DE02C863D8F5A005A7BF375375A6A4 . 297472 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\termsrv.dll
[7] 2008-04-14 . B7DE02C863D8F5A005A7BF375375A6A4 . 297472 . . [5.1.2600.5512] . . c:\winxp\system32\termsrv.dll
[7] 2008-04-14 . B7DE02C863D8F5A005A7BF375375A6A4 . 297472 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\termsrv.dll
[7] 2008-04-14 . B7DE02C863D8F5A005A7BF375375A6A4 . 297472 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\termsrv.dll
.
[7] 2008-04-14 . 0DAF0705D7B39C94E287913226688804 . 348672 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\hnetcfg.dll
[7] 2008-04-14 . 0DAF0705D7B39C94E287913226688804 . 348672 . . [5.1.2600.5512] . . c:\winxp\system32\hnetcfg.dll
[7] 2008-04-14 . 0DAF0705D7B39C94E287913226688804 . 348672 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\hnetcfg.dll
[7] 2008-04-14 . 0DAF0705D7B39C94E287913226688804 . 348672 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\hnetcfg.dll
.
[7] 2008-04-14 . D45960BE52C3C610D361977057F98C54 . 175616 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\appmgmts.dll
[7] 2008-04-14 . D45960BE52C3C610D361977057F98C54 . 175616 . . [5.1.2600.5512] . . c:\winxp\system32\appmgmts.dll
[7] 2008-04-14 . D45960BE52C3C610D361977057F98C54 . 175616 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\appmgmts.dll
[7] 2008-04-14 . D45960BE52C3C610D361977057F98C54 . 175616 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\appmgmts.dll
.
[7] 2008-04-14 . 9E1CA3160DAFB159CA14F83B1E317F75 . 12160 . . [5.1.2600.0] . . c:\winxp\erdnt\cache\acpiec.sys
[7] 2008-04-14 . 9E1CA3160DAFB159CA14F83B1E317F75 . 12160 . . [5.1.2600.0] . . c:\winxp\system32\drivers\acpiec.sys
.
[7] 2008-04-13 17:39 . 8BED39E3C35D6A489438B8141717A557 . 142592 . . [5.1.2601.3142] . . c:\winxp\ServicePackFiles\i386\aec.sys
[7] 2008-04-13 16:39 . 8BED39E3C35D6A489438B8141717A557 . 142592 . . [5.1.2601.3142] . . c:\winxp\erdnt\cache\aec.sys
[7] 2008-04-13 16:39 . 8BED39E3C35D6A489438B8141717A557 . 142592 . . [5.1.2601.3142] . . c:\winxp\system32\dllcache\aec.sys
[7] 2008-04-13 16:39 . 8BED39E3C35D6A489438B8141717A557 . 142592 . . [5.1.2601.3142] . . c:\winxp\system32\drivers\aec.sys
.
[7] 2008-04-13 . 08FD04AA961BDC77FB983F328334E3D7 . 42368 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\agp440.sys
[7] 2008-04-13 . 08FD04AA961BDC77FB983F328334E3D7 . 42368 . . [5.1.2600.5512] . . c:\winxp\system32\drivers\agp440.sys
.
[7] 2008-04-14 . 3BB22519A194418D5FEC05D800A19AD0 . 36608 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\ip6fw.sys
[7] 2008-04-14 . 3BB22519A194418D5FEC05D800A19AD0 . 36608 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\ip6fw.sys
[7] 2008-04-14 . 3BB22519A194418D5FEC05D800A19AD0 . 36608 . . [5.1.2600.5512] . . c:\winxp\system32\drivers\ip6fw.sys
[7] 2008-04-13 . 3BB22519A194418D5FEC05D800A19AD0 . 36608 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\ip6fw.sys
.
[7] 2008-04-14 10:00 . ACC19BA6876AF18768EE87931CAD14E2 . 927504 . . [4.1.0.61] . . c:\winxp\erdnt\cache\mfc40u.dll
[7] 2008-04-14 10:00 . ACC19BA6876AF18768EE87931CAD14E2 . 927504 . . [4.1.0.61] . . c:\winxp\system32\mfc40u.dll
[7] 2008-04-14 10:00 . ACC19BA6876AF18768EE87931CAD14E2 . 927504 . . [4.1.0.61] . . c:\winxp\system32\dllcache\mfc40u.dll
[7] 2008-04-14 03:22 . ACC19BA6876AF18768EE87931CAD14E2 . 927504 . . [4.1.0.61] . . c:\winxp\ServicePackFiles\i386\mfc40u.dll
.
[7] 2008-04-14 . B7550A7107281D170CE85524B1488C98 . 33792 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\msgsvc.dll
[7] 2008-04-14 . B7550A7107281D170CE85524B1488C98 . 33792 . . [5.1.2600.5512] . . c:\winxp\system32\msgsvc.dll
[7] 2008-04-14 . B7550A7107281D170CE85524B1488C98 . 33792 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\msgsvc.dll
[7] 2008-04-14 . B7550A7107281D170CE85524B1488C98 . 33792 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\msgsvc.dll
.
[7] 2008-12-10 14:34 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . c:\winxp\erdnt\cache\mspmsnsv.dll
[7] 2008-12-10 14:34 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . c:\winxp\system32\mspmsnsv.dll
[7] 2008-12-10 14:34 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . c:\winxp\system32\dllcache\mspmsnsv.dll
.
[7] 2008-12-10 . 898647EBE4276EB8032FCE2F2684D336 . 2026496 . . [5.1.2600.5657] . . c:\winxp\erdnt\cache\ntkrnlpa.exe
[7] 2008-12-10 . 898647EBE4276EB8032FCE2F2684D336 . 2026496 . . [5.1.2600.5657] . . c:\winxp\system32\ntkrnlpa.exe
[7] 2008-04-14 . E51980EF65CED4490A7395A06C08DA34 . 2068224 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\ntkrnlpa.exe
.
[7] 2008-04-14 10:00 . 56AF4064996FA5BAC9C449B1514B4770 . 438272 . . [5.1.2400.5512] . . c:\winxp\erdnt\cache\ntmssvc.dll
[7] 2008-04-14 10:00 . 56AF4064996FA5BAC9C449B1514B4770 . 438272 . . [5.1.2400.5512] . . c:\winxp\system32\ntmssvc.dll
[7] 2008-04-14 10:00 . 56AF4064996FA5BAC9C449B1514B4770 . 438272 . . [5.1.2400.5512] . . c:\winxp\system32\dllcache\ntmssvc.dll
[7] 2008-04-14 03:22 . 56AF4064996FA5BAC9C449B1514B4770 . 438272 . . [5.1.2400.5512] . . c:\winxp\ServicePackFiles\i386\ntmssvc.dll
.
[7] 2008-04-14 . 1DFD8975D8C89214B98D9387C1125B49 . 186880 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\upnphost.dll
[7] 2008-04-14 . 1DFD8975D8C89214B98D9387C1125B49 . 186880 . . [5.1.2600.5512] . . c:\winxp\system32\upnphost.dll
[7] 2008-04-14 . 1DFD8975D8C89214B98D9387C1125B49 . 186880 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\upnphost.dll
[7] 2008-04-14 . 1DFD8975D8C89214B98D9387C1125B49 . 186880 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\upnphost.dll
.
[7] 2008-04-14 . 9236E736EDB57BE7D1EF6274410E3BAC . 367616 . . [5.3.2600.5512] . . c:\winxp\erdnt\cache\dsound.dll
[7] 2008-04-14 . 9236E736EDB57BE7D1EF6274410E3BAC . 367616 . . [5.3.2600.5512] . . c:\winxp\system32\dsound.dll
[7] 2008-04-14 . 9236E736EDB57BE7D1EF6274410E3BAC . 367616 . . [5.3.2600.5512] . . c:\winxp\system32\dllcache\dsound.dll
[7] 2008-04-14 . 9236E736EDB57BE7D1EF6274410E3BAC . 367616 . . [5.3.2600.5512] . . c:\winxp\ServicePackFiles\i386\dsound.dll
.
[7] 2008-04-14 . 36969CF86E51EC8ED202B40F2FA80AA6 . 1689088 . . [5.03.2600.5512] . . c:\winxp\erdnt\cache\d3d9.dll
[7] 2008-04-14 . 36969CF86E51EC8ED202B40F2FA80AA6 . 1689088 . . [5.03.2600.5512] . . c:\winxp\system32\d3d9.dll
[7] 2008-04-14 . 36969CF86E51EC8ED202B40F2FA80AA6 . 1689088 . . [5.03.2600.5512] . . c:\winxp\system32\dllcache\d3d9.dll
[7] 2008-04-14 . 36969CF86E51EC8ED202B40F2FA80AA6 . 1689088 . . [5.03.2600.5512] . . c:\winxp\ServicePackFiles\i386\d3d9.dll
.
[7] 2008-04-14 . 4A37188B83B00DD9CFBA049687AD0DAF . 279552 . . [5.03.2600.5512] . . c:\winxp\erdnt\cache\ddraw.dll
[7] 2008-04-14 . 4A37188B83B00DD9CFBA049687AD0DAF . 279552 . . [5.03.2600.5512] . . c:\winxp\system32\ddraw.dll
[7] 2008-04-14 . 4A37188B83B00DD9CFBA049687AD0DAF . 279552 . . [5.03.2600.5512] . . c:\winxp\system32\dllcache\ddraw.dll
[7] 2008-04-14 . 4A37188B83B00DD9CFBA049687AD0DAF . 279552 . . [5.03.2600.5512] . . c:\winxp\ServicePackFiles\i386\ddraw.dll
.
[7] 2008-04-14 10:00 . 5D7F5A46975D2E59A6FECB6C231D200F . 84992 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\olepro32.dll
[7] 2008-04-14 10:00 . 5D7F5A46975D2E59A6FECB6C231D200F . 84992 . . [5.1.2600.5512] . . c:\winxp\system32\olepro32.dll
[7] 2008-04-14 10:00 . 5D7F5A46975D2E59A6FECB6C231D200F . 84992 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\olepro32.dll
[7] 2008-04-14 03:22 . 5D7F5A46975D2E59A6FECB6C231D200F . 84992 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\olepro32.dll
.
[7] 2008-04-14 . C47FD93010649AC0D79022D9B69ADBE4 . 41984 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\perfctrs.dll
[7] 2008-04-14 . C47FD93010649AC0D79022D9B69ADBE4 . 41984 . . [5.1.2600.5512] . . c:\winxp\system32\perfctrs.dll
[7] 2008-04-14 . C47FD93010649AC0D79022D9B69ADBE4 . 41984 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\perfctrs.dll
[7] 2008-04-14 . C47FD93010649AC0D79022D9B69ADBE4 . 41984 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\perfctrs.dll
.
[7] 2008-04-14 . F86000634319F71535BCE6B06995EE99 . 18944 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\version.dll
[7] 2008-04-14 . F86000634319F71535BCE6B06995EE99 . 18944 . . [5.1.2600.5512] . . c:\winxp\system32\version.dll
[7] 2008-04-14 . F86000634319F71535BCE6B06995EE99 . 18944 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\version.dll
[7] 2008-04-14 . F86000634319F71535BCE6B06995EE99 . 18944 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\version.dll
.
[7] 2008-10-15 . 056C927CF7207857E8B34F7A8FFD9B9E . 633632 . . [7.00.6000.20935] . . c:\winxp\$hf_mig$\KB958215-IE7\SP2QFE\iexplore.exe
[7] 2008-10-15 . 9D3DB9ADFABD2F0BC778EC03250A3ABB . 633632 . . [7.00.6000.16762] . . c:\winxp\erdnt\cache\IEXPLORE.EXE
[7] 2008-10-15 . 9D3DB9ADFABD2F0BC778EC03250A3ABB . 633632 . . [7.00.6000.16762] . . c:\winxp\system32\dllcache\iexplore.exe
[7] 2008-04-14 . 3BFE49B4CDFAC83B0F3C79412895A179 . 93184 . . [6.00.2900.5512] . . c:\winxp\ServicePackFiles\i386\iexplore.exe
.
[7] 2008-12-10 . 0F4406A09190AEED362C9141281130E2 . 2147840 . . [5.1.2600.5657] . . c:\winxp\erdnt\cache\ntoskrnl.exe
[7] 2008-12-10 . 0F4406A09190AEED362C9141281130E2 . 2147840 . . [5.1.2600.5657] . . c:\winxp\system32\ntoskrnl.exe
[7] 2008-04-14 . 354C9291513BCE4D0ED6B0C6A15470F8 . 2191360 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\ntoskrnl.exe
.
[7] 2008-04-14 . FE77A85495065F3AD59C5C65B6C54182 . 171520 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\srsvc.dll
[7] 2008-04-14 . FE77A85495065F3AD59C5C65B6C54182 . 171520 . . [5.1.2600.5512] . . c:\winxp\system32\srsvc.dll
[7] 2008-04-14 . FE77A85495065F3AD59C5C65B6C54182 . 171520 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\srsvc.dll
[7] 2008-04-14 . FE77A85495065F3AD59C5C65B6C54182 . 171520 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\srsvc.dll
.
[7] 2008-04-14 . 7B353059E665F8B7AD2BBEAEF597CF45 . 177152 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\w32time.dll
[7] 2008-04-14 . 7B353059E665F8B7AD2BBEAEF597CF45 . 177152 . . [5.1.2600.5512] . . c:\winxp\system32\w32time.dll
[7] 2008-04-14 . 7B353059E665F8B7AD2BBEAEF597CF45 . 177152 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\w32time.dll
[7] 2008-04-14 . 7B353059E665F8B7AD2BBEAEF597CF45 . 177152 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\w32time.dll
.
[7] 2008-04-14 . BC2C5985611C5356B24AEB370953DED9 . 334336 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\wiaservc.dll
[7] 2008-04-14 . BC2C5985611C5356B24AEB370953DED9 . 334336 . . [5.1.2600.5512] . . c:\winxp\system32\wiaservc.dll
[7] 2008-04-14 . BC2C5985611C5356B24AEB370953DED9 . 334336 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\wiaservc.dll
[7] 2008-04-14 . BC2C5985611C5356B24AEB370953DED9 . 334336 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\wiaservc.dll
.
[7] 2008-04-14 . 2CF969B9BF1EF069075DCDCE309FAAE1 . 18944 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\midimap.dll
[7] 2008-04-14 . 2CF969B9BF1EF069075DCDCE309FAAE1 . 18944 . . [5.1.2600.5512] . . c:\winxp\system32\midimap.dll
[7] 2008-04-14 . 2CF969B9BF1EF069075DCDCE309FAAE1 . 18944 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\midimap.dll
[7] 2008-04-14 . 2CF969B9BF1EF069075DCDCE309FAAE1 . 18944 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\midimap.dll
.
[7] 2008-04-14 . 469FED8597896DB77B49384BE90E2E0A . 7680 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\rasadhlp.dll
[7] 2008-04-14 . 469FED8597896DB77B49384BE90E2E0A . 7680 . . [5.1.2600.5512] . . c:\winxp\system32\rasadhlp.dll
[7] 2008-04-14 . 469FED8597896DB77B49384BE90E2E0A . 7680 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\rasadhlp.dll
[7] 2008-04-14 . 469FED8597896DB77B49384BE90E2E0A . 7680 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\rasadhlp.dll
.
[7] 2008-04-14 . 02AF8A799D173C2D0C71F399C03AC9E1 . 19456 . . [5.1.2600.5512] . . c:\winxp\erdnt\cache\wshtcpip.dll
[7] 2008-04-14 . 02AF8A799D173C2D0C71F399C03AC9E1 . 19456 . . [5.1.2600.5512] . . c:\winxp\system32\wshtcpip.dll
[7] 2008-04-14 . 02AF8A799D173C2D0C71F399C03AC9E1 . 19456 . . [5.1.2600.5512] . . c:\winxp\system32\dllcache\wshtcpip.dll
[7] 2008-04-14 . 02AF8A799D173C2D0C71F399C03AC9E1 . 19456 . . [5.1.2600.5512] . . c:\winxp\ServicePackFiles\i386\wshtcpip.dll
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54	131248	----a-w-	c:\dokumente und einstellungen\Alexander\Anwendungsdaten\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54	131248	----a-w-	c:\dokumente und einstellungen\Alexander\Anwendungsdaten\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54	131248	----a-w-	c:\dokumente und einstellungen\Alexander\Anwendungsdaten\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54	131248	----a-w-	c:\dokumente und einstellungen\Alexander\Anwendungsdaten\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\EldosIconOverlay]
@="{5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC}"
[HKEY_CLASSES_ROOT\CLSID\{5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC}]
2012-04-09 11:57	158224	----a-w-	c:\winxp\system32\CbFsMntNtf3.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="d:\daemon tools lite\DTLite.exe" [2012-04-11 3672384]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"="d:\programme\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"NvCplDaemon"="c:\winxp\system32\NvCpl.dll" [2009-01-30 13594624]
"nwiz"="nwiz.exe" [2009-01-30 1657376]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
"FreePDF Assistant"="c:\programme\FreePDF_XP\fpassist.exe" [2009-09-05 385024]
"CanonMyPrinter"="c:\programme\Canon\MyPrinter\BJMyPrt.exe" [2010-03-25 2516296]
"CanonSolutionMenuEx"="c:\programme\Canon\Solution Menu EX\CNSEMAIN.EXE" [2010-04-02 1185112]
"QuickTime Task"="c:\programme\QuickTime\QTTask.exe" [2012-04-18 421888]
"iTunesHelper"="c:\programme\iTunes\iTunesHelper.exe" [2013-02-20 152392]
"SMSERIAL"="sm56hlpr.exe" [2005-09-16 557056]
"Adobe ARM"="c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" [2014-05-08 959904]
"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2014-10-07 507776]
"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2015-03-03 703280]
"Avira Systray"="c:\programme\Avira\My Avira\Avira.OE.Systray.exe" [2014-12-31 126712]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\winxp\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2008-01-22 05:43	152872	----a-w-	c:\programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2007-03-01 10:27	153136	----a-w-	c:\programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2006-02-27 12:58	16005120	----a-w-	c:\winxp\RTHDCPL.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
2009-12-21 05:45	39424	----a-w-	d:\winamp\winampa.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"d:\\Programme\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"d:\\Programme\\Microsoft Office\\Office12\\GROOVE.EXE"=
"d:\\Programme\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"d:\\Firefox\\firefox.exe"=
"%windir%\explorer.exe"= %windir%\explorer.exe
"d:\\My Mobile\\MyMobiler\\MyMobiler.exe"=
"c:\\Programme\\Bonjour\\mDNSResponder.exe"=
"c:\\Programme\\iTunes\\iTunes.exe"=
"c:\\Dokumente und Einstellungen\\Alexander\\Anwendungsdaten\\Dropbox\\bin\\Dropbox.exe"=
.
R0 hotcore3;hc3ServiceName;c:\winxp\system32\drivers\hotcore3.sys [13.06.2012 21:06 40560]
R1 avkmgr;avkmgr;c:\winxp\system32\drivers\avkmgr.sys [02.03.2015 18:18 37352]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\winxp\system32\drivers\dtsoftbus01.sys [21.06.2012 16:27 242240]
R2 AntiVirSchedulerService;Avira Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [02.03.2015 18:18 432888]
R2 Avira.OE.ServiceHost;Avira Service Host;c:\programme\Avira\My Avira\Avira.OE.ServiceHost.exe [31.12.2014 12:27 178424]
R2 NovacomD;Palm Novacom;c:\programme\Palm, Inc\novacomd\x86\novacomd.exe [24.06.2011 21:16 61440]
R2 NSHE;Guardant Emulator Driver;c:\winxp\system32\drivers\NSHE.SYS [24.06.2012 19:12 97792]
R3 cbfs3;EldoS Callback File System driver v3;c:\winxp\system32\drivers\cbfs3.sys [12.02.2013 13:43 299024]
S2 LcSvrAdm;ELSA Administration Service;g:\elsawin\installation\bin\LcSvrAdm.exe --> g:\elsawin\installation\bin\LcSvrAdm.exe [?]
S2 LcSvrDba;ELSA DBA Server;g:\elsawin\installation\bin\LcSvrDba.exe --> g:\elsawin\installation\bin\LcSvrDba.exe [?]
S2 LcSvrHis;ELSA Historie Server;g:\elsawin\installation\bin\LcSvrHis.exe --> g:\elsawin\installation\bin\LcSvrHis.exe [?]
S2 LcSvrPAS;ELSA PASS Server;g:\elsawin\installation\bin\LcSvrPas.exe --> g:\elsawin\installation\bin\LcSvrPas.exe [?]
S2 LcSvrSaz;ELSA APOSpro Server;g:\elsawin\installation\bin\LcSvrSaz.exe --> g:\elsawin\installation\bin\LcSvrSaz.exe [?]
S3 CFcatchme;CFcatchme;\??\c:\combofix\CFcatchme.sys --> c:\combofix\CFcatchme.sys [?]
S3 LcSvrAuf;ELSA Auftragsverwaltungs Service;g:\elsawin\installation\bin\LcSvrAuf.exe --> g:\elsawin\installation\bin\LcSvrAuf.exe [?]
S3 pwdrvio;pwdrvio;c:\winxp\system32\pwdrvio.sys [29.05.2012 15:41 16472]
S3 pwdspio;pwdspio;c:\winxp\system32\pwdspio.sys [29.05.2012 15:41 11104]
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - AVGNTFLT
*NewlyCreated* - AVIPBB
*NewlyCreated* - AVKMGR
*NewlyCreated* - SSMDRV
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12	REG_MULTI_SZ   	Pml Driver HPZ12 Net Driver HPZ12
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-05-20 09:39	1077576	----a-w-	c:\programme\Google\Chrome\Application\34.0.1847.137\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2015-03-04 c:\winxp\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programme\Google\Update\GoogleUpdate.exe [2013-04-17 15:06]
.
2015-03-03 c:\winxp\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programme\Google\Update\GoogleUpdate.exe [2013-04-17 15:06]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = www.google.com
mStart Page = www.google.com
IE: Nach Microsoft E&xel exportieren - d:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\dokumente und einstellungen\Alexander\Anwendungsdaten\Mozilla\Firefox\Profiles\0qgqdyu2.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?btnG=Google+Search&q=
FF - prefs.js: browser.startup.homepage - hxxps://www.google.de/
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?btnG=Google+Search&q=
.
.
------- Dateityp-Verknüpfung -------
.
.txt=
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKLM-Run-DivXUpdate - c:\programme\DivX\DivX Update\DivXUpdate.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2015-03-04 18:58
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse... 
.
Scanne versteckte Autostarteinträge... 
.
Scanne versteckte Dateien... 
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINXP\\system32\\Macromed\\Flash\\FlashUtil32_14_0_0_145_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINXP\\system32\\Macromed\\Flash\\FlashUtil32_14_0_0_145_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'explorer.exe'(3220)
c:\dokumente und einstellungen\Alexander\Anwendungsdaten\Dropbox\bin\DropboxExt.22.dll
c:\winxp\system32\CbFsMntNtf3.dll
c:\winxp\system32\wpdshserviceobj.dll
c:\winxp\system32\msi.dll
c:\winxp\system32\portabledevicetypes.dll
c:\winxp\system32\portabledeviceapi.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\programme\Avira\AntiVir Desktop\avguard.exe
c:\programme\Bonjour\mDNSResponder.exe
c:\winxp\system32\rundll32.exe
c:\winxp\sm56hlpr.exe
c:\winxp\system32\nvsvc32.exe
c:\winxp\system32\wbem\unsecapp.exe
c:\programme\Avira\AntiVir Desktop\avshadow.exe
c:\winxp\system32\wscntfy.exe
c:\winxp\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2015-03-04  19:06:05 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2015-03-04 14:36
.
Vor Suchlauf: 5.024.727.040 Bytes frei
Nach Suchlauf: 5.100.036.096 Bytes frei
.
- - End Of File - - CDD736AB46AEEABCDE15E9539A693BD2
72B8CE41AF0DE751C946802B3ED844B4
         

hi,

Downloade dir bitte TDSSKiller.exe und speichere diese Datei auf dem Desktop

• Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
• Drücke Start Scan
  
• Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
  TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
  Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt

Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

TDSS Killfer log

10:13:51.0390 0x02fc  TDSS rootkit removing tool 3.0.0.44 Jan 22 2015 08:27:04
10:14:55.0531 0x02fc  ============================================================
10:14:55.0531 0x02fc  Current date / time: 2015/03/05 10:14:55.0531
10:14:55.0531 0x02fc  SystemInfo:
10:14:55.0531 0x02fc  
10:14:55.0531 0x02fc  OS Version: 5.1.2600 ServicePack: 3.0
10:14:55.0531 0x02fc  Product type: Workstation
10:14:55.0531 0x02fc  ComputerName: ALEX
10:14:55.0531 0x02fc  UserName: Alexander
10:14:55.0531 0x02fc  Windows directory: C:\WINXP
10:14:55.0531 0x02fc  System windows directory: C:\WINXP
10:14:55.0531 0x02fc  Processor architecture: Intel x86
10:14:55.0531 0x02fc  Number of processors: 2
10:14:55.0531 0x02fc  Page size: 0x1000
10:14:55.0531 0x02fc  Boot type: Normal boot
10:14:55.0531 0x02fc  ============================================================
10:15:22.0000 0x02fc  KLMD registered as C:\WINXP\system32\drivers\86224070.sys
10:15:22.0390 0x02fc  System UUID: {447D5278-09FA-D5E2-EEE9-7E5EA69CDCD6}
10:15:25.0218 0x02fc  Drive \Device\Harddisk0\DR0 - Size: 0x1BF2976000 ( 111.79 Gb ), SectorSize: 0x200, Cylinders: 0x3901, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
10:15:25.0296 0x02fc  Drive \Device\Harddisk1\DR5 - Size: 0x7470C06000 ( 465.76 Gb ), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
10:15:25.0687 0x02fc  ============================================================
10:15:25.0687 0x02fc  \Device\Harddisk0\DR0:
10:15:25.0687 0x02fc  MBR partitions:
10:15:25.0687 0x02fc  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x2711637
10:15:25.0703 0x02fc  \Device\Harddisk1\DR5:
10:15:25.0703 0x02fc  MBR partitions:
10:15:25.0703 0x02fc  \Device\Harddisk1\DR5\Partition1: MBR, Type 0xC, StartLBA 0x3F, BlocksNum 0x3A380D41
10:15:25.0703 0x02fc  ============================================================
10:15:25.0718 0x02fc  C: <-> \Device\Harddisk0\DR0\Partition1
10:15:25.0750 0x02fc  J: <-> \Device\Harddisk1\DR5\Partition1
10:15:25.0750 0x02fc  ============================================================
10:15:25.0750 0x02fc  Initialize success
10:15:25.0750 0x02fc  ============================================================
10:16:21.0671 0x0198  ============================================================
10:16:21.0671 0x0198  Scan started
10:16:21.0671 0x0198  Mode: Manual; SigCheck; TDLFS; 
10:16:21.0671 0x0198  ============================================================
10:16:21.0671 0x0198  KSN ping started
10:16:52.0859 0x0198  KSN ping finished: true
10:16:55.0500 0x0198  ================ Scan system memory ========================
10:16:55.0531 0x0198  System memory - ok
10:16:55.0531 0x0198  ================ Scan services =============================
10:16:56.0953 0x0198  Abiosdsk - ok
10:16:56.0953 0x0198  abp480n5 - ok
10:16:57.0125 0x0198  [ AC407F1A62C3A300B4F2B5A9F1D55B2C, 31F5FC61B37E22100B3A52A590295A7E827FFC581FA9960C64B9032452AAECED ] ACPI            C:\WINXP\system32\DRIVERS\ACPI.sys
10:17:08.0031 0x0198  ACPI - ok
10:17:09.0000 0x0198  [ 9E1CA3160DAFB159CA14F83B1E317F75, 13B3E897B0E819BF734449416D9EC6EBCAC89538EC69BF48C068593B82D57004 ] ACPIEC          C:\WINXP\system32\DRIVERS\ACPIEC.sys
10:17:09.0375 0x0198  ACPIEC - ok
10:17:09.0375 0x0198  adpu160m - ok
10:17:09.0515 0x0198  [ 8BED39E3C35D6A489438B8141717A557, 1B5796E56B0927360CE0759641B1151828BC0A9E45620D2B2D880491F5CE33D0 ] aec             C:\WINXP\system32\drivers\aec.sys
10:17:09.0718 0x0198  aec - ok
10:17:09.0781 0x0198  [ 4D43E74F2A1239D53929B82600F1971C, E1B03036DA856F0E75A87BD3FDDB973D591E8145E881B2D836F2A2E0B9998C5B ] AFD             C:\WINXP\System32\drivers\afd.sys
10:17:10.0375 0x0198  AFD - ok
10:17:10.0375 0x0198  Aha154x - ok
10:17:10.0390 0x0198  aic78u2 - ok
10:17:10.0390 0x0198  aic78xx - ok
10:17:10.0468 0x0198  [ 738D80CC01D7BC7584BE917B7F544394, DCC17AAEF5CDDF52FAAC3CC6904EF421CD595F66318A2370BEE261D5C3A8E340 ] Alerter         C:\WINXP\system32\alrsvc.dll
10:17:10.0843 0x0198  Alerter - ok
10:17:10.0921 0x0198  [ 190CD73D4984F94D823F9444980513E5, 93A32C2495CCA094F768BA707C74DA5C00B8A88A9236DD1A297439A7C2E6C6FA ] ALG             C:\WINXP\System32\alg.exe
10:17:11.0109 0x0198  ALG - ok
10:17:11.0125 0x0198  AliIde - ok
10:17:11.0125 0x0198  amsint - ok
10:17:12.0593 0x0198  [ 963F57EDF1A5C72AC66173F3B7CB329B, 0934361B0A55F4C082D70F264FAB5D36BAC482C135275AE552D442E64B3D5C1D ] AntiVirSchedulerService C:\Programme\Avira\AntiVir Desktop\sched.exe
10:17:13.0062 0x0198  AntiVirSchedulerService - ok
10:17:13.0156 0x0198  [ 963F57EDF1A5C72AC66173F3B7CB329B, 0934361B0A55F4C082D70F264FAB5D36BAC482C135275AE552D442E64B3D5C1D ] AntiVirService  C:\Programme\Avira\AntiVir Desktop\avguard.exe
10:17:13.0218 0x0198  AntiVirService - ok
10:17:13.0328 0x0198  [ D45960BE52C3C610D361977057F98C54, 9186589B502F46B47672CFB8EBD558D51B0F3CBFE4E0DDBA625A4265236518CE ] AppMgmt         C:\WINXP\System32\appmgmts.dll
10:17:13.0593 0x0198  AppMgmt - ok
10:17:13.0671 0x0198  [ B5B8A80875C1DEDEDA8B02765642C32F, AD0C71D73B1B8225351FBF4FFB43001A32B4DAE69504C59970CD2428BB33D4EF ] Arp1394         C:\WINXP\system32\DRIVERS\arp1394.sys
10:17:13.0937 0x0198  Arp1394 - ok
10:17:13.0937 0x0198  asc - ok
10:17:14.0093 0x0198  asc3350p - ok
10:17:14.0093 0x0198  asc3550 - ok
10:17:14.0500 0x0198  [ 776ACEFA0CA9DF0FAA51A5FB2F435705, 72DF7ED6B085BC468994F5B3189506FD726A9A17A9C42ACA1E420D787691361D ] aspnet_state    C:\WINXP\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
10:17:15.0078 0x0198  aspnet_state - ok
10:17:15.0156 0x0198  [ B153AFFAC761E7F5FCFA822B9C4E97BC, 7E60F572A6B3C6219E3C86225AA37243AFFD74337DB7F108B04778042E5CC959 ] AsyncMac        C:\WINXP\system32\DRIVERS\asyncmac.sys
10:17:15.0437 0x0198  AsyncMac - ok
10:17:15.0468 0x0198  [ 9F3A2F5AA6875C72BF062C712CFA2674, B4DF1D2C56A593C6B54DE57395E3B51D288F547842893B32B0F59228A0CF70B9 ] atapi           C:\WINXP\system32\DRIVERS\atapi.sys
10:17:15.0640 0x0198  atapi - ok
10:17:15.0750 0x0198  Atdisk - ok
10:17:15.0796 0x0198  [ 9916C1225104BA14794209CFA8012159, 5D6F05F715C52A16D05CAE15C3DFE77A139A7F27F7AE710EC9A10F9EE05115A1 ] Atmarpc         C:\WINXP\system32\DRIVERS\atmarpc.sys
10:17:16.0000 0x0198  Atmarpc - ok
10:17:16.0062 0x0198  [ 58ED0D5452DF7BE732193E7999C6B9A4, 254E2ECF592DDA2E3E6CA9F6F3E77926E2265586A7937BA95199ED47BCDE69A3 ] AudioSrv        C:\WINXP\System32\audiosrv.dll
10:17:16.0421 0x0198  AudioSrv - ok
10:17:16.0515 0x0198  [ D9F724AA26C010A217C97606B160ED68, 329B5118F2409731D06FDAE85B6ADD64A048292801BCB3546651CEB303111695 ] audstub         C:\WINXP\system32\DRIVERS\audstub.sys
10:17:16.0703 0x0198  audstub - ok
10:17:16.0765 0x0198  [ AF5DA81B19AFA730F1E5246AD81D140A, 532951071F56896A3B5D47874C14D996C8620EA02F87D4BA21B083EC804FB166 ] avgntflt        C:\WINXP\system32\DRIVERS\avgntflt.sys
10:17:18.0125 0x0198  avgntflt - ok
10:17:18.0218 0x0198  [ A5674637BCA212D9FE136ADFA04C9857, 95F3632EBB041C539816D285EBE1F379D46A4187379C69D4683D9F4DECBDB80C ] avipbb          C:\WINXP\system32\DRIVERS\avipbb.sys
10:17:18.0281 0x0198  avipbb - ok
10:17:18.0500 0x0198  [ 523EBA6B6124EC416FF35A37BB47C30A, D2C545BB78E91ECCD3FFACFB524D03DFD5E277871A2500164F3602445A8A86FA ] Avira.OE.ServiceHost C:\Programme\Avira\My Avira\Avira.OE.ServiceHost.exe
10:17:18.0546 0x0198  Avira.OE.ServiceHost - ok
10:17:18.0671 0x0198  [ D8C712305F73CD34D1B344810E522728, 49A474FF6CA44E8427D7A8290B47395125B0148AF384CF2B3B1FA495A4718CBA ] avkmgr          C:\WINXP\system32\DRIVERS\avkmgr.sys
10:17:18.0718 0x0198  avkmgr - ok
10:17:18.0812 0x0198  [ DA1F27D85E0D1525F6621372E7B685E9, 5A81A46A3BDD19DAFC6C87D277267A5D44F3A1B5302F2CC1111D84B7BAD5610D ] Beep            C:\WINXP\system32\drivers\Beep.sys
10:17:19.0031 0x0198  Beep - ok
10:17:19.0109 0x0198  [ D6F603772A789BB3228F310D650B8BD1, A539025C70FD998A9B8703DE05CAE5E99BC721D8852EA561EBC2DD20CB371D2E ] BITS            C:\WINXP\system32\qmgr.dll
10:17:19.0609 0x0198  BITS - ok
10:17:19.0921 0x0198  [ DB5BEA73EDAF19AC68B2C0FAD0F92B1A, 10F21999FF6B1D410EBF280F7F27DEACA5289739CF12F4293B614B8FC6C88DCC ] Bonjour Service C:\Programme\Bonjour\mDNSResponder.exe
10:17:20.0000 0x0198  Bonjour Service - ok
10:17:20.0156 0x0198  [ B42057F06BBB98B31876C0B3F2B54E33, 779AF28378E8D37E784BEDBEE23DCFFC6C9C9068180F2A9058C91047E33ED078 ] Browser         C:\WINXP\System32\browser.dll
10:17:20.0406 0x0198  Browser - ok
10:17:20.0515 0x0198  [ B279426E3C0C344893ED78A613A73BDE, 30B29ED5DCFF0C180B806A5FBC705E1CAF6B0F525298CDA79A77FC2AF6E5AAA7 ] BthEnum         C:\WINXP\system32\DRIVERS\BthEnum.sys
10:17:20.0734 0x0198  BthEnum - ok
10:17:20.0828 0x0198  [ FCA6F069597B62D42495191ACE3FC6C1, 23A4EAA542547AC48BCB19DEC9C8E1C1D7D83F199F045DA4682C33292F011CE9 ] BTHMODEM        C:\WINXP\system32\DRIVERS\bthmodem.sys
10:17:21.0015 0x0198  BTHMODEM - ok
10:17:21.0140 0x0198  [ 80602B8746D3738F5886CE3D67EF06B6, 15ABAA8106C42A4453763EEB92B291844580168C934088DB1E22B2065DC238E9 ] BthPan          C:\WINXP\system32\DRIVERS\bthpan.sys
10:17:21.0406 0x0198  BthPan - ok
10:17:21.0500 0x0198  [ F55BFD05892C321FB7470D334D6B44E1, 383C842108CD23640ED1EAD10043BCB95290E8C40EAC4CED30047B46B22B568F ] BTHPORT         C:\WINXP\system32\Drivers\BTHport.sys
10:17:21.0625 0x0198  BTHPORT - ok
10:17:21.0656 0x0198  [ 26C601EF7525E31379744ABFC6F35A1B, 842626D3A00DDA959A4AB730C0D551244DCDA15AC291FD70CC7324571A6088EC ] BthServ         C:\WINXP\System32\bthserv.dll
10:17:21.0812 0x0198  BthServ - ok
10:17:21.0859 0x0198  [ 61364CD71EF63B0F038B7E9DF00F1EFA, FB44D02B4379A8AF7DD8B0B22B53888B758903700142BFE45A412709294CE88A ] BTHUSB          C:\WINXP\system32\Drivers\BTHUSB.sys
10:17:22.0187 0x0198  BTHUSB - ok
10:17:22.0328 0x0198  catchme - ok
10:17:22.0515 0x0198  [ F6B032F03602321CBAD380A6EB883525, 0793ABED0CB32EBDF9BEE4A5A47F65CF76A9D1AD45920E7CFAD3764854450E8C ] cbfs3           C:\WINXP\system32\DRIVERS\cbfs3.sys
10:17:22.0781 0x0198  cbfs3 - ok
10:17:22.0875 0x0198  [ 90A673FC8E12A79AFBED2576F6A7AAF9, BDE7858A3457DB979FEDD8577FA6321BF72848E4A7BF9F173C78A6A10CBB3EBE ] cbidf2k         C:\WINXP\system32\drivers\cbidf2k.sys
10:17:23.0156 0x0198  cbidf2k - ok
10:17:23.0156 0x0198  cd20xrnt - ok
10:17:23.0203 0x0198  [ C1B486A7658353D33A10CC15211A873B, AA4DD9E7AAE5AAB1146B360B17001F975D2F29A1281CF7B13E7136480410F347 ] Cdaudio         C:\WINXP\system32\drivers\Cdaudio.sys
10:17:23.0421 0x0198  Cdaudio - ok
10:17:23.0531 0x0198  [ C885B02847F5D2FD45A24E219ED93B32, B26B2F8E3A831E2B65EB0C5195B0645CD50E22615CE79C9B0B391CD563B121DB ] Cdfs            C:\WINXP\system32\drivers\Cdfs.sys
10:17:23.0703 0x0198  Cdfs - ok
10:17:23.0828 0x0198  [ 1F4260CC5B42272D71F79E570A27A4FE, B51C2A3ED3C309953D0EA45869C8E464C10F2533DADE9E0286AF674979098D1D ] Cdrom           C:\WINXP\system32\DRIVERS\cdrom.sys
10:17:24.0078 0x0198  Cdrom - ok
10:17:24.0125 0x0198  CFcatchme - ok
10:17:24.0140 0x0198  Changer - ok
10:17:24.0187 0x0198  [ 28E3040D1F1CA2008CD6B29DFEBC9A5E, ACB458E8A11AA2143734A5A0281973D95158E6402A6453F98F9832D1E19B01F9 ] CiSvc           C:\WINXP\system32\cisvc.exe
10:17:24.0359 0x0198  CiSvc - ok
10:17:24.0421 0x0198  [ 778A30ED3C134EB7E406AFC407E9997D, 3E6AD115AB2596EB001BC21AEADDBC75F27C42DB90C986B7AD17743CE631234E ] ClipSrv         C:\WINXP\system32\clipsrv.exe
10:17:24.0640 0x0198  ClipSrv - ok
10:17:24.0890 0x0198  [ D87ACAED61E417BBA546CED5E7E36D9C, 14AC6034A5BC0FB2A1AFDAD42BEF4DE641556E54AD30D0C46765660A4BE55462 ] clr_optimization_v2.0.50727_32 C:\WINXP\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
10:17:25.0265 0x0198  clr_optimization_v2.0.50727_32 - ok
10:17:25.0421 0x0198  [ C5A75EB48E2344ABDC162BDA79E16841, 6070A8AAFD38FBC6A68A2B10C20117612354DF21B4492D90CA522BFB6870D726 ] clr_optimization_v4.0.30319_32 C:\WINXP\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
10:17:25.0859 0x0198  clr_optimization_v4.0.30319_32 - ok
10:17:25.0906 0x0198  [ 0F6C187D38D98F8DF904589A5F94D411, DB987093446216CEE913AC27503BF7E23E5A62DF169B355730285DAB64F6ED28 ] CmBatt          C:\WINXP\system32\DRIVERS\CmBatt.sys
10:17:26.0109 0x0198  CmBatt - ok
10:17:26.0109 0x0198  CmdIde - ok
10:17:26.0125 0x0198  [ 6E4C9F21F0FAE8940661144F41B13203, 731202A0DD021FCF9287FEA631212603AAAC23F9E7F76B2882F913B18A971F1C ] Compbatt        C:\WINXP\system32\DRIVERS\compbatt.sys
10:17:26.0281 0x0198  Compbatt - ok
10:17:26.0281 0x0198  COMSysApp - ok
10:17:26.0296 0x0198  Cpqarray - ok
10:17:26.0390 0x0198  [ 611F824E5C703A5A899F84C5F1699E4D, 9EFA5612FE58E9974E4CC13D39D91D7B5DEA3ED66BEFBED3AAE6D2800FD8162A ] CryptSvc        C:\WINXP\System32\cryptsvc.dll
10:17:26.0531 0x0198  CryptSvc - ok
10:17:26.0531 0x0198  dac2w2k - ok
10:17:26.0546 0x0198  dac960nt - ok
10:17:26.0640 0x0198  [ E970C2296916BF4A2F958680016FE312, ED7FA2854D12D82A0E58536702C7DCD89E274677B113B6974AED4B276FAA4DF4 ] DcomLaunch      C:\WINXP\system32\rpcss.dll
10:17:27.0093 0x0198  DcomLaunch - ok
10:17:27.0187 0x0198  [ C29A1C9B75BA38FA37F8C44405DEC360, 7476D8BC4380CDE56764B2034AF3741DA4ED00F315E41C9A02B5EAD04374F241 ] Dhcp            C:\WINXP\System32\dhcpcsvc.dll
10:17:27.0406 0x0198  Dhcp - ok
10:17:27.0437 0x0198  [ 044452051F3E02E7963599FC8F4F3E25, 584BDDB074618BE76454CF90E74829CFF588B5B5FAEB793E2F7AAD26352DD689 ] Disk            C:\WINXP\system32\DRIVERS\disk.sys
10:17:27.0593 0x0198  Disk - ok
10:17:27.0593 0x0198  dmadmin - ok
10:17:27.0718 0x0198  [ 0DCFC8395A99FECBB1EF771CEC7FE4EA, 89B0AEE5BE01B9FE4FF2989FF16DB6121721ACDFCE6D9655C0ACD321D8C308BE ] dmboot          C:\WINXP\system32\drivers\dmboot.sys
10:17:28.0000 0x0198  dmboot - ok
10:17:28.0062 0x0198  [ 53720AB12B48719D00E327DA470A619A, 800264866A6267C9000A85D00095D57908D059D737E5F28C9C4049B884C46228 ] dmio            C:\WINXP\system32\drivers\dmio.sys
10:17:28.0281 0x0198  dmio - ok
10:17:28.0312 0x0198  [ E9317282A63CA4D188C0DF5E09C6AC5F, D41E002F555FE9015EF620975255F58BB79198CA1FF0E09EC950CB450FF77CF7 ] dmload          C:\WINXP\system32\drivers\dmload.sys
10:17:28.0531 0x0198  dmload - ok
10:17:28.0546 0x0198  [ 25C83FFBBA13B554EB6D59A9B2E2EE78, 9FBD655ED3E9163AE11EC207F283E387EFBA5A23108EC790BAE4846B35E66F16 ] dmserver        C:\WINXP\System32\dmserver.dll
10:17:28.0734 0x0198  dmserver - ok
10:17:28.0812 0x0198  [ 8A208DFCF89792A484E76C40E5F50B45, 4E40E2EB38C6254E7CAA488200E89EE7DEBBBA773890BC6A84313CC68178D54F ] DMusic          C:\WINXP\system32\drivers\DMusic.sys
10:17:29.0031 0x0198  DMusic - ok
10:17:29.0078 0x0198  [ 8C9ED3B2834AAE63081AB2DA831C6FE9, 87D2931A5CD3658A28072BEC3F28384B91CC3B19D072CE9C69F119B80671C163 ] Dnscache        C:\WINXP\System32\dnsrslvr.dll
10:17:29.0265 0x0198  Dnscache - ok
10:17:29.0328 0x0198  [ 676E36C4FF5BCEA1900F44182B9723E6, 740CF18BD40E00FEA26CF0E6340C5D18F7D0B4390055FAEEC258B3AA790C4AE9 ] Dot3svc         C:\WINXP\System32\dot3svc.dll
10:17:29.0500 0x0198  Dot3svc - ok
10:17:29.0500 0x0198  dpti2o - ok
10:17:29.0562 0x0198  [ 8F5FCFF8E8848AFAC920905FBD9D33C8, C8C6FB97AB0871C8C88A2201525A5CF10D5131CB6980D32692ED7A8F58399AD5 ] drmkaud         C:\WINXP\system32\drivers\drmkaud.sys
10:17:29.0734 0x0198  drmkaud - ok
10:17:29.0828 0x0198  [ 687AF6BB383885FF6A64071B189A7F3E, 1C751B8DD27F63E88D0223A8434CED7589AC00EC6275938C59D1B954F0354F78 ] dtsoftbus01     C:\WINXP\system32\DRIVERS\dtsoftbus01.sys
10:17:29.0875 0x0198  dtsoftbus01 - ok
10:17:29.0921 0x0198  [ 4E4F2FDDAB0A0736D7671134DCCE91FB, 8E2C57D1A006856C47CBDD5765A9DD317DB205B26DA8BFC70555A506257A1CD9 ] EapHost         C:\WINXP\System32\eapsvc.dll
10:17:30.0109 0x0198  EapHost - ok
10:17:30.0171 0x0198  [ 877C18558D70587AA7823A1A308AC96B, 6B336A62112988D855513F45153F73F8470C41A448E9B7438B4A8EC1813AABF1 ] ERSvc           C:\WINXP\System32\ersvc.dll
10:17:30.0375 0x0198  ERSvc - ok
10:17:30.0421 0x0198  [ 4BB6A83640F1D1792AD21CE767B621C6, 7B88A06D5220DE5C378B8C017354E9C8C89D625251A6EB607059A663E2BACD0A ] Eventlog        C:\WINXP\system32\services.exe
10:17:30.0593 0x0198  Eventlog - ok
10:17:30.0734 0x0198  [ ADA7241C16F3F42C7F210539FAD5F3AA, 70CF3FD831AD049D7C11AF0636E12FFC76A198BA05FC745CEB9A48516B9FA99E ] EventSystem     C:\WINXP\system32\es.dll
10:17:30.0984 0x0198  EventSystem - ok
10:17:31.0125 0x0198  [ 3EF58F2EAE3AECAB45D682152DB2F67D, 61A0904D27572B1129B17CE073AEBF30E26398D8B9BD8279458D1A4363555467 ] exFat           C:\WINXP\system32\drivers\exFat.sys
10:17:31.0375 0x0198  exFat - ok
10:17:31.0578 0x0198  [ 38D332A6D56AF32635675F132548343E, E6909DB836AF679B4F4D62C7396D6C82769CC7ABB8C919C2AABFE934FCE268F6 ] Fastfat         C:\WINXP\system32\drivers\Fastfat.sys
10:17:32.0281 0x0198  Fastfat - ok
10:17:32.0500 0x0198  [ 40602EBFBE06AA075C8E4560743F6883, 808AF03F31CA4168888D0E3802AE4A0DE7F7324F4CD2F8FE491211895C9C6901 ] FastUserSwitchingCompatibility C:\WINXP\System32\shsvcs.dll
10:17:32.0734 0x0198  FastUserSwitchingCompatibility - ok
10:17:32.0828 0x0198  [ 92CDD60B6730B9F50F6A1A0C1F8CDC81, 8307A532AB4D05CBBCE206DC2759497708BF5AAA880BD00F0E4F281D8578A1F5 ] Fdc             C:\WINXP\system32\drivers\Fdc.sys
10:17:33.0078 0x0198  Fdc - ok
10:17:33.0140 0x0198  [ B0678A548587C5F1967B0D70BACAD6C1, 7E49910212ED87313F926E4800EA8D34809C287A686CA69B82B79C1A6451F88C ] Fips            C:\WINXP\system32\drivers\Fips.sys
10:17:33.0343 0x0198  Fips - ok
10:17:33.0421 0x0198  [ 9D27E7B80BFCDF1CDD9B555862D5E7F0, 69C271AD5BCEBFD8AE5A769BDD7EC51256DA3A8ADAD5D12E5C0D13F4E82D8805 ] Flpydisk        C:\WINXP\system32\drivers\Flpydisk.sys
10:17:33.0671 0x0198  Flpydisk - ok
10:17:33.0765 0x0198  [ B2CF4B0786F8212CB92ED2B50C6DB6B0, 280F5CF8A90F7BEDE73ADD0DD0F8952088133A7CA9A3D3B7041957E33B36845D ] FltMgr          C:\WINXP\system32\drivers\fltmgr.sys
10:17:36.0015 0x0198  FltMgr - ok
10:17:36.0343 0x0198  [ 8BA7C024070F2B7FDD98ED8A4BA41789, 47585006F86B2C6016EC54250A416794792D1E4024FF229C120BC25B684AF66A ] FontCache3.0.0.0 C:\WINXP\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
10:17:36.0703 0x0198  FontCache3.0.0.0 - ok
10:17:36.0828 0x0198  [ C865B83411D7347627A4BEEC22543FB1, 40F2232892CABF192903DA148ABD359F6FC0C5A21AC0B61EDC011C7CC4AA54BF ] Fs_Rec          C:\WINXP\system32\drivers\Fs_Rec.sys
10:17:36.0953 0x0198  Fs_Rec - ok
10:17:37.0031 0x0198  [ 8F1955CE42E1484714B542F341647778, 8EB3F99625F409D3032561E8AB44BEFBFBFBA4EC873C2151C92A5CAAF7F2AA55 ] Ftdisk          C:\WINXP\system32\DRIVERS\ftdisk.sys
10:17:37.0562 0x0198  Ftdisk - ok
10:17:37.0640 0x0198  [ 185ADA973B5020655CEE342059A86CBB, D3E352DFAF30761505480A4C557D980083F65EC5BD46E2656B2114D47B272A89 ] GEARAspiWDM     C:\WINXP\system32\DRIVERS\GEARAspiWDM.sys
10:17:37.0703 0x0198  GEARAspiWDM - ok
10:17:37.0812 0x0198  [ 0A02C63C8B144BD8C86B103DEE7C86A2, 7A3235DD3E1995DD72B212FAEB3ECA2A974434DE9BF6D269EA11BA65A80E7E50 ] Gpc             C:\WINXP\system32\DRIVERS\msgpc.sys
10:17:38.0031 0x0198  Gpc - ok
10:17:38.0281 0x0198  [ 506708142BC63DABA64F2D3AD1DCD5BF, 9C36A08D9E7932FF4DA7B5F24E6B42C92F28685B8ABE964C870E8D7670FD531A ] gupdate         C:\Programme\Google\Update\GoogleUpdate.exe
10:17:38.0406 0x0198  gupdate - ok
10:17:38.0609 0x0198  [ 506708142BC63DABA64F2D3AD1DCD5BF, 9C36A08D9E7932FF4DA7B5F24E6B42C92F28685B8ABE964C870E8D7670FD531A ] gupdatem        C:\Programme\Google\Update\GoogleUpdate.exe
10:17:38.0671 0x0198  gupdatem - ok
10:17:39.0312 0x0198  [ D95554949082FD29A04D351B58396718, A9E4D2EE0CDE5BD0D2CAA784C080146B6EDBC78AB6857995DEA8D377D9E3CF46 ] Hardlock        C:\WINXP\system32\drivers\hardlock.sys
10:17:40.0656 0x0198  Hardlock - ok
10:17:40.0796 0x0198  [ 573C7D0A32852B48F3058CFD8026F511, BC384BBA394AFDCDA1A9ABC858C692AA84A1F0A31AF3DDF7F38D120C027927FB ] HDAudBus        C:\WINXP\system32\DRIVERS\HDAudBus.sys
10:17:41.0140 0x0198  HDAudBus - ok
10:17:41.0328 0x0198  [ CB66BF85BF599BEFD6C6A57C2E20357F, 55D3A0F9279FF316766F42548FCB61C452942B08A37590C4892DF110BE4E53C6 ] helpsvc         C:\WINXP\PCHealth\HelpCtr\Binaries\pchsvc.dll
10:17:41.0578 0x0198  helpsvc - ok
10:17:41.0718 0x0198  [ B35DA85E60C0103F2E4104532DA2F12B, E13C9F73DF7713554CB614B36123D75014F5121AA1FC9069733E61758751CBE4 ] HidServ         C:\WINXP\System32\hidserv.dll
10:17:42.0515 0x0198  HidServ - ok
10:17:42.0640 0x0198  [ CCF82C5EC8A7326C3066DE870C06DAF1, 93395FA4C26B2E82DC8B7025ED3BCF583885E5D8C5F60CD6EEAA6335D6A126EC ] HidUsb          C:\WINXP\system32\DRIVERS\hidusb.sys
10:17:42.0906 0x0198  HidUsb - ok
10:17:43.0015 0x0198  [ ED29F14101523A6E0E808107405D452C, B8FA987637787BEECC2EB06D36293DAC355523392B49A8C5A9491EEE961917E9 ] hkmsvc          C:\WINXP\System32\kmsvc.dll
10:17:43.0375 0x0198  hkmsvc - ok
10:17:43.0562 0x0198  [ 48ED16C0C98C950843E673EEEE02AC94, 16F85C4E377E41C0E86A2AB3AE2E429E12866773CBBCB85A384E1792011F96D1 ] hotcore3        C:\WINXP\system32\DRIVERS\hotcore3.sys
10:17:43.0687 0x0198  hotcore3 - ok
10:17:43.0703 0x0198  hpn - ok
10:17:43.0781 0x0198  [ F6AACF5BCE2893E0C1754AFEB672E5C9, 62A7A70515B5570A649DC30A3A122B1302F6839A63927C8B29EBE04ABA654892 ] HTTP            C:\WINXP\system32\Drivers\HTTP.sys
10:17:44.0218 0x0198  HTTP - ok
10:17:44.0312 0x0198  [ 9E4ADB854CEBCFB81A4B36718FEECD16, 677AB64460775686F8366D6BF35D420A2486C3F07338A00A7C2788A5142B9F08 ] HTTPFilter      C:\WINXP\System32\w3ssl.dll
10:17:44.0500 0x0198  HTTPFilter - ok
10:17:44.0515 0x0198  i2omgmt - ok
10:17:44.0515 0x0198  i2omp - ok
10:17:44.0671 0x0198  [ E283B97CFBEB86C1D86BAED5F7846A92, 7664F791D08C80DF1E52B34BE69F073AA645610C4BD975F498254807602374AB ] i8042prt        C:\WINXP\system32\DRIVERS\i8042prt.sys
10:17:45.0078 0x0198  i8042prt - ok
10:17:45.0234 0x0198  [ D483687EACE0C065EE772481A96E05F5, A22200E90C78DFE73FE0FBEED5331AB43CD7133651FD125595C4DB604AD71B29 ] iaStor          C:\WINXP\system32\DRIVERS\iaStor.sys
10:17:45.0656 0x0198  iaStor - ok
10:17:45.0953 0x0198  [ C01AC32DC5C03076CFB852CB5DA5229C, A4D7749220B5BC965D96A267F1E02FE8284A230BA249109207BD4B9EA8DFAC96 ] idsvc           C:\WINXP\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
10:17:46.0703 0x0198  idsvc - ok
10:17:46.0781 0x0198  [ 083A052659F5310DD8B6A6CB05EDCF8E, 48D39B03FFB6FAA1529B774443BA12618AE3982D9F65A7B9D18F2269F78B31F4 ] Imapi           C:\WINXP\system32\DRIVERS\imapi.sys
10:17:47.0015 0x0198  Imapi - ok
10:17:47.0125 0x0198  [ D4B413AA210C21E46AEDD2BA5B68D38E, 2309622867AA8FC832A729FA78F48742D4BD6CA0DAFBFB9DDB0772D671E1ED75 ] ImapiService    C:\WINXP\system32\imapi.exe
10:17:47.0312 0x0198  ImapiService - ok
10:17:47.0328 0x0198  ini910u - ok
10:17:47.0703 0x0198  [ 19EEDB7E20D269D547CE74AF90FEAE2D, 25B1F50F95F332281A716C021C2EA61EFC0189957436155A81E4DE13DE1B52BB ] IntcAzAudAddService C:\WINXP\system32\drivers\RtkHDAud.sys
10:17:51.0015 0x0198  IntcAzAudAddService - ok
10:17:51.0031 0x0198  IntelIde - ok
10:17:51.0078 0x0198  [ 4C7D2750158ED6E7AD642D97BFFAE351, C05E4799752F090DCB632F07F62ADE38D31534621064D269AD535CA0BDFED448 ] intelppm        C:\WINXP\system32\DRIVERS\intelppm.sys
10:17:51.0296 0x0198  intelppm - ok
10:17:51.0328 0x0198  [ 3BB22519A194418D5FEC05D800A19AD0, F6662F440950596DC1382DD1DB5D7891CCEA30A6062BEA942C18445B5F0D8B16 ] Ip6Fw           C:\WINXP\system32\drivers\ip6fw.sys
10:17:51.0453 0x0198  Ip6Fw - ok
10:17:51.0531 0x0198  [ 731F22BA402EE4B62748ADAF6363C182, 5C3BEBD008A5BE4DC2F92076FF41A10DDC01E10EC7E6552213CFA11970811848 ] IpFilterDriver  C:\WINXP\system32\DRIVERS\ipfltdrv.sys
10:17:51.0687 0x0198  IpFilterDriver - ok
10:17:51.0718 0x0198  [ B87AB476DCF76E72010632B5550955F5, E6E74D3A86A7917A8BAED44F8E97CCD2EB171E4E4B27E9907F60D1523FAF319A ] IpInIp          C:\WINXP\system32\DRIVERS\ipinip.sys
10:17:51.0875 0x0198  IpInIp - ok
10:17:51.0890 0x0198  [ CC748EA12C6EFFDE940EE98098BF96BB, AF523E21C25D9A1715EFEA573E4F52AF5D4FC9F28A2D613F5DB629C186C439E0 ] IpNat           C:\WINXP\system32\DRIVERS\ipnat.sys
10:17:52.0031 0x0198  IpNat - ok
10:17:52.0156 0x0198  [ E46B17060D3962A384AE484094614788, 9E8EF45C72A01FA586FF028B62F6675114CC9CBBCE172A789EDA754AE3F79121 ] iPod Service    C:\Programme\iPod\bin\iPodService.exe
10:17:52.0265 0x0198  iPod Service - ok
10:17:52.0328 0x0198  [ 23C74D75E36E7158768DD63D92789A91, 394D296F38E7D8EFD91A6EEC301D9CE6AF910E35EB9819F1A9E3363863AEDFDC ] IPSec           C:\WINXP\system32\DRIVERS\ipsec.sys
10:17:52.0453 0x0198  IPSec - ok
10:17:52.0515 0x0198  [ C93C9FF7B04D772627A3646D89F7BF89, 805FA48E7A46D4F10240BF880A2468F53DEA36E83004399228AB70DB7D20544A ] IRENUM          C:\WINXP\system32\DRIVERS\irenum.sys
10:17:52.0750 0x0198  IRENUM - ok
10:17:52.0828 0x0198  [ 6DFB88F64135C525433E87648BDA30DE, 8233EEFBEF36AAA152F2C55D23D7118F0DE40C9C22EB5D9793405A4770889540 ] isapnp          C:\WINXP\system32\DRIVERS\isapnp.sys
10:17:52.0984 0x0198  isapnp - ok
10:17:53.0078 0x0198  [ 1704D8C4C8807B889E43C649B478A452, E854C90CD301F42BE2520CEDAD35E49DF2D43606CF4EEED861B74882118D04D1 ] Kbdclass        C:\WINXP\system32\DRIVERS\kbdclass.sys
10:17:53.0218 0x0198  Kbdclass - ok
10:17:53.0296 0x0198  [ B6D6C117D771C98130497265F26D1882, E79CC4EA5C088F988BA61F80764F9CAD9B78BC56A7E17DD54622C75483BC5DF4 ] kbdhid          C:\WINXP\system32\DRIVERS\kbdhid.sys
10:17:53.0500 0x0198  kbdhid - ok
10:17:53.0578 0x0198  [ 692BCF44383D056AED41B045A323D378, 1A99DEE83FFAF64E73067FC049C0A4CE07D94E4AE31EFA17B38CEFA9E41D67DC ] kmixer          C:\WINXP\system32\drivers\kmixer.sys
10:17:53.0734 0x0198  kmixer - ok
10:17:53.0796 0x0198  [ 1705745D900DABF2D89F90EBADDC7517, FE90589415BDB3BA482D3EBE1A87A7BF1429791E8F18BCB66BF8874631CC8B2C ] KSecDD          C:\WINXP\system32\drivers\KSecDD.sys
10:17:53.0953 0x0198  KSecDD - ok
10:17:54.0000 0x0198  [ D6EB4916B203CBE525F8EFF5FD5AB16C, 93C0F25E7D018B85FE8725EF39F25AED80698D39356FA8FC9CA534F68C430EE8 ] LanmanServer    C:\WINXP\System32\srvsvc.dll
10:17:54.0187 0x0198  LanmanServer - ok
10:17:54.0265 0x0198  [ C0DB1E9367681ECD7ECCA9615C1D0F9B, 0CB18C35032E39163645C1761A9488639D2EF0643D856FDAA013BFF8A69DC744 ] lanmanworkstation C:\WINXP\System32\wkssvc.dll
10:17:54.0531 0x0198  lanmanworkstation - ok
10:17:54.0531 0x0198  lbrtfdc - ok
10:17:54.0531 0x0198  LcSvrAdm - ok
10:17:54.0562 0x0198  LcSvrAuf - ok
10:17:54.0562 0x0198  LcSvrDba - ok
10:17:54.0578 0x0198  LcSvrHis - ok
10:17:54.0578 0x0198  LcSvrPAS - ok
10:17:54.0593 0x0198  LcSvrSaz - ok
10:17:54.0656 0x0198  [ 636714B7D43C8D0C80449123FD266920, F06F6C7DC49B26EFCAC3570C67BA9BD934F62C6F382DA4DD2AB302C7B970F414 ] LmHosts         C:\WINXP\System32\lmhsvc.dll
10:17:54.0828 0x0198  LmHosts - ok
10:17:54.0859 0x0198  [ B7550A7107281D170CE85524B1488C98, A3854B16A65436BEF6BEDE918B43B3BE8F00D303660DB5831DD376271DC43239 ] Messenger       C:\WINXP\System32\msgsvc.dll
10:17:55.0015 0x0198  Messenger - ok
10:17:55.0031 0x0198  Microsoft Office Groove Audit Service - ok
10:17:55.0078 0x0198  [ 4AE068242760A1FB6E1A44BF4E16AFA6, 1FB771162B96AAF787AC24867B818DF8511F0780BB094FA9A38C11D8DBFE68BC ] mnmdd           C:\WINXP\system32\drivers\mnmdd.sys
10:17:55.0234 0x0198  mnmdd - ok
10:17:55.0296 0x0198  [ C2F1D365FD96791B037EE504868065D3, 87BD87E08FD00D115524B049F1A3A719AB86557D68968E7090CD0F271F985CAF ] mnmsrvc         C:\WINXP\system32\mnmsrvc.exe
10:17:55.0421 0x0198  mnmsrvc - ok
10:17:55.0515 0x0198  [ 6FB74EBD4EC57A6F1781DE3852CC3362, 0454509D9A31E0202C08AE17294E2682F227D177A3C73B303E4C8332757AFCA1 ] Modem           C:\WINXP\system32\drivers\Modem.sys
10:17:55.0656 0x0198  Modem - ok
10:17:55.0718 0x0198  [ B24CE8005DEAB254C0251E15CB71D802, 6804A8ABDAD5EC846E7F8077D1EE9BA45D6226ACFF42C70BE3DE7C8980EF9EC4 ] Mouclass        C:\WINXP\system32\DRIVERS\mouclass.sys
10:17:55.0843 0x0198  Mouclass - ok
10:17:55.0906 0x0198  [ 66A6F73C74E1791464160A7065CE711A, 3C570FA1E8EF976B83759220FE95BAC9D7D48D607F91B113EDE4790D34ACBD46 ] mouhid          C:\WINXP\system32\DRIVERS\mouhid.sys
10:17:56.0359 0x0198  mouhid - ok
10:17:56.0453 0x0198  [ A80B9A0BAD1B73637DBCBBA7DF72D3FD, 2A5E15ED2C24C6C65EF2F7E1FD93374774076C9D8D451E4422561F4D269C012F ] MountMgr        C:\WINXP\system32\drivers\MountMgr.sys
10:17:56.0625 0x0198  MountMgr - ok
10:17:56.0718 0x0198  [ 26EA1DAD601EE3ACAC301D66F07BA219, C9594BB15D53D4AC2156CCCD2DB65B2C20620F1F60DA85F48D1586FC10028096 ] MozillaMaintenance C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe
10:17:56.0906 0x0198  MozillaMaintenance - ok
10:17:56.0906 0x0198  mraid35x - ok
10:17:57.0031 0x0198  [ 11D42BB6206F33FBB3BA0288D3EF81BD, 76ABCFB62C5AC549F58C231F72A99882CDEB74928104B77FE52554765C2B1A22 ] MRxDAV          C:\WINXP\system32\DRIVERS\mrxdav.sys
10:17:57.0421 0x0198  MRxDAV - ok
10:17:57.0531 0x0198  [ 7170AB42B51954DEF2781A4D1CCE65F4, 6E85E082E80A6343F5D4A559EFC9DAEFA0D1AAA811262C3AFEDD18416B6DCB96 ] MRxSmb          C:\WINXP\system32\DRIVERS\mrxsmb.sys
10:17:57.0906 0x0198  MRxSmb - ok
10:17:57.0953 0x0198  [ 35A031AF38C55F92D28AA03EE9F12CC9, 97245D204C886EE8DCCC2DEAC80A0E358A7E0C1982F77389DA50DCF091FC9DDC ] MSDTC           C:\WINXP\system32\msdtc.exe
10:17:58.0093 0x0198  MSDTC - ok
10:17:58.0140 0x0198  [ C941EA2454BA8350021D774DAF0F1027, C940E978C7B66A713A0FDAB54B5F995DF59D089AFCD96221DD3222948CD49BBD ] Msfs            C:\WINXP\system32\drivers\Msfs.sys
10:17:58.0281 0x0198  Msfs - ok
10:17:58.0296 0x0198  MSIServer - ok
10:17:58.0390 0x0198  [ D1575E71568F4D9E14CA56B7B0453BF1, 4ABE0E24786C0D39FA2B885447E56204CA6942FB175E534DCE675D7BCF0B176A ] MSKSSRV         C:\WINXP\system32\drivers\MSKSSRV.sys
10:17:58.0531 0x0198  MSKSSRV - ok
10:17:58.0593 0x0198  [ 325BB26842FC7CCC1FCCE2C457317F3E, C07BE560513B1FB91D756494F0BA4AEEB2E1998DE0E1C21EE83DB1183B0CEE91 ] MSPCLOCK        C:\WINXP\system32\drivers\MSPCLOCK.sys
10:17:58.0796 0x0198  MSPCLOCK - ok
10:17:58.0890 0x0198  [ BAD59648BA099DA4A17680B39730CB3D, 9AD4C7C94C186C8815D0BC75DCAFB962158DA6935A244BA243EDDDEB33F9816C ] MSPQM           C:\WINXP\system32\drivers\MSPQM.sys
10:17:59.0046 0x0198  MSPQM - ok
10:17:59.0078 0x0198  [ AF5F4F3F14A8EA2C26DE30F7A1E17136, AC93A1E4ABB0D038B772E429015567E44CC2EDB66C54DBE23A5F98176FAC1520 ] mssmbios        C:\WINXP\system32\DRIVERS\mssmbios.sys
10:17:59.0218 0x0198  mssmbios - ok
10:17:59.0250 0x0198  [ 2F625D11385B1A94360BFC70AAEFDEE1, 23E4974120233CF1A7BEE48977706A0A55418699379D1450502ABEB24191AC80 ] Mup             C:\WINXP\system32\drivers\Mup.sys
10:17:59.0375 0x0198  Mup - ok
10:17:59.0453 0x0198  [ 46BB15AE2AC7D025D6D2567B876817BD, 102A101B96D1078C98FA0F871C801A9A8538E20E5686AB0C7680B2F6C92B3165 ] napagent        C:\WINXP\System32\qagentrt.dll
10:17:59.0625 0x0198  napagent - ok
10:17:59.0953 0x0198  [ 5E8EDD6A52E897C19EC6E149FE6C7A8E, 0ACF2237F5AFA72505FFE2C9639FFDBBB991EDF804376610B0719F0131F63E43 ] NBService       C:\Programme\Nero\Nero 7\Nero BackItUp\NBService.exe
10:18:00.0328 0x0198  NBService - ok
10:18:00.0390 0x0198  [ 1DF7F42665C94B825322FAE71721130D, FE0DCB728471465B39A42A7511F4133021FBA5DF88F88BCB5FE2FF34CFD713F9 ] NDIS            C:\WINXP\system32\drivers\NDIS.sys
10:18:00.0578 0x0198  NDIS - ok
10:18:00.0609 0x0198  [ 1AB3D00C991AB086E69DB84B6C0ED78F, 1F881FCCF5557C44C078D99CA2DD38D635413D6212DBEDC06A428EDAC7F8B04E ] NdisTapi        C:\WINXP\system32\DRIVERS\ndistapi.sys
10:18:00.0765 0x0198  NdisTapi - ok
10:18:00.0796 0x0198  [ F927A4434C5028758A842943EF1A3849, B1AA3AF150C05307461774925901789456B0CCCD03A5E71ADA4AB58455962BEE ] Ndisuio         C:\WINXP\system32\DRIVERS\ndisuio.sys
10:18:00.0937 0x0198  Ndisuio - ok
10:18:00.0968 0x0198  [ EDC1531A49C80614B2CFDA43CA8659AB, 494042F790F33721328B4451E79842E21919681CC421A4F9633EC4D383E06097 ] NdisWan         C:\WINXP\system32\DRIVERS\ndiswan.sys
10:18:01.0156 0x0198  NdisWan - ok
10:18:01.0203 0x0198  [ 6215023940CFD3702B46ABC304E1D45A, C767F3A349B365F6E7566C0738E2F62D8FFF8CB4457347E3614BD403BC6CADCB ] NDProxy         C:\WINXP\system32\drivers\NDProxy.sys
10:18:01.0390 0x0198  NDProxy - ok
10:18:01.0468 0x0198  [ 90EB97C8DBF11BB0016C51946AC5ECD6, 1DE00CCDDF49FB05FA73FE14C8EA101B410BFD40A1F7A099B61BBDB6324985BB ] Net Driver HPZ12 C:\WINXP\system32\HPZinw12.dll
10:18:01.0546 0x0198  Net Driver HPZ12 - detected UnsignedFile.Multi.Generic ( 1 )
10:18:04.0031 0x0198  Detect skipped due to KSN trusted
10:18:04.0031 0x0198  Net Driver HPZ12 - ok
10:18:04.0093 0x0198  [ 5D81CF9A2F1A3A756B66CF684911CDF0, 7989C36607CAEA17AFA2C1C9904145CA0714A54B9F712D9D4C1AB140D0B2CC0C ] NetBIOS         C:\WINXP\system32\DRIVERS\netbios.sys
10:18:04.0296 0x0198  NetBIOS - ok
10:18:04.0328 0x0198  [ 74B2B2F5BEA5E9A3DC021D685551BD3D, 7932B71F98B4122BE88F576BF6D745A757AE378A48924B7F4358837B75640A82 ] NetBT           C:\WINXP\system32\DRIVERS\netbt.sys
10:18:04.0671 0x0198  NetBT - ok
10:18:04.0734 0x0198  [ 8ACE4251BFFD09CE75679FE940E996CC, 81969521B5EAEA09ECA63058BE9697BB69AF2596339CA9DF0CFEDC031DCFDC7E ] NetDDE          C:\WINXP\system32\netdde.exe
10:18:04.0984 0x0198  NetDDE - ok
10:18:05.0015 0x0198  [ 8ACE4251BFFD09CE75679FE940E996CC, 81969521B5EAEA09ECA63058BE9697BB69AF2596339CA9DF0CFEDC031DCFDC7E ] NetDDEdsdm      C:\WINXP\system32\netdde.exe
10:18:05.0140 0x0198  NetDDEdsdm - ok
10:18:05.0187 0x0198  [ AFB8261B56CBA0D86AEB6DF682AF9785, 104D96F1F19DD4CE492064ACC9634406A019EAE20B42D03198E400E661897127 ] Netlogon        C:\WINXP\system32\lsass.exe
10:18:05.0343 0x0198  Netlogon - ok
10:18:05.0406 0x0198  [ E6D88F1F6745BF00B57E7855A2AB696C, 12A5EDD853600FF5EBF91E127077745AE1E61E66DBC1D4D4306570F171AF4A39 ] Netman          C:\WINXP\System32\netman.dll
10:18:05.0546 0x0198  Netman - ok
10:18:05.0609 0x0198  [ D22CD77D4F0D63D1169BB35911BFF12D, 85B1FDFA02E1B8EA4FCB9B7EEB687C5C448697FC7EC9D178C5A2F64D2C9CFEE8 ] NetTcpPortSharing C:\WINXP\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
10:18:05.0796 0x0198  NetTcpPortSharing - ok
10:18:06.0031 0x0198  [ E2F396F71A793A04839DBB6AF304A026, EF7203E0E48AE6FB3084BC8A4D8A452C8F4F76C34628DB7BD81E5A1AA62C8095 ] NETw3x32        C:\WINXP\system32\DRIVERS\NETw3x32.sys
10:18:06.0593 0x0198  NETw3x32 - ok
10:18:06.0640 0x0198  [ E9E47CFB2D461FA0FC75B7A74C6383EA, 544136F5BFD4DC23D45E90F12FA48B82FD9EAEA9EAF3E0F5F0BD27E23D672C3E ] NIC1394         C:\WINXP\system32\DRIVERS\nic1394.sys
10:18:06.0828 0x0198  NIC1394 - ok
10:18:06.0937 0x0198  [ F12B9D9A069331877D006CC81B4735F9, 28EEE4A21412174BE0CAF7B041DAAB8299AA59EA5F6E41B8AFDD1A4DA770C793 ] Nla             C:\WINXP\System32\mswsock.dll
10:18:07.0093 0x0198  Nla - ok
10:18:07.0296 0x0198  [ 193FA51DDDD0BFFDED1C340F0434999A, C05CA0A8568E9CBDA15633ED420C29F52082114B2B9F24EB61369E42C480C080 ] NMIndexingService C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe
10:18:07.0953 0x0198  NMIndexingService - ok
10:18:08.0203 0x0198  [ 590168F80BEBC75CAF9EC7006A77C9B4, E0F36978EBE1DC67B5BA0916350A95F2B5932F95004EFC2761F3F810BD52D712 ] NovacomD        C:\Programme\Palm, Inc\novacomd\x86\novacomd.exe
10:18:08.0312 0x0198  NovacomD - detected UnsignedFile.Multi.Generic ( 1 )
10:18:10.0875 0x0198  Detect skipped due to KSN trusted
10:18:10.0875 0x0198  NovacomD - ok
10:18:10.0937 0x0198  [ 3182D64AE053D6FB034F44B6DEF8034A, 4ADFC76965BA2A5F488E71789A4E4EA702A74AF42725F72130D1CA919406CF19 ] Npfs            C:\WINXP\system32\drivers\Npfs.sys
10:18:11.0265 0x0198  Npfs - ok
10:18:11.0359 0x0198  [ F8E396F5E703D7A8F37D90F59C776268, 80E3CE00732F3FC1A7FBCD77D68E45116DCDAA1BA6057D2B16C2127CB75223EF ] NSHE            C:\WINXP\system32\Drivers\NSHE.SYS
10:18:11.0531 0x0198  NSHE - detected UnsignedFile.Multi.Generic ( 1 )
10:18:13.0500 0x0ba8  Object required for P2P: [ 5E8EDD6A52E897C19EC6E149FE6C7A8E ] NBService
10:18:14.0515 0x0198  NSHE ( UnsignedFile.Multi.Generic ) - warning
10:18:16.0234 0x0ba8  Object send P2P result: true
10:18:17.0312 0x0198  [ 78A08DD6A8D65E697C18E1DB01C5CDCA, E0E6F3ED05068E32F1D5C2D2B38CDEF4536B8656DB6756C66CF6B40B60C8F3DA ] Ntfs            C:\WINXP\system32\drivers\Ntfs.sys
10:18:17.0828 0x0198  Ntfs - ok
10:18:17.0875 0x0198  [ AFB8261B56CBA0D86AEB6DF682AF9785, 104D96F1F19DD4CE492064ACC9634406A019EAE20B42D03198E400E661897127 ] NtLmSsp         C:\WINXP\system32\lsass.exe
10:18:18.0000 0x0198  NtLmSsp - ok
10:18:18.0125 0x0198  [ 56AF4064996FA5BAC9C449B1514B4770, 154602EFEC22728503D4ABA025DF711B0F2CFC983F5E3BF25F2A4BCD1AE250EC ] NtmsSvc         C:\WINXP\system32\ntmssvc.dll
10:18:18.0515 0x0198  NtmsSvc - ok
10:18:18.0578 0x0198  [ 73C1E1F395918BC2C6DD67AF7591A3AD, B21133A75253EC15E2DFF66D3B480AB1A7E1A2360476C810E7AA55D0F0EB08D4 ] Null            C:\WINXP\system32\drivers\Null.sys
10:18:18.0812 0x0198  Null - ok
10:18:19.0343 0x0198  [ D42FB8615E810901779294F5627364FE, 2D74EE4525F816387017E56F23B08EFB14BE0AD7FC5663758B71639BA46EA9B9 ] nv              C:\WINXP\system32\DRIVERS\nv4_mini.sys
10:18:20.0671 0x0198  nv - ok
10:18:20.0750 0x0198  [ 755D3A2DE4B05024F90430FE32FF26A5, 07ED1CED388A10D6A3F6A814D4879FDA2D62C64A30D82330A23B49828BA5760C ] NVSvc           C:\WINXP\system32\nvsvc32.exe
10:18:20.0796 0x0198  NVSvc - ok
10:18:20.0812 0x0198  [ B305F3FAD35083837EF46A0BBCE2FC57, 9D0E0E666D652D0FC9EAB97280A5D67AAF61D6B21929DF7CF8ED72A367720464 ] NwlnkFlt        C:\WINXP\system32\DRIVERS\nwlnkflt.sys
10:18:20.0937 0x0198  NwlnkFlt - ok
10:18:20.0937 0x0198  [ C99B3415198D1AAB7227F2C88FD664B9, DD8DA4B5E804F134AB9233859544C025062902DFC3E8FB8A09A67337A4E73F55 ] NwlnkFwd        C:\WINXP\system32\DRIVERS\nwlnkfwd.sys
10:18:21.0062 0x0198  NwlnkFwd - ok
10:18:21.0171 0x0198  [ 84DE1DD996B48B05ACE31AD015FA108A, 4B9D1E4EF83ECED6C77F23D9879C124534F7053D7423E3A2D0F67A4A720CEA94 ] odserv          C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE
10:18:21.0296 0x0198  odserv - ok
10:18:21.0312 0x0198  [ CA33832DF41AFB202EE7AEB05145922F, 9DD0089C2E13C7F81214C3B5A4A61276292052F9BBFEA7FCD0F6AA27815D5F95 ] ohci1394        C:\WINXP\system32\DRIVERS\ohci1394.sys
10:18:21.0453 0x0198  ohci1394 - ok
10:18:21.0500 0x0198  [ 5A432A042DAE460ABE7199B758E8606C, 6E5D1F477D290905BE27CEBF9572BAC6B05FFEF2FAD901D3C8E11F665F8B9A71 ] ose             C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE
10:18:21.0531 0x0198  ose - ok
10:18:21.0593 0x0198  [ F84785660305B9B903FB3BCA8BA29837, BDBDE61076800415D98759077E9E039C80B55DBE68E31F8BF44A909C6C3D3276 ] Parport         C:\WINXP\system32\drivers\Parport.sys
10:18:21.0796 0x0198  Parport - ok
10:18:21.0812 0x0198  [ BEB3BA25197665D82EC7065B724171C6, 7E71C13BA30CD95CEE8A9CC85E6F48A01F30EDEAADEE69D80AE828BF97E5A5CA ] PartMgr         C:\WINXP\system32\drivers\PartMgr.sys
10:18:21.0937 0x0198  PartMgr - ok
10:18:21.0968 0x0198  [ C2BF987829099A3EAA2CA6A0A90ECB4F, 1DF21EA8E43875CFEECD869407429F82FB449707CFB845718499468E699BAAAA ] ParVdm          C:\WINXP\system32\drivers\ParVdm.sys
10:18:22.0093 0x0198  ParVdm - ok
10:18:22.0125 0x0198  [ 387E8DEDC343AA2D1EFBC30580273ACD, 5F3E642BDB759777E570ED5B22AC7E93CDCD362708F281657AD7BAB44EDEC802 ] PCI             C:\WINXP\system32\DRIVERS\pci.sys
10:18:22.0265 0x0198  PCI - ok
10:18:22.0281 0x0198  PCIDump - ok
10:18:22.0281 0x0198  [ 59BA86D9A61CBCF4DF8E598C331F5B82, 822D11C5CE77BFD7B2F25350CCBF92B0B9388EEA6D86ED220B768C720976D839 ] PCIIde          C:\WINXP\system32\DRIVERS\pciide.sys
10:18:22.0421 0x0198  PCIIde - ok
10:18:22.0453 0x0198  [ A2A966B77D61847D61A3051DF87C8C97, 6CED7CA26DC62B0AAFC83A2E07336DAD25954491201BB8E06103971F3F0B8B51 ] Pcmcia          C:\WINXP\system32\drivers\Pcmcia.sys
10:18:22.0593 0x0198  Pcmcia - ok
10:18:22.0593 0x0198  PDCOMP - ok
10:18:22.0593 0x0198  PDFRAME - ok
10:18:22.0609 0x0198  PDRELI - ok
10:18:22.0609 0x0198  PDRFRAME - ok
10:18:22.0609 0x0198  perc2 - ok
10:18:22.0625 0x0198  perc2hib - ok
10:18:22.0656 0x0198  [ 4BB6A83640F1D1792AD21CE767B621C6, 7B88A06D5220DE5C378B8C017354E9C8C89D625251A6EB607059A663E2BACD0A ] PlugPlay        C:\WINXP\system32\services.exe
10:18:22.0781 0x0198  PlugPlay - ok
10:18:22.0812 0x0198  [ F0EFAF6000E9FCBD77F769D527CE5F9D, 2318F47BB5D43CA288AB753F68F509F92CC33F7C0613640C13E14D50BDBD9E65 ] Pml Driver HPZ12 C:\WINXP\system32\HPZipm12.dll
10:18:22.0843 0x0198  Pml Driver HPZ12 - detected UnsignedFile.Multi.Generic ( 1 )
10:18:25.0234 0x0198  Detect skipped due to KSN trusted
10:18:25.0234 0x0198  Pml Driver HPZ12 - ok
10:18:25.0328 0x0198  [ AFB8261B56CBA0D86AEB6DF682AF9785, 104D96F1F19DD4CE492064ACC9634406A019EAE20B42D03198E400E661897127 ] PolicyAgent     C:\WINXP\system32\lsass.exe
10:18:25.0500 0x0198  PolicyAgent - ok
10:18:25.0609 0x0198  [ EFEEC01B1D3CF84F16DDD24D9D9D8F99, C5F0C8C66A3AF7E7BB04CEDE4AC5306F8387AB384A2107DC5BE413AAE968EFF1 ] PptpMiniport    C:\WINXP\system32\DRIVERS\raspptp.sys
10:18:25.0750 0x0198  PptpMiniport - ok
10:18:25.0750 0x0198  [ AFB8261B56CBA0D86AEB6DF682AF9785, 104D96F1F19DD4CE492064ACC9634406A019EAE20B42D03198E400E661897127 ] ProtectedStorage C:\WINXP\system32\lsass.exe
10:18:25.0859 0x0198  ProtectedStorage - ok
10:18:25.0906 0x0198  [ 09298EC810B07E5D582CB3A3F9255424, 35473A1BE25AC289474090EB0806AC6B3035DC33D1F3DF97A14BF1E361AC6AC3 ] PSched          C:\WINXP\system32\DRIVERS\psched.sys
10:18:26.0046 0x0198  PSched - ok
10:18:26.0078 0x0198  [ 80D317BD1C3DBC5D4FE7B1678C60CADD, DA76804B55D0CAB3DDD01EFC06673764AE4860693375C658B6063FB14AF7F12C ] Ptilink         C:\WINXP\system32\DRIVERS\ptilink.sys
10:18:26.0234 0x0198  Ptilink - ok
10:18:26.0265 0x0198  [ 681AE4F1927FE0FDEEE2863F1684088D, 716213F0624B7FDB349F1C33399EA92FE3806B1217F3A032DB58B05924FB5C04 ] pwdrvio         C:\WINXP\system32\pwdrvio.sys
10:18:26.0296 0x0198  pwdrvio - ok
10:18:26.0328 0x0198  [ BC60895CE021309EBD887D2F22055654, D926335F51D4DA2D2B3BCA3021023A2AD91151FD3EEC5C45DB198F627BCDDD37 ] pwdspio         C:\WINXP\system32\pwdspio.sys
10:18:26.0343 0x0198  pwdspio - ok
10:18:26.0375 0x0198  [ E42E3433DBB4CFFE8FDD91EAB29AEA8E, 20ABD8372B242FD356AC143E7EB56F93CFEA4988ED1B0C4434CB64C387D7F66C ] PxHelp20        C:\WINXP\system32\Drivers\PxHelp20.sys
10:18:26.0406 0x0198  PxHelp20 - ok
10:18:26.0406 0x0198  ql1080 - ok
10:18:26.0406 0x0198  Ql10wnt - ok
10:18:26.0421 0x0198  ql12160 - ok
10:18:26.0421 0x0198  ql1240 - ok
10:18:26.0437 0x0198  ql1280 - ok
10:18:26.0437 0x0198  [ FE0D99D6F31E4FAD8159F690D68DED9C, 998685622ABE631984B7E4DBF91AB3594B1F574378D75EB9F6265F4650470692 ] RasAcd          C:\WINXP\system32\DRIVERS\rasacd.sys
10:18:26.0593 0x0198  RasAcd - ok
10:18:26.0609 0x0198  [ F5BA6CACCDB66C8F048E867563203246, AFEAD8FC02313F7EBC8F9F39E7ED2868852B480BE3902FA7BD0AFD81492AB243 ] RasAuto         C:\WINXP\System32\rasauto.dll
10:18:26.0765 0x0198  RasAuto - ok
10:18:26.0781 0x0198  [ 11B4A627BC9614B885C4969BFA5FF8A6, EAE0A412A2B0F68919C32A96B3A08CC1A06585E4998819F5C9051745F63FF5AD ] Rasl2tp         C:\WINXP\system32\DRIVERS\rasl2tp.sys
10:18:26.0906 0x0198  Rasl2tp - ok
10:18:26.0953 0x0198  [ F9A7B66EA345726EDB5862A46B1ECCD5, 5D35429D394D36A1692A7E219BA1A85CD8096FEAE0F90BFE036A63118FEDBF57 ] RasMan          C:\WINXP\System32\rasmans.dll
10:18:27.0078 0x0198  RasMan - ok
10:18:27.0078 0x0198  [ 5BC962F2654137C9909C3D4603587DEE, A5CE5653D0105240F5E86CFAAB89E7917D42D939E2F27A5A7D6979289CA651B8 ] RasPppoe        C:\WINXP\system32\DRIVERS\raspppoe.sys
10:18:27.0203 0x0198  RasPppoe - ok
10:18:27.0203 0x0198  [ FDBB1D60066FCFBB7452FD8F9829B242, 10A2DACF944BD000032EBA8C095CB3D879CC55B28C377ADF6E52E508E47444DB ] Raspti          C:\WINXP\system32\DRIVERS\raspti.sys
10:18:27.0328 0x0198  Raspti - ok
10:18:27.0390 0x0198  [ 7AD224AD1A1437FE28D89CF22B17780A, 6645235CA27D671954E3557FA37082881C3D7D47492C71264CD8CB8D108EC801 ] Rdbss           C:\WINXP\system32\DRIVERS\rdbss.sys
10:18:27.0531 0x0198  Rdbss - ok
10:18:27.0562 0x0198  [ 4912D5B403614CE99C28420F75353332, 975341ECD660209987B5E5171B8315E032439E408CBE8A5986E67AF767F373BB ] RDPCDD          C:\WINXP\system32\DRIVERS\RDPCDD.sys
10:18:27.0687 0x0198  RDPCDD - ok
10:18:27.0734 0x0198  [ 15CABD0F7C00C47C70124907916AF3F1, 66B5C978B7FB6359AD8BAC9F568FE9D469E358FEAB07B1F129BA9E85F1DF723E ] rdpdr           C:\WINXP\system32\DRIVERS\rdpdr.sys
10:18:27.0859 0x0198  rdpdr - ok
10:18:27.0968 0x0198  [ 6728E45B66F93C08F11DE2E316FC70DD, EA63ECD4F84CAE08BD2BF843C48AF505B1B9D7B61349A63536C9C6FEBEF23452 ] RDPWD           C:\WINXP\system32\drivers\RDPWD.sys
10:18:28.0125 0x0198  RDPWD - ok
10:18:28.0156 0x0198  [ 263AF18AF0F3DB99F574C95F284CCEC9, 2BFA9952E97EFEB386FC56EC2C125080CD12DAC078DBE43C395CB4D9F22165D3 ] RDSessMgr       C:\WINXP\system32\sessmgr.exe
10:18:28.0296 0x0198  RDSessMgr - ok
10:18:28.0312 0x0198  [ ED761D453856F795A7FE056E42C36365, EF026585B33415D8FCE94A9F27D7A4396C7C35C88E06A4CF0FEA702401E8597A ] redbook         C:\WINXP\system32\DRIVERS\redbook.sys
10:18:28.0453 0x0198  redbook - ok
10:18:28.0500 0x0198  [ 0E97EC96D6942CEEC2D188CC2EB69A01, D4253B4420BEF19451A55AB91E4834482181A31A31134F6E2AFE05C8E20C81A5 ] RemoteAccess    C:\WINXP\System32\mprdim.dll
10:18:28.0625 0x0198  RemoteAccess - ok
10:18:28.0656 0x0198  [ E4CD1F3D84E1C2CA0B8CF7501E201593, 649CC0B04F94D407EB6B4C7FDE2C6E4D2B1531307BC67C5775E44D66EF2E4F8A ] RemoteRegistry  C:\WINXP\system32\regsvc.dll
10:18:28.0796 0x0198  RemoteRegistry - ok
10:18:28.0843 0x0198  [ 851C30DF2807FCFA21E4C681A7D6440E, C2269B8ED4E831664B83F8F3BE33E5A340206A9E07F89CDF6707EAD8F280FBE9 ] RFCOMM          C:\WINXP\system32\DRIVERS\rfcomm.sys
10:18:28.0968 0x0198  RFCOMM - ok
10:18:29.0000 0x0198  [ 2A02E21867497DF20B8FC95631395169, D89E2D17ED4E1C727847C0E92D2DF68AEB70BF0B956BD2FE024ED70A961759D2 ] RpcLocator      C:\WINXP\system32\locator.exe
10:18:29.0171 0x0198  RpcLocator - ok
10:18:29.0203 0x0198  [ E970C2296916BF4A2F958680016FE312, ED7FA2854D12D82A0E58536702C7DCD89E274677B113B6974AED4B276FAA4DF4 ] RpcSs           C:\WINXP\System32\rpcss.dll
10:18:29.0390 0x0198  RpcSs - ok
10:18:29.0421 0x0198  [ 4BDD71B4B521521499DFD14735C4F398, 7B1498D3C67E56D05B58B7DA319ECB0117C37963AABB0E59B42831C087469DA1 ] RSVP            C:\WINXP\system32\rsvp.exe
10:18:29.0546 0x0198  RSVP - ok
10:18:29.0593 0x0198  [ 7889E3981E0A5D347E037ABD467D53A5, 480F582A33CEAD2CFF4ADC6F9EA122C44D47499A4A352EF5B8461B9973E13966 ] RTL8023xp       C:\WINXP\system32\DRIVERS\Rtnicxp.sys
10:18:29.0656 0x0198  RTL8023xp - ok
10:18:29.0687 0x0198  [ AFB8261B56CBA0D86AEB6DF682AF9785, 104D96F1F19DD4CE492064ACC9634406A019EAE20B42D03198E400E661897127 ] SamSs           C:\WINXP\system32\lsass.exe
10:18:29.0796 0x0198  SamSs - ok
10:18:29.0828 0x0198  [ DCEC079FAD95D36C8DD5CB6D779DFE32, F8546552D939A225853A0CE4913701A93738DF02C999D16E141E9A828814BBC6 ] SCardSvr        C:\WINXP\System32\SCardSvr.exe
10:18:29.0953 0x0198  SCardSvr - ok
10:18:30.0015 0x0198  [ A050194A44D7FA8D7186ED2F4E8367AE, BCDF56D5A2F9E202DC67E7FE4BCC617BCC0BDFF2D221A621020068B17B2855BB ] Schedule        C:\WINXP\system32\schedsvc.dll
10:18:30.0156 0x0198  Schedule - ok
10:18:30.0171 0x0198  [ 90A3935D05B494A5A39D37E71F09A677, F72733A69BC6E1A2BB91D7632FF3463C12563F60FDCC00A2CDD67FF20D479952 ] Secdrv          C:\WINXP\system32\DRIVERS\secdrv.sys
10:18:30.0312 0x0198  Secdrv - ok
10:18:30.0328 0x0198  [ BEE4CFD1D48C23B44CF4B974B0B79B2B, DF3B02D713F8A4602BE75F004074D5DF79AFF2D58FF37110B2A6AC29F680758B ] seclogon        C:\WINXP\System32\seclogon.dll
10:18:30.0453 0x0198  seclogon - ok
10:18:30.0468 0x0198  [ 2AAC9B6ED9EDDFFB721D6452E34D67E3, 95D83F054A6610328D56E56CD948A6618C590231853E56FC20E7557DB61384A4 ] SENS            C:\WINXP\system32\sens.dll
10:18:30.0609 0x0198  SENS - ok
10:18:30.0625 0x0198  [ CF24EB4F0412C82BCD1F4F35A025E31D, B74CB094126F5C23F601C34D53B2DF5BE3E5918230AC9DCFCFFA8E66B3A0FA25 ] Serial          C:\WINXP\system32\drivers\Serial.sys
10:18:30.0765 0x0198  Serial - ok
10:18:30.0812 0x0198  [ 8E6B8C671615D126FDC553D1E2DE5562, CEEC0067514555D5CA489F50E3D7562FCA8DB8E952C3C878604C9277FC77959F ] Sfloppy         C:\WINXP\system32\drivers\Sfloppy.sys
10:18:30.0937 0x0198  Sfloppy - ok
10:18:30.0968 0x0198  [ CAD058D5F8B889A87CA3EB3CF624DCEF, A7CDCF44261D1F4D820927253EA8EBB63714B7BAFF8B08DE073507D9A7EEA5BB ] SharedAccess    C:\WINXP\System32\ipnathlp.dll
10:18:31.0125 0x0198  SharedAccess - ok
10:18:31.0140 0x0198  [ 40602EBFBE06AA075C8E4560743F6883, 808AF03F31CA4168888D0E3802AE4A0DE7F7324F4CD2F8FE491211895C9C6901 ] ShellHWDetection C:\WINXP\System32\shsvcs.dll
10:18:31.0265 0x0198  ShellHWDetection - ok
10:18:31.0265 0x0198  Simbad - ok
10:18:31.0359 0x0198  [ 6D841806E2A4FEFF0E0F65989025B964, ED9880FA1C8B248A5CE24482A46B97C13EBF9C21CD1BA02C19EDB9718F944460 ] smserial        C:\WINXP\system32\DRIVERS\smserial.sys
10:18:31.0500 0x0198  smserial - ok
10:18:31.0515 0x0198  Sparrow - ok
10:18:31.0531 0x0198  [ AB8B92451ECB048A4D1DE7C3FFCB4A9F, DD17733CBB370FCA08F0296704D7CBEACA3C8F76D0ABE4761C3B1FFDF7481D9E ] splitter        C:\WINXP\system32\drivers\splitter.sys
10:18:31.0640 0x0198  splitter - ok
10:18:31.0687 0x0198  [ 39356A9CDB6753A6D13A4072A9F5A4BB, 7E41478460B0FFE7606F245B74AD60244816F4523FD4355C26BADF724BCE6575 ] Spooler         C:\WINXP\system32\spoolsv.exe
10:18:31.0828 0x0198  Spooler - ok
10:18:31.0875 0x0198  [ 50FA898F8C032796D3B1B9951BB5A90F, 1C86273EC19EB96D6DB9CE6670C00683B77C99C42CC2F7E75BC50872B93446B1 ] sr              C:\WINXP\system32\DRIVERS\sr.sys
10:18:32.0000 0x0198  sr - ok
10:18:32.0031 0x0198  [ FE77A85495065F3AD59C5C65B6C54182, EB4BAF992F961B2FD5D24BFCB6BCB2142BC32933139A818835FEAB190E4283BB ] srservice       C:\WINXP\system32\srsvc.dll
10:18:32.0171 0x0198  srservice - ok
10:18:32.0187 0x0198  [ AE4D13B572399B206B43D65DA4D9983D, B3085FB57F4534E00990F24213F9E44EED73D3DC01AAC985D34F626F2F6927A5 ] Srv             C:\WINXP\system32\DRIVERS\srv.sys
10:18:32.0250 0x0198  Srv - ok
10:18:32.0265 0x0198  [ 4DF5B05DFAEC29E13E1ED6F6EE12C500, 2971D7D45D6942D310D47DBD19B9680D2D29527E79B86133C72217FD29259465 ] SSDPSRV         C:\WINXP\System32\ssdpsrv.dll
10:18:32.0406 0x0198  SSDPSRV - ok
10:18:32.0421 0x0198  [ A36EE93698802CD899F98BFD553D8185, 224CFED921EA230FF8025D259E34968FD2C0FD34BB3A918FB4B9B8BA42BEA5D3 ] ssmdrv          C:\WINXP\system32\DRIVERS\ssmdrv.sys
10:18:32.0437 0x0198  ssmdrv - ok
10:18:32.0484 0x0198  [ BC2C5985611C5356B24AEB370953DED9, 15CBAB8166827DC098E2B16AB6F49A1441A4CB52AF3588F0AD964CAB596DFE10 ] stisvc          C:\WINXP\system32\wiaservc.dll
10:18:32.0625 0x0198  stisvc - ok
10:18:32.0640 0x0198  [ 3941D127AEF12E93ADDF6FE6EE027E0F, EA1F0E32E1C5E90FA4AAC421DEBBE086512340758D3217A6334E886BCE638B51 ] swenum          C:\WINXP\system32\DRIVERS\swenum.sys
10:18:32.0781 0x0198  swenum - ok
10:18:32.0828 0x0198  [ 8CE882BCC6CF8A62F2B2323D95CB3D01, B408550A581F3DA222355964AFA4E976AD8471F0AA37573C42C4948AE5A23A3B ] swmidi          C:\WINXP\system32\drivers\swmidi.sys
10:18:32.0953 0x0198  swmidi - ok
10:18:32.0953 0x0198  SwPrv - ok
10:18:32.0953 0x0198  symc810 - ok
10:18:32.0968 0x0198  symc8xx - ok
10:18:32.0968 0x0198  sym_hi - ok
10:18:32.0968 0x0198  sym_u3 - ok
10:18:33.0000 0x0198  [ 8B83F3ED0F1688B4958F77CD6D2BF290, 546D3602183702B4F53E84413CFA2C933D64C8540378E54A8DCD148F3F36A2DA ] sysaudio        C:\WINXP\system32\drivers\sysaudio.sys
10:18:33.0125 0x0198  sysaudio - ok
10:18:33.0156 0x0198  [ 2903FFFA2523926D6219428040DCE6B9, 4F13181931B0499F6C3F08138054DBCD1F84CB9806999A9172B80DE79D446F62 ] SysmonLog       C:\WINXP\system32\smlogsvc.exe
10:18:33.0296 0x0198  SysmonLog - ok
10:18:33.0328 0x0198  [ 05903CAC4B98908D55EA5774775B382E, AC3666CBD894D737874A5998DC7F46A0A51A7B23B1835FC735B9AD503A2191CC ] TapiSrv         C:\WINXP\System32\tapisrv.dll
10:18:33.0453 0x0198  TapiSrv - ok
10:18:33.0500 0x0198  [ 93EA8D04EC73A85DB02EB8805988F733, 013008E23F5F14E0C836C28524D1181759BAF84530C6331163882A772217F398 ] Tcpip           C:\WINXP\system32\DRIVERS\tcpip.sys
10:18:33.0671 0x0198  Tcpip - ok
10:18:33.0703 0x0198  [ 6471A66807F5E104E4885F5B67349397, F35CBFFB8BB235CCE30EF94A5273333900DD49FD506BF9D55D99A320B8A53A5A ] TDPIPE          C:\WINXP\system32\drivers\TDPIPE.sys
10:18:33.0812 0x0198  TDPIPE - ok
10:18:33.0828 0x0198  [ C56B6D0402371CF3700EB322EF3AAF61, 7743FA4C734BCE38EFB1CA69BC17364D8421E2CD172F856F7E38E7AE1EE93F2F ] TDTCP           C:\WINXP\system32\drivers\TDTCP.sys
10:18:33.0968 0x0198  TDTCP - ok
10:18:33.0984 0x0198  [ 88155247177638048422893737429D9E, B6D4E8691917946332C2208D01F8C8281978C1AD1E9951C5D99DF0D49AC34B3B ] TermDD          C:\WINXP\system32\DRIVERS\termdd.sys
10:18:34.0125 0x0198  TermDD - ok
10:18:34.0250 0x0198  [ B7DE02C863D8F5A005A7BF375375A6A4, 6DE05A7B28CA5A78D58536347FC47F15883EEDBEF487CEA0117CC280FC582DCC ] TermService     C:\WINXP\System32\termsrv.dll
10:18:34.0406 0x0198  TermService - ok
10:18:34.0437 0x0198  [ 40602EBFBE06AA075C8E4560743F6883, 808AF03F31CA4168888D0E3802AE4A0DE7F7324F4CD2F8FE491211895C9C6901 ] Themes          C:\WINXP\System32\shsvcs.dll
10:18:34.0562 0x0198  Themes - ok
10:18:34.0640 0x0198  [ 03681A1CE77F51586903869A5AB1DEAB, E2EC0A481412166B654682C2F3D953E96E757466135CBD2D813B967EDB13C721 ] TlntSvr         C:\WINXP\system32\tlntsvr.exe
10:18:34.0859 0x0198  TlntSvr - ok
10:18:34.0875 0x0198  TosIde - ok
10:18:34.0921 0x0198  [ 626504572B175867F30F3215C04B3E2F, 47E87CE9BC666D5CB5953C5D497DC00A7CC28F8EC0A064B3E47700279C5C4B91 ] TrkWks          C:\WINXP\system32\trkwks.dll
10:18:35.0109 0x0198  TrkWks - ok
10:18:35.0156 0x0198  [ 5787B80C2E3C5E2F56C2A233D91FA2C9, 3774905CF77954DFCECDA5BCC7CDE3D0ED72712BFAAD85ADAE5246306447E46C ] Udfs            C:\WINXP\system32\drivers\Udfs.sys
10:18:35.0359 0x0198  Udfs - ok
10:18:35.0375 0x0198  ultra - ok
10:18:35.0437 0x0198  [ 402DDC88356B1BAC0EE3DD1580C76A31, 32A686595710336A6BFD54C03F552AE39439611662F84EF5D24193AE5665C6F3 ] Update          C:\WINXP\system32\DRIVERS\update.sys
10:18:35.0671 0x0198  Update - ok
10:18:35.0750 0x0198  [ 1DFD8975D8C89214B98D9387C1125B49, 0B6B268487C8E45E9B86BF4A0A9DB669E0E45D600DE3C82B63F9986CA9E01082 ] upnphost        C:\WINXP\System32\upnphost.dll
10:18:35.0921 0x0198  upnphost - ok
10:18:35.0953 0x0198  [ 9B11E6118958E63E1FEF129466E2BDA7, 97168BCE3F4A9BB9E6500F05E34851FB957B219C598944FADC28AC0011C0503B ] UPS             C:\WINXP\System32\ups.exe
10:18:36.0187 0x0198  UPS - ok
10:18:36.0250 0x0198  [ 6E421CCC57059B0186C6259CA3B6DFC9, E348BF23CCD6C14FD10C1689BBDC77E125245331F97BFE60D4C8FD9A8711CB59 ] USBAAPL         C:\WINXP\system32\Drivers\usbaapl.sys
10:18:36.0328 0x0198  USBAAPL - detected UnsignedFile.Multi.Generic ( 1 )
10:18:38.0765 0x0198  Detect skipped due to KSN trusted
10:18:38.0765 0x0198  USBAAPL - ok
10:18:38.0781 0x0198  [ 173F317CE0DB8E21322E71B7E60A27E8, 7042441BA63AE38AE9D7BE0BC5CA7404FC9EE5BB3F084604A68F01E82769652A ] usbccgp         C:\WINXP\system32\DRIVERS\usbccgp.sys
10:18:39.0046 0x0198  usbccgp - ok
10:18:39.0078 0x0198  [ 65DCF09D0E37D4C6B11B5B0B76D470A7, 90EBA8BAF45932B453D905EDF2BDDDF3A432BFD50B9F7DF58CDEAE98D11C2E2F ] usbehci         C:\WINXP\system32\DRIVERS\usbehci.sys
10:18:39.0359 0x0198  usbehci - ok
10:18:39.0406 0x0198  [ 1AB3CDDE553B6E064D2E754EFE20285C, A99C4528C4227B1E96847614745AAFACD3C5F1BDFE435214DBF78740FFB300FE ] usbhub          C:\WINXP\system32\DRIVERS\usbhub.sys
10:18:39.0671 0x0198  usbhub - ok
10:18:39.0718 0x0198  [ A717C8721046828520C9EDF31288FC00, 1530BBE832EDBB0974AD89D723A03FF7A0094B368992D73C2C3E62A181DF1E0A ] usbprint        C:\WINXP\system32\DRIVERS\usbprint.sys
10:18:39.0984 0x0198  usbprint - ok
10:18:40.0046 0x0198  [ A0B8CF9DEB1184FBDD20784A58FA75D4, D8AFD45BD9CF7B02F2554AA6085194DE82893AF794EDF479BC9B9E9C1758DC75 ] usbscan         C:\WINXP\system32\DRIVERS\usbscan.sys
10:18:40.0218 0x0198  usbscan - ok
10:18:40.0265 0x0198  [ A32426D9B14A089EAA1D922E0C5801A9, ED1DC52EE45F8EAD3AEC4B1F817BB25634141CF48295494C5947DCE6CF7A9817 ] USBSTOR         C:\WINXP\system32\DRIVERS\USBSTOR.SYS
10:18:40.0468 0x0198  USBSTOR - ok
10:18:40.0562 0x0198  [ 26496F9DEE2D787FC3E61AD54821FFE6, 8BE7FF647470B9A951CBB478FAF83D657A15CC78037F42348A6B738F21D523DA ] usbuhci         C:\WINXP\system32\DRIVERS\usbuhci.sys
10:18:40.0718 0x0198  usbuhci - ok
10:18:40.0750 0x0198  [ 0D3A8FAFCEACD8B7625CD549757A7DF1, B9CFDEFCD66AA139F3DC2F967B184669532922563AD5A71769BABDC4370D065E ] VgaSave         C:\WINXP\System32\drivers\vga.sys
10:18:40.0890 0x0198  VgaSave - ok
10:18:40.0890 0x0198  ViaIde - ok
10:18:40.0921 0x0198  [ A5A712F4E880874A477AF790B5186E1D, FE885ED04C3EAFC379787F836738A2769E43D07CF52DD917D90C38E001957A5E ] VolSnap         C:\WINXP\system32\drivers\VolSnap.sys
10:18:41.0062 0x0198  VolSnap - ok
10:18:41.0093 0x0198  [ 68F106273BE29E7B7EF8266977268E78, 1488AB7A654EBC94C73E1D494067189ACB95BC233980110CAC4C0297CDC4115A ] VSS             C:\WINXP\System32\vssvc.exe
10:18:41.0343 0x0198  VSS - ok
10:18:41.0406 0x0198  [ 7B353059E665F8B7AD2BBEAEF597CF45, 84A4311F18A4B8DCB364741DEA7D18E2363F19564B2EF25214965DC729527068 ] W32Time         C:\WINXP\system32\w32time.dll
10:18:41.0562 0x0198  W32Time - ok
10:18:41.0625 0x0198  [ E20B95BAEDB550F32DD489265C1DA1F6, 5589B2067E6C9FBA290D8C5EADDC198EBAF39C50C3CD7D2BC5CDA7CBFBC445E5 ] Wanarp          C:\WINXP\system32\DRIVERS\wanarp.sys
10:18:41.0843 0x0198  Wanarp - ok
10:18:42.0015 0x0198  [ 46A247F6617526AFE38B6F12F5512120, 24931910E3D678829A7A6CF1140CFE428E05057A4D3A14086ED66B884E847D2D ] wceusbsh        C:\WINXP\system32\DRIVERS\wceusbsh.sys
10:18:42.0265 0x0198  wceusbsh - ok
10:18:42.0390 0x0198  [ D918617B46457B9AC28027722E30F647, 407284D3055DC11944D4EE7E4357E7CF9CAF8CA40CA50633AB6FD4A82CB7EEA6 ] Wdf01000        C:\WINXP\system32\Drivers\wdf01000.sys
10:18:43.0343 0x0198  Wdf01000 - ok
10:18:43.0343 0x0198  WDICA - ok
10:18:43.0390 0x0198  [ 6768ACF64B18196494413695F0C3A00F, 3A8F8586F1D997D19A8478345338D2AECD785AEABDB61531DD3F92003D3230A5 ] wdmaud          C:\WINXP\system32\drivers\wdmaud.sys
10:18:43.0640 0x0198  wdmaud - ok
10:18:43.0718 0x0198  [ 81727C9873E3905A2FFC1EBD07265002, 6AC2383A1DCBB7FA3DB90FBB874C8E1819F5B7492717FF41E303EFC7BF72F93E ] WebClient       C:\WINXP\System32\webclnt.dll
10:18:43.0937 0x0198  WebClient - ok
10:18:44.0031 0x0198  [ 6F3F3973D97714CC5F906A19FE883729, 7817118BE94D0F6FAE0F9CE48AD70FFE0AEF886CCE09C666768FAB61047F992F ] winmgmt         C:\WINXP\system32\wbem\WMIsvc.dll
10:18:44.0187 0x0198  winmgmt - ok
10:18:44.0234 0x0198  [ 30FC6E5448D0CBAAA95280EEEF7FEDAE, 04374450882504D9031951F4E9317E5A128EBA5A22A3555ACD28BC742861AF9C ] WinUSB          C:\WINXP\system32\DRIVERS\WinUSB.sys
10:18:44.0359 0x0198  WinUSB - ok
10:18:44.0453 0x0198  [ C51B4A5C05A5475708E3C81C7765B71D, F776D2680BD3407307B7072626F78460361FC5BC38623C9E16F394D300AB25DE ] WmdmPmSN        C:\WINXP\system32\mspmsnsv.dll
10:18:44.0671 0x0198  WmdmPmSN - ok
10:18:44.0828 0x0198  [ 53E1CCF332A2F40B5E08476921CD8B44, BBD472701811695EB8BD06CB3DFAF07D2632E1D271B387395455FE9B274CB470 ] Wmi             C:\WINXP\System32\advapi32.dll
10:18:45.0359 0x0198  Wmi - ok
10:18:45.0437 0x0198  [ C42584FD66CE9E17403AEBCA199F7BDB, E3F2E1066F36AE5D33D4482239B2E556BE0C137923C9A120DFB36EC82F2E77B0 ] WmiAcpi         C:\WINXP\system32\DRIVERS\wmiacpi.sys
10:18:45.0671 0x0198  WmiAcpi - ok
10:18:45.0750 0x0198  [ 93908111BA57A6E60EC2FA2DE202105C, F395F25F18D15C6B9FEDB45FD31E10295FFE5517E2BC86ACAC11904EA0664BE2 ] WmiApSrv        C:\WINXP\system32\wbem\wmiapsrv.exe
10:18:46.0000 0x0198  WmiApSrv - ok
10:18:46.0281 0x0198  [ BF05650BB7DF5E9EBDD25974E22403BB, AF173D89B768CFC7AB03DFADD4F049CAC40AC59A0C9208AF5AB92CB368983077 ] WMPNetworkSvc   C:\Programme\Windows Media Player\WMPNetwk.exe
10:18:47.0375 0x0198  WMPNetworkSvc - ok
10:18:47.0437 0x0198  [ CF4DEF1BF66F06964DC0D91844239104, CC1D9CECE2056D29A9651D51BB57C3F4F9BF9E90A4808CF7496C683C874FBD51 ] WpdUsb          C:\WINXP\system32\DRIVERS\wpdusb.sys
10:18:47.0500 0x0198  WpdUsb - ok
10:18:47.0671 0x0198  [ DCF3E3EDF5109EE8BC02FE6E1F045795, 4B8E14B1CFB095982D34DAEC336114F5039D7793080FB787DC95A63B6B945DD0 ] WPFFontCache_v0400 C:\WINXP\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
10:18:47.0859 0x0198  WPFFontCache_v0400 - ok
10:18:47.0906 0x0198  [ 6ABE6E225ADB5A751622A9CC3BC19CE8, 4061C5D0F051DFF1730E2A3BFC1CCA97B29602FC50F10F6B44D93B0D28F42024 ] WS2IFSL         C:\WINXP\System32\drivers\ws2ifsl.sys
10:18:48.0125 0x0198  WS2IFSL - ok
10:18:48.0187 0x0198  [ 300B3E84FAF1A5C1F791C159BA28035D, 0194856BDF94C1F274AF70AD558290ACDACDDEA331BD66FEB8E167ABD1E36786 ] wscsvc          C:\WINXP\system32\wscsvc.dll
10:18:48.0453 0x0198  wscsvc - ok
10:18:48.0578 0x0198  [ 7B4FE05202AA6BF9F4DFD0E6A0D8A085, A1DB8909FA73337DB613D01824945485186654364A4DF129B8CB913CF87D1D2E ] wuauserv        C:\WINXP\system32\wuauserv.dll
10:18:49.0296 0x0198  wuauserv - ok
10:18:49.0375 0x0198  [ 6FF66513D372D479EF1810223C8D20CE, 65BABE162C8A457E37E26A0D1B81AF763E009493D81DC5554B6852FEF0B9D767 ] WudfPf          C:\WINXP\system32\DRIVERS\WudfPf.sys
10:18:49.0546 0x0198  WudfPf - ok
10:18:49.0593 0x0198  [ AC13CB789D93412106B0FB6C7EB2BCB6, 8F5B0BD0CBBAB182A400F8994D4727BC0C978D749B6429A2D41B412AE97428B6 ] WudfRd          C:\WINXP\system32\DRIVERS\wudfrd.sys
10:18:49.0656 0x0198  WudfRd - ok
10:18:49.0718 0x0198  [ 575A4190D989F64732119E4114045A4F, 373C344B106AFDB1E6125A21DFE28CA6CFC77FA87FE904656A4F209DB2ED69C7 ] WudfSvc         C:\WINXP\System32\WUDFSvc.dll
10:18:49.0921 0x0198  WudfSvc - ok
10:18:50.0031 0x0198  [ C4F109C005F6725162D2D12CA751E4A7, AC996B44338328BDD4442FE48406F286A64526F0EC77BE00A19FA7FDB0407CFE ] WZCSVC          C:\WINXP\System32\wzcsvc.dll
10:18:50.0453 0x0198  WZCSVC - ok
10:18:50.0531 0x0198  [ 0ADA34871A2E1CD2CAAFED1237A47750, 45BEF8649078BD74C1A347B5F2D3A1958E5A7DCD6C6BA8A2E0CAD277A929C64E ] xmlprov         C:\WINXP\System32\xmlprov.dll
10:18:50.0765 0x0198  xmlprov - ok
10:18:50.0828 0x0198  ================ Scan global ===============================
10:18:50.0890 0x0198  [ 2C60091CA5F67C3032EAB3B30390C27F, 9E205C8E67F4B61FCFA2A82AA1968D522C3B6410D7075BE813F7F1564D61632E ] C:\WINXP\system32\basesrv.dll
10:18:51.0078 0x0198  [ 4CD408F799D4A72B0DE1F1116A77A48E, 7EF6B36B63DD010C30AC7B4825E6980C70B18DA4327AB6BC69FBA977E1952992 ] C:\WINXP\system32\winsrv.dll
10:18:51.0171 0x0198  [ 4CD408F799D4A72B0DE1F1116A77A48E, 7EF6B36B63DD010C30AC7B4825E6980C70B18DA4327AB6BC69FBA977E1952992 ] C:\WINXP\system32\winsrv.dll
10:18:51.0203 0x0198  [ 4BB6A83640F1D1792AD21CE767B621C6, 7B88A06D5220DE5C378B8C017354E9C8C89D625251A6EB607059A663E2BACD0A ] C:\WINXP\system32\services.exe
10:18:51.0203 0x0198  [ Global ] - ok
10:18:51.0203 0x0198  ================ Scan MBR ==================================
10:18:51.0234 0x0198  [ 72B8CE41AF0DE751C946802B3ED844B4 ] \Device\Harddisk0\DR0
10:18:52.0531 0x0198  \Device\Harddisk0\DR0 - ok
10:18:52.0843 0x0198  [ 988D3C46CBD13EC7F482B833C55264C8 ] \Device\Harddisk1\DR5
10:18:53.0062 0x0198  \Device\Harddisk1\DR5 - ok
10:18:53.0062 0x0198  ================ Scan VBR ==================================
10:18:53.0093 0x0198  [ 34095B8FD15F83203A0C04A0911C328B ] \Device\Harddisk0\DR0\Partition1
10:18:53.0125 0x0198  \Device\Harddisk0\DR0\Partition1 - ok
10:18:53.0140 0x0198  [ 421227C6B09183097A11B6F24F3773AA ] \Device\Harddisk1\DR5\Partition1
10:18:53.0156 0x0198  \Device\Harddisk1\DR5\Partition1 - ok
10:18:53.0156 0x0198  ================ Scan generic autorun ======================
10:18:53.0156 0x0198  GrooveMonitor - ok
10:18:53.0171 0x0198  NvCplDaemon - ok
10:18:53.0171 0x0198  nwiz - ok
10:18:53.0171 0x0198  BluetoothAuthenticationAgent - ok
10:18:53.0375 0x0198  [ 2819C34E9764437E9496E8B3B16C9547, 5BD387CA0621FEC5A44176207587EB4FC4046A5127E11541280E6ACA7374880B ] C:\Programme\FreePDF_XP\fpassist.exe
10:18:53.0437 0x0198  FreePDF Assistant - detected UnsignedFile.Multi.Generic ( 1 )
10:18:58.0453 0x0198  Detect skipped due to KSN trusted
10:18:58.0453 0x0198  FreePDF Assistant - ok
10:18:58.0984 0x0198  [ 50F85FE43AF859330CC9515353EF300C, 8B8ACE4F0B306BAC57FA9DA835115E2D9301658CB2C636D7F48B4212D8E5A1C8 ] C:\Programme\Canon\MyPrinter\BJMyPrt.exe
10:18:59.0687 0x0198  CanonMyPrinter - ok
10:18:59.0984 0x0198  [ 3B78ACCCAA5132638E7CF419F4A965C7, C91DD62901778FEB6BDBABD6F736D59FD85361AE53867AD232C90D22ECB7B49F ] C:\Programme\Canon\Solution Menu EX\CNSEMAIN.EXE
10:19:00.0671 0x0198  CanonSolutionMenuEx - ok
10:19:00.0843 0x0198  [ 916A2C4EB028604783FD5EA169236C1D, C97DAA1BE5C912DDCEDBA7619631BB98F4A9B32B1E40C5374A64E25305E0A1C4 ] C:\Programme\QuickTime\QTTask.exe
10:19:01.0484 0x0198  QuickTime Task - detected UnsignedFile.Multi.Generic ( 1 )
10:19:03.0812 0x0198  Detect skipped due to KSN trusted
10:19:03.0812 0x0198  QuickTime Task - ok
10:19:03.0890 0x0198  [ 8E2A7F1F62467A7DCB8AB2C0642F47CA, 5A0C356E9AA19DEB3C1C62A3DC62A2BC612C2257A4BF32B9BD276FBEDB58983D ] C:\Programme\iTunes\iTunesHelper.exe
10:19:03.0968 0x0198  iTunesHelper - ok
10:19:04.0046 0x0198  [ 63CF8030DBDE25296184700B99153DBD, 48B05D6C7A281F354CD17CB54610A86AA8B6499BF3461458CF5881AC62E147F6 ] C:\WINXP\sm56hlpr.exe
10:19:04.0203 0x0198  SMSERIAL - ok
10:19:04.0390 0x0198  [ 048EA4B978851788E9F5E8E4F081DF7A, EB62719AC0DCC18FF056F2CD84438BF14B61E38F0619617C81961C6257BDFCEC ] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe
10:19:04.0781 0x0198  Adobe ARM - ok
10:19:04.0953 0x0198  [ 887CAA31048EB8ED09A0CBD0E6F46F09, BBCED0BD4EB00C3FECFC9448223D4C441A868787877291F5489B07B43FAB65A4 ] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
10:19:05.0062 0x0198  SunJavaUpdateSched - ok
10:19:05.0218 0x0198  [ 085F30DB0B38903940A4141E675BDC08, 3ABFB79C850D2B1976DB4DEF69AA031C4E18B5E240316908DDD16DEA4050365A ] C:\Programme\Avira\AntiVir Desktop\avgnt.exe
10:19:05.0296 0x0198  avgnt - ok
10:19:05.0375 0x0198  [ 22283306E9A33D4EB10F8B6C7499C30E, F527A3ED9816EE5C5A191A26A7D29A2CAFAB7DA3BAA3295FE0E8A2D44F0F5F45 ] C:\Programme\Avira\My Avira\Avira.OE.Systray.exe
10:19:05.0406 0x0198  Avira Systray - ok
10:19:05.0406 0x0198  DAEMON Tools Lite - ok
10:19:05.0406 0x0198  Waiting for KSN requests completion. In queue: 8
10:19:06.0406 0x0198  Waiting for KSN requests completion. In queue: 6
10:19:07.0406 0x0198  Waiting for KSN requests completion. In queue: 6
10:19:09.0062 0x0198  AV detected via SS1: Avira Desktop, 15.0.8.650, enabled, updated
10:19:09.0296 0x0198  Win FW state via NFM: disabled
10:19:11.0640 0x0198  ============================================================
10:19:11.0640 0x0198  Scan finished
10:19:11.0640 0x0198  ============================================================
10:19:11.0656 0x00a0  Detected object count: 1
10:19:11.0656 0x00a0  Actual detected object count: 1
10:27:46.0937 0x00a0  NSHE ( UnsignedFile.Multi.Generic ) - skipped by user
10:27:46.0937 0x00a0  NSHE ( UnsignedFile.Multi.Generic ) - User select action: Skip
         

Downloade Dir bitte Malwarebytes Anti-Malware

• Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
• Starte Malwarebytes' Anti-Malware (MBAM).
• Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
• Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
• Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
• Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
• Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
• Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
• Starte die AdwCleaner.exe mit einem Doppelklick.
• Stimme den Nutzungsbedingungen zu.
• Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
  • "Tracing" Schlüssel löschen
  • Winsock Einstellungen zurücksetzen
  • Proxy Einstellungen zurücksetzen
  • Internet Explorer Richtlinien zurücksetzen
  • Chrome Richtlinien zurücksetzen
  • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
• Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
• Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
• Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

• Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
• Drücke eine beliebige Taste, um das Tool zu starten.
• Je nach System kann der Scan eine Weile dauern.
• Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
• Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

MBAM log

 Malwarebytes Anti-Malware 
www.malwarebytes.org


Update, 05.03.2015 17:28:27, SYSTEM, ALEX, Manual, program, 2.0.2.1012, 2.0.4.1028, 
Update, 05.03.2015 17:28:27, SYSTEM, ALEX, Manual, Remediation Database, 2013.10.16.1, 2014.12.6.1, 
Update, 05.03.2015 17:28:31, SYSTEM, ALEX, Manual, Rootkit Database, 2014.2.20.1, 2015.2.25.1, 
Update, 05.03.2015 17:28:32, SYSTEM, ALEX, Manual, Malware Database, 2014.3.4.9, 2015.3.5.2, 
Update, 05.03.2015 17:29:20, SYSTEM, ALEX, Manual, Remediation Database, 2013.10.16.1, 2014.12.6.1, 
Update, 05.03.2015 17:29:20, SYSTEM, ALEX, Manual, Rootkit Database, 2014.11.18.1, 2015.2.25.1, 
Protection, 05.03.2015 17:29:23, SYSTEM, ALEX, Protection, Malware Protection, Starting, 
Protection, 05.03.2015 17:29:23, SYSTEM, ALEX, Protection, Malware Protection, Started, 
Protection, 05.03.2015 17:29:23, SYSTEM, ALEX, Protection, Malicious Website Protection, Starting, 
Update, 05.03.2015 17:29:30, SYSTEM, ALEX, Manual, Malware Database, 2014.11.20.6, 2015.3.5.2, 
Protection, 05.03.2015 17:29:31, SYSTEM, ALEX, Protection, Refresh, Starting, 
Protection, 05.03.2015 17:29:42, SYSTEM, ALEX, Protection, Malicious Website Protection, Started, 
Protection, 05.03.2015 17:30:08, SYSTEM, ALEX, Protection, Malicious Website Protection, Stopping, 
Protection, 05.03.2015 17:30:08, SYSTEM, ALEX, Protection, Malicious Website Protection, Stopped, 
Protection, 05.03.2015 17:30:37, SYSTEM, ALEX, Protection, Refresh, Success, 
Protection, 05.03.2015 17:30:42, SYSTEM, ALEX, Protection, Malicious Website Protection, Starting, 
Protection, 05.03.2015 17:31:03, SYSTEM, ALEX, Protection, Malicious Website Protection, Started, 
Scan, 05.03.2015 17:47:04, SYSTEM, ALEX, Manual, Start: % 1 "% 2", Dauer: % 1 min 17 Sekunden, Bedrohungs-Suchlauf, Abgeschlossen, 0 Malwareerkennung, 0-Malwareerkennung, 
Protection, 05.03.2015 17:47:05, SYSTEM, ALEX, Protection, Malicious Website Protection, Stopping, 
Protection, 05.03.2015 17:47:05, SYSTEM, ALEX, Protection, Malicious Website Protection, Stopped, 
Protection, 05.03.2015 17:47:05, SYSTEM, ALEX, Protection, Malicious Website Protection, Starting, 
Protection, 05.03.2015 17:47:27, SYSTEM, ALEX, Protection, Malicious Website Protection, Started, 

(end)
         

ADW-Cleaner log

# AdwCleaner v4.111 - Bericht erstellt 05/03/2015 um 17:56:42
# Aktualisiert 18/02/2015 von Xplode
# Datenbank : 2015-03-02.3 [Server]
# Betriebssystem : Microsoft Windows XP Service Pack 3 (x86)
# Benutzername : Alexander - ALEX
# Gestarted von : C:\Dokumente und Einstellungen\Alexander\Desktop\AdwCleaner_4.111.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Geplante Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****


***** [ Internetbrowser ] *****

-\\ Internet Explorer v7.0.6000.16762


-\\ Mozilla Firefox v30.0 (de)


-\\ Google Chrome v34.0.1847.137


*************************

AdwCleaner[R0].txt - [3860 Bytes] - [03/03/2015 17:51:27]
AdwCleaner[R1].txt - [963 Bytes] - [05/03/2015 17:51:04]
AdwCleaner[S0].txt - [3921 Bytes] - [03/03/2015 17:57:03]
AdwCleaner[S1].txt - [886 Bytes] - [05/03/2015 17:56:42]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [944  Bytes] ##########
         

JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.3 (03.01.2015:1)
OS: Microsoft Windows XP x86
Ran by Alexander on 05.03.2015 at 18:12:14,40
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 05.03.2015 at 18:16:40,35
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         

frische FRST log


FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 04-03-2015
Ran by Alexander (administrator) on ALEX on 05-03-2015 18:19:44
Running from C:\Dokumente und Einstellungen\Alexander\Desktop
Loaded Profiles: Alexander (Available profiles: Alexander)
Platform: Microsoft Windows XP Professional Service Pack 3 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 7 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\WINXP\system32\smss.exe
(Microsoft Corporation) C:\WINXP\system32\csrss.exe
(Microsoft Corporation) C:\WINXP\system32\winlogon.exe
(Microsoft Corporation) C:\WINXP\system32\services.exe
(Microsoft Corporation) C:\WINXP\system32\lsass.exe
(Microsoft Corporation) C:\WINXP\system32\svchost.exe
(Microsoft Corporation) C:\WINXP\system32\svchost.exe
(Microsoft Corporation) C:\WINXP\system32\svchost.exe
(Microsoft Corporation) C:\WINXP\system32\svchost.exe
(Microsoft Corporation) C:\WINXP\system32\svchost.exe
(Microsoft Corporation) C:\WINXP\system32\svchost.exe
(Microsoft Corporation) C:\WINXP\system32\spoolsv.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\sched.exe
(Google Inc.) C:\Programme\Google\Update\GoogleUpdate.exe
(Microsoft Corporation) D:\Programme\Microsoft Office\Office12\GrooveMonitor.exe
(shbox.de) C:\Programme\FreePDF_XP\fpassist.exe
(CANON INC.) C:\Programme\Canon\MyPrinter\BJMYPRT.EXE
(Motorola Inc.) C:\WINXP\sm56hlpr.exe
(Oracle Corporation) C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Programme\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\WINXP\system32\svchost.exe
(Malwarebytes Corporation) C:\Programme\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Programme\ Malwarebytes Anti-Malware \mbamservice.exe
(Microsoft Corporation) C:\WINXP\system32\svchost.exe
(Palm) C:\Programme\Palm, Inc\novacomd\x86\novacomd.exe
(NVIDIA Corporation) C:\WINXP\system32\nvsvc32.exe
(Microsoft Corporation) C:\WINXP\system32\svchost.exe
(Microsoft Corporation) C:\WINXP\system32\svchost.exe
(Malwarebytes Corporation) C:\Programme\ Malwarebytes Anti-Malware \mbam.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corporation) C:\WINXP\system32\wbem\wmiprvse.exe
(Microsoft Corporation) C:\WINXP\system32\wbem\unsecapp.exe
(Microsoft Corporation) C:\WINXP\system32\wuauclt.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\WINXP\system32\wscntfy.exe
(Microsoft Corporation) C:\WINXP\system32\alg.exe
(Microsoft Corporation) C:\WINXP\system32\svchost.exe
(Microsoft Corporation) C:\WINXP\explorer.exe
(Mozilla Corporation) D:\Firefox\firefox.exe
(Microsoft Corporation) C:\WINXP\system32\wbem\wmiprvse.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [GrooveMonitor] => D:\Programme\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-27] (Microsoft Corporation)
HKLM\...\Run: [NvCplDaemon] => RUNDLL32.EXE C:\WINXP\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [nwiz] => nwiz.exe /install
HKLM\...\Run: [BluetoothAuthenticationAgent] => rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
HKLM\...\Run: [FreePDF Assistant] => C:\Programme\FreePDF_XP\fpassist.exe [385024 2009-09-05] (shbox.de)
HKLM\...\Run: [CanonMyPrinter] => C:\Programme\Canon\MyPrinter\BJMyPrt.exe [2516296 2010-03-25] (CANON INC.)
HKLM\...\Run: [CanonSolutionMenuEx] => C:\Programme\Canon\Solution Menu EX\CNSEMAIN.EXE [1185112 2010-04-02] (CANON INC.)
HKLM\...\Run: [QuickTime Task] => C:\Programme\QuickTime\QTTask.exe [421888 2012-04-18] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Programme\iTunes\iTunesHelper.exe [152392 2013-02-20] (Apple Inc.)
HKLM\...\Run: [SMSERIAL] => C:\WINXP\sm56hlpr.exe [557056 2005-09-16] (Motorola Inc.)
HKLM\...\Run: [Adobe ARM] => C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe [959904 2014-05-08] (Adobe Systems Incorporated)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation)
HKLM\...\Run: [avgnt] => C:\Programme\Avira\AntiVir Desktop\avgnt.exe [703280 2015-03-03] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [Avira Systray] => C:\Programme\Avira\My Avira\Avira.OE.Systray.exe [127792 2015-02-12] (Avira Operations GmbH & Co. KG)
HKLM\...\Winlogon: [Userinit] C:\WINXP\system32\userinit.exe,
HKLM\...\Winlogon: [Shell] Explorer.exe [x ] ()
HKLM\...\Winlogon: [UIHost] C:\WINXP\system32\logonui.exe [515072 2008-04-14] (Microsoft Corporation)
Winlogon\Notify\crypt32chain: C:\WINXP\system32\crypt32.dll (Microsoft Corporation)
Winlogon\Notify\cryptnet: C:\WINXP\system32\cryptnet.dll (Microsoft Corporation)
Winlogon\Notify\cscdll: C:\WINXP\system32\cscdll.dll (Microsoft Corporation)
Winlogon\Notify\dimsntfy: C:\WINXP\System32\dimsntfy.dll (Microsoft Corporation)
Winlogon\Notify\ScCertProp: C:\WINXP\system32\wlnotify.dll (Microsoft Corporation)
Winlogon\Notify\Schedule: C:\WINXP\system32\wlnotify.dll (Microsoft Corporation)
Winlogon\Notify\sclgntfy: C:\WINXP\system32\sclgntfy.dll (Microsoft Corporation)
Winlogon\Notify\SensLogn: C:\WINXP\system32\WlNotify.dll (Microsoft Corporation)
Winlogon\Notify\termsrv: C:\WINXP\system32\wlnotify.dll (Microsoft Corporation)
Winlogon\Notify\WgaLogon: C:\WINXP\system32\WgaLogon.dll (Microsoft Corporation)
Winlogon\Notify\wlballoon: C:\WINXP\system32\wlnotify.dll (Microsoft Corporation)
HKU\S-1-5-19\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINXP\System32\logon.scr [220672 2008-04-14] (Microsoft Corporation)
HKU\S-1-5-20\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINXP\System32\logon.scr [220672 2008-04-14] (Microsoft Corporation)
HKU\S-1-5-21-1935655697-1229272821-1417001333-1003\...\Run: [DAEMON Tools Lite] => D:\DAEMON Tools Lite\DTLite.exe [3672384 2012-04-11] (DT Soft Ltd)
HKU\S-1-5-21-1935655697-1229272821-1417001333-1003\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINXP\system32\logon.scr [220672 2008-04-14] (Microsoft Corporation)
HKU\S-1-5-18\...\Run: [CTFMON.EXE] => C:\WINXP\system32\CTFMON.EXE [15360 2008-04-14] (Microsoft Corporation)
HKU\S-1-5-18\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINXP\system32\logon.scr [220672 2008-04-14] (Microsoft Corporation)
SSODL: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\WINXP\system32\CbFsMntNtf3.dll (EldoS Corporation)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Dokumente und Einstellungen\Alexander\Anwendungsdaten\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Dokumente und Einstellungen\Alexander\Anwendungsdaten\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Dokumente und Einstellungen\Alexander\Anwendungsdaten\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Dokumente und Einstellungen\Alexander\Anwendungsdaten\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [EldosIconOverlay] -> {5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC} => C:\WINXP\system32\CbFsMntNtf3.dll (EldoS Corporation)
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 1 (GFS Unread Stub)] -> {99FD978C-D287-4F50-827F-B2C658EDA8E7} => D:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 2 (GFS Stub)] -> {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} => D:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)] -> {920E6DB1-9907-4370-B3A0-BAFC03D81399} => D:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 3 (GFS Folder)] -> {16F3DD56-1AF5-4347-846D-7C10C4192619} => D:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 4 (GFS Unread Mark)] -> {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} => D:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-1935655697-1229272821-1417001333-1003\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1935655697-1229272821-1417001333-1003\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINXP\system32\blank.htm
HKU\S-1-5-21-1935655697-1229272821-1417001333-1003\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs,Tabs: "www.google.com" <======= ATTENTION
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-1935655697-1229272821-1417001333-1003 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
SearchScopes: HKU\S-1-5-21-1935655697-1229272821-1417001333-1003 -> {853106B3-C3EB-414B-B7BE-77F3506B532A} URL = hxxp://www.google.de/search?q={searchTerms}
BHO: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Programme\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> D:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Programme\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Programme\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Programme\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Toolbar: HKU\S-1-5-21-1935655697-1229272821-1417001333-1003 -> Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Programme\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Handler: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINXP\system32\urlmon.dll (Microsoft Corporation)
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Handler: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
Handler: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: vw-wi - {0F3C833F-FB28-40EA-8CB9-6A55B996C3F6} - g:\elsawin\installation\bin\wiProt.dll No File
Handler: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINXP\system32\wiascr.dll (Microsoft Corporation)
Filter: text/webviewhtml - {733AC4CB-F1A4-11d0-B951-00A0C90312E1} - C:\WINXP\system32\SHELL32.dll (Microsoft Corporation)
ShellExecuteHooks:  - {AEB6717E-7E19-11d0-97EE-00C04FD91972} -  No File [ ]
Winsock: Catalog5 01 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog5 02 C:\WINXP\system32\winrnr.dll [16896] (Microsoft Corporation)
Winsock: Catalog5 03 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog5 04 C:\Programme\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Winsock: Catalog5 05 C:\WINXP\system32\wshbth.dll [108032] (Microsoft Corporation)
Winsock: Catalog9 01 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 02 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 03 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 04 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 05 C:\WINXP\system32\rsvpsp.dll [92672] (Microsoft Corporation)
Winsock: Catalog9 06 C:\WINXP\system32\rsvpsp.dll [92672] (Microsoft Corporation)
Winsock: Catalog9 07 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 08 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 09 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 10 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 11 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 12 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 13 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 14 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 15 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 16 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 17 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 18 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 19 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 20 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 21 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 22 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 23 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 24 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 25 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 26 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 27 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 28 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 29 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 30 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 31 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 32 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 33 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 34 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Dokumente und Einstellungen\Alexander\Anwendungsdaten\Mozilla\Firefox\Profiles\0qgqdyu2.default
FF NewTab: hxxp://www.google.de/
FF DefaultSearchUrl: hxxp://www.google.com/search?btnG=Google+Search&q=
FF SearchEngineOrder.1: Google
FF Homepage: https://www.google.de/
FF Keyword.URL: hxxp://www.google.com/search?btnG=Google+Search&q=
FF Plugin: @adobe.com/FlashPlayer -> C:\WINXP\system32\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Programme\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 -> C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll No File
FF Plugin: @java.com/DTPlugin,version=11.25.2 -> C:\Programme\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.25.2 -> C:\Programme\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Programme\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\WINXP\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @pages.tvunetworks.com/WebPlayer -> C:\WINXP\system32\TVUAx\npTVUAx.dll (TVU networks)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Programme\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Programme\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @veetle.com/veetleCorePlugin,version=0.9.18 -> C:\Programme\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF Plugin: @veetle.com/veetlePlayerPlugin,version=0.9.18 -> C:\Programme\Veetle\Player\npvlc.dll (Veetle Inc)
FF Plugin: Adobe Reader -> C:\Programme\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1935655697-1229272821-1417001333-1003: @unity3d.com/UnityPlayer,version=1.0 -> C:\Dokumente und Einstellungen\Alexander\Lokale Einstellungen\Anwendungsdaten\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Extension: Avira Browser Safety - C:\Dokumente und Einstellungen\Alexander\Anwendungsdaten\Mozilla\Firefox\Profiles\0qgqdyu2.default\Extensions\abs@avira.com [2015-03-02]
FF Extension: TVU Web Player - C:\Dokumente und Einstellungen\Alexander\Anwendungsdaten\Mozilla\Firefox\Profiles\0qgqdyu2.default\Extensions\firefox@tvunetworks.com [2010-12-07]
FF Extension: Tab Utilities - C:\Dokumente und Einstellungen\Alexander\Anwendungsdaten\Mozilla\Firefox\Profiles\0qgqdyu2.default\Extensions\tabutils@ithinc.cn.xpi [2013-01-08]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\WINXP\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\WINXP\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2010-10-15]
StartMenuInternet: FIREFOX.EXE - D:\Firefox\firefox.exe

Chrome: 
=======
CHR Profile: C:\Dokumente und Einstellungen\Alexander\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Dokumente und Einstellungen\Alexander\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-06-25]
CHR Extension: (Google Drive) - C:\Dokumente und Einstellungen\Alexander\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-06-25]
CHR Extension: (YouTube) - C:\Dokumente und Einstellungen\Alexander\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-04-17]
CHR Extension: (Google Search) - C:\Dokumente und Einstellungen\Alexander\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-04-17]
CHR Extension: (Google Wallet) - C:\Dokumente und Einstellungen\Alexander\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-10-05]
CHR Extension: (Gmail) - C:\Dokumente und Einstellungen\Alexander\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-04-17]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S4 Alerter; C:\WINXP\system32\alrsvc.dll [17408 2008-04-14] (Microsoft Corporation)
R3 ALG; C:\WINXP\System32\alg.exe [44544 2008-04-14] (Microsoft Corporation)
R2 AntiVirSchedulerService; C:\Programme\Avira\AntiVir Desktop\sched.exe [432888 2015-03-03] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Programme\Avira\AntiVir Desktop\avguard.exe [432888 2015-03-03] (Avira Operations GmbH & Co. KG)
S3 AppMgmt; C:\WINXP\System32\appmgmts.dll [175616 2008-04-14] (Microsoft Corporation)
S3 aspnet_state; C:\WINXP\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [35160 2010-03-18] (Microsoft Corporation)
R2 AudioSrv; C:\WINXP\System32\audiosrv.dll [42496 2008-04-14] (Microsoft Corporation)
R2 Avira.OE.ServiceHost; C:\Programme\Avira\My Avira\Avira.OE.ServiceHost.exe [184056 2015-02-12] (Avira Operations GmbH & Co. KG)
S3 BITS; C:\WINXP\system32\qmgr.dll [409088 2008-04-14] (Microsoft Corporation)
R2 Bonjour Service; C:\Programme\Bonjour\mDNSResponder.exe [390504 2011-08-30] (Apple Inc.)
R2 Browser; C:\WINXP\System32\browser.dll [77824 2008-04-14] (Microsoft Corporation)
R2 BthServ; C:\WINXP\System32\bthserv.dll [30208 2008-04-14] (Microsoft Corporation)
S3 CiSvc; C:\WINXP\system32\cisvc.exe [5632 2008-04-14] (Microsoft Corporation)
S3 ClipSrv; C:\WINXP\system32\clipsrv.exe [33280 2008-04-14] (Microsoft Corporation)
S4 clr_optimization_v2.0.50727_32; C:\WINXP\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [69632 2008-07-25] (Microsoft Corporation)
S2 clr_optimization_v4.0.30319_32; C:\WINXP\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [130384 2010-03-18] (Microsoft Corporation)
R2 CryptSvc; C:\WINXP\System32\cryptsvc.dll [62464 2008-04-14] (Microsoft Corporation)
R2 DcomLaunch; C:\WINXP\system32\rpcss.dll [399360 2008-04-14] (Microsoft Corporation)
R2 Dhcp; C:\WINXP\System32\dhcpcsvc.dll [127488 2008-04-14] (Microsoft Corporation)
S3 dmadmin; C:\WINXP\System32\dmadmin.exe [225280 2008-04-14] (Microsoft Corp., Veritas Software)
R2 dmserver; C:\WINXP\System32\dmserver.dll [24064 2008-04-14] (Microsoft Corp.)
R2 Dnscache; C:\WINXP\System32\dnsrslvr.dll [45568 2008-04-14] (Microsoft Corporation)
S3 Dot3svc; C:\WINXP\System32\dot3svc.dll [133120 2008-04-14] (Microsoft Corporation)
S3 EapHost; C:\WINXP\System32\eapsvc.dll [33792 2008-04-14] (Microsoft Corporation)
R2 ERSvc; C:\WINXP\System32\ersvc.dll [23040 2008-04-14] (Microsoft Corporation)
R2 Eventlog; C:\WINXP\system32\services.exe [109056 2008-04-14] (Microsoft Corporation)
R3 EventSystem; C:\WINXP\system32\es.dll [253952 2008-12-10] (Microsoft Corporation)
R3 FastUserSwitchingCompatibility; C:\WINXP\System32\shsvcs.dll [135168 2008-04-14] (Microsoft Corporation)
S3 FontCache3.0.0.0; C:\WINXP\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [46104 2008-07-29] (Microsoft Corporation)
S2 gupdate; C:\Programme\Google\Update\GoogleUpdate.exe [116648 2013-04-17] (Google Inc.)
S3 gupdatem; C:\Programme\Google\Update\GoogleUpdate.exe [116648 2013-04-17] (Google Inc.)
R2 helpsvc; C:\WINXP\PCHealth\HelpCtr\Binaries\pchsvc.dll [38400 2008-04-14] (Microsoft Corporation)
R2 HidServ; C:\WINXP\System32\hidserv.dll [21504 2008-04-14] (Microsoft Corporation)
S3 hkmsvc; C:\WINXP\System32\kmsvc.dll [61440 2008-04-14] (Microsoft Corporation)
R3 HTTPFilter; C:\WINXP\System32\w3ssl.dll [15872 2008-04-14] (Microsoft Corporation)
S3 idsvc; C:\WINXP\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [881664 2008-07-29] (Microsoft Corporation)
S3 ImapiService; C:\WINXP\system32\imapi.exe [150528 2008-04-14] (Microsoft Corporation)
S3 iPod Service; C:\Programme\iPod\bin\iPodService.exe [553288 2013-02-20] (Apple Inc.)
R2 LanmanServer; C:\WINXP\System32\srvsvc.dll [96768 2008-04-14] (Microsoft Corporation)
R2 lanmanworkstation; C:\WINXP\System32\wkssvc.dll [132096 2008-04-14] (Microsoft Corporation)
R2 LmHosts; C:\WINXP\System32\lmhsvc.dll [13824 2008-04-14] (Microsoft Corporation)
R2 MBAMScheduler; C:\Programme\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
R2 MBAMService; C:\Programme\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
S4 Messenger; C:\WINXP\System32\msgsvc.dll [33792 2008-04-14] (Microsoft Corporation)
S3 Microsoft Office Groove Audit Service; D:\Programme\Microsoft Office\Office12\GrooveAuditService.exe [65824 2006-10-27] (Microsoft Corporation)
S3 mnmsrvc; C:\WINXP\system32\mnmsrvc.exe [32768 2008-04-14] (Microsoft Corporation)
S3 MozillaMaintenance; C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe [119408 2014-06-24] (Mozilla Foundation)
S3 MSDTC; C:\WINXP\system32\msdtc.exe [6144 2008-04-14] (Microsoft Corporation)
S3 MSIServer; C:\WINXP\System32\msiexec.exe [95744 2008-05-19] (Microsoft Corporation)
S3 napagent; C:\WINXP\System32\qagentrt.dll [294400 2008-04-14] (Microsoft Corporation)
S3 NBService; C:\Programme\Nero\Nero 7\Nero BackItUp\NBService.exe [800040 2007-11-28] (Nero AG)
R2 Net Driver HPZ12; C:\WINXP\system32\HPZinw12.dll [44032 2010-04-07] (Hewlett-Packard) [File not signed]
S4 NetDDE; C:\WINXP\system32\netdde.exe [114176 2008-04-14] (Microsoft Corporation)
S4 NetDDEdsdm; C:\WINXP\system32\netdde.exe [114176 2008-04-14] (Microsoft Corporation)
S3 Netlogon; C:\WINXP\system32\lsass.exe [13312 2008-04-14] (Microsoft Corporation)
R3 Netman; C:\WINXP\System32\netman.dll [198144 2008-04-14] (Microsoft Corporation)
S4 NetTcpPortSharing; C:\WINXP\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [124240 2010-03-18] (Microsoft Corporation)
R3 Nla; C:\WINXP\System32\mswsock.dll [247296 2008-04-14] (Microsoft Corporation)
S4 NMIndexingService; C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe [275752 2008-01-22] (Nero AG)
R2 NovacomD; C:\Programme\Palm, Inc\novacomd\x86\novacomd.exe [61440 2011-06-24] (Palm) [File not signed]
S3 NtLmSsp; C:\WINXP\system32\lsass.exe [13312 2008-04-14] (Microsoft Corporation)
S3 NtmsSvc; C:\WINXP\system32\ntmssvc.dll [438272 2008-04-14] (Microsoft Corporation)
R2 NVSvc; C:\WINXP\system32\nvsvc32.exe [168004 2009-01-30] (NVIDIA Corporation)
S3 odserv; C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE [441136 2006-10-26] (Microsoft Corporation)
S3 ose; C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE [145184 2006-10-26] (Microsoft Corporation)
R2 PlugPlay; C:\WINXP\system32\services.exe [109056 2008-04-14] (Microsoft Corporation)
R2 Pml Driver HPZ12; C:\WINXP\system32\HPZipm12.dll [53760 2010-04-07] (Hewlett-Packard) [File not signed]
R2 PolicyAgent; C:\WINXP\system32\lsass.exe [13312 2008-04-14] (Microsoft Corporation)
R2 ProtectedStorage; C:\WINXP\system32\lsass.exe [13312 2008-04-14] (Microsoft Corporation)
S3 RasAuto; C:\WINXP\System32\rasauto.dll [88576 2008-04-14] (Microsoft Corporation)
R3 RasMan; C:\WINXP\System32\rasmans.dll [186368 2008-04-14] (Microsoft Corporation)
S3 RDSessMgr; C:\WINXP\system32\sessmgr.exe [143360 2008-04-14] (Microsoft Corporation)
S4 RemoteAccess; C:\WINXP\System32\mprdim.dll [53248 2008-04-14] (Microsoft Corporation)
R2 RemoteRegistry; C:\WINXP\system32\regsvc.dll [59904 2008-04-14] (Microsoft Corporation)
S3 RpcLocator; C:\WINXP\system32\locator.exe [75264 2008-04-14] (Microsoft Corporation)
R2 RpcSs; C:\WINXP\System32\rpcss.dll [399360 2008-04-14] (Microsoft Corporation)
S3 RSVP; C:\WINXP\system32\rsvp.exe [132608 2008-04-14] (Microsoft Corporation)
R2 SamSs; C:\WINXP\system32\lsass.exe [13312 2008-04-14] (Microsoft Corporation)
S3 SCardSvr; C:\WINXP\System32\SCardSvr.exe [99840 2008-04-14] (Microsoft Corporation)
R2 Schedule; C:\WINXP\system32\schedsvc.dll [193536 2008-04-14] (Microsoft Corporation)
R2 seclogon; C:\WINXP\System32\seclogon.dll [18944 2008-04-14] (Microsoft Corporation)
R2 SENS; C:\WINXP\system32\sens.dll [39424 2008-04-14] (Microsoft Corporation)
R2 SharedAccess; C:\WINXP\System32\ipnathlp.dll [334336 2008-04-14] (Microsoft Corporation)
R2 ShellHWDetection; C:\WINXP\System32\shsvcs.dll [135168 2008-04-14] (Microsoft Corporation)
R2 Spooler; C:\WINXP\system32\spoolsv.exe [57856 2008-04-14] (Microsoft Corporation)
R2 srservice; C:\WINXP\system32\srsvc.dll [171520 2008-04-14] (Microsoft Corporation)
R3 SSDPSRV; C:\WINXP\System32\ssdpsrv.dll [71680 2008-04-14] (Microsoft Corporation)
R2 stisvc; C:\WINXP\system32\wiaservc.dll [334336 2008-04-14] (Microsoft Corporation)
S3 SysmonLog; C:\WINXP\system32\smlogsvc.exe [94208 2008-04-14] (Microsoft Corporation)
R3 TapiSrv; C:\WINXP\System32\tapisrv.dll [249856 2008-04-14] (Microsoft Corporation)
R3 TermService; C:\WINXP\System32\termsrv.dll [297472 2008-04-14] (Microsoft Corporation)
R2 Themes; C:\WINXP\System32\shsvcs.dll [135168 2008-04-14] (Microsoft Corporation)
S3 TlntSvr; C:\WINXP\system32\tlntsvr.exe [75264 2008-04-14] (Microsoft Corporation)
R2 TrkWks; C:\WINXP\system32\trkwks.dll [90112 2008-04-14] (Microsoft Corporation)
S3 upnphost; C:\WINXP\System32\upnphost.dll [186880 2008-04-14] (Microsoft Corporation)
S3 UPS; C:\WINXP\System32\ups.exe [18432 2008-04-14] (Microsoft Corporation)
S3 VSS; C:\WINXP\System32\vssvc.exe [292864 2008-04-14] (Microsoft Corporation)
R2 W32Time; C:\WINXP\system32\w32time.dll [177152 2008-04-14] (Microsoft Corporation)
U2 WebClient; C:\WINXP\System32\webclnt.dll [68096 2008-04-14] (Microsoft Corporation)
R2 winmgmt; C:\WINXP\system32\wbem\WMIsvc.dll [145408 2008-04-14] (Microsoft Corporation)
S3 WmdmPmSN; C:\WINXP\system32\mspmsnsv.dll [27136 2008-12-10] (Microsoft Corporation)
S3 Wmi; C:\WINXP\System32\advapi32.dll [678400 2008-04-14] (Microsoft Corporation)
S3 WmiApSrv; C:\WINXP\system32\wbem\wmiapsrv.exe [126464 2008-04-14] (Microsoft Corporation)
S3 WMPNetworkSvc; C:\Programme\Windows Media Player\WMPNetwk.exe [920576 2006-11-03] (Microsoft Corporation)
S3 WPFFontCache_v0400; C:\WINXP\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [753504 2010-03-18] (Microsoft Corporation)
R2 wscsvc; C:\WINXP\system32\wscsvc.dll [80896 2008-04-14] (Microsoft Corporation)
R2 wuauserv; C:\WINXP\system32\wuauserv.dll [6656 2008-04-14] (Microsoft Corporation)
R2 WudfSvc; C:\WINXP\System32\WUDFSvc.dll [55296 2008-01-19] (Microsoft Corporation)
R2 WZCSVC; C:\WINXP\System32\wzcsvc.dll [483840 2008-12-10] (Microsoft Corporation)
S3 xmlprov; C:\WINXP\System32\xmlprov.dll [129024 2008-04-14] (Microsoft Corporation)
S2 LcSvrAdm; g:\elsawin\installation\bin\LcSvrAdm.exe [X]
S3 LcSvrAuf; g:\elsawin\installation\bin\LcSvrAuf.exe [X]
S2 LcSvrDba; g:\elsawin\installation\bin\LcSvrDba.exe [X]
S2 LcSvrHis; g:\elsawin\installation\bin\LcSvrHis.exe [X]
S2 LcSvrPAS; g:\elsawin\installation\bin\LcSvrPas.exe [X]
S2 LcSvrSaz; g:\elsawin\installation\bin\LcSvrSaz.exe [X]
S3 SwPrv; C:\WINXP\system32\dllhost.exe /Processid:{754E7D9E-E094-4527-B77E-79F9E5C6619D}

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 ACPI; C:\WINXP\System32\DRIVERS\ACPI.sys [188800 2008-04-14] (Microsoft Corporation)
R0 ACPIEC; C:\WINXP\System32\DRIVERS\ACPIEC.sys [12160 2008-04-14] (Microsoft Corporation)
S3 aec; C:\WINXP\System32\drivers\aec.sys [142592 2008-04-13] (Microsoft Corporation)
R1 AFD; C:\WINXP\System32\drivers\afd.sys [138496 2008-12-10] (Microsoft Corporation)
R3 Arp1394; C:\WINXP\System32\DRIVERS\arp1394.sys [60800 2008-12-10] (Microsoft Corporation)
S3 AsyncMac; C:\WINXP\System32\DRIVERS\asyncmac.sys [14336 2008-04-14] (Microsoft Corporation)
R0 atapi; C:\WINXP\System32\DRIVERS\atapi.sys [96512 2008-04-14] (Microsoft Corporation)
S3 Atmarpc; C:\WINXP\System32\DRIVERS\atmarpc.sys [59904 2008-04-14] (Microsoft Corporation)
R3 audstub; C:\WINXP\System32\DRIVERS\audstub.sys [3072 2001-08-17] (Microsoft Corporation)
R2 avgntflt; C:\WINXP\System32\DRIVERS\avgntflt.sys [105864 2015-02-04] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\WINXP\System32\DRIVERS\avipbb.sys [136216 2015-02-04] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\WINXP\System32\DRIVERS\avkmgr.sys [37352 2015-02-04] (Avira Operations GmbH & Co. KG)
R1 Beep; C:\WINXP\system32\Drivers\Beep.sys [4224 2008-04-14] (Microsoft Corporation)
S3 BthEnum; C:\WINXP\System32\DRIVERS\BthEnum.sys [17024 2008-04-13] (Microsoft Corporation)
S3 BTHMODEM; C:\WINXP\System32\DRIVERS\bthmodem.sys [37888 2008-04-13] (Microsoft Corporation)
S3 BthPan; C:\WINXP\System32\DRIVERS\bthpan.sys [101120 2008-04-13] (Microsoft Corporation)
S3 BTHPORT; C:\WINXP\System32\Drivers\BTHport.sys [273024 2008-12-10] (Microsoft Corporation)
S3 BTHUSB; C:\WINXP\System32\Drivers\BTHUSB.sys [18944 2008-04-13] (Microsoft Corporation)
R3 cbfs3; C:\WINXP\System32\DRIVERS\cbfs3.sys [299024 2012-04-09] (EldoS Corporation)
S4 cbidf2k; C:\WINXP\system32\Drivers\cbidf2k.sys [13952 2008-04-14] (Microsoft Corporation)
S1 Cdaudio; C:\WINXP\system32\Drivers\Cdaudio.sys [18688 2008-12-10] (Microsoft Corporation)
R4 Cdfs; C:\WINXP\system32\Drivers\Cdfs.sys [63744 2008-04-14] (Microsoft Corporation)
R1 Cdrom; C:\WINXP\System32\DRIVERS\cdrom.sys [62976 2008-04-14] (Microsoft Corporation)
R3 CmBatt; C:\WINXP\System32\DRIVERS\CmBatt.sys [13952 2008-04-14] (Microsoft Corporation)
R0 Compbatt; C:\WINXP\System32\DRIVERS\compbatt.sys [10240 2008-04-14] (Microsoft Corporation)
R0 Disk; C:\WINXP\System32\DRIVERS\disk.sys [36352 2008-04-14] (Microsoft Corporation)
S4 dmboot; C:\WINXP\System32\drivers\dmboot.sys [800384 2008-04-14] (Microsoft Corp., Veritas Software)
R0 dmio; C:\WINXP\System32\drivers\dmio.sys [154112 2008-04-14] (Microsoft Corp., Veritas Software)
R0 dmload; C:\WINXP\System32\drivers\dmload.sys [5888 2008-04-14] (Microsoft Corp., Veritas Software.)
S3 DMusic; C:\WINXP\System32\drivers\DMusic.sys [52864 2008-04-13] (Microsoft Corporation)
S3 drmkaud; C:\WINXP\System32\drivers\drmkaud.sys [2944 2008-04-13] (Microsoft Corporation)
R1 dtsoftbus01; C:\WINXP\System32\DRIVERS\dtsoftbus01.sys [242240 2012-06-21] (DT Soft Ltd)
S4 exFat; C:\WINXP\system32\Drivers\exFat.sys [133632 2008-09-29] (Microsoft Corporation)
R4 Fastfat; C:\WINXP\system32\Drivers\Fastfat.sys [143744 2008-04-14] (Microsoft Corporation)
S1 Fdc; C:\WINXP\system32\Drivers\Fdc.sys [27392 2008-04-14] (Microsoft Corporation)
R1 Fips; C:\WINXP\system32\Drivers\Fips.sys [44672 2008-04-14] (Microsoft Corporation)
S1 Flpydisk; C:\WINXP\system32\Drivers\Flpydisk.sys [20480 2008-04-14] (Microsoft Corporation)
R0 FltMgr; C:\WINXP\System32\drivers\fltmgr.sys [129792 2008-04-14] (Microsoft Corporation)
U1 Fs_Rec; C:\WINXP\system32\Drivers\Fs_Rec.sys [9216 2008-09-29] (Microsoft Corporation)
R0 Ftdisk; C:\WINXP\System32\DRIVERS\ftdisk.sys [126336 2008-04-14] (Microsoft Corporation)
R3 GEARAspiWDM; C:\WINXP\System32\DRIVERS\GEARAspiWDM.sys [26840 2012-08-21] (GEAR Software Inc.)
R3 Gpc; C:\WINXP\System32\DRIVERS\msgpc.sys [35072 2008-04-14] (Microsoft Corporation)
R2 Hardlock; C:\WINXP\system32\drivers\hardlock.sys [693760 2006-11-22] (Aladdin Knowledge Systems Ltd.)
R3 HDAudBus; C:\WINXP\System32\DRIVERS\HDAudBus.sys [144384 2008-04-14] (Windows (R) Server 2003 DDK provider)
R3 HidUsb; C:\WINXP\System32\DRIVERS\hidusb.sys [10368 2008-04-13] (Microsoft Corporation)
R0 hotcore3; C:\WINXP\System32\DRIVERS\hotcore3.sys [40560 2010-05-20] (Paragon Software Group)
R3 HTTP; C:\WINXP\System32\Drivers\HTTP.sys [264832 2008-04-14] (Microsoft Corporation)
R1 i8042prt; C:\WINXP\System32\DRIVERS\i8042prt.sys [52992 2008-04-14] (Microsoft Corporation)
R0 iaStor; C:\WINXP\System32\DRIVERS\iaStor.sys [330264 2010-01-05] (Intel Corporation)
R1 Imapi; C:\WINXP\System32\DRIVERS\imapi.sys [42112 2008-04-14] (Microsoft Corporation)
R3 IntcAzAudAddService; C:\WINXP\System32\drivers\RtkHDAud.sys [4241920 2006-02-27] (Realtek Semiconductor Corp.)
R1 intelppm; C:\WINXP\System32\DRIVERS\intelppm.sys [40448 2008-04-14] (Microsoft Corporation)
S3 Ip6Fw; C:\WINXP\System32\drivers\ip6fw.sys [36608 2008-04-14] (Microsoft Corporation)
R3 IpFilterDriver; C:\WINXP\System32\DRIVERS\ipfltdrv.sys [32896 2008-04-14] (Microsoft Corporation)
S3 IpInIp; C:\WINXP\System32\DRIVERS\ipinip.sys [20864 2008-04-14] (Microsoft Corporation)
R3 IpNat; C:\WINXP\System32\DRIVERS\ipnat.sys [152832 2008-04-14] (Microsoft Corporation)
R1 IPSec; C:\WINXP\System32\DRIVERS\ipsec.sys [75264 2008-04-14] (Microsoft Corporation)
S3 IRENUM; C:\WINXP\System32\DRIVERS\irenum.sys [11264 2008-04-14] (Microsoft Corporation)
R0 isapnp; C:\WINXP\System32\DRIVERS\isapnp.sys [37632 2008-04-14] (Microsoft Corporation)
R1 Kbdclass; C:\WINXP\System32\DRIVERS\kbdclass.sys [25216 2008-04-14] (Microsoft Corporation)
R1 kbdhid; C:\WINXP\System32\DRIVERS\kbdhid.sys [14720 2008-04-14] (Microsoft Corporation)
R3 kmixer; C:\WINXP\System32\drivers\kmixer.sys [172416 2008-04-13] (Microsoft Corporation)
R0 KSecDD; C:\WINXP\system32\Drivers\KSecDD.sys [92288 2008-04-14] (Microsoft Corporation)
R3 MBAMProtector; C:\WINXP\system32\drivers\mbam.sys [23256 2014-11-21] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\WINXP\system32\drivers\MBAMSwissArmy.sys [114904 2015-03-05] (Malwarebytes Corporation)
R1 mnmdd; C:\WINXP\system32\Drivers\mnmdd.sys [4224 2008-04-14] (Microsoft Corporation)
R3 Modem; C:\WINXP\system32\Drivers\Modem.sys [30336 2008-12-10] (Microsoft Corporation)
R1 Mouclass; C:\WINXP\System32\DRIVERS\mouclass.sys [23552 2008-12-10] (Microsoft Corporation)
R3 mouhid; C:\WINXP\System32\DRIVERS\mouhid.sys [12288 2001-08-18] (Microsoft Corporation)
R0 MountMgr; C:\WINXP\system32\Drivers\MountMgr.sys [42368 2008-04-14] (Microsoft Corporation)
R3 MRxDAV; C:\WINXP\System32\DRIVERS\mrxdav.sys [180608 2008-04-14] (Microsoft Corporation)
R1 MRxSmb; C:\WINXP\System32\DRIVERS\mrxsmb.sys [455936 2008-12-10] (Microsoft Corporation)
R1 Msfs; C:\WINXP\system32\Drivers\Msfs.sys [19072 2008-04-14] (Microsoft Corporation)
S3 MSKSSRV; C:\WINXP\System32\drivers\MSKSSRV.sys [7552 2008-04-13] (Microsoft Corporation)
S3 MSPCLOCK; C:\WINXP\System32\drivers\MSPCLOCK.sys [5376 2008-04-13] (Microsoft Corporation)
S3 MSPQM; C:\WINXP\System32\drivers\MSPQM.sys [4992 2008-04-13] (Microsoft Corporation)
R3 mssmbios; C:\WINXP\System32\DRIVERS\mssmbios.sys [15488 2008-12-10] (Microsoft Corporation)
R0 Mup; C:\WINXP\system32\Drivers\Mup.sys [105344 2008-04-14] (Microsoft Corporation)
R0 NDIS; C:\WINXP\system32\Drivers\NDIS.sys [182656 2008-04-14] (Microsoft Corporation)
R3 NdisTapi; C:\WINXP\System32\DRIVERS\ndistapi.sys [10112 2008-04-14] (Microsoft Corporation)
R3 Ndisuio; C:\WINXP\System32\DRIVERS\ndisuio.sys [14592 2008-12-10] (Microsoft Corporation)
R3 NdisWan; C:\WINXP\System32\DRIVERS\ndiswan.sys [91520 2008-04-14] (Microsoft Corporation)
R3 NDProxy; C:\WINXP\system32\Drivers\NDProxy.sys [40576 2008-04-14] (Microsoft Corporation)
R1 NetBIOS; C:\WINXP\System32\DRIVERS\netbios.sys [34688 2008-04-14] (Microsoft Corporation)
R1 NetBT; C:\WINXP\System32\DRIVERS\netbt.sys [162816 2008-04-14] (Microsoft Corporation)
R3 NETw3x32; C:\WINXP\System32\DRIVERS\NETw3x32.sys [1709696 2006-09-27] (Intel® Corporation)
R3 NIC1394; C:\WINXP\System32\DRIVERS\nic1394.sys [61824 2008-12-10] (Microsoft Corporation)
R1 Npfs; C:\WINXP\system32\Drivers\Npfs.sys [30848 2008-04-14] (Microsoft Corporation)
R2 NSHE; C:\WINXP\system32\Drivers\NSHE.SYS [97792 2008-11-23] (T0r0 2008) [File not signed]
R4 Ntfs; C:\WINXP\system32\Drivers\Ntfs.sys [574976 2008-04-14] (Microsoft Corporation)
R1 Null; C:\WINXP\system32\Drivers\Null.sys [2944 2008-04-14] (Microsoft Corporation)
R3 nv; C:\WINXP\System32\DRIVERS\nv4_mini.sys [6250848 2009-01-30] (NVIDIA Corporation)
S3 NwlnkFlt; C:\WINXP\System32\DRIVERS\nwlnkflt.sys [12416 2008-04-14] (Microsoft Corporation)
S3 NwlnkFwd; C:\WINXP\System32\DRIVERS\nwlnkfwd.sys [32512 2008-04-14] (Microsoft Corporation)
R0 ohci1394; C:\WINXP\System32\DRIVERS\ohci1394.sys [61696 2008-04-14] (Microsoft Corporation)
S3 Parport; C:\WINXP\system32\Drivers\Parport.sys [80384 2008-12-10] (Microsoft Corporation)
R0 PartMgr; C:\WINXP\system32\Drivers\PartMgr.sys [19712 2008-04-14] (Microsoft Corporation)
S2 ParVdm; C:\WINXP\system32\Drivers\ParVdm.sys [7040 2008-04-14] (Microsoft Corporation)
R0 PCI; C:\WINXP\System32\DRIVERS\pci.sys [68224 2008-04-14] (Microsoft Corporation)
R0 PCIIde; C:\WINXP\System32\DRIVERS\pciide.sys [3328 2001-08-18] (Microsoft Corporation)
S4 Pcmcia; C:\WINXP\system32\Drivers\Pcmcia.sys [120576 2008-04-14] (Microsoft Corporation)
R3 PptpMiniport; C:\WINXP\System32\DRIVERS\raspptp.sys [48384 2008-04-14] (Microsoft Corporation)
R3 PSched; C:\WINXP\System32\DRIVERS\psched.sys [69120 2008-04-14] (Microsoft Corporation)
R3 Ptilink; C:\WINXP\System32\DRIVERS\ptilink.sys [17792 2008-04-14] (Parallel Technologies, Inc.)
S3 pwdrvio; C:\WINXP\system32\pwdrvio.sys [16472 2012-01-18] ()
S3 pwdspio; C:\WINXP\system32\pwdspio.sys [11104 2012-01-18] ()
R0 PxHelp20; C:\WINXP\System32\Drivers\PxHelp20.sys [45648 2010-08-12] (Sonic Solutions)
R1 RasAcd; C:\WINXP\System32\DRIVERS\rasacd.sys [8832 2008-04-14] (Microsoft Corporation)
R3 Rasl2tp; C:\WINXP\System32\DRIVERS\rasl2tp.sys [51328 2008-04-14] (Microsoft Corporation)
R3 RasPppoe; C:\WINXP\System32\DRIVERS\raspppoe.sys [41472 2008-04-14] (Microsoft Corporation)
R3 Raspti; C:\WINXP\System32\DRIVERS\raspti.sys [16512 2008-04-14] (Microsoft Corporation)
R1 Rdbss; C:\WINXP\System32\DRIVERS\rdbss.sys [175744 2008-04-14] (Microsoft Corporation)
R1 RDPCDD; C:\WINXP\System32\DRIVERS\RDPCDD.sys [4224 2008-04-14] (Microsoft Corporation)
R3 rdpdr; C:\WINXP\System32\DRIVERS\rdpdr.sys [196224 2008-04-14] (Microsoft Corporation)
S3 RDPWD; C:\WINXP\system32\Drivers\RDPWD.sys [139656 2008-04-14] (Microsoft Corporation)
R1 redbook; C:\WINXP\System32\DRIVERS\redbook.sys [57728 2008-04-14] (Microsoft Corporation)
S3 RFCOMM; C:\WINXP\System32\DRIVERS\rfcomm.sys [59136 2008-04-13] (Microsoft Corporation)
R3 RTL8023xp; C:\WINXP\System32\DRIVERS\Rtnicxp.sys [78720 2005-09-30] (Realtek Semiconductor Corporation                           )
S3 Secdrv; C:\WINXP\System32\DRIVERS\secdrv.sys [20480 2008-04-14] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
S2 Serial; C:\WINXP\system32\Drivers\Serial.sys [65536 2008-04-14] (Microsoft Corporation)
S1 Sfloppy; C:\WINXP\system32\Drivers\Sfloppy.sys [11392 2008-04-14] (Microsoft Corporation)
R3 smserial; C:\WINXP\System32\DRIVERS\smserial.sys [846792 2005-09-16] (Motorola Inc.)
S3 splitter; C:\WINXP\System32\drivers\splitter.sys [6272 2008-04-13] (Microsoft Corporation)
R0 sr; C:\WINXP\System32\DRIVERS\sr.sys [73472 2008-04-14] (Microsoft Corporation)
R3 Srv; C:\WINXP\System32\DRIVERS\srv.sys [333824 2008-12-10] (Microsoft Corporation)
R1 ssmdrv; C:\WINXP\System32\DRIVERS\ssmdrv.sys [28520 2015-02-04] (Avira GmbH)
R3 swenum; C:\WINXP\System32\DRIVERS\swenum.sys [4352 2008-12-10] (Microsoft Corporation)
S3 swmidi; C:\WINXP\System32\drivers\swmidi.sys [56576 2008-04-13] (Microsoft Corporation)
R3 sysaudio; C:\WINXP\System32\drivers\sysaudio.sys [60800 2008-04-13] (Microsoft Corporation)
R1 Tcpip; C:\WINXP\System32\DRIVERS\tcpip.sys [361344 2008-04-14] (Microsoft Corporation)
S3 TDPIPE; C:\WINXP\system32\Drivers\TDPIPE.sys [12040 2008-04-14] (Microsoft Corporation)
S3 TDTCP; C:\WINXP\system32\Drivers\TDTCP.sys [21896 2008-04-14] (Microsoft Corporation)
R1 TermDD; C:\WINXP\System32\DRIVERS\termdd.sys [40840 2008-04-14] (Microsoft Corporation)
S4 Udfs; C:\WINXP\system32\Drivers\Udfs.sys [66048 2008-04-14] (Microsoft Corporation)
R3 Update; C:\WINXP\System32\DRIVERS\update.sys [384768 2008-04-14] (Microsoft Corporation)
S3 USBAAPL; C:\WINXP\System32\Drivers\usbaapl.sys [45056 2012-12-13] (Apple, Inc.) [File not signed]
R3 usbccgp; C:\WINXP\System32\DRIVERS\usbccgp.sys [32128 2008-04-13] (Microsoft Corporation)
R3 usbehci; C:\WINXP\System32\DRIVERS\usbehci.sys [30208 2008-04-14] (Microsoft Corporation)
R3 usbhub; C:\WINXP\System32\DRIVERS\usbhub.sys [59520 2008-04-14] (Microsoft Corporation)
S3 usbprint; C:\WINXP\System32\DRIVERS\usbprint.sys [25856 2008-04-13] (Microsoft Corporation)
S3 usbscan; C:\WINXP\System32\DRIVERS\usbscan.sys [15104 2008-04-13] (Microsoft Corporation)
R3 USBSTOR; C:\WINXP\System32\DRIVERS\USBSTOR.SYS [26368 2008-04-13] (Microsoft Corporation)
R3 usbuhci; C:\WINXP\System32\DRIVERS\usbuhci.sys [20608 2008-04-14] (Microsoft Corporation)
R1 VgaSave; C:\WINXP\System32\drivers\vga.sys [20992 2008-04-14] (Microsoft Corporation)
R0 VolSnap; C:\WINXP\system32\Drivers\VolSnap.sys [53760 2008-04-14] (Microsoft Corporation)
R3 Wanarp; C:\WINXP\System32\DRIVERS\wanarp.sys [34560 2008-04-14] (Microsoft Corporation)
S3 wceusbsh; C:\WINXP\System32\DRIVERS\wceusbsh.sys [28672 2006-11-06] (Microsoft Corporation)
S3 Wdf01000; C:\WINXP\System32\Drivers\wdf01000.sys [444136 2009-07-14] (Microsoft Corporation)
R3 wdmaud; C:\WINXP\System32\drivers\wdmaud.sys [83072 2008-04-13] (Microsoft Corporation)
S3 WinUSB; C:\WINXP\System32\DRIVERS\WinUSB.sys [34944 2009-07-13] (Microsoft Corporation)
R1 WmiAcpi; C:\WINXP\System32\DRIVERS\wmiacpi.sys [8832 2008-04-14] (Microsoft Corporation)
S3 WpdUsb; C:\WINXP\System32\DRIVERS\wpdusb.sys [38528 2008-12-10] (Microsoft Corporation)
R1 WS2IFSL; C:\WINXP\System32\drivers\ws2ifsl.sys [12032 2008-04-14] (Microsoft Corporation)
R0 WudfPf; C:\WINXP\System32\DRIVERS\WudfPf.sys [77696 2008-01-18] (Microsoft Corporation)
S3 WudfRd; C:\WINXP\System32\DRIVERS\wudfrd.sys [83328 2008-01-18] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 CFcatchme; \??\C:\ComboFix\CFcatchme.sys [X]
S4 IntelIde; No ImagePath
U5 ScsiPort; C:\WINXP\system32\drivers\scsiport.sys [96384 2008-04-14] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-05 18:19 - 2015-03-05 18:19 - 00000000 ____D () C:\Dokumente und Einstellungen\Alexander\Desktop\FRST-OlderVersion
2015-03-05 18:16 - 2015-03-05 18:16 - 00000585 _____ () C:\Dokumente und Einstellungen\Alexander\Desktop\JRT.txt
2015-03-05 17:59 - 2015-03-05 17:59 - 00001023 _____ () C:\Dokumente und Einstellungen\Alexander\Desktop\AdwCleaner[S1].txt
2015-03-05 17:49 - 2015-03-05 17:49 - 00002255 _____ () C:\Dokumente und Einstellungen\Alexander\Desktop\mbam.txt
2015-03-05 17:27 - 2015-03-05 17:29 - 00000751 _____ () C:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk
2015-03-05 17:27 - 2015-03-05 17:29 - 00000000 ____D () C:\Programme\ Malwarebytes Anti-Malware 
2015-03-05 17:27 - 2015-03-05 17:29 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\ Malwarebytes Anti-Malware 
2015-03-05 17:27 - 2014-11-21 06:14 - 00054360 _____ (Malwarebytes Corporation) C:\WINXP\system32\Drivers\mbamchameleon.sys
2015-03-05 17:27 - 2014-11-21 06:14 - 00023256 _____ (Malwarebytes Corporation) C:\WINXP\system32\Drivers\mbam.sys
2015-03-05 10:20 - 2015-03-05 10:20 - 00000834 _____ () C:\Dokumente und Einstellungen\All Users\Desktop\Avira.lnk
2015-03-05 10:13 - 2015-03-05 10:13 - 04197016 _____ (Kaspersky Lab ZAO) C:\Dokumente und Einstellungen\Alexander\Desktop\tdsskiller.exe
2015-03-04 19:06 - 2015-03-04 19:06 - 00055923 _____ () C:\ComboFix.txt
2015-03-04 19:06 - 2015-03-04 19:06 - 00000000 ____D () C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\temp
2015-03-04 19:06 - 2015-03-04 19:06 - 00000000 ____D () C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\temp
2015-03-04 19:06 - 2015-03-04 19:06 - 00000000 ____D () C:\Dokumente und Einstellungen\Default User\Lokale Einstellungen\temp
2015-03-04 18:28 - 2011-06-26 11:15 - 00256000 _____ () C:\WINXP\PEV.exe
2015-03-04 18:28 - 2010-11-07 21:50 - 00208896 _____ () C:\WINXP\MBR.exe
2015-03-04 18:28 - 2009-04-20 09:26 - 00060416 _____ (NirSoft) C:\WINXP\NIRCMD.exe
2015-03-04 18:28 - 2000-08-31 04:30 - 00518144 _____ (SteelWerX) C:\WINXP\SWREG.exe
2015-03-04 18:28 - 2000-08-31 04:30 - 00406528 _____ (SteelWerX) C:\WINXP\SWSC.exe
2015-03-04 18:28 - 2000-08-31 04:30 - 00212480 _____ (SteelWerX) C:\WINXP\SWXCACLS.exe
2015-03-04 18:28 - 2000-08-31 04:30 - 00098816 _____ () C:\WINXP\sed.exe
2015-03-04 18:28 - 2000-08-31 04:30 - 00080412 _____ () C:\WINXP\grep.exe
2015-03-04 18:28 - 2000-08-31 04:30 - 00068096 _____ () C:\WINXP\zip.exe
2015-03-04 18:27 - 2015-03-04 19:06 - 00000000 ____D () C:\Qoobox
2015-03-04 18:26 - 2015-03-04 18:27 - 05612482 ____R (Swearware) C:\Dokumente und Einstellungen\Alexander\Desktop\ComboFix.exe
2015-03-03 19:18 - 2015-03-03 19:19 - 00026610 _____ () C:\Dokumente und Einstellungen\Alexander\Desktop\Addition.txt
2015-03-03 19:16 - 2015-03-05 18:20 - 00047890 _____ () C:\Dokumente und Einstellungen\Alexander\Desktop\FRST.txt
2015-03-03 19:10 - 2015-03-03 19:10 - 00834762 _____ () C:\Dokumente und Einstellungen\Alexander\Desktop\Unbenannt999.bmp
2015-03-03 18:10 - 2015-03-05 18:07 - 01388333 _____ (Thisisu) C:\Dokumente und Einstellungen\Alexander\Desktop\JRT.exe
2015-03-03 17:50 - 2015-03-05 17:56 - 00000000 ____D () C:\AdwCleaner
2015-03-03 17:50 - 2015-03-03 17:50 - 02126848 _____ () C:\Dokumente und Einstellungen\Alexander\Desktop\AdwCleaner_4.111.exe
2015-03-03 17:29 - 2015-03-03 17:45 - 00114904 _____ (Malwarebytes Corporation) C:\WINXP\system32\Drivers\536154D9.sys
2015-03-03 17:29 - 2015-03-03 17:29 - 00114904 _____ (Malwarebytes Corporation) C:\WINXP\system32\Drivers\35A5549B.sys
2015-03-03 17:28 - 2015-03-03 17:28 - 00110296 _____ (Malwarebytes Corporation) C:\WINXP\system32\Drivers\47067E77.sys
2015-03-03 17:25 - 2015-03-03 17:25 - 00110296 _____ (Malwarebytes Corporation) C:\WINXP\system32\Drivers\48230029.sys
2015-03-03 17:16 - 2015-03-03 17:16 - 00000529 _____ () C:\Dokumente und Einstellungen\Alexander\Desktop\Revo Uninstaller.lnk
2015-03-03 17:13 - 2015-03-05 18:19 - 01132544 _____ (Farbar) C:\Dokumente und Einstellungen\Alexander\Desktop\FRST.exe
2015-03-03 17:13 - 2015-03-05 18:19 - 00000000 ____D () C:\FRST
2015-03-02 19:39 - 2015-03-05 17:57 - 00275294 _____ () C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-S-1-5-21-1935655697-1229272821-1417001333-1003-0.dat
2015-03-02 18:20 - 2015-03-05 10:18 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Package Cache
2015-03-02 18:20 - 2015-03-02 18:20 - 00000000 ____D () C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Avira
2015-03-02 18:20 - 2015-03-02 18:20 - 00000000 ____D () C:\Dokumente und Einstellungen\Alexander\Anwendungsdaten\Avira
2015-03-02 18:19 - 2015-03-05 10:19 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Avira
2015-03-02 18:18 - 2015-02-04 17:51 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\WINXP\system32\Drivers\avipbb.sys
2015-03-02 18:18 - 2015-02-04 17:51 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\WINXP\system32\Drivers\avkmgr.sys
2015-03-02 18:18 - 2015-02-04 17:51 - 00028520 _____ (Avira GmbH) C:\WINXP\system32\Drivers\ssmdrv.sys
2015-03-02 18:17 - 2015-03-05 10:19 - 00000000 ____D () C:\Programme\Avira
2015-03-02 18:17 - 2015-03-02 18:21 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avira

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-05 18:20 - 2014-06-19 15:29 - 00000000 ____D () C:\Dokumente und Einstellungen\Alexander\Lokale Einstellungen\Temp
2015-03-05 18:14 - 2014-06-19 15:29 - 00000000 ____D () C:\WINXP\Temp
2015-03-05 18:09 - 2013-04-17 19:36 - 00001096 _____ () C:\WINXP\Tasks\GoogleUpdateTaskMachineUA.job
2015-03-05 18:04 - 2014-07-14 17:39 - 00114904 _____ (Malwarebytes Corporation) C:\WINXP\system32\Drivers\MBAMSwissArmy.sys
2015-03-05 17:59 - 2014-06-19 14:17 - 00365217 _____ () C:\WINXP\WindowsUpdate.log
2015-03-05 17:59 - 2013-04-17 19:36 - 00001092 _____ () C:\WINXP\Tasks\GoogleUpdateTaskMachineCore.job
2015-03-05 17:59 - 2010-01-06 01:04 - 00202011 _____ () C:\WINXP\system32\nvapps.xml
2015-03-05 17:59 - 2010-01-05 23:42 - 00000006 ____H () C:\WINXP\Tasks\SA.DAT
2015-03-05 17:59 - 2010-01-05 22:55 - 00000159 _____ () C:\WINXP\wiadebug.log
2015-03-05 17:59 - 2010-01-05 22:55 - 00000050 _____ () C:\WINXP\wiaservc.log
2015-03-05 17:57 - 2013-02-12 14:53 - 00275294 _____ () C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-System.dat
2015-03-05 17:57 - 2010-01-05 23:48 - 00000190 ___SH () C:\Dokumente und Einstellungen\Alexander\ntuser.ini
2015-03-05 17:57 - 2010-01-05 23:48 - 00000000 ____D () C:\Dokumente und Einstellungen\Alexander
2015-03-05 17:57 - 2010-01-05 23:42 - 00032274 _____ () C:\WINXP\SchedLgU.Txt
2015-03-05 17:27 - 2010-01-05 22:53 - 00000000 ____D () C:\Programme
2015-03-05 17:27 - 2010-01-05 22:53 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme
2015-03-05 17:22 - 2010-01-05 23:29 - 00000000 __SHD () C:\Dokumente und Einstellungen\NetworkService
2015-03-04 18:55 - 2010-01-05 23:46 - 00000000 ____D () C:\WINXP
2015-03-04 18:55 - 2008-04-14 14:30 - 00000227 _____ () C:\WINXP\system.ini
2015-03-04 18:53 - 2012-02-29 19:07 - 00000000 ____D () C:\WINXP\SxsCaPendDel
2015-03-04 18:53 - 2008-04-14 14:30 - 00002206 _____ () C:\WINXP\system32\wpa.dbl
2015-03-04 18:51 - 2014-06-18 17:56 - 00000000 ____D () C:\WINXP\erdnt
2015-03-04 18:24 - 2013-10-14 15:28 - 00000664 _____ () C:\WINXP\system32\d3d9caps.dat
2015-03-03 19:08 - 2010-01-13 23:38 - 00000069 _____ () C:\WINXP\NeroDigital.ini
2015-03-03 18:43 - 2014-07-08 17:51 - 00000000 ____D () C:\WINXP\system32\NtmsData
2015-03-03 18:42 - 2010-01-05 23:21 - 00013311 _____ () C:\WINXP\wmsetup.log
2015-03-03 18:25 - 2010-01-05 23:21 - 00000000 ____D () C:\WINXP\Registration
2015-03-03 18:21 - 2012-07-09 18:28 - 00000000 ____D () C:\Programme\Gemeinsame Dateien\Apple
2015-03-03 17:16 - 2010-01-05 23:48 - 00000000 ___RD () C:\Dokumente und Einstellungen\Alexander\Startmenü\Programme
2015-03-02 18:52 - 2014-07-06 23:40 - 00359515 _____ () C:\WINXP\setupapi.log
2015-03-02 18:52 - 2010-01-05 23:46 - 00000000 ____D () C:\WINXP\repair
2015-03-02 18:20 - 2010-01-05 23:42 - 00000000 __SHD () C:\Dokumente und Einstellungen\LocalService
2015-02-04 17:51 - 2010-01-08 13:20 - 00105864 _____ (Avira Operations GmbH & Co. KG) C:\WINXP\system32\Drivers\avgntflt.sys
2015-02-03 16:51 - 2010-01-05 22:52 - 00207683 _____ () C:\WINXP\setupact.log

==================== Files in the root of some directories =======

2012-05-28 08:59 - 2012-05-28 08:59 - 0002528 _____ () C:\Dokumente und Einstellungen\Alexander\Anwendungsdaten\$_hpcst$.hpc
2014-07-06 15:55 - 2014-07-07 11:55 - 0000038 _____ () C:\Dokumente und Einstellungen\Alexander\Anwendungsdaten\WB.CFG
2010-01-08 13:04 - 2014-12-22 22:45 - 0032256 _____ () C:\Dokumente und Einstellungen\Alexander\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

Some content of TEMP:
====================
C:\Dokumente und Einstellungen\Alexander\Lokale Einstellungen\Temp\avgnt.exe
C:\Dokumente und Einstellungen\Alexander\Lokale Einstellungen\Temp\Quarantine.exe
C:\Dokumente und Einstellungen\Alexander\Lokale Einstellungen\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\WINXP\explorer.exe => File is digitally signed
C:\WINXP\system32\winlogon.exe => File is digitally signed
C:\WINXP\system32\svchost.exe => File is digitally signed
C:\WINXP\system32\services.exe => File is digitally signed
C:\WINXP\system32\User32.dll => File is digitally signed
C:\WINXP\system32\userinit.exe => File is digitally signed
C:\WINXP\system32\rpcss.dll => File is digitally signed
C:\WINXP\system32\Drivers\volsnap.sys => File is digitally signed

==================== End Of Log ============================
         

--- --- ---

--- --- ---

ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte SecurityCheck und:

• Speichere es auf dem Desktop.
• Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
• Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

ESET

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7587
# api_version=3.0.2
# EOSSerial=feae9d3f7ed0dc488b0b8879794dcbc4
# engine=18783
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-06-19 12:44:42
# local_time=2014-06-19 05:14:42 (+0430, Afghanistan Normalzeit)
# country="Germany"
# lang=1031
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode_1='AntiVir Desktop'
# compatibility_mode=1797 16775165 100 94 70841067 177900616 70829447 0
# scanned=234452
# found=33
# cleaned=0
# scan_time=11890
sh=EE9C25446C6F9AFB73C09D8C55ACC017D2562C27 ft=0 fh=0000000000000000 vn="JS/SecurityDisabler.A.Gen evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Backup\C\Dokumente und Einstellungen\Alexander\Anwendungsdaten\Mozilla\Firefox\Profiles\0qgqdyu2.default\prefs_19_06_2014_14_46_16.js"
sh=C5DB8386C3A901DD6D4FB8B66685B889FA1099F9 ft=0 fh=0000000000000000 vn="JS/SecurityDisabler.A.Gen evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Dokumente und Einstellungen\Alexander\Anwendungsdaten\Mozilla\Firefox\Profiles\0qgqdyu2.default\user.js.vir"
sh=519A8691D28EB09172F5342CE60A92741C3988E9 ft=1 fh=0b74d7c2c83300bb vn="Variante von Win32/SpeedingUpMyPC Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Programme\Optimizer Pro\OptimizerPro.exe.vir"
sh=8E104BA4F55265AAD3D63BC8A8364E02FE037429 ft=1 fh=cdd052684d4c9bcf vn="Variante von Win32/SProtector.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Programme\Optimizer Pro\OptProCrash.dll.vir"
sh=933483E050FDABCAAD9DDC84EBDF04B2D199FDDF ft=1 fh=59f06a39375ae8f1 vn="Variante von Win32/SProtector.F evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Programme\Optimizer Pro\OptProCrashSvc.dll.vir"
sh=F6B4EBA433A08E784F21798F4942A4DFE0CABEBC ft=1 fh=d64082093cf98dd6 vn="Variante von Win32/AdWare.SpeedingUpMyPC.D Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Programme\Optimizer Pro\OptProLauncher.exe.vir"
sh=A3ABA0F8882DB45E47F801D1ABF70918B80C6F11 ft=1 fh=d558369f8c59f0c4 vn="Variante von Win32/Adware.SpeedingUpMyPC.C Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Programme\Optimizer Pro\OptProSmartScan.exe.vir"
sh=19EB43549BB028C46AD2D93480BBAFABA73F1200 ft=0 fh=0000000000000000 vn="JS/SecurityDisabler.A.Gen evtl. unerwünschte Anwendung" ac=I fn="C:\Dokumente und Einstellungen\Alexander\Anwendungsdaten\Mozilla\Firefox\Profiles\0qgqdyu2.default\prefs.js"
sh=6D45E5BA52B6BC5027A12229A7EE8C8E8F80B79E ft=0 fh=0000000000000000 vn="JS/SecurityDisabler.A.Gen evtl. unerwünschte Anwendung" ac=I fn="C:\Dokumente und Einstellungen\Alexander\Anwendungsdaten\Mozilla\Firefox\Profiles\0qgqdyu2.default\prefs.js.BAK"
sh=E5A3C100D2D0FD94482783AF2B2FF94CDFC9923F ft=1 fh=a0ddd0619a504a2e vn="Variante von Win32/Hao123.A evtl. unerwünschte Anwendung" ac=I fn="C:\Programme\FreeTime\FormatFactory\FFModules\Package\BaiDu\hao123inst.exe"
sh=1B2E938EAEA27B990355B6C3DB6C1C1A9F33BFB4 ft=1 fh=c71c0011ddfe20fa vn="Variante von Win32/Toolbar.Montiera.A evtl. unerwünschte Anwendung" ac=I fn="C:\Sandbox\Alexander\DefaultBox\drive\C\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarApp.dll"
sh=7A18C5B083B2038CB2DE877694085DF633F40C46 ft=1 fh=c71c0011b1f6426d vn="Win32/Toolbar.Babylon evtl. unerwünschte Anwendung" ac=I fn="C:\Sandbox\Alexander\DefaultBox\drive\C\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarEng.dll"
sh=AC056A6D25E04155BA23BF34670C3E6D2A85B248 ft=1 fh=c71c0011bbd638b2 vn="Variante von Win32/Toolbar.Montiera.A evtl. unerwünschte Anwendung" ac=I fn="C:\Sandbox\Alexander\DefaultBox\drive\C\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarsrv.exe"
sh=C02A094933FD68AE44EAE0EA249EB6A981353C91 ft=1 fh=1cff81f31528b9a9 vn="Win32/Toolbar.Babylon evtl. unerwünschte Anwendung" ac=I fn="C:\Sandbox\Alexander\DefaultBox\drive\C\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll"
sh=9E60FE40C5BA463780413D5D22446858015EFF4B ft=1 fh=b2e9a257c367f009 vn="Win32/Toolbar.Babylon evtl. unerwünschte Anwendung" ac=I fn="C:\Sandbox\Alexander\DefaultBox\drive\C\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll"
sh=CBFDF3A614F5543094F0CB47DF7ECA3EF3EEF436 ft=0 fh=0000000000000000 vn="JS/SecurityDisabler.A.Gen evtl. unerwünschte Anwendung" ac=I fn="C:\Sandbox\Alexander\DefaultBox\user\current\Anwendungsdaten\Mozilla\Firefox\Profiles\0qgqdyu2.default\user.js"
sh=43A205985790C47A7E611FA2D3CAB9B4EB59121F ft=1 fh=5bd497922ffc5928 vn="Variante von Win32/Toolbar.Babylon.F evtl. unerwünschte Anwendung" ac=I fn="C:\Sandbox\Alexander\DefaultBox\user\current\Lokale Einstellungen\Anwendungsdaten\Babylon\Setup\BExternal.dll"
sh=69FDC602A51E52C603F23A80E9B087C262DCE940 ft=1 fh=cab0049ca6613a48 vn="Variante von Win32/Toolbar.Babylon.E evtl. unerwünschte Anwendung" ac=I fn="C:\Sandbox\Alexander\DefaultBox\user\current\Lokale Einstellungen\Anwendungsdaten\Babylon\Setup\IECookieLow.dll"
sh=3A9D7D4639B5EB8BEC42DF972C44493690EAADFC ft=1 fh=b8a59cf28e1dc165 vn="Variante von Win32/Toolbar.Babylon.H evtl. unerwünschte Anwendung" ac=I fn="C:\Sandbox\Alexander\DefaultBox\user\current\Lokale Einstellungen\Anwendungsdaten\Babylon\Setup\Setup.exe"
sh=3A9D7D4639B5EB8BEC42DF972C44493690EAADFC ft=1 fh=b8a59cf28e1dc165 vn="Variante von Win32/Toolbar.Babylon.H evtl. unerwünschte Anwendung" ac=I fn="C:\Sandbox\Alexander\DefaultBox\user\current\Lokale Einstellungen\Temp\679F4909-BAB0-7891-83E4-88EF3AB2B5F9\Setup.exe"
sh=027DF2D2944EA506A71D61928674C2CC42A8FE69 ft=1 fh=4c97c45eed1dce37 vn="Win32/Toolbar.Babylon evtl. unerwünschte Anwendung" ac=I fn="C:\Sandbox\Alexander\DefaultBox\user\current\Lokale Einstellungen\Temp\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbar4ie.exe"
sh=519A8691D28EB09172F5342CE60A92741C3988E9 ft=1 fh=0b74d7c2c83300bb vn="Variante von Win32/SpeedingUpMyPC Anwendung" ac=I fn="C:\System Volume Information\_restore{AAB4F754-CCF5-43E0-BF09-003EDA1EEE13}\RP597\A0063977.exe"
sh=8E104BA4F55265AAD3D63BC8A8364E02FE037429 ft=1 fh=cdd052684d4c9bcf vn="Variante von Win32/SProtector.I evtl. unerwünschte Anwendung" ac=I fn="C:\System Volume Information\_restore{AAB4F754-CCF5-43E0-BF09-003EDA1EEE13}\RP597\A0063978.dll"
sh=933483E050FDABCAAD9DDC84EBDF04B2D199FDDF ft=1 fh=59f06a39375ae8f1 vn="Variante von Win32/SProtector.F evtl. unerwünschte Anwendung" ac=I fn="C:\System Volume Information\_restore{AAB4F754-CCF5-43E0-BF09-003EDA1EEE13}\RP597\A0063979.dll"
sh=F6B4EBA433A08E784F21798F4942A4DFE0CABEBC ft=1 fh=d64082093cf98dd6 vn="Variante von Win32/AdWare.SpeedingUpMyPC.D Anwendung" ac=I fn="C:\System Volume Information\_restore{AAB4F754-CCF5-43E0-BF09-003EDA1EEE13}\RP597\A0063982.exe"
sh=A3ABA0F8882DB45E47F801D1ABF70918B80C6F11 ft=1 fh=d558369f8c59f0c4 vn="Variante von Win32/Adware.SpeedingUpMyPC.C Anwendung" ac=I fn="C:\System Volume Information\_restore{AAB4F754-CCF5-43E0-BF09-003EDA1EEE13}\RP597\A0063985.exe"
sh=0DE3FAF0A6A677BAE22C3FDA06E8FF7A55273534 ft=0 fh=0000000000000000 vn="JS/SecurityDisabler.A.Gen evtl. unerwünschte Anwendung" ac=I fn="C:\zoek_backup\C_Dokumente und Einstellungen_ALEXAN~1_Anwendungsdaten_Mozilla_Firefox_Profiles_0qgqdyu2.default_prefs__1526_.backup.vir"
sh=A1D40C1D8141C73CBB70C001C43AAE122A263EF7 ft=1 fh=8b0bf2dab680cac3 vn="Variante von Win32/InstallCore.D evtl. unerwünschte Anwendung" ac=I fn="D:\cnet_pwhe6_exe.exe"
sh=D86D2FC37B1FED635CAF6F25254D7A575466ED1E ft=1 fh=7614c1446a9b863f vn="Variante von Win32/Hao123.A evtl. unerwünschte Anwendung" ac=I fn="D:\FFSetup3.3.4.0.exe"
sh=D456BDA9D3F012C0DF4DE922E8D8716E5DBA1C85 ft=1 fh=b5b71a15df625315 vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="D:\FreeVideoDub.exe"
sh=EAE2784C9115FE9CFA44A116B74E72C1BCCFA7F6 ft=1 fh=2e79e77116fe19c4 vn="Win32/DownWare.L evtl. unerwünschte Anwendung" ac=I fn="D:\MyPhoneExplorer_1.8.5.exe"
sh=F334DC1C90D9EEC96CFEE9AC45CD789612D11343 ft=1 fh=24d5b0283199622f vn="Win32/SoftonicDownloader.A evtl. unerwünschte Anwendung" ac=I fn="D:\SoftonicDownloader39076.exe"
sh=885431C308AE25B5D346DD6C6FC48368FBAE007F ft=1 fh=b396c386f88064dc vn="Win32/SoftonicDownloader.A evtl. unerwünschte Anwendung" ac=I fn="D:\SoftonicDownloader_fuer_deutsches-sprachpaket-fur-photofiltre.exe"
ESETSmartInstaller@High as downloader log:
all ok
esets_scanner_update returned -1 esets_gle=1
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=feae9d3f7ed0dc488b0b8879794dcbc4
# engine=22782
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-03-06 10:25:23
# local_time=2015-03-06 02:55:23 (+0430, Afghanistan Normalzeit)
# country="Germany"
# lang=1031
# osver=5.1.2600 NT Service Pack 3
# scanned=220811
# found=25
# cleaned=25
# scan_time=7089
sh=9A633D558E433D2044964C67F1965C0969222357 ft=1 fh=be4168e8927294fe vn="MSIL/AdvancedSystemProtector.D evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Programme\RegClean Pro\systweakasp.exe.vir"
sh=7335AC6479C60C0CA52DB18043CCB49891639B08 ft=0 fh=0000000000000000 vn="JS/SecurityDisabler.A.Gen evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Dokumente und Einstellungen\Alexander\Anwendungsdaten\Mozilla\Firefox\Profiles\0qgqdyu2.default\prefs.js"
sh=66928D578C44219D2E6267F80B9394EBD2CCED37 ft=0 fh=0000000000000000 vn="JS/SecurityDisabler.A.Gen evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Dokumente und Einstellungen\Alexander\Anwendungsdaten\Mozilla\Firefox\Profiles\0qgqdyu2.default\prefs.js.BAK"
sh=1B2E938EAEA27B990355B6C3DB6C1C1A9F33BFB4 ft=1 fh=c71c0011ddfe20fa vn="Variante von Win32/Toolbar.Montiera.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Sandbox\Alexander\DefaultBox\drive\C\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarApp.dll"
sh=7A18C5B083B2038CB2DE877694085DF633F40C46 ft=1 fh=c71c0011b1f6426d vn="Win32/Toolbar.Babylon evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Sandbox\Alexander\DefaultBox\drive\C\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarEng.dll"
sh=AC056A6D25E04155BA23BF34670C3E6D2A85B248 ft=1 fh=c71c0011bbd638b2 vn="Variante von Win32/Toolbar.Babylon.AA evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Sandbox\Alexander\DefaultBox\drive\C\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarsrv.exe"
sh=C02A094933FD68AE44EAE0EA249EB6A981353C91 ft=1 fh=1cff81f31528b9a9 vn="Win32/Toolbar.Babylon evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Sandbox\Alexander\DefaultBox\drive\C\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll"
sh=9E60FE40C5BA463780413D5D22446858015EFF4B ft=1 fh=b2e9a257c367f009 vn="Win32/Toolbar.Babylon evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Sandbox\Alexander\DefaultBox\drive\C\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll"
sh=48418FBFEF40F234E6B508403FF4237DABFECA40 ft=1 fh=a6613b57b8c7e341 vn="Win32/Systweak.O evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Sandbox\Alexander\DefaultBox\drive\C\Programme\RegClean Pro\CleanSchedule.exe"
sh=0E88CF03E7770CC7DCB56F0381D93A2896367786 ft=1 fh=d609ebf9480273df vn="Variante von Win32/Systweak.P evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Sandbox\Alexander\DefaultBox\drive\C\Programme\RegClean Pro\RCPUninstall.exe"
sh=923019F5FEC65F32D6498EE6E5EBD9B5F3DC08EA ft=1 fh=8b51e8f8162ec5ee vn="Variante von Win32/Systweak evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Sandbox\Alexander\DefaultBox\drive\C\Programme\RegClean Pro\RegCleanPro.exe"
sh=18CA82077ED59437F950B970AAF0F93940FC9823 ft=1 fh=03ec528918889643 vn="Variante von Win32/Systweak.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Sandbox\Alexander\DefaultBox\drive\C\WINXP\system32\roboot.exe"
sh=CBFDF3A614F5543094F0CB47DF7ECA3EF3EEF436 ft=0 fh=0000000000000000 vn="JS/SecurityDisabler.A.Gen evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Sandbox\Alexander\DefaultBox\user\current\Anwendungsdaten\Mozilla\Firefox\Profiles\0qgqdyu2.default\user.js"
sh=43A205985790C47A7E611FA2D3CAB9B4EB59121F ft=1 fh=5bd497922ffc5928 vn="Variante von Win32/Toolbar.Babylon.F evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Sandbox\Alexander\DefaultBox\user\current\Lokale Einstellungen\Anwendungsdaten\Babylon\Setup\BExternal.dll"
sh=69FDC602A51E52C603F23A80E9B087C262DCE940 ft=1 fh=cab0049ca6613a48 vn="Variante von Win32/Toolbar.Babylon.E evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Sandbox\Alexander\DefaultBox\user\current\Lokale Einstellungen\Anwendungsdaten\Babylon\Setup\IECookieLow.dll"
sh=3A9D7D4639B5EB8BEC42DF972C44493690EAADFC ft=1 fh=b8a59cf28e1dc165 vn="Variante von Win32/Toolbar.Babylon.E evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Sandbox\Alexander\DefaultBox\user\current\Lokale Einstellungen\Anwendungsdaten\Babylon\Setup\Setup.exe"
sh=3A9D7D4639B5EB8BEC42DF972C44493690EAADFC ft=1 fh=b8a59cf28e1dc165 vn="Variante von Win32/Toolbar.Babylon.E evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Sandbox\Alexander\DefaultBox\user\current\Lokale Einstellungen\Temp\679F4909-BAB0-7891-83E4-88EF3AB2B5F9\Setup.exe"
sh=027DF2D2944EA506A71D61928674C2CC42A8FE69 ft=1 fh=4c97c45eed1dce37 vn="Win32/Toolbar.Babylon evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Sandbox\Alexander\DefaultBox\user\current\Lokale Einstellungen\Temp\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbar4ie.exe"
sh=E5A3C100D2D0FD94482783AF2B2FF94CDFC9923F ft=1 fh=a0ddd0619a504a2e vn="Variante von Win32/Hao123.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\System Volume Information\_restore{AAB4F754-CCF5-43E0-BF09-003EDA1EEE13}\RP648\A0069100.exe"
sh=05A2E943969BE29318675E105EE1605CC2B7FE50 ft=1 fh=28e73ed5b32e7ff9 vn="Variante von Win32/Systweak.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\System Volume Information\_restore{AAB4F754-CCF5-43E0-BF09-003EDA1EEE13}\RP659\A0071476.exe"
sh=D86D2FC37B1FED635CAF6F25254D7A575466ED1E ft=1 fh=7614c1446a9b863f vn="Variante von Win32/Hao123.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="D:\FFSetup3.3.4.0.exe"
sh=D456BDA9D3F012C0DF4DE922E8D8716E5DBA1C85 ft=1 fh=b5b71a15df625315 vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="D:\FreeVideoDub.exe"
sh=EAE2784C9115FE9CFA44A116B74E72C1BCCFA7F6 ft=1 fh=2e79e77116fe19c4 vn="Win32/DownWare.L evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="D:\MyPhoneExplorer_1.8.5.exe"
sh=F334DC1C90D9EEC96CFEE9AC45CD789612D11343 ft=1 fh=24d5b0283199622f vn="Win32/SoftonicDownloader.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="D:\SoftonicDownloader39076.exe"
sh=885431C308AE25B5D346DD6C6FC48368FBAE007F ft=1 fh=b396c386f88064dc vn="Win32/SoftonicDownloader.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="D:\SoftonicDownloader_fuer_deutsches-sprachpaket-fur-photofiltre.exe"
         

Bei Security check kommt

"UNSUPPORTED OPERATING SYSTEM! ABORTED!"

in der txt-datei.


FRST-log


FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 04-03-2015
Ran by Alexander (administrator) on ALEX on 06-03-2015 15:05:38
Running from C:\Dokumente und Einstellungen\Alexander\Desktop
Loaded Profiles: Alexander &  (Available profiles: Alexander)
Platform: Microsoft Windows XP Professional Service Pack 3 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 7 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\WINXP\system32\smss.exe
(Microsoft Corporation) C:\WINXP\system32\csrss.exe
(Microsoft Corporation) C:\WINXP\system32\winlogon.exe
(Microsoft Corporation) C:\WINXP\system32\services.exe
(Microsoft Corporation) C:\WINXP\system32\lsass.exe
(Microsoft Corporation) C:\WINXP\system32\svchost.exe
(Microsoft Corporation) C:\WINXP\system32\svchost.exe
(Microsoft Corporation) C:\WINXP\system32\svchost.exe
(Microsoft Corporation) C:\WINXP\system32\svchost.exe
(Microsoft Corporation) C:\WINXP\system32\svchost.exe
(Microsoft Corporation) C:\WINXP\system32\svchost.exe
(Microsoft Corporation) C:\WINXP\system32\spoolsv.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\sched.exe
(Microsoft Corporation) D:\Programme\Microsoft Office\Office12\GrooveMonitor.exe
(shbox.de) C:\Programme\FreePDF_XP\fpassist.exe
(CANON INC.) C:\Programme\Canon\MyPrinter\BJMYPRT.EXE
(Motorola Inc.) C:\WINXP\sm56hlpr.exe
(Oracle Corporation) C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Programme\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\WINXP\system32\svchost.exe
(Palm) C:\Programme\Palm, Inc\novacomd\x86\novacomd.exe
(NVIDIA Corporation) C:\WINXP\system32\nvsvc32.exe
(Microsoft Corporation) C:\WINXP\system32\svchost.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corporation) C:\WINXP\system32\wbem\wmiprvse.exe
(Microsoft Corporation) C:\WINXP\system32\wbem\unsecapp.exe
(Microsoft Corporation) C:\WINXP\system32\wuauclt.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\WINXP\system32\wscntfy.exe
(Microsoft Corporation) C:\WINXP\system32\alg.exe
(Microsoft Corporation) C:\WINXP\system32\svchost.exe
(Microsoft Corporation) C:\WINXP\explorer.exe
(Mozilla Corporation) D:\Firefox\firefox.exe
(Microsoft Corporation) C:\WINXP\system32\dllhost.exe
(Microsoft Corporation) C:\WINXP\system32\msdtc.exe
(Google Inc.) C:\Programme\Google\Update\GoogleUpdate.exe
(Microsoft Corporation) C:\WINXP\system32\wbem\wmiprvse.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [GrooveMonitor] => D:\Programme\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-27] (Microsoft Corporation)
HKLM\...\Run: [NvCplDaemon] => RUNDLL32.EXE C:\WINXP\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [nwiz] => nwiz.exe /install
HKLM\...\Run: [BluetoothAuthenticationAgent] => rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
HKLM\...\Run: [FreePDF Assistant] => C:\Programme\FreePDF_XP\fpassist.exe [385024 2009-09-05] (shbox.de)
HKLM\...\Run: [CanonMyPrinter] => C:\Programme\Canon\MyPrinter\BJMyPrt.exe [2516296 2010-03-25] (CANON INC.)
HKLM\...\Run: [CanonSolutionMenuEx] => C:\Programme\Canon\Solution Menu EX\CNSEMAIN.EXE [1185112 2010-04-02] (CANON INC.)
HKLM\...\Run: [QuickTime Task] => C:\Programme\QuickTime\QTTask.exe [421888 2012-04-18] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Programme\iTunes\iTunesHelper.exe [152392 2013-02-20] (Apple Inc.)
HKLM\...\Run: [SMSERIAL] => C:\WINXP\sm56hlpr.exe [557056 2005-09-16] (Motorola Inc.)
HKLM\...\Run: [Adobe ARM] => C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe [959904 2014-05-08] (Adobe Systems Incorporated)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation)
HKLM\...\Run: [avgnt] => C:\Programme\Avira\AntiVir Desktop\avgnt.exe [703280 2015-03-03] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [Avira Systray] => C:\Programme\Avira\My Avira\Avira.OE.Systray.exe [127792 2015-02-12] (Avira Operations GmbH & Co. KG)
HKLM\...\Winlogon: [Userinit] C:\WINXP\System32\Userinit.exe,
HKLM\...\Winlogon: [Shell] explorer.exe [x ] ()
HKLM\...\Winlogon: [UIHost] C:\WINXP\system32\logonui.exe [515072 2008-04-14] (Microsoft Corporation)
Winlogon\Notify\crypt32chain: C:\WINXP\system32\crypt32.dll (Microsoft Corporation)
Winlogon\Notify\cryptnet: C:\WINXP\system32\cryptnet.dll (Microsoft Corporation)
Winlogon\Notify\cscdll: C:\WINXP\system32\cscdll.dll (Microsoft Corporation)
Winlogon\Notify\dimsntfy: C:\WINXP\System32\dimsntfy.dll (Microsoft Corporation)
Winlogon\Notify\ScCertProp: C:\WINXP\system32\wlnotify.dll (Microsoft Corporation)
Winlogon\Notify\Schedule: C:\WINXP\system32\wlnotify.dll (Microsoft Corporation)
Winlogon\Notify\sclgntfy: C:\WINXP\system32\sclgntfy.dll (Microsoft Corporation)
Winlogon\Notify\SensLogn: C:\WINXP\system32\WlNotify.dll (Microsoft Corporation)
Winlogon\Notify\termsrv: C:\WINXP\system32\wlnotify.dll (Microsoft Corporation)
Winlogon\Notify\WgaLogon: C:\WINXP\system32\WgaLogon.dll (Microsoft Corporation)
Winlogon\Notify\wlballoon: C:\WINXP\system32\wlnotify.dll (Microsoft Corporation)
HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [CTFMON.EXE] => C:\WINXP\system32\CTFMON.EXE [15360 2008-04-14] (Microsoft Corporation)
HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINXP\system32\logon.scr [220672 2008-04-14] (Microsoft Corporation)
HKU\S-1-5-19\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINXP\System32\logon.scr [220672 2008-04-14] (Microsoft Corporation)
HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINXP\System32\logon.scr [220672 2008-04-14] (Microsoft Corporation)
HKU\S-1-5-20\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINXP\System32\logon.scr [220672 2008-04-14] (Microsoft Corporation)
HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINXP\System32\logon.scr [220672 2008-04-14] (Microsoft Corporation)
HKU\S-1-5-21-1935655697-1229272821-1417001333-1003\...\Run: [DAEMON Tools Lite] => D:\DAEMON Tools Lite\DTLite.exe [3672384 2012-04-11] (DT Soft Ltd)
HKU\S-1-5-21-1935655697-1229272821-1417001333-1003\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINXP\system32\logon.scr [220672 2008-04-14] (Microsoft Corporation)
HKU\S-1-5-21-1935655697-1229272821-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [DAEMON Tools Lite] => D:\DAEMON Tools Lite\DTLite.exe [3672384 2012-04-11] (DT Soft Ltd)
HKU\S-1-5-21-1935655697-1229272821-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINXP\system32\logon.scr [220672 2008-04-14] (Microsoft Corporation)
HKU\S-1-5-18\...\Run: [CTFMON.EXE] => C:\WINXP\system32\CTFMON.EXE [15360 2008-04-14] (Microsoft Corporation)
HKU\S-1-5-18\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINXP\system32\logon.scr [220672 2008-04-14] (Microsoft Corporation)
SSODL: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\WINXP\system32\CbFsMntNtf3.dll (EldoS Corporation)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Dokumente und Einstellungen\Alexander\Anwendungsdaten\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Dokumente und Einstellungen\Alexander\Anwendungsdaten\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Dokumente und Einstellungen\Alexander\Anwendungsdaten\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Dokumente und Einstellungen\Alexander\Anwendungsdaten\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [EldosIconOverlay] -> {5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC} => C:\WINXP\system32\CbFsMntNtf3.dll (EldoS Corporation)
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 1 (GFS Unread Stub)] -> {99FD978C-D287-4F50-827F-B2C658EDA8E7} => D:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 2 (GFS Stub)] -> {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} => D:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)] -> {920E6DB1-9907-4370-B3A0-BAFC03D81399} => D:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 3 (GFS Folder)] -> {16F3DD56-1AF5-4347-846D-7C10C4192619} => D:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 4 (GFS Unread Mark)] -> {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} => D:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-1935655697-1229272821-1417001333-1003\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-1935655697-1229272821-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1935655697-1229272821-1417001333-1003\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINXP\system32\blank.htm
HKU\S-1-5-21-1935655697-1229272821-1417001333-1003\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-1935655697-1229272821-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINXP\system32\blank.htm
HKU\S-1-5-21-1935655697-1229272821-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs,Tabs: "www.google.com" <======= ATTENTION
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-1935655697-1229272821-1417001333-1003 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
SearchScopes: HKU\S-1-5-21-1935655697-1229272821-1417001333-1003 -> {853106B3-C3EB-414B-B7BE-77F3506B532A} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-1935655697-1229272821-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
SearchScopes: HKU\S-1-5-21-1935655697-1229272821-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {853106B3-C3EB-414B-B7BE-77F3506B532A} URL = hxxp://www.google.de/search?q={searchTerms}
BHO: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Programme\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> D:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Programme\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Programme\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Programme\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Toolbar: HKU\S-1-5-21-1935655697-1229272821-1417001333-1003 -> Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Programme\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Toolbar: HKU\S-1-5-21-1935655697-1229272821-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Programme\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Handler: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINXP\system32\urlmon.dll (Microsoft Corporation)
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Handler: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
Handler: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: vw-wi - {0F3C833F-FB28-40EA-8CB9-6A55B996C3F6} - g:\elsawin\installation\bin\wiProt.dll No File
Handler: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINXP\system32\wiascr.dll (Microsoft Corporation)
Filter: text/webviewhtml - {733AC4CB-F1A4-11d0-B951-00A0C90312E1} - C:\WINXP\system32\SHELL32.dll (Microsoft Corporation)
ShellExecuteHooks:  - {AEB6717E-7E19-11d0-97EE-00C04FD91972} -  No File [ ]
Winsock: Catalog5 01 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog5 02 C:\WINXP\system32\winrnr.dll [16896] (Microsoft Corporation)
Winsock: Catalog5 03 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog5 04 C:\Programme\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Winsock: Catalog5 05 C:\WINXP\system32\wshbth.dll [108032] (Microsoft Corporation)
Winsock: Catalog9 01 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 02 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 03 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 04 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 05 C:\WINXP\system32\rsvpsp.dll [92672] (Microsoft Corporation)
Winsock: Catalog9 06 C:\WINXP\system32\rsvpsp.dll [92672] (Microsoft Corporation)
Winsock: Catalog9 07 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 08 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 09 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 10 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 11 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 12 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 13 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 14 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 15 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 16 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 17 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 18 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 19 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 20 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 21 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 22 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 23 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 24 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 25 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 26 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 27 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 28 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 29 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 30 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 31 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 32 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 33 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Winsock: Catalog9 34 C:\WINXP\system32\mswsock.dll [247296] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Dokumente und Einstellungen\Alexander\Anwendungsdaten\Mozilla\Firefox\Profiles\0qgqdyu2.default
FF Plugin: @adobe.com/FlashPlayer -> C:\WINXP\system32\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Programme\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 -> C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll No File
FF Plugin: @java.com/DTPlugin,version=11.25.2 -> C:\Programme\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.25.2 -> C:\Programme\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Programme\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\WINXP\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @pages.tvunetworks.com/WebPlayer -> C:\WINXP\system32\TVUAx\npTVUAx.dll (TVU networks)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Programme\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Programme\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @veetle.com/veetleCorePlugin,version=0.9.18 -> C:\Programme\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF Plugin: @veetle.com/veetlePlayerPlugin,version=0.9.18 -> C:\Programme\Veetle\Player\npvlc.dll (Veetle Inc)
FF Plugin: Adobe Reader -> C:\Programme\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1935655697-1229272821-1417001333-1003: @unity3d.com/UnityPlayer,version=1.0 -> C:\Dokumente und Einstellungen\Alexander\Lokale Einstellungen\Anwendungsdaten\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKU\S-1-5-21-1935655697-1229272821-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0: @unity3d.com/UnityPlayer,version=1.0 -> C:\Dokumente und Einstellungen\Alexander\Lokale Einstellungen\Anwendungsdaten\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Extension: Avira Browser Safety - C:\Dokumente und Einstellungen\Alexander\Anwendungsdaten\Mozilla\Firefox\Profiles\0qgqdyu2.default\Extensions\abs@avira.com [2015-03-02]
FF Extension: TVU Web Player - C:\Dokumente und Einstellungen\Alexander\Anwendungsdaten\Mozilla\Firefox\Profiles\0qgqdyu2.default\Extensions\firefox@tvunetworks.com [2010-12-07]
FF Extension: Tab Utilities - C:\Dokumente und Einstellungen\Alexander\Anwendungsdaten\Mozilla\Firefox\Profiles\0qgqdyu2.default\Extensions\tabutils@ithinc.cn.xpi [2013-01-08]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\WINXP\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\WINXP\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2010-10-15]
StartMenuInternet: FIREFOX.EXE - D:\Firefox\firefox.exe

Chrome: 
=======
CHR Profile: C:\Dokumente und Einstellungen\Alexander\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Dokumente und Einstellungen\Alexander\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-06-25]
CHR Extension: (Google Drive) - C:\Dokumente und Einstellungen\Alexander\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-06-25]
CHR Extension: (YouTube) - C:\Dokumente und Einstellungen\Alexander\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-04-17]
CHR Extension: (Google Search) - C:\Dokumente und Einstellungen\Alexander\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-04-17]
CHR Extension: (Google Wallet) - C:\Dokumente und Einstellungen\Alexander\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-10-05]
CHR Extension: (Gmail) - C:\Dokumente und Einstellungen\Alexander\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-04-17]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S4 Alerter; C:\WINXP\system32\alrsvc.dll [17408 2008-04-14] (Microsoft Corporation)
R3 ALG; C:\WINXP\System32\alg.exe [44544 2008-04-14] (Microsoft Corporation)
R2 AntiVirSchedulerService; C:\Programme\Avira\AntiVir Desktop\sched.exe [432888 2015-03-03] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Programme\Avira\AntiVir Desktop\avguard.exe [432888 2015-03-03] (Avira Operations GmbH & Co. KG)
S3 AppMgmt; C:\WINXP\System32\appmgmts.dll [175616 2008-04-14] (Microsoft Corporation)
S3 aspnet_state; C:\WINXP\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [35160 2010-03-18] (Microsoft Corporation)
R2 AudioSrv; C:\WINXP\System32\audiosrv.dll [42496 2008-04-14] (Microsoft Corporation)
R2 Avira.OE.ServiceHost; C:\Programme\Avira\My Avira\Avira.OE.ServiceHost.exe [184056 2015-02-12] (Avira Operations GmbH & Co. KG)
S3 BITS; C:\WINXP\system32\qmgr.dll [409088 2008-04-14] (Microsoft Corporation)
R2 Bonjour Service; C:\Programme\Bonjour\mDNSResponder.exe [390504 2011-08-30] (Apple Inc.)
R2 Browser; C:\WINXP\System32\browser.dll [77824 2008-04-14] (Microsoft Corporation)
R2 BthServ; C:\WINXP\System32\bthserv.dll [30208 2008-04-14] (Microsoft Corporation)
S3 CiSvc; C:\WINXP\system32\cisvc.exe [5632 2008-04-14] (Microsoft Corporation)
S3 ClipSrv; C:\WINXP\system32\clipsrv.exe [33280 2008-04-14] (Microsoft Corporation)
S4 clr_optimization_v2.0.50727_32; C:\WINXP\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [69632 2008-07-25] (Microsoft Corporation)
S2 clr_optimization_v4.0.30319_32; C:\WINXP\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [130384 2010-03-18] (Microsoft Corporation)
R2 CryptSvc; C:\WINXP\System32\cryptsvc.dll [62464 2008-04-14] (Microsoft Corporation)
R2 DcomLaunch; C:\WINXP\system32\rpcss.dll [399360 2008-04-14] (Microsoft Corporation)
R2 Dhcp; C:\WINXP\System32\dhcpcsvc.dll [127488 2008-04-14] (Microsoft Corporation)
S3 dmadmin; C:\WINXP\System32\dmadmin.exe [225280 2008-04-14] (Microsoft Corp., Veritas Software)
R2 dmserver; C:\WINXP\System32\dmserver.dll [24064 2008-04-14] (Microsoft Corp.)
R2 Dnscache; C:\WINXP\System32\dnsrslvr.dll [45568 2008-04-14] (Microsoft Corporation)
S3 Dot3svc; C:\WINXP\System32\dot3svc.dll [133120 2008-04-14] (Microsoft Corporation)
S3 EapHost; C:\WINXP\System32\eapsvc.dll [33792 2008-04-14] (Microsoft Corporation)
R2 ERSvc; C:\WINXP\System32\ersvc.dll [23040 2008-04-14] (Microsoft Corporation)
R2 Eventlog; C:\WINXP\system32\services.exe [109056 2008-04-14] (Microsoft Corporation)
R3 EventSystem; C:\WINXP\system32\es.dll [253952 2008-12-10] (Microsoft Corporation)
R3 FastUserSwitchingCompatibility; C:\WINXP\System32\shsvcs.dll [135168 2008-04-14] (Microsoft Corporation)
S3 FontCache3.0.0.0; C:\WINXP\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [46104 2008-07-29] (Microsoft Corporation)
S2 gupdate; C:\Programme\Google\Update\GoogleUpdate.exe [116648 2013-04-17] (Google Inc.)
S3 gupdatem; C:\Programme\Google\Update\GoogleUpdate.exe [116648 2013-04-17] (Google Inc.)
R2 helpsvc; C:\WINXP\PCHealth\HelpCtr\Binaries\pchsvc.dll [38400 2008-04-14] (Microsoft Corporation)
R2 HidServ; C:\WINXP\System32\hidserv.dll [21504 2008-04-14] (Microsoft Corporation)
S3 hkmsvc; C:\WINXP\System32\kmsvc.dll [61440 2008-04-14] (Microsoft Corporation)
R3 HTTPFilter; C:\WINXP\System32\w3ssl.dll [15872 2008-04-14] (Microsoft Corporation)
S3 idsvc; C:\WINXP\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [881664 2008-07-29] (Microsoft Corporation)
S3 ImapiService; C:\WINXP\system32\imapi.exe [150528 2008-04-14] (Microsoft Corporation)
S3 iPod Service; C:\Programme\iPod\bin\iPodService.exe [553288 2013-02-20] (Apple Inc.)
R2 LanmanServer; C:\WINXP\System32\srvsvc.dll [96768 2008-04-14] (Microsoft Corporation)
R2 lanmanworkstation; C:\WINXP\System32\wkssvc.dll [132096 2008-04-14] (Microsoft Corporation)
R2 LmHosts; C:\WINXP\System32\lmhsvc.dll [13824 2008-04-14] (Microsoft Corporation)
S2 MBAMScheduler; C:\Programme\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
S2 MBAMService; C:\Programme\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
S4 Messenger; C:\WINXP\System32\msgsvc.dll [33792 2008-04-14] (Microsoft Corporation)
S3 Microsoft Office Groove Audit Service; D:\Programme\Microsoft Office\Office12\GrooveAuditService.exe [65824 2006-10-27] (Microsoft Corporation)
S3 mnmsrvc; C:\WINXP\system32\mnmsrvc.exe [32768 2008-04-14] (Microsoft Corporation)
S3 MozillaMaintenance; C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe [119408 2014-06-24] (Mozilla Foundation)
R3 MSDTC; C:\WINXP\system32\msdtc.exe [6144 2008-04-14] (Microsoft Corporation)
S3 MSIServer; C:\WINXP\System32\msiexec.exe [95744 2008-05-19] (Microsoft Corporation)
S3 napagent; C:\WINXP\System32\qagentrt.dll [294400 2008-04-14] (Microsoft Corporation)
S3 NBService; C:\Programme\Nero\Nero 7\Nero BackItUp\NBService.exe [800040 2007-11-28] (Nero AG)
S2 Net Driver HPZ12; C:\WINXP\system32\HPZinw12.dll [44032 2010-04-07] (Hewlett-Packard) [File not signed]
S4 NetDDE; C:\WINXP\system32\netdde.exe [114176 2008-04-14] (Microsoft Corporation)
S4 NetDDEdsdm; C:\WINXP\system32\netdde.exe [114176 2008-04-14] (Microsoft Corporation)
S3 Netlogon; C:\WINXP\system32\lsass.exe [13312 2008-04-14] (Microsoft Corporation)
R3 Netman; C:\WINXP\System32\netman.dll [198144 2008-04-14] (Microsoft Corporation)
S4 NetTcpPortSharing; C:\WINXP\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [124240 2010-03-18] (Microsoft Corporation)
R3 Nla; C:\WINXP\System32\mswsock.dll [247296 2008-04-14] (Microsoft Corporation)
S4 NMIndexingService; C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe [275752 2008-01-22] (Nero AG)
R2 NovacomD; C:\Programme\Palm, Inc\novacomd\x86\novacomd.exe [61440 2011-06-24] (Palm) [File not signed]
S3 NtLmSsp; C:\WINXP\system32\lsass.exe [13312 2008-04-14] (Microsoft Corporation)
S3 NtmsSvc; C:\WINXP\system32\ntmssvc.dll [438272 2008-04-14] (Microsoft Corporation)
R2 NVSvc; C:\WINXP\system32\nvsvc32.exe [168004 2009-01-30] (NVIDIA Corporation)
S3 odserv; C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE [441136 2006-10-26] (Microsoft Corporation)
S3 ose; C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE [145184 2006-10-26] (Microsoft Corporation)
R2 PlugPlay; C:\WINXP\system32\services.exe [109056 2008-04-14] (Microsoft Corporation)
S2 Pml Driver HPZ12; C:\WINXP\system32\HPZipm12.dll [53760 2010-04-07] (Hewlett-Packard) [File not signed]
R2 PolicyAgent; C:\WINXP\system32\lsass.exe [13312 2008-04-14] (Microsoft Corporation)
R2 ProtectedStorage; C:\WINXP\system32\lsass.exe [13312 2008-04-14] (Microsoft Corporation)
S3 RasAuto; C:\WINXP\System32\rasauto.dll [88576 2008-04-14] (Microsoft Corporation)
R3 RasMan; C:\WINXP\System32\rasmans.dll [186368 2008-04-14] (Microsoft Corporation)
S3 RDSessMgr; C:\WINXP\system32\sessmgr.exe [143360 2008-04-14] (Microsoft Corporation)
S4 RemoteAccess; C:\WINXP\System32\mprdim.dll [53248 2008-04-14] (Microsoft Corporation)
R2 RemoteRegistry; C:\WINXP\system32\regsvc.dll [59904 2008-04-14] (Microsoft Corporation)
S3 RpcLocator; C:\WINXP\system32\locator.exe [75264 2008-04-14] (Microsoft Corporation)
R2 RpcSs; C:\WINXP\System32\rpcss.dll [399360 2008-04-14] (Microsoft Corporation)
S3 RSVP; C:\WINXP\system32\rsvp.exe [132608 2008-04-14] (Microsoft Corporation)
R2 SamSs; C:\WINXP\system32\lsass.exe [13312 2008-04-14] (Microsoft Corporation)
S3 SCardSvr; C:\WINXP\System32\SCardSvr.exe [99840 2008-04-14] (Microsoft Corporation)
R2 Schedule; C:\WINXP\system32\schedsvc.dll [193536 2008-04-14] (Microsoft Corporation)
R2 seclogon; C:\WINXP\System32\seclogon.dll [18944 2008-04-14] (Microsoft Corporation)
R2 SENS; C:\WINXP\system32\sens.dll [39424 2008-04-14] (Microsoft Corporation)
R2 SharedAccess; C:\WINXP\System32\ipnathlp.dll [334336 2008-04-14] (Microsoft Corporation)
R2 ShellHWDetection; C:\WINXP\System32\shsvcs.dll [135168 2008-04-14] (Microsoft Corporation)
R2 Spooler; C:\WINXP\system32\spoolsv.exe [57856 2008-04-14] (Microsoft Corporation)
R2 srservice; C:\WINXP\system32\srsvc.dll [171520 2008-04-14] (Microsoft Corporation)
R3 SSDPSRV; C:\WINXP\System32\ssdpsrv.dll [71680 2008-04-14] (Microsoft Corporation)
R2 stisvc; C:\WINXP\system32\wiaservc.dll [334336 2008-04-14] (Microsoft Corporation)
S3 SysmonLog; C:\WINXP\system32\smlogsvc.exe [94208 2008-04-14] (Microsoft Corporation)
R3 TapiSrv; C:\WINXP\System32\tapisrv.dll [249856 2008-04-14] (Microsoft Corporation)
R3 TermService; C:\WINXP\System32\termsrv.dll [297472 2008-04-14] (Microsoft Corporation)
R2 Themes; C:\WINXP\System32\shsvcs.dll [135168 2008-04-14] (Microsoft Corporation)
S3 TlntSvr; C:\WINXP\system32\tlntsvr.exe [75264 2008-04-14] (Microsoft Corporation)
R2 TrkWks; C:\WINXP\system32\trkwks.dll [90112 2008-04-14] (Microsoft Corporation)
S3 upnphost; C:\WINXP\System32\upnphost.dll [186880 2008-04-14] (Microsoft Corporation)
S3 UPS; C:\WINXP\System32\ups.exe [18432 2008-04-14] (Microsoft Corporation)
S3 VSS; C:\WINXP\System32\vssvc.exe [292864 2008-04-14] (Microsoft Corporation)
R2 W32Time; C:\WINXP\system32\w32time.dll [177152 2008-04-14] (Microsoft Corporation)
U2 WebClient; C:\WINXP\System32\webclnt.dll [68096 2008-04-14] (Microsoft Corporation)
R2 winmgmt; C:\WINXP\system32\wbem\WMIsvc.dll [145408 2008-04-14] (Microsoft Corporation)
S3 WmdmPmSN; C:\WINXP\system32\mspmsnsv.dll [27136 2008-12-10] (Microsoft Corporation)
S3 Wmi; C:\WINXP\System32\advapi32.dll [678400 2008-04-14] (Microsoft Corporation)
S3 WmiApSrv; C:\WINXP\system32\wbem\wmiapsrv.exe [126464 2008-04-14] (Microsoft Corporation)
S3 WMPNetworkSvc; C:\Programme\Windows Media Player\WMPNetwk.exe [920576 2006-11-03] (Microsoft Corporation)
S3 WPFFontCache_v0400; C:\WINXP\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [753504 2010-03-18] (Microsoft Corporation)
R2 wscsvc; C:\WINXP\system32\wscsvc.dll [80896 2008-04-14] (Microsoft Corporation)
R2 wuauserv; C:\WINXP\system32\wuauserv.dll [6656 2008-04-14] (Microsoft Corporation)
R2 WudfSvc; C:\WINXP\System32\WUDFSvc.dll [55296 2008-01-19] (Microsoft Corporation)
R2 WZCSVC; C:\WINXP\System32\wzcsvc.dll [483840 2008-12-10] (Microsoft Corporation)
S3 xmlprov; C:\WINXP\System32\xmlprov.dll [129024 2008-04-14] (Microsoft Corporation)
S2 LcSvrAdm; g:\elsawin\installation\bin\LcSvrAdm.exe [X]
S3 LcSvrAuf; g:\elsawin\installation\bin\LcSvrAuf.exe [X]
S2 LcSvrDba; g:\elsawin\installation\bin\LcSvrDba.exe [X]
S2 LcSvrHis; g:\elsawin\installation\bin\LcSvrHis.exe [X]
S2 LcSvrPAS; g:\elsawin\installation\bin\LcSvrPas.exe [X]
S2 LcSvrSaz; g:\elsawin\installation\bin\LcSvrSaz.exe [X]
S3 SwPrv; C:\WINXP\system32\dllhost.exe /Processid:{754E7D9E-E094-4527-B77E-79F9E5C6619D}

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 ACPI; C:\WINXP\System32\DRIVERS\ACPI.sys [188800 2008-04-14] (Microsoft Corporation)
R0 ACPIEC; C:\WINXP\System32\DRIVERS\ACPIEC.sys [12160 2008-04-14] (Microsoft Corporation)
S3 aec; C:\WINXP\System32\drivers\aec.sys [142592 2008-04-13] (Microsoft Corporation)
R1 AFD; C:\WINXP\System32\drivers\afd.sys [138496 2008-12-10] (Microsoft Corporation)
R3 Arp1394; C:\WINXP\System32\DRIVERS\arp1394.sys [60800 2008-12-10] (Microsoft Corporation)
S3 AsyncMac; C:\WINXP\System32\DRIVERS\asyncmac.sys [14336 2008-04-14] (Microsoft Corporation)
R0 atapi; C:\WINXP\System32\DRIVERS\atapi.sys [96512 2008-04-14] (Microsoft Corporation)
S3 Atmarpc; C:\WINXP\System32\DRIVERS\atmarpc.sys [59904 2008-04-14] (Microsoft Corporation)
R3 audstub; C:\WINXP\System32\DRIVERS\audstub.sys [3072 2001-08-17] (Microsoft Corporation)
R2 avgntflt; C:\WINXP\System32\DRIVERS\avgntflt.sys [105864 2015-02-04] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\WINXP\System32\DRIVERS\avipbb.sys [136216 2015-02-04] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\WINXP\System32\DRIVERS\avkmgr.sys [37352 2015-02-04] (Avira Operations GmbH & Co. KG)
R1 Beep; C:\WINXP\system32\Drivers\Beep.sys [4224 2008-04-14] (Microsoft Corporation)
S3 BthEnum; C:\WINXP\System32\DRIVERS\BthEnum.sys [17024 2008-04-13] (Microsoft Corporation)
S3 BTHMODEM; C:\WINXP\System32\DRIVERS\bthmodem.sys [37888 2008-04-13] (Microsoft Corporation)
S3 BthPan; C:\WINXP\System32\DRIVERS\bthpan.sys [101120 2008-04-13] (Microsoft Corporation)
S3 BTHPORT; C:\WINXP\System32\Drivers\BTHport.sys [273024 2008-12-10] (Microsoft Corporation)
S3 BTHUSB; C:\WINXP\System32\Drivers\BTHUSB.sys [18944 2008-04-13] (Microsoft Corporation)
R3 cbfs3; C:\WINXP\System32\DRIVERS\cbfs3.sys [299024 2012-04-09] (EldoS Corporation)
S4 cbidf2k; C:\WINXP\system32\Drivers\cbidf2k.sys [13952 2008-04-14] (Microsoft Corporation)
S1 Cdaudio; C:\WINXP\system32\Drivers\Cdaudio.sys [18688 2008-12-10] (Microsoft Corporation)
R4 Cdfs; C:\WINXP\system32\Drivers\Cdfs.sys [63744 2008-04-14] (Microsoft Corporation)
R1 Cdrom; C:\WINXP\System32\DRIVERS\cdrom.sys [62976 2008-04-14] (Microsoft Corporation)
R3 CmBatt; C:\WINXP\System32\DRIVERS\CmBatt.sys [13952 2008-04-14] (Microsoft Corporation)
R0 Compbatt; C:\WINXP\System32\DRIVERS\compbatt.sys [10240 2008-04-14] (Microsoft Corporation)
R0 Disk; C:\WINXP\System32\DRIVERS\disk.sys [36352 2008-04-14] (Microsoft Corporation)
S4 dmboot; C:\WINXP\System32\drivers\dmboot.sys [800384 2008-04-14] (Microsoft Corp., Veritas Software)
R0 dmio; C:\WINXP\System32\drivers\dmio.sys [154112 2008-04-14] (Microsoft Corp., Veritas Software)
R0 dmload; C:\WINXP\System32\drivers\dmload.sys [5888 2008-04-14] (Microsoft Corp., Veritas Software.)
S3 DMusic; C:\WINXP\System32\drivers\DMusic.sys [52864 2008-04-13] (Microsoft Corporation)
S3 drmkaud; C:\WINXP\System32\drivers\drmkaud.sys [2944 2008-04-13] (Microsoft Corporation)
R1 dtsoftbus01; C:\WINXP\System32\DRIVERS\dtsoftbus01.sys [242240 2012-06-21] (DT Soft Ltd)
S4 exFat; C:\WINXP\system32\Drivers\exFat.sys [133632 2008-09-29] (Microsoft Corporation)
R4 Fastfat; C:\WINXP\system32\Drivers\Fastfat.sys [143744 2008-04-14] (Microsoft Corporation)
S1 Fdc; C:\WINXP\system32\Drivers\Fdc.sys [27392 2008-04-14] (Microsoft Corporation)
R1 Fips; C:\WINXP\system32\Drivers\Fips.sys [44672 2008-04-14] (Microsoft Corporation)
S1 Flpydisk; C:\WINXP\system32\Drivers\Flpydisk.sys [20480 2008-04-14] (Microsoft Corporation)
R0 FltMgr; C:\WINXP\System32\drivers\fltmgr.sys [129792 2008-04-14] (Microsoft Corporation)
U1 Fs_Rec; C:\WINXP\system32\Drivers\Fs_Rec.sys [9216 2008-09-29] (Microsoft Corporation)
R0 Ftdisk; C:\WINXP\System32\DRIVERS\ftdisk.sys [126336 2008-04-14] (Microsoft Corporation)
R3 GEARAspiWDM; C:\WINXP\System32\DRIVERS\GEARAspiWDM.sys [26840 2012-08-21] (GEAR Software Inc.)
R3 Gpc; C:\WINXP\System32\DRIVERS\msgpc.sys [35072 2008-04-14] (Microsoft Corporation)
R2 Hardlock; C:\WINXP\system32\drivers\hardlock.sys [693760 2006-11-22] (Aladdin Knowledge Systems Ltd.)
R3 HDAudBus; C:\WINXP\System32\DRIVERS\HDAudBus.sys [144384 2008-04-14] (Windows (R) Server 2003 DDK provider)
R3 HidUsb; C:\WINXP\System32\DRIVERS\hidusb.sys [10368 2008-04-13] (Microsoft Corporation)
R0 hotcore3; C:\WINXP\System32\DRIVERS\hotcore3.sys [40560 2010-05-20] (Paragon Software Group)
R3 HTTP; C:\WINXP\System32\Drivers\HTTP.sys [264832 2008-04-14] (Microsoft Corporation)
R1 i8042prt; C:\WINXP\System32\DRIVERS\i8042prt.sys [52992 2008-04-14] (Microsoft Corporation)
R0 iaStor; C:\WINXP\System32\DRIVERS\iaStor.sys [330264 2010-01-05] (Intel Corporation)
R1 Imapi; C:\WINXP\System32\DRIVERS\imapi.sys [42112 2008-04-14] (Microsoft Corporation)
R3 IntcAzAudAddService; C:\WINXP\System32\drivers\RtkHDAud.sys [4241920 2006-02-27] (Realtek Semiconductor Corp.)
R1 intelppm; C:\WINXP\System32\DRIVERS\intelppm.sys [40448 2008-04-14] (Microsoft Corporation)
S3 Ip6Fw; C:\WINXP\System32\drivers\ip6fw.sys [36608 2008-04-14] (Microsoft Corporation)
R3 IpFilterDriver; C:\WINXP\System32\DRIVERS\ipfltdrv.sys [32896 2008-04-14] (Microsoft Corporation)
S3 IpInIp; C:\WINXP\System32\DRIVERS\ipinip.sys [20864 2008-04-14] (Microsoft Corporation)
R3 IpNat; C:\WINXP\System32\DRIVERS\ipnat.sys [152832 2008-04-14] (Microsoft Corporation)
R1 IPSec; C:\WINXP\System32\DRIVERS\ipsec.sys [75264 2008-04-14] (Microsoft Corporation)
S3 IRENUM; C:\WINXP\System32\DRIVERS\irenum.sys [11264 2008-04-14] (Microsoft Corporation)
R0 isapnp; C:\WINXP\System32\DRIVERS\isapnp.sys [37632 2008-04-14] (Microsoft Corporation)
R1 Kbdclass; C:\WINXP\System32\DRIVERS\kbdclass.sys [25216 2008-04-14] (Microsoft Corporation)
R1 kbdhid; C:\WINXP\System32\DRIVERS\kbdhid.sys [14720 2008-04-14] (Microsoft Corporation)
R3 kmixer; C:\WINXP\System32\drivers\kmixer.sys [172416 2008-04-13] (Microsoft Corporation)
R0 KSecDD; C:\WINXP\system32\Drivers\KSecDD.sys [92288 2008-04-14] (Microsoft Corporation)
R3 MBAMProtector; C:\WINXP\system32\drivers\mbam.sys [23256 2014-11-21] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\WINXP\system32\drivers\MBAMSwissArmy.sys [114904 2015-03-06] (Malwarebytes Corporation)
R1 mnmdd; C:\WINXP\system32\Drivers\mnmdd.sys [4224 2008-04-14] (Microsoft Corporation)
R3 Modem; C:\WINXP\system32\Drivers\Modem.sys [30336 2008-12-10] (Microsoft Corporation)
R1 Mouclass; C:\WINXP\System32\DRIVERS\mouclass.sys [23552 2008-12-10] (Microsoft Corporation)
R3 mouhid; C:\WINXP\System32\DRIVERS\mouhid.sys [12288 2001-08-18] (Microsoft Corporation)
R0 MountMgr; C:\WINXP\system32\Drivers\MountMgr.sys [42368 2008-04-14] (Microsoft Corporation)
R3 MRxDAV; C:\WINXP\System32\DRIVERS\mrxdav.sys [180608 2008-04-14] (Microsoft Corporation)
R1 MRxSmb; C:\WINXP\System32\DRIVERS\mrxsmb.sys [455936 2008-12-10] (Microsoft Corporation)
R1 Msfs; C:\WINXP\system32\Drivers\Msfs.sys [19072 2008-04-14] (Microsoft Corporation)
S3 MSKSSRV; C:\WINXP\System32\drivers\MSKSSRV.sys [7552 2008-04-13] (Microsoft Corporation)
S3 MSPCLOCK; C:\WINXP\System32\drivers\MSPCLOCK.sys [5376 2008-04-13] (Microsoft Corporation)
S3 MSPQM; C:\WINXP\System32\drivers\MSPQM.sys [4992 2008-04-13] (Microsoft Corporation)
R3 mssmbios; C:\WINXP\System32\DRIVERS\mssmbios.sys [15488 2008-12-10] (Microsoft Corporation)
R0 Mup; C:\WINXP\system32\Drivers\Mup.sys [105344 2008-04-14] (Microsoft Corporation)
R0 NDIS; C:\WINXP\system32\Drivers\NDIS.sys [182656 2008-04-14] (Microsoft Corporation)
R3 NdisTapi; C:\WINXP\System32\DRIVERS\ndistapi.sys [10112 2008-04-14] (Microsoft Corporation)
R3 Ndisuio; C:\WINXP\System32\DRIVERS\ndisuio.sys [14592 2008-12-10] (Microsoft Corporation)
R3 NdisWan; C:\WINXP\System32\DRIVERS\ndiswan.sys [91520 2008-04-14] (Microsoft Corporation)
R3 NDProxy; C:\WINXP\system32\Drivers\NDProxy.sys [40576 2008-04-14] (Microsoft Corporation)
R1 NetBIOS; C:\WINXP\System32\DRIVERS\netbios.sys [34688 2008-04-14] (Microsoft Corporation)
R1 NetBT; C:\WINXP\System32\DRIVERS\netbt.sys [162816 2008-04-14] (Microsoft Corporation)
R3 NETw3x32; C:\WINXP\System32\DRIVERS\NETw3x32.sys [1709696 2006-09-27] (Intel® Corporation)
R3 NIC1394; C:\WINXP\System32\DRIVERS\nic1394.sys [61824 2008-12-10] (Microsoft Corporation)
R1 Npfs; C:\WINXP\system32\Drivers\Npfs.sys [30848 2008-04-14] (Microsoft Corporation)
R2 NSHE; C:\WINXP\system32\Drivers\NSHE.SYS [97792 2008-11-23] (T0r0 2008) [File not signed]
R4 Ntfs; C:\WINXP\system32\Drivers\Ntfs.sys [574976 2008-04-14] (Microsoft Corporation)
R1 Null; C:\WINXP\system32\Drivers\Null.sys [2944 2008-04-14] (Microsoft Corporation)
R3 nv; C:\WINXP\System32\DRIVERS\nv4_mini.sys [6250848 2009-01-30] (NVIDIA Corporation)
S3 NwlnkFlt; C:\WINXP\System32\DRIVERS\nwlnkflt.sys [12416 2008-04-14] (Microsoft Corporation)
S3 NwlnkFwd; C:\WINXP\System32\DRIVERS\nwlnkfwd.sys [32512 2008-04-14] (Microsoft Corporation)
R0 ohci1394; C:\WINXP\System32\DRIVERS\ohci1394.sys [61696 2008-04-14] (Microsoft Corporation)
S3 Parport; C:\WINXP\system32\Drivers\Parport.sys [80384 2008-12-10] (Microsoft Corporation)
R0 PartMgr; C:\WINXP\system32\Drivers\PartMgr.sys [19712 2008-04-14] (Microsoft Corporation)
S2 ParVdm; C:\WINXP\system32\Drivers\ParVdm.sys [7040 2008-04-14] (Microsoft Corporation)
R0 PCI; C:\WINXP\System32\DRIVERS\pci.sys [68224 2008-04-14] (Microsoft Corporation)
R0 PCIIde; C:\WINXP\System32\DRIVERS\pciide.sys [3328 2001-08-18] (Microsoft Corporation)
S4 Pcmcia; C:\WINXP\system32\Drivers\Pcmcia.sys [120576 2008-04-14] (Microsoft Corporation)
R3 PptpMiniport; C:\WINXP\System32\DRIVERS\raspptp.sys [48384 2008-04-14] (Microsoft Corporation)
R3 PSched; C:\WINXP\System32\DRIVERS\psched.sys [69120 2008-04-14] (Microsoft Corporation)
R3 Ptilink; C:\WINXP\System32\DRIVERS\ptilink.sys [17792 2008-04-14] (Parallel Technologies, Inc.)
S3 pwdrvio; C:\WINXP\system32\pwdrvio.sys [16472 2012-01-18] ()
S3 pwdspio; C:\WINXP\system32\pwdspio.sys [11104 2012-01-18] ()
R0 PxHelp20; C:\WINXP\System32\Drivers\PxHelp20.sys [45648 2010-08-12] (Sonic Solutions)
R1 RasAcd; C:\WINXP\System32\DRIVERS\rasacd.sys [8832 2008-04-14] (Microsoft Corporation)
R3 Rasl2tp; C:\WINXP\System32\DRIVERS\rasl2tp.sys [51328 2008-04-14] (Microsoft Corporation)
R3 RasPppoe; C:\WINXP\System32\DRIVERS\raspppoe.sys [41472 2008-04-14] (Microsoft Corporation)
R3 Raspti; C:\WINXP\System32\DRIVERS\raspti.sys [16512 2008-04-14] (Microsoft Corporation)
R1 Rdbss; C:\WINXP\System32\DRIVERS\rdbss.sys [175744 2008-04-14] (Microsoft Corporation)
R1 RDPCDD; C:\WINXP\System32\DRIVERS\RDPCDD.sys [4224 2008-04-14] (Microsoft Corporation)
R3 rdpdr; C:\WINXP\System32\DRIVERS\rdpdr.sys [196224 2008-04-14] (Microsoft Corporation)
S3 RDPWD; C:\WINXP\system32\Drivers\RDPWD.sys [139656 2008-04-14] (Microsoft Corporation)
R1 redbook; C:\WINXP\System32\DRIVERS\redbook.sys [57728 2008-04-14] (Microsoft Corporation)
S3 RFCOMM; C:\WINXP\System32\DRIVERS\rfcomm.sys [59136 2008-04-13] (Microsoft Corporation)
R3 RTL8023xp; C:\WINXP\System32\DRIVERS\Rtnicxp.sys [78720 2005-09-30] (Realtek Semiconductor Corporation                           )
S3 Secdrv; C:\WINXP\System32\DRIVERS\secdrv.sys [20480 2008-04-14] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
S2 Serial; C:\WINXP\system32\Drivers\Serial.sys [65536 2008-04-14] (Microsoft Corporation)
S1 Sfloppy; C:\WINXP\system32\Drivers\Sfloppy.sys [11392 2008-04-14] (Microsoft Corporation)
R3 smserial; C:\WINXP\System32\DRIVERS\smserial.sys [846792 2005-09-16] (Motorola Inc.)
S3 splitter; C:\WINXP\System32\drivers\splitter.sys [6272 2008-04-13] (Microsoft Corporation)
R0 sr; C:\WINXP\System32\DRIVERS\sr.sys [73472 2008-04-14] (Microsoft Corporation)
R3 Srv; C:\WINXP\System32\DRIVERS\srv.sys [333824 2008-12-10] (Microsoft Corporation)
R1 ssmdrv; C:\WINXP\System32\DRIVERS\ssmdrv.sys [28520 2015-02-04] (Avira GmbH)
R3 swenum; C:\WINXP\System32\DRIVERS\swenum.sys [4352 2008-12-10] (Microsoft Corporation)
S3 swmidi; C:\WINXP\System32\drivers\swmidi.sys [56576 2008-04-13] (Microsoft Corporation)
R3 sysaudio; C:\WINXP\System32\drivers\sysaudio.sys [60800 2008-04-13] (Microsoft Corporation)
R1 Tcpip; C:\WINXP\System32\DRIVERS\tcpip.sys [361344 2008-04-14] (Microsoft Corporation)
S3 TDPIPE; C:\WINXP\system32\Drivers\TDPIPE.sys [12040 2008-04-14] (Microsoft Corporation)
S3 TDTCP; C:\WINXP\system32\Drivers\TDTCP.sys [21896 2008-04-14] (Microsoft Corporation)
R1 TermDD; C:\WINXP\System32\DRIVERS\termdd.sys [40840 2008-04-14] (Microsoft Corporation)
S4 Udfs; C:\WINXP\system32\Drivers\Udfs.sys [66048 2008-04-14] (Microsoft Corporation)
R3 Update; C:\WINXP\System32\DRIVERS\update.sys [384768 2008-04-14] (Microsoft Corporation)
S3 USBAAPL; C:\WINXP\System32\Drivers\usbaapl.sys [45056 2012-12-13] (Apple, Inc.) [File not signed]
R3 usbccgp; C:\WINXP\System32\DRIVERS\usbccgp.sys [32128 2008-04-13] (Microsoft Corporation)
R3 usbehci; C:\WINXP\System32\DRIVERS\usbehci.sys [30208 2008-04-14] (Microsoft Corporation)
R3 usbhub; C:\WINXP\System32\DRIVERS\usbhub.sys [59520 2008-04-14] (Microsoft Corporation)
S3 usbprint; C:\WINXP\System32\DRIVERS\usbprint.sys [25856 2008-04-13] (Microsoft Corporation)
S3 usbscan; C:\WINXP\System32\DRIVERS\usbscan.sys [15104 2008-04-13] (Microsoft Corporation)
R3 USBSTOR; C:\WINXP\System32\DRIVERS\USBSTOR.SYS [26368 2008-04-13] (Microsoft Corporation)
R3 usbuhci; C:\WINXP\System32\DRIVERS\usbuhci.sys [20608 2008-04-14] (Microsoft Corporation)
R1 VgaSave; C:\WINXP\System32\drivers\vga.sys [20992 2008-04-14] (Microsoft Corporation)
R0 VolSnap; C:\WINXP\system32\Drivers\VolSnap.sys [53760 2008-04-14] (Microsoft Corporation)
R3 Wanarp; C:\WINXP\System32\DRIVERS\wanarp.sys [34560 2008-04-14] (Microsoft Corporation)
S3 wceusbsh; C:\WINXP\System32\DRIVERS\wceusbsh.sys [28672 2006-11-06] (Microsoft Corporation)
S3 Wdf01000; C:\WINXP\System32\Drivers\wdf01000.sys [444136 2009-07-14] (Microsoft Corporation)
R3 wdmaud; C:\WINXP\System32\drivers\wdmaud.sys [83072 2008-04-13] (Microsoft Corporation)
S3 WinUSB; C:\WINXP\System32\DRIVERS\WinUSB.sys [34944 2009-07-13] (Microsoft Corporation)
R1 WmiAcpi; C:\WINXP\System32\DRIVERS\wmiacpi.sys [8832 2008-04-14] (Microsoft Corporation)
S3 WpdUsb; C:\WINXP\System32\DRIVERS\wpdusb.sys [38528 2008-12-10] (Microsoft Corporation)
R1 WS2IFSL; C:\WINXP\System32\drivers\ws2ifsl.sys [12032 2008-04-14] (Microsoft Corporation)
R0 WudfPf; C:\WINXP\System32\DRIVERS\WudfPf.sys [77696 2008-01-18] (Microsoft Corporation)
S3 WudfRd; C:\WINXP\System32\DRIVERS\wudfrd.sys [83328 2008-01-18] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 CFcatchme; \??\C:\ComboFix\CFcatchme.sys [X]
S4 IntelIde; No ImagePath
U5 ScsiPort; C:\WINXP\system32\drivers\scsiport.sys [96384 2008-04-14] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-06 15:01 - 2015-03-06 15:03 - 00852594 _____ () C:\Dokumente und Einstellungen\Alexander\Desktop\SecurityCheck.exe
2015-03-06 12:23 - 2015-03-06 12:24 - 02347384 _____ (ESET) C:\Dokumente und Einstellungen\Alexander\Desktop\esetsmartinstaller_deu.exe
2015-03-05 18:19 - 2015-03-05 18:19 - 00000000 ____D () C:\Dokumente und Einstellungen\Alexander\Desktop\FRST-OlderVersion
2015-03-05 18:16 - 2015-03-05 18:16 - 00000585 _____ () C:\Dokumente und Einstellungen\Alexander\Desktop\JRT.txt
2015-03-05 17:59 - 2015-03-05 17:59 - 00001023 _____ () C:\Dokumente und Einstellungen\Alexander\Desktop\AdwCleaner[S1].txt
2015-03-05 17:49 - 2015-03-05 17:49 - 00002255 _____ () C:\Dokumente und Einstellungen\Alexander\Desktop\mbam.txt
2015-03-05 17:27 - 2015-03-05 17:29 - 00000751 _____ () C:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk
2015-03-05 17:27 - 2015-03-05 17:29 - 00000000 ____D () C:\Programme\ Malwarebytes Anti-Malware 
2015-03-05 17:27 - 2015-03-05 17:29 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\ Malwarebytes Anti-Malware 
2015-03-05 17:27 - 2014-11-21 06:14 - 00054360 _____ (Malwarebytes Corporation) C:\WINXP\system32\Drivers\mbamchameleon.sys
2015-03-05 17:27 - 2014-11-21 06:14 - 00023256 _____ (Malwarebytes Corporation) C:\WINXP\system32\Drivers\mbam.sys
2015-03-05 10:20 - 2015-03-05 10:20 - 00000834 _____ () C:\Dokumente und Einstellungen\All Users\Desktop\Avira.lnk
2015-03-05 10:13 - 2015-03-05 10:13 - 04197016 _____ (Kaspersky Lab ZAO) C:\Dokumente und Einstellungen\Alexander\Desktop\tdsskiller.exe
2015-03-04 19:06 - 2015-03-04 19:06 - 00055923 _____ () C:\ComboFix.txt
2015-03-04 19:06 - 2015-03-04 19:06 - 00000000 ____D () C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\temp
2015-03-04 19:06 - 2015-03-04 19:06 - 00000000 ____D () C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\temp
2015-03-04 19:06 - 2015-03-04 19:06 - 00000000 ____D () C:\Dokumente und Einstellungen\Default User\Lokale Einstellungen\temp
2015-03-04 18:28 - 2011-06-26 11:15 - 00256000 _____ () C:\WINXP\PEV.exe
2015-03-04 18:28 - 2010-11-07 21:50 - 00208896 _____ () C:\WINXP\MBR.exe
2015-03-04 18:28 - 2009-04-20 09:26 - 00060416 _____ (NirSoft) C:\WINXP\NIRCMD.exe
2015-03-04 18:28 - 2000-08-31 04:30 - 00518144 _____ (SteelWerX) C:\WINXP\SWREG.exe
2015-03-04 18:28 - 2000-08-31 04:30 - 00406528 _____ (SteelWerX) C:\WINXP\SWSC.exe
2015-03-04 18:28 - 2000-08-31 04:30 - 00212480 _____ (SteelWerX) C:\WINXP\SWXCACLS.exe
2015-03-04 18:28 - 2000-08-31 04:30 - 00098816 _____ () C:\WINXP\sed.exe
2015-03-04 18:28 - 2000-08-31 04:30 - 00080412 _____ () C:\WINXP\grep.exe
2015-03-04 18:28 - 2000-08-31 04:30 - 00068096 _____ () C:\WINXP\zip.exe
2015-03-04 18:27 - 2015-03-04 19:06 - 00000000 ____D () C:\Qoobox
2015-03-04 18:26 - 2015-03-04 18:27 - 05612482 ____R (Swearware) C:\Dokumente und Einstellungen\Alexander\Desktop\ComboFix.exe
2015-03-03 19:18 - 2015-03-03 19:19 - 00026610 _____ () C:\Dokumente und Einstellungen\Alexander\Desktop\Addition.txt
2015-03-03 19:16 - 2015-03-06 15:06 - 00050307 _____ () C:\Dokumente und Einstellungen\Alexander\Desktop\FRST.txt
2015-03-03 19:10 - 2015-03-03 19:10 - 00834762 _____ () C:\Dokumente und Einstellungen\Alexander\Desktop\Unbenannt999.bmp
2015-03-03 18:10 - 2015-03-05 18:07 - 01388333 _____ (Thisisu) C:\Dokumente und Einstellungen\Alexander\Desktop\JRT.exe
2015-03-03 17:50 - 2015-03-05 17:56 - 00000000 ____D () C:\AdwCleaner
2015-03-03 17:50 - 2015-03-03 17:50 - 02126848 _____ () C:\Dokumente und Einstellungen\Alexander\Desktop\AdwCleaner_4.111.exe
2015-03-03 17:29 - 2015-03-03 17:45 - 00114904 _____ (Malwarebytes Corporation) C:\WINXP\system32\Drivers\536154D9.sys
2015-03-03 17:29 - 2015-03-03 17:29 - 00114904 _____ (Malwarebytes Corporation) C:\WINXP\system32\Drivers\35A5549B.sys
2015-03-03 17:28 - 2015-03-03 17:28 - 00110296 _____ (Malwarebytes Corporation) C:\WINXP\system32\Drivers\47067E77.sys
2015-03-03 17:25 - 2015-03-03 17:25 - 00110296 _____ (Malwarebytes Corporation) C:\WINXP\system32\Drivers\48230029.sys
2015-03-03 17:16 - 2015-03-03 17:16 - 00000529 _____ () C:\Dokumente und Einstellungen\Alexander\Desktop\Revo Uninstaller.lnk
2015-03-03 17:13 - 2015-03-06 15:05 - 00000000 ____D () C:\FRST
2015-03-03 17:13 - 2015-03-05 18:19 - 01132544 _____ (Farbar) C:\Dokumente und Einstellungen\Alexander\Desktop\FRST.exe
2015-03-02 19:39 - 2015-03-05 17:57 - 00275294 _____ () C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-S-1-5-21-1935655697-1229272821-1417001333-1003-0.dat
2015-03-02 18:20 - 2015-03-05 17:59 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Package Cache
2015-03-02 18:20 - 2015-03-02 18:20 - 00000000 ____D () C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Avira
2015-03-02 18:20 - 2015-03-02 18:20 - 00000000 ____D () C:\Dokumente und Einstellungen\Alexander\Anwendungsdaten\Avira
2015-03-02 18:19 - 2015-03-05 10:19 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Avira
2015-03-02 18:18 - 2015-02-04 17:51 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\WINXP\system32\Drivers\avipbb.sys
2015-03-02 18:18 - 2015-02-04 17:51 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\WINXP\system32\Drivers\avkmgr.sys
2015-03-02 18:18 - 2015-02-04 17:51 - 00028520 _____ (Avira GmbH) C:\WINXP\system32\Drivers\ssmdrv.sys
2015-03-02 18:17 - 2015-03-05 10:19 - 00000000 ____D () C:\Programme\Avira
2015-03-02 18:17 - 2015-03-02 18:21 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avira

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-06 15:06 - 2014-06-19 15:29 - 00000000 ____D () C:\Dokumente und Einstellungen\Alexander\Lokale Einstellungen\Temp
2015-03-06 14:59 - 2014-06-19 14:17 - 00365713 _____ () C:\WINXP\WindowsUpdate.log
2015-03-06 14:37 - 2014-06-19 15:29 - 00000000 ____D () C:\WINXP\Temp
2015-03-06 14:09 - 2013-04-17 19:36 - 00001096 _____ () C:\WINXP\Tasks\GoogleUpdateTaskMachineUA.job
2015-03-06 14:09 - 2013-04-17 19:36 - 00001092 _____ () C:\WINXP\Tasks\GoogleUpdateTaskMachineCore.job
2015-03-06 09:22 - 2014-07-14 17:39 - 00114904 _____ (Malwarebytes Corporation) C:\WINXP\system32\Drivers\MBAMSwissArmy.sys
2015-03-05 19:10 - 2014-07-08 17:51 - 00000000 ____D () C:\WINXP\system32\NtmsData
2015-03-05 18:33 - 2010-01-05 23:21 - 00000000 ____D () C:\WINXP\Registration
2015-03-05 17:59 - 2010-01-06 01:04 - 00202011 _____ () C:\WINXP\system32\nvapps.xml
2015-03-05 17:59 - 2010-01-05 23:42 - 00000006 ____H () C:\WINXP\Tasks\SA.DAT
2015-03-05 17:59 - 2010-01-05 22:55 - 00000159 _____ () C:\WINXP\wiadebug.log
2015-03-05 17:59 - 2010-01-05 22:55 - 00000050 _____ () C:\WINXP\wiaservc.log
2015-03-05 17:57 - 2013-02-12 14:53 - 00275294 _____ () C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-System.dat
2015-03-05 17:57 - 2010-01-05 23:48 - 00000190 ___SH () C:\Dokumente und Einstellungen\Alexander\ntuser.ini
2015-03-05 17:57 - 2010-01-05 23:48 - 00000000 ____D () C:\Dokumente und Einstellungen\Alexander
2015-03-05 17:57 - 2010-01-05 23:42 - 00032274 _____ () C:\WINXP\SchedLgU.Txt
2015-03-05 17:27 - 2010-01-05 22:53 - 00000000 ____D () C:\Programme
2015-03-05 17:27 - 2010-01-05 22:53 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme
2015-03-05 17:22 - 2010-01-05 23:29 - 00000000 __SHD () C:\Dokumente und Einstellungen\NetworkService
2015-03-04 18:55 - 2010-01-05 23:46 - 00000000 ____D () C:\WINXP
2015-03-04 18:55 - 2008-04-14 14:30 - 00000227 _____ () C:\WINXP\system.ini
2015-03-04 18:53 - 2012-02-29 19:07 - 00000000 ____D () C:\WINXP\SxsCaPendDel
2015-03-04 18:53 - 2008-04-14 14:30 - 00002206 _____ () C:\WINXP\system32\wpa.dbl
2015-03-04 18:51 - 2014-06-18 17:56 - 00000000 ____D () C:\WINXP\erdnt
2015-03-04 18:24 - 2013-10-14 15:28 - 00000664 _____ () C:\WINXP\system32\d3d9caps.dat
2015-03-03 19:08 - 2010-01-13 23:38 - 00000069 _____ () C:\WINXP\NeroDigital.ini
2015-03-03 18:42 - 2010-01-05 23:21 - 00013311 _____ () C:\WINXP\wmsetup.log
2015-03-03 18:21 - 2012-07-09 18:28 - 00000000 ____D () C:\Programme\Gemeinsame Dateien\Apple
2015-03-03 17:16 - 2010-01-05 23:48 - 00000000 ___RD () C:\Dokumente und Einstellungen\Alexander\Startmenü\Programme
2015-03-02 18:52 - 2014-07-06 23:40 - 00359515 _____ () C:\WINXP\setupapi.log
2015-03-02 18:52 - 2010-01-05 23:46 - 00000000 ____D () C:\WINXP\repair
2015-03-02 18:20 - 2010-01-05 23:42 - 00000000 __SHD () C:\Dokumente und Einstellungen\LocalService
2015-02-04 17:51 - 2010-01-08 13:20 - 00105864 _____ (Avira Operations GmbH & Co. KG) C:\WINXP\system32\Drivers\avgntflt.sys

==================== Files in the root of some directories =======

2012-05-28 08:59 - 2012-05-28 08:59 - 0002528 _____ () C:\Dokumente und Einstellungen\Alexander\Anwendungsdaten\$_hpcst$.hpc
2014-07-06 15:55 - 2014-07-07 11:55 - 0000038 _____ () C:\Dokumente und Einstellungen\Alexander\Anwendungsdaten\WB.CFG
2010-01-08 13:04 - 2014-12-22 22:45 - 0032256 _____ () C:\Dokumente und Einstellungen\Alexander\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

Some content of TEMP:
====================
C:\Dokumente und Einstellungen\Alexander\Lokale Einstellungen\Temp\avgnt.exe
C:\Dokumente und Einstellungen\Alexander\Lokale Einstellungen\Temp\Quarantine.exe
C:\Dokumente und Einstellungen\Alexander\Lokale Einstellungen\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\WINXP\explorer.exe => File is digitally signed
C:\WINXP\system32\winlogon.exe => File is digitally signed
C:\WINXP\system32\svchost.exe => File is digitally signed
C:\WINXP\system32\services.exe => File is digitally signed
C:\WINXP\system32\User32.dll => File is digitally signed
C:\WINXP\system32\userinit.exe => File is digitally signed
C:\WINXP\system32\rpcss.dll => File is digitally signed
C:\WINXP\system32\Drivers\volsnap.sys => File is digitally signed

==================== End Of Log ============================
         

--- --- ---

--- --- ---




Ich habe eine Frage zu ESET,
dort wurden 25 Dateien gefunden, die 'schädlich' sind.
Hat ESET die automatisch gelöscht? oder sind die immer noch auf meinem PC?

Machen wir jetzt:

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

C:\Dokumente und Einstellungen\Alexander\Anwendungsdaten\Mozilla\Firefox\Profiles\0qgqdyu2.default\prefs.js

C:\Dokumente und Einstellungen\Alexander\Anwendungsdaten\Mozilla\Firefox\Profiles\0qgqdyu2.default\prefs.js.BAK

C:\Programme\FreeTime\FormatFactory\FFModules\Package\BaiDu\hao123inst.exe

C:\Sandbox\Alexander\DefaultBox\drive\C\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarApp.dll

C:\Sandbox\Alexander\DefaultBox\drive\C\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarEng.dll

C:\Sandbox\Alexander\DefaultBox\drive\C\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarsrv.exe

C:\Sandbox\Alexander\DefaultBox\drive\C\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll

C:\Sandbox\Alexander\DefaultBox\drive\C\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll

C:\Sandbox\Alexander\DefaultBox\user\current\Anwendungsdaten\Mozilla\Firefox\Profiles\0qgqdyu2.default\user.js

C:\Sandbox\Alexander\DefaultBox\user\current\Lokale Einstellungen\Anwendungsdaten\Babylon\Setup\BExternal.dll

C:\Sandbox\Alexander\DefaultBox\user\current\Lokale Einstellungen\Anwendungsdaten\Babylon\Setup\IECookieLow.dll

C:\Sandbox\Alexander\DefaultBox\user\current\Lokale Einstellungen\Anwendungsdaten\Babylon\Setup\Setup.exe

C:\Sandbox\Alexander\DefaultBox\user\current\Lokale Einstellungen\Temp\679F4909-BAB0-7891-83E4-88EF3AB2B5F9\Setup.exe

C:\Sandbox\Alexander\DefaultBox\user\current\Lokale Einstellungen\Temp\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbar4ie.exe

C:\System Volume Information\_restore{AAB4F754-CCF5-43E0-BF09-003EDA1EEE13}\RP597\A0063977.exe

C:\System Volume Information\_restore{AAB4F754-CCF5-43E0-BF09-003EDA1EEE13}\RP597\A0063978.dll

C:\System Volume Information\_restore{AAB4F754-CCF5-43E0-BF09-003EDA1EEE13}\RP597\A0063979.dll

C:\System Volume Information\_restore{AAB4F754-CCF5-43E0-BF09-003EDA1EEE13}\RP597\A0063982.exe

C:\System Volume Information\_restore{AAB4F754-CCF5-43E0-BF09-003EDA1EEE13}\RP597\A0063985.exe

C:\zoek_backup\C_Dokumente und Einstellungen_ALEXAN~1_Anwendungsdaten_Mozilla_Firefox_Profiles_0qgqdyu2.default_prefs__1526_.backup.vir

D:\cnet_pwhe6_exe.exe

D:\FFSetup3.3.4.0.exe

D:\FreeVideoDub.exe

D:\MyPhoneExplorer_1.8.5.exe

D:\SoftonicDownloader39076.exe

D:\SoftonicDownloader_fuer_deutsches-sprachpaket-fur-photofiltre.exe

C:\AdwCleaner\Quarantine\C\Programme\RegClean Pro\systweakasp.exe.vir

C:\Sandbox\Alexander\DefaultBox\drive\C\Programme\RegClean Pro\CleanSchedule.exe

C:\Sandbox\Alexander\DefaultBox\drive\C\Programme\RegClean Pro\RCPUninstall.exe

C:\Sandbox\Alexander\DefaultBox\drive\C\Programme\RegClean Pro\RegCleanPro.exe

C:\Sandbox\Alexander\DefaultBox\drive\C\WINXP\system32\roboot.exe

C:\System Volume Information\_restore{AAB4F754-CCF5-43E0-BF09-003EDA1EEE13}\RP648\A0069100.exe

C:\System Volume Information\_restore{AAB4F754-CCF5-43E0-BF09-003EDA1EEE13}\RP659\A0071476.exe
HKLM\...\Winlogon: [Shell] explorer.exe [x ] ()
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKU\S-1-5-21-1935655697-1229272821-1417001333-1003\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-1935655697-1229272821-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs,Tabs: "www.google.com" <======= ATTENTION
ShellExecuteHooks:  - {AEB6717E-7E19-11d0-97EE-00C04FD91972} -  No File [ ]
Emptytemp:
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

• Starte nun FRST erneut und klicke den Entfernen Button.
• Das Tool erstellt eine Fixlog.txt.
• Poste mir deren Inhalt.

Rechner vom Netz trennen da XP.




Cleanup:
(Die Reihenfolge ist hier entscheidend)

Falls Defogger verwendet wurde: Erneut starten und auf Re-enable klicken.

Falls Combofix verwendet wurde:
Combofix deinstallieren

• Wichtig: Bitte Antivirus-Programm, evtl. vorhandenes Skript-Blocking und Anti-Malware Programme deaktivieren.
  
• Drücke bitte die + R Taste und schreibe Combofix /Uninstall in das Ausführen-Fenster.
• Klicke auf OK.
  Damit wird Combofix komplett entfernt und der Cache der Systemwiederherstellung geleert.
• Nun die eben deaktivierten Programme wieder aktivieren.

Alle Logs gepostet? Dann lade Dir bitte DelFix herunter.

• Schließe alle offenen Programme.
• Starte die delfix.exe mit einem Doppelklick.
• Setze vor jede Funktion ein Häkchen.
• Klicke auf Start.

Hinweis: DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
Starte Deinen Rechner abschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen.

Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst...und/oder das Forum mit einer kleinen Spende unterstützen.


Absicherung:
Beim Betriebsystem Windows die automatischen Updates aktivieren. Auch die sicherheitsrelevante Software sollte immer nur in der aktuellsten Version vorliegen:

Browser
Java
Flash-Player
PDF-Reader

Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren.
Ich empfehle z.B. die Verwendung von Mozilla Firefox statt des Internet Explorers. Zudem lassen sich mit dem Firefox auch PDF-Dokumente öffnen.

Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig.

Verwende ein Antivirusprogramm mit Echtzeitscanner und stets aktueller Signaturendatenbank.
Meine Empfehlung:

Emsisoft

Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware und ESET scannen.

Optional:
NoScript verhindert das Ausführen von aktiven Inhalten (Java, JavaScript, Flash,...) für sämtliche Websites. Man kann aber nach dem Prinzip einer Whitelist festlegen, auf welchen Seiten Scripts erlaubt werden sollen.
Malwarebytes Anti Exploit: Schützt die Anwendungen des Computers vor der Ausnutzung bekannter Schwachstellen.


Lade Software von einem sauberen Portal wie .
Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen.
Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwcleaner .


Abschließend noch ein paar grundsätzliche Bemerkungen:
Ändere regelmäßig Deine wichtigen Online-Passwörter und erstelle regelmäßig Backups Deiner wichtigen Dateien oder des Systems.
Der Nutzen von Registry-Cleanern, Optimizern usw. zur Performancesteigerung ist umstritten. Ich empfehle deshalb, die Finger von der Registry zu lassen und lieber die windowseigene Datenträgerbereinigung zu verwenden.

Fixlog

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 08-03-2015 03
Ran by Alexander at 2015-03-09 16:14:00 Run:1
Running from C:\Dokumente und Einstellungen\Alexander\Desktop
Loaded Profiles: Alexander &  (Available profiles: Alexander)
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
C:\Dokumente und Einstellungen\Alexander\Anwendungsdaten\Mozilla\Firefox\Profiles\0qgqdyu2.default\prefs.js

C:\Dokumente und Einstellungen\Alexander\Anwendungsdaten\Mozilla\Firefox\Profiles\0qgqdyu2.default\prefs.js.BAK

C:\Programme\FreeTime\FormatFactory\FFModules\Package\BaiDu\hao123inst.exe

C:\Sandbox\Alexander\DefaultBox\drive\C\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarApp.dll

C:\Sandbox\Alexander\DefaultBox\drive\C\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarEng.dll

C:\Sandbox\Alexander\DefaultBox\drive\C\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarsrv.exe

C:\Sandbox\Alexander\DefaultBox\drive\C\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll

C:\Sandbox\Alexander\DefaultBox\drive\C\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll

C:\Sandbox\Alexander\DefaultBox\user\current\Anwendungsdaten\Mozilla\Firefox\Profiles\0qgqdyu2.default\user.js

C:\Sandbox\Alexander\DefaultBox\user\current\Lokale Einstellungen\Anwendungsdaten\Babylon\Setup\BExternal.dll

C:\Sandbox\Alexander\DefaultBox\user\current\Lokale Einstellungen\Anwendungsdaten\Babylon\Setup\IECookieLow.dll

C:\Sandbox\Alexander\DefaultBox\user\current\Lokale Einstellungen\Anwendungsdaten\Babylon\Setup\Setup.exe

C:\Sandbox\Alexander\DefaultBox\user\current\Lokale Einstellungen\Temp\679F4909-BAB0-7891-83E4-88EF3AB2B5F9\Setup.exe

C:\Sandbox\Alexander\DefaultBox\user\current\Lokale Einstellungen\Temp\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbar4ie.exe

C:\System Volume Information\_restore{AAB4F754-CCF5-43E0-BF09-003EDA1EEE13}\RP597\A0063977.exe

C:\System Volume Information\_restore{AAB4F754-CCF5-43E0-BF09-003EDA1EEE13}\RP597\A0063978.dll

C:\System Volume Information\_restore{AAB4F754-CCF5-43E0-BF09-003EDA1EEE13}\RP597\A0063979.dll

C:\System Volume Information\_restore{AAB4F754-CCF5-43E0-BF09-003EDA1EEE13}\RP597\A0063982.exe

C:\System Volume Information\_restore{AAB4F754-CCF5-43E0-BF09-003EDA1EEE13}\RP597\A0063985.exe

C:\zoek_backup\C_Dokumente und Einstellungen_ALEXAN~1_Anwendungsdaten_Mozilla_Firefox_Profiles_0qgqdyu2.default_prefs__1526_.backup.vir

D:\cnet_pwhe6_exe.exe

D:\FFSetup3.3.4.0.exe

D:\FreeVideoDub.exe

D:\MyPhoneExplorer_1.8.5.exe

D:\SoftonicDownloader39076.exe

D:\SoftonicDownloader_fuer_deutsches-sprachpaket-fur-photofiltre.exe

C:\AdwCleaner\Quarantine\C\Programme\RegClean Pro\systweakasp.exe.vir

C:\Sandbox\Alexander\DefaultBox\drive\C\Programme\RegClean Pro\CleanSchedule.exe

C:\Sandbox\Alexander\DefaultBox\drive\C\Programme\RegClean Pro\RCPUninstall.exe

C:\Sandbox\Alexander\DefaultBox\drive\C\Programme\RegClean Pro\RegCleanPro.exe

C:\Sandbox\Alexander\DefaultBox\drive\C\WINXP\system32\roboot.exe

C:\System Volume Information\_restore{AAB4F754-CCF5-43E0-BF09-003EDA1EEE13}\RP648\A0069100.exe

C:\System Volume Information\_restore{AAB4F754-CCF5-43E0-BF09-003EDA1EEE13}\RP659\A0071476.exe
HKLM\...\Winlogon: [Shell] explorer.exe [x ] ()
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKU\S-1-5-21-1935655697-1229272821-1417001333-1003\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-1935655697-1229272821-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs,Tabs: "www.google.com" <======= ATTENTION
ShellExecuteHooks:  - {AEB6717E-7E19-11d0-97EE-00C04FD91972} -  No File [ ]
Emptytemp:
         
*****************

"C:\Dokumente und Einstellungen\Alexander\Anwendungsdaten\Mozilla\Firefox\Profiles\0qgqdyu2.default\prefs.js" => File/Directory not found.
"C:\Dokumente und Einstellungen\Alexander\Anwendungsdaten\Mozilla\Firefox\Profiles\0qgqdyu2.default\prefs.js.BAK" => File/Directory not found.
"C:\Programme\FreeTime\FormatFactory\FFModules\Package\BaiDu\hao123inst.exe" => File/Directory not found.
"C:\Sandbox\Alexander\DefaultBox\drive\C\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarApp.dll" => File/Directory not found.
"C:\Sandbox\Alexander\DefaultBox\drive\C\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarEng.dll" => File/Directory not found.
"C:\Sandbox\Alexander\DefaultBox\drive\C\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarsrv.exe" => File/Directory not found.
"C:\Sandbox\Alexander\DefaultBox\drive\C\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll" => File/Directory not found.
"C:\Sandbox\Alexander\DefaultBox\drive\C\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll" => File/Directory not found.
"C:\Sandbox\Alexander\DefaultBox\user\current\Anwendungsdaten\Mozilla\Firefox\Profiles\0qgqdyu2.default\user.js" => File/Directory not found.
"C:\Sandbox\Alexander\DefaultBox\user\current\Lokale Einstellungen\Anwendungsdaten\Babylon\Setup\BExternal.dll" => File/Directory not found.
"C:\Sandbox\Alexander\DefaultBox\user\current\Lokale Einstellungen\Anwendungsdaten\Babylon\Setup\IECookieLow.dll" => File/Directory not found.
"C:\Sandbox\Alexander\DefaultBox\user\current\Lokale Einstellungen\Anwendungsdaten\Babylon\Setup\Setup.exe" => File/Directory not found.
"C:\Sandbox\Alexander\DefaultBox\user\current\Lokale Einstellungen\Temp\679F4909-BAB0-7891-83E4-88EF3AB2B5F9\Setup.exe" => File/Directory not found.
"C:\Sandbox\Alexander\DefaultBox\user\current\Lokale Einstellungen\Temp\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbar4ie.exe" => File/Directory not found.
"C:\System Volume Information\_restore{AAB4F754-CCF5-43E0-BF09-003EDA1EEE13}\RP597\A0063977.exe" => File/Directory not found.
"C:\System Volume Information\_restore{AAB4F754-CCF5-43E0-BF09-003EDA1EEE13}\RP597\A0063978.dll" => File/Directory not found.
"C:\System Volume Information\_restore{AAB4F754-CCF5-43E0-BF09-003EDA1EEE13}\RP597\A0063979.dll" => File/Directory not found.
"C:\System Volume Information\_restore{AAB4F754-CCF5-43E0-BF09-003EDA1EEE13}\RP597\A0063982.exe" => File/Directory not found.
"C:\System Volume Information\_restore{AAB4F754-CCF5-43E0-BF09-003EDA1EEE13}\RP597\A0063985.exe" => File/Directory not found.
"C:\zoek_backup\C_Dokumente und Einstellungen_ALEXAN~1_Anwendungsdaten_Mozilla_Firefox_Profiles_0qgqdyu2.default_prefs__1526_.backup.vir" => File/Directory not found.
"D:\cnet_pwhe6_exe.exe" => File/Directory not found.
"D:\FFSetup3.3.4.0.exe" => File/Directory not found.
"D:\FreeVideoDub.exe" => File/Directory not found.
"D:\MyPhoneExplorer_1.8.5.exe" => File/Directory not found.
"D:\SoftonicDownloader39076.exe" => File/Directory not found.
"D:\SoftonicDownloader_fuer_deutsches-sprachpaket-fur-photofiltre.exe" => File/Directory not found.
"C:\AdwCleaner\Quarantine\C\Programme\RegClean Pro\systweakasp.exe.vir" => File/Directory not found.
"C:\Sandbox\Alexander\DefaultBox\drive\C\Programme\RegClean Pro\CleanSchedule.exe" => File/Directory not found.
"C:\Sandbox\Alexander\DefaultBox\drive\C\Programme\RegClean Pro\RCPUninstall.exe" => File/Directory not found.
"C:\Sandbox\Alexander\DefaultBox\drive\C\Programme\RegClean Pro\RegCleanPro.exe" => File/Directory not found.
"C:\Sandbox\Alexander\DefaultBox\drive\C\WINXP\system32\roboot.exe" => File/Directory not found.
"C:\System Volume Information\_restore{AAB4F754-CCF5-43E0-BF09-003EDA1EEE13}\RP648\A0069100.exe" => File/Directory not found.
"C:\System Volume Information\_restore{AAB4F754-CCF5-43E0-BF09-003EDA1EEE13}\RP659\A0071476.exe" => File/Directory not found.
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value was restored successfully.
"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
"HKU\S-1-5-21-1935655697-1229272821-1417001333-1003\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
"HKU\S-1-5-21-1935655697-1229272821-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs\\Tabs => Value was restored successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks\\{AEB6717E-7E19-11d0-97EE-00C04FD91972} => value deleted successfully.
HKCR\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972} => Key not found. 
EmptyTemp: => Removed 317.7 MB temporary data.


The system needed a reboot. 

==== End of Fixlog 16:16:56 ====
         

Und ich habe , Stand jetzt, alle Schadsoftware beseitigt?
Dann fang ich jetzt mit der Datensicherung für den neuen PC an

jap, fertig

Danke

Ich habe noch eine letzte Frage,
das Thema kommt jetzt auch als ich alle Daten zusammen suche, die ich noch sichern will.

unter dem pfad:

C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temp

liegen 8GB Daten ab, die ich nicht zuordnen kann.
im größten Teil: Microsoft .NET Framework 2.0....txt - Dateien
und passend dazu viele "HTML"-Dateien

kann ich die Dateien komplett löschen?

Tempordner, also ja

Danke