Hallo zusammen!
Ich bin nicht gerade das, was man als komputerprofi bezeichnen würde und deshalb hoffe ich nocheinmal mehr dass ihr mir dementsprechend helfen könnt!

ich habe mich im internet schlau gemacht und herausgefunden dass ich durch die installation von antivirgear einen großen fehler gemacht habe.. ich habe das programm allerdings schon wieder gelöscht! nur unachtsamkeit und meinem "fachwissen habe ich mir allerdings den gleichen fehler (mit anderem programm) nochmals erlaubt!

nach weiterer suche im internet habe ich den ordner viedo atcive x access gelöscht und mir anschließend HijackThis downgeloaded!

hab mir folgendes Logfile erstellt:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:23:02, on 24.09.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Network Associates\Common Framework\FrameworkService.exe
C:\Programme\Network Associates\VirusScan\Mcshield.exe
C:\Programme\Network Associates\VirusScan\VsTskMgr.exe
C:\Programme\Microsoft SQL Server\MSSQL$MESONIC\Binn\sqlservr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Programme\Roxio\MyDVD\MyDVD\USBDeviceService.exe
C:\Programme\Network Associates\VirusScan\SHSTAT.EXE
C:\Programme\Network Associates\Common Framework\UpdaterUI.exe
C:\Programme\Sony\HotKey Utility\HKserv.exe
D:\SPMgr.exe
C:\Programme\Java\jre1.5.0_04\bin\jusched.exe
C:\Programme\Sony\HotKey Utility\HKWnd.exe
C:\Programme\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Programme\Roxio\MyDVD\MyDVD\DetectorApp.exe
C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe
C:\Programme\ATnotes\ATnotes.exe
C:\Programme\Internet Explorer\IEXPLORE.EXE
C:\Programme\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Programme\Siemens\Gigaset USB Stick 108\Gcc.exe
C:\Programme\Siemens\Gigaset USB Stick 108\OdHost.exe
C:\Programme\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\Rundll32.exe
C:\Programme\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.at/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.24.2:3128
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - D:\Programme\ICQToolbar\toolbaru.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1C3C4699-B285-475F-BE47-0B26088CE876} - C:\Programme\Video ActiveX Access\iesplg.dll (file missing)
O2 - BHO: rightonadz.biz browser optimizer - {36A91CEC-6C71-4758-B492-397BFC8E96A2} - C:\WINDOWS\system32\gzmrotate.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Programme\Viewpoint\Viewpoint Toolbar\ViewBarBHO.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar2.dll
O2 - BHO: adssite - {F31B3634-12AA-41ca-B021-0685C3B3E4CA} - C:\WINDOWS\system32\nsh12D3.dll
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Programme\Viewpoint\Viewpoint Toolbar\ViewBar.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar2.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programme\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - D:\Programme\ICQToolbar\toolbaru.dll (file missing)
O3 - Toolbar: Mein PONSline - {A6F74643-242A-A7A4-8DD5-AB40B9E25345} - (no file)
O3 - Toolbar: Adssite Toolbar - {41C29B07-6F91-4966-91BE-2E2841643C83} - C:\Programme\Adssite Advanced Toolbar\toolbar.dll
O3 - Toolbar: Protection Bar - {F06E2ABE-3A50-4079-BE25-FC100D9EAA25} - C:\Programme\Video ActiveX Access\iesbpl.dll (file missing)
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [ShStatEXE] "C:\Programme\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Programme\Network Associates\Common Framework\UpdaterUI.exe"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programme\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [HKSERV.EXE] C:\Programme\Sony\HotKey Utility\HKserv.exe
O4 - HKLM\..\Run: [SonyPowerCfg] D:\SPMgr.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [OpwareSE2] "C:\Programme\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [OPSE reminder] "C:\Programme\ScanSoft\OmniPageSE2.0\EregGer\Ereg.exe" -r "C:\Programme\ScanSoft\OmniPageSE2.0\EregGer\ereg.ini"
O4 - HKLM\..\Run: [ICQ Lite] "D:\Programme\ICQLite\ICQLite.exe" -minimize
O4 - HKLM\..\Run: [webHancer Agent] "C:\Program Files\webHancer\Programs\whAgent.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [DetectorApp] C:\Programme\Roxio\MyDVD\MyDVD\DetectorApp.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\GEMEIN~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [hid_start] C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\system32\gzmrotate.dll" DllVerify
O4 - HKLM\..\Run: [{58-8E-EF-F0-ZN}] C:\DOKUME~1\Manuel\LOKALE~1\Temp\BundleDownloader\22.ex_ P2D002
O4 - HKLM\..\RunOnce: [iMeshBar Uninstall] rundll32 C:\PROGRA~1\UNINST~1.DLL,O -2
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ATnotes.exe] C:\Programme\ATnotes\ATnotes.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programme\Gemeinsame Dateien\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [EA Core] C:\Programme\Electronic Arts\EA Downloader\Core.exe -silent
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: TA_Start.lnk = C:\Dokumente und Einstellungen\Manuel\Lokale Einstellungen\Temp\BundleDownloader\22.ex_
O4 - Global Startup: Acrobat Assistant.lnk = C:\Programme\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Gigaset WLAN Adapter Monitor.lnk = C:\Programme\Siemens\Gigaset USB Stick 108\Gcc.exe
O4 - Global Startup: Service Manager.lnk = C:\Programme\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programme\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://c:\programme\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &ICQ Toolbar Search - res://D:\Programme\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: &Translate English Word - res://c:\programme\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: &Viewpoint Search - res://C:\Programme\Viewpoint\Viewpoint Toolbar\ViewBar.dll/CXTSEARCH.HTML
O8 - Extra context menu item: Backward Links - res://c:\programme\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\programme\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Easy-WebPrint - Drucken - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint - Schnelldruck - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint - Vorschau - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint - Zu Druckliste hinzufügen - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\programme\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\programme\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O12 - Plugin for .pdf: C:\Programme\Internet Explorer\PLUGINS\nppdf32.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.hakhollabrunn.ac.at
O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - https://components.viewpoint.com/MTSInstallers/MetaStream3.cab?url=http://www.viewpoint.com/cgi-bin/installer.v4/vet_install_popup.pl?1&4&04.00.05.04&unknown&unknown&http://www9.volvo.com/truck/3dtruckconfigurator2/all/fh16.asp
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = nhl.local
O17 - HKLM\Software\..\Telephony: DomainName = nhl.local
O17 - HKLM\System\CCS\Services\Tcpip\..\{4D09F4F5-19DF-4FCF-AED7-15D16507752B}: NameServer = 213.33.99.70,80.120.17.70
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = nhl.local
O22 - SharedTaskScheduler: flensburg - {d6ef030a-a235-41ba-9ead-89b6ff542f00} - C:\WINDOWS\system32\pluwue.dll (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Programme\Gemeinsame Dateien\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Programme\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Programme\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Programme\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: RadClock - Unknown owner - C:\WINDOWS\system32\RadClock.exe
O23 - Service: USBDeviceService - Unknown owner - C:\Programme\Roxio\MyDVD\MyDVD\USBDeviceService.exe

--
End of file - 12264 bytes


--------------------------
ich hoffe ich habe dabei nicht allzuviel falsch gemacht und ihr könnt mir helfen
bitte nicht vergessen dass ich eher zu den Laien zu zählen bin!
vielen dank für eure hilfe!!!
mfg m_leeb

Anleitung SmitfraudFix:

Lade dir dieses Tool -> SmitfraudFix
-Boote im abgesicherten Modus
-Starte es dann und lass das System Reinigen. (Option 2)



-Poste danach wie in der Anleitung beschrieben, das Ergebnis des Scans, die C:\rapport.txt

danke mal für diesen tipp
ich werde mein bestes tun!
mfg

hier habe ich dir rapport.txt datei:
SmitFraudFix v2.227

Scan done at 15:54:18,08, 24.09.2007
Run from C:\Dokumente und Einstellungen\Manuel\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{d6ef030a-a235-41ba-9ead-89b6ff542f00}"="flensburg"

[HKEY_CLASSES_ROOT\CLSID\{d6ef030a-a235-41ba-9ead-89b6ff542f00}\InProcServer32]
@="C:\WINDOWS\system32\pluwue.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{d6ef030a-a235-41ba-9ead-89b6ff542f00}\InProcServer32]
@="C:\WINDOWS\system32\pluwue.dll"


»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» hosts


127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

C:\DOKUME~1\ALLUSE~1.WIN\STARTM~1\Online Security Guide.url Deleted
C:\DOKUME~1\ALLUSE~1.WIN\STARTM~1\Security Troubleshooting.url Deleted
C:\DOKUME~1\Manuel\FAVORI~1\Online Security Test.url Deleted
C:\Programme\AntiVirGear 3.7\ Deleted

»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{4D09F4F5-19DF-4FCF-AED7-15D16507752B}: NameServer=213.33.99.70,80.120.17.70
HKLM\SYSTEM\CS1\Services\Tcpip\..\{4D09F4F5-19DF-4FCF-AED7-15D16507752B}: NameServer=213.33.99.70,80.120.17.70
HKLM\SYSTEM\CS3\Services\Tcpip\..\{4D09F4F5-19DF-4FCF-AED7-15D16507752B}: NameServer=213.33.99.70,80.120.17.70


»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{d6ef030a-a235-41ba-9ead-89b6ff542f00}"="flensburg"

[HKEY_CLASSES_ROOT\CLSID\{d6ef030a-a235-41ba-9ead-89b6ff542f00}\InProcServer32]
@="C:\WINDOWS\system32\pluwue.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{d6ef030a-a235-41ba-9ead-89b6ff542f00}\InProcServer32]
@="C:\WINDOWS\system32\pluwue.dll"



»»»»»»»»»»»»»»»»»»»»»»»» End

und jetzt!?!
mfg

Smitfraudfix hat nicht alles gefunden!

ComboFix

-Lade dir das Tool hier herunter -> KLICK
-Starte nun die combofix.exe, bestätige mit (Y)es, lass die Bereinigung durchlaufen
und kopiere nun den Text ab, und füge ihn in deinen Beitrag im Board ein!

Dann noch mal Smitfraudfix wie eben laufen lassen und das Log posten.

Filelist

1. Lade das filelist.zip auf deinen Desktop herunter.
2. Entpacke die Zip-Datei auf deinen Desktop (mit einem Packprogramm), öffne die nun auf deinem Destop vorhandene filelist.bat mit einem Doppelklick auf die Datei
3. Dein Editor (Textverarbeitungsprogramm) wird sich öffnen
4. Markiere von diesem Inhalt aus jedem Verzeichnis jeweils die letzten 30 Tage, wähle kopieren, füge diese Dateien in deinem nächsten Beitrag ein.

Dies sind die Verzeichnisse von denen wir jeweils die letzten 30 Tage sehen wollen:
Verzeichnis von C:\
Verzeichnis von C:\WINDOWS\system32
Verzeichnis von C:\WINDOWS
Verzeichnis von C:\WINDOWS\Prefetch (Windows XP)
Verzeichnis von C:\WINDOWS\tasks
Verzeichnis von C:\WINDOWS\Temp
Verzeichnis von C:\DOCUME~1\Name\LOCALS~1\Temp
Credits to Karl83 / KarlKarl

Also mit dem ComboFix gab es bei mir einige Probleme:
nach dem Durchlauf der Reiningung (es wurden einige Stufen aufgezählt...) schlug ein automatischer Neustart fehl und ich bekam den blauen bildschirm mit "schwerwiegender fehler" etc.!

hier sind jedoch die verzeichnisse (jeweils die letzten 30 tage) ... ich hoffe das bringt was!

Verzeichnis von C:\

2007-09-24 20:03 535,875,584 hiberfil.sys
2007-09-24 15:54 2,640 rapport.txt
2007-09-24 00:12 30,729 crashAddress.txt

Verzeichnis von C:\WINDOWS\system32

2007-09-24 20:06 1,179,402 perfh009.dat
2007-09-24 20:06 602,068 perfc009.dat
2007-09-24 20:06 1,505,154 perfh007.dat
2007-09-24 20:06 697,472 perfc007.dat
2007-09-24 20:06 3,742 PerfStringBackup.INI
2007-09-24 20:03 13,002 wpa.dbl
2007-09-24 15:54 0 tmp.txt
2007-09-24 15:54 4,504 tmp.reg
2007-09-18 09:16 40,315 gzmrot-uninst.exe
2007-09-18 09:16 79,882 adssite-remove.exe
2007-09-12 12:46 62,464 gzmrotate.dll
2007-09-06 04:50 17,474,680 MRT.exe
2007-09-06 00:22 289,144 VCCLSID.exe
2007-08-29 19:06 249,852 TZLog.log

Verzeichnis von C:\WINDOWS\Prefetch

2007-09-24 20:06 29,172 WMIPRVSE.EXE-0D449B4F.pf
2007-09-24 20:06 24,898 WMIADAP.EXE-32F99497.pf
2007-09-24 20:06 82,348 IEXPLORE.EXE-360BBB5C.pf
2007-09-24 20:05 20,032 MOBSYNC.EXE-0EFADB79.pf
2007-09-24 20:05 78,658 DWWIN.EXE-2C373FB7.pf
2007-09-24 20:04 119,904 WUAUCLT.EXE-1360D60A.pf
2007-09-24 20:04 29,086 USERINIT.EXE-0743FDA9.pf
2007-09-24 20:04 50,976 POWERPNT.EXE-345BE1B3.pf
2007-09-24 20:04 20,510 REGSVR32.EXE-396DEA2C.pf
2007-09-24 20:04 1,088,058 NTOSBOOT-B00DFAAD.pf
2007-09-24 16:31 58,714 NOTEPAD.EXE-2F2D61E1.pf
2007-09-24 16:16 16,764 VERCLSID.EXE-28F52AD2.pf
2007-09-24 15:59 29,416 WGATRAY.EXE-350D4455.pf
2007-09-24 15:37 62,556 ICQLITE.EXE-27EB5A87.pf
2007-09-24 14:54 34,162 AU_.EXE-17000160.pf
2007-09-24 14:24 19,616 TASKMGR.EXE-06144C13.pf
2007-09-24 14:19 75,258 RUNDLL32.EXE-61CC0D7C.pf
2007-09-24 14:18 50,480 DRWTSN32.EXE-01DDCF15.pf
2007-09-24 14:12 35,992 RUNDLL32.EXE-3F254C92.pf
2007-09-24 13:33 82,220 DUMPREP.EXE-0AF2BF67.pf
2007-09-24 01:07 99,836 WMPLAYER.EXE-017735B5.pf
2007-09-24 00:53 72,810 BEARSHARE.EXE-22CC2AD5.pf
2007-09-24 00:07 76,296 MANAGER07.EXE-38B7302D.pf
2007-09-22 21:32 59,384 RUNDLL32.EXE-4EE39BB6.pf
2007-09-22 20:52 88,622 WMPLAYER.EXE-017735B4.pf
2007-09-22 20:38 80,334 WMPLAYER.EXE-017735B3.pf
2007-09-21 18:31 41,424 WINZIP32.EXE-2F3C90C9.pf
2007-09-21 05:07 13,958 RUNDLL32.EXE-6E8D4657.pf
2007-09-20 13:52 26,636 AGENT.EXE-04D86242.pf
2007-09-20 13:51 12,856 ISUSPM.EXE-0D47C79C.pf
2007-09-19 18:50 57,698 DFRGNTFS.EXE-38C3807C.pf
2007-09-19 18:50 16,498 DEFRAG.EXE-2858C7E2.pf
2007-09-19 18:50 373,210 Layout.ini
2007-09-18 00:13 78,354 WMPLAYER.EXE-017735B1.pf
2007-09-16 20:55 20,488 RUNDLL32.EXE-41FB74E5.pf
2007-09-15 13:14 70,990 MSIMN.EXE-2E3AC8DB.pf
2007-09-15 01:39 65,258 MSNMSGR.EXE-0B0F9290.pf
2007-09-14 17:47 22,162 ZPLAYER.EXE-2230A905.pf
2007-09-14 17:03 20,982 MCSCRIPT.EXE-06C12F1E.pf
2007-09-14 17:03 21,222 MCUPDATE.EXE-05F6C622.pf
2007-09-08 17:18 16,634 RUNDLL32.EXE-7215828E.pf
2007-09-08 17:18 76,222 PHOTOSHP.EXE-37572EC3.pf
2007-09-08 17:09 45,902 ACRORD32INFO.EXE-3AD69296.pf
2007-09-08 17:07 99,642 WINWORD.EXE-218A1AF8.pf
2007-09-08 16:18 23,650 SETUP.EXE-00FAC559.pf
2007-09-08 16:17 7,152 QT3GPPFLATTEN.EXE-0856913B.pf
2007-09-08 16:17 75,624 FFMPEG.EXE-335A8E6C.pf
2007-09-08 16:16 19,332 3GP_CONVERTER.EXE-3731FA52.pf
2007-09-08 16:16 7,426 AVSCHECK.EXE-1A20789A.pf
2007-09-08 15:34 24,164 RUNDLL32.EXE-5E6F207D.pf
2007-09-08 15:34 24,308 RUNDLL32.EXE-46122CFA.pf
2007-09-08 14:32 32,148 RUNDLL32.EXE-3AE85716.pf
2007-09-08 14:32 32,484 RUNDLL32.EXE-4DE6ABA9.pf
2007-09-08 14:31 29,424 RUNDLL32.EXE-3F777136.pf
2007-09-08 14:31 27,880 RUNDLL32.EXE-57492CA2.pf
2007-09-08 14:30 27,304 RUNDLL32.EXE-4150D622.pf
2007-09-08 14:29 27,638 RUNDLL32.EXE-50B5C57E.pf
2007-09-08 14:27 29,428 RUNDLL32.EXE-5E84FFBA.pf
2007-09-08 14:06 16,486 RUNDLL32.EXE-4D165A71.pf
2007-09-07 14:55 81,474 HELPSVC.EXE-1C192440.pf
2007-09-07 08:38 29,190 RUNDLL32.EXE-4C1B3145.pf
2007-09-07 08:38 33,280 RUNDLL32.EXE-696F2A94.pf
2007-09-07 08:10 16,486 RUNDLL32.EXE-766C6BB3.pf
2007-09-05 03:28 18,606 RUNDLL32.EXE-50A0D04F.pf
2007-09-05 02:57 26,348 DIVXSM.EXE-052AE590.pf
2007-09-05 00:43 22,254 RUNDLL32.EXE-552B536E.pf
2007-09-04 22:06 17,098 RUNDLL32.EXE-7487E34E.pf
2007-09-04 22:04 25,420 RUNDLL32.EXE-5BD8A836.pf
2007-09-04 16:07 24,744 RUNDLL32.EXE-5FB62B09.pf
2007-09-04 16:07 24,562 RUNDLL32.EXE-40D217DD.pf
2007-09-04 15:02 19,224 USNSVC.EXE-39BD0D0B.pf
2007-09-04 10:15 16,486 RUNDLL32.EXE-5B9F4A2F.pf
2007-09-04 10:11 16,486 RUNDLL32.EXE-48F58BB1.pf
2007-09-04 09:59 28,966 FFMPEG.EXE-2F5A0451.pf
2007-09-04 09:53 20,826 3GP_CONVERTER.EXE-0933D87D.pf
2007-09-04 09:53 8,154 AVSCHECK.EXE-2BC06317.pf
2007-09-04 09:51 27,350 SETUP.EXE-03C9C583.pf
2007-09-04 09:50 3,408 FFMPEG.EXE-016B1D23.pf
2007-09-04 09:49 7,170 ATOMCHANGER.EXE-316B55FA.pf
2007-09-04 09:49 15,566 3GP_CONVERTER.EXE-357D95BB.pf
2007-09-04 09:44 5,268 MESSAGEBOX.EXE-18B00B46.pf
2007-09-04 09:44 6,656 SHUTDOWN.EXE-1132BD1A.pf
2007-09-04 09:44 3,440 AVSCHECK.EXE-189BBFA6.pf
2007-09-04 09:32 26,940 FLVPLAYER.EXE-1AD552AE.pf
2007-09-04 09:30 14,830 RUNDLL32.EXE-6EEE0EC9.pf
2007-09-03 11:14 42,376 RUNDLL32.EXE-6700A4A0.pf
2007-08-31 18:17 2,640 RUNDLL32.EXE-453420C4.pf
2007-08-30 23:06 16,486 RUNDLL32.EXE-3B75B76F.pf
2007-08-30 22:47 16,426 RUNDLL32.EXE-63DA62D6.pf
2007-08-30 22:23 45,598 THEMESCREATOR.EXE-04579873.pf
2007-08-30 22:05 16,486 RUNDLL32.EXE-66822FB7.pf
2007-08-30 21:18 23,644 RUNDLL32.EXE-72F27B40.pf
2007-08-30 21:17 23,734 RUNDLL32.EXE-50854CFC.pf
2007-08-30 21:15 34,018 THEMESCREATOR-V3.17.B4.EXE-03F54ABE.pf
2007-08-30 21:14 22,718 RUNDLL32.EXE-4AA1433B.pf
2007-08-30 13:38 18,116 RUNDLL32.EXE-693123C7.pf
2007-08-30 12:56 31,746 SAPISVR.EXE-01935425.pf
2007-08-30 12:56 28,818 RUNDLL32.EXE-66AA8248.pf
2007-08-30 11:57 16,486 RUNDLL32.EXE-6D223DAB.pf
2007-08-30 11:50 21,604 ODHOST.EXE-191FCC90.pf
2007-08-30 11:50 22,194 WZQKPICK.EXE-28392457.pf
2007-08-30 11:50 25,800 SQLMANGR.EXE-07A2C011.pf
2007-08-30 11:50 12,212 READER_SL.EXE-2A604B5A.pf
2007-08-30 11:50 10,954 ACROTRAY.EXE-13B05561.pf
2007-08-30 11:50 18,758 CORE.EXE-188297D2.pf
2007-08-30 11:50 13,802 ATNOTES.EXE-1603798A.pf
2007-08-30 11:50 5,010 ISSCH.EXE-0CA829D3.pf
2007-08-30 11:50 14,360 ISUSPM.EXE-375F0166.pf
2007-08-30 11:50 25,830 HKSERV.EXE-19BD6D27.pf
2007-08-30 11:50 14,624 DAEMON.EXE-08834E39.pf
2007-08-30 11:50 19,596 UPDATERUI.EXE-23B9083F.pf
2007-08-30 11:50 16,646 SHSTAT.EXE-0240FD44.pf
2007-08-30 11:50 10,956 CTFMON.EXE-05E57A5E.pf
2007-08-30 11:49 60,682 EXPLORER.EXE-02121B1A.pf
2007-08-30 11:49 18,908 ATI2EVXX.EXE-07A42849.pf
2007-08-30 11:49 5,992 ATIPRBXX.EXE-0B7C0042.pf
2007-08-30 11:49 9,224 ATIPTAXX.EXE-362CCF09.pf
2007-08-30 11:49 15,714 MPNOTIFY.EXE-240461D6.pf
2007-08-30 11:40 6,110 LOGON.SCR-24ADF392.pf
2007-08-30 11:20 16,486 RUNDLL32.EXE-3EA62109.pf
2007-08-30 11:16 10,522 RUNONCE.EXE-01CA3A2F.pf
2007-08-30 11:15 29,192 RUNDLL32.EXE-63CCACB5.pf
2007-08-29 19:08 94,414 ACRORD32.EXE-0ABDA372.pf
2007-08-29 19:06 51,898 UPDATE.EXE-33C870DA.pf
2007-08-29 19:06 5,078 TZCHANGE.EXE-0A83DDF5.pf
2007-08-29 19:05 28,416 UPDATE.EXE-235E9B16.pf
2007-08-29 12:58 7,840 ADOBE GAMMA LOADER.EXE-0C2694E8.pf
2007-08-28 23:26 13,534 UNINST.EXE-1F124E75.pf
2007-08-28 23:26 14,932 UNINSTALLER.EXE-056F804C.pf
2007-08-28 20:09 55,962 UPDATE.EXE-14A99CB9.pf

Verzeichnis von C:\WINDOWS

2007-09-24 20:03 0 0.log
2007-09-24 20:03 1,410,604 WindowsUpdate.log
2007-09-24 20:03 50 wiaservc.log
2007-09-24 20:03 159 wiadebug.log
2007-09-24 20:03 2,048 bootstat.dat
2007-09-24 15:55 161,532 setupact.log
2007-09-24 15:51 179,632 ntbtlog.txt
2007-09-24 15:49 32,622 SchedLgU.Txt
2007-09-14 17:03 512 randseed.rnd
2007-09-13 12:23 155,469 wmsetup.log
2007-08-30 11:17 657,779 setupapi.log
2007-08-29 19:07 211,484 ntdtcsetup.log
2007-08-29 19:07 349,656 comsetup.log
2007-08-29 19:07 1,189,924 iis6.log
2007-08-29 19:07 1,374 imsins.log
2007-08-29 19:07 54,152 ocmsn.log
2007-08-29 19:07 471,952 tsoc.log
2007-08-29 19:07 43,979 tabletoc.log
2007-08-29 19:07 7,975 KB939683.log
2007-08-29 19:07 61,788 medctroc.Log
2007-08-29 19:07 153,011 netfxocm.log
2007-08-29 19:07 486,697 ocgen.log
2007-08-29 19:07 51,364 msgsocm.log
2007-08-29 19:07 1,017,974 FaxSetup.log
2007-08-29 19:07 322,530 msmqinst.log
2007-08-29 19:06 1,374 imsins.BAK
2007-08-29 19:06 22,450 KB933360.log

Verzeichnis von C:\WINDOWS\tasks

2007-09-24 20:03 6 SA.DAT
2007-09-12 08:58 276 AppleSoftwareUpdate.job
2001-08-23 14:00 65 desktop.ini

Verzeichnis von C:\WINDOWS\temp

2007-09-24 20:04 409 WGANotify.settings
2007-09-24 20:03 16,384 Perflib_Perfdata_1f0.dat
2007-09-24 20:03 255 WGAErrLog.txt
2007-09-24 15:58 16,384 Perflib_Perfdata_1f8.dat
2007-09-04 09:47 16,384 Perflib_Perfdata_758.dat
2007-08-29 12:56 16,384 Perflib_Perfdata_744.dat
2007-08-20 15:42 16,384 Perflib_Perfdata_788.dat

Verzeichnis von C:\DOKUME~1\Manuel\LOKALE~1\Temp

2007-09-24 20:07 155,010 filelist.txt
2007-09-24 20:03 406 jusched.log
2007-03-23 03:07 2,478 filelist.bat