virus Alureon.H gefunden und windows vista updates nicht mehr möglich

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4376

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18928

01.08.2010 13:58:21
mbam-log-2010-08-01 (13-58-21).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 138796
Laufzeit: 7 Minute(n), 42 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\Windows\Temp\svchost.exe (Worm.Koobface) -> Quarantined and deleted successfully.
         

logfile of random's system information tool 1.08 2010-08-01 12:58:06

======Uninstall list======

Activation Assistant for the 2007 Microsoft Office suites-->"C:\ProgramData\{623D32E9-0C62-4453-AD44-98B31F52A5E1}\Microsoft Office Activation Assistant.exe" REMOVE=TRUE MODIFY=FALSE
Adobe Flash Player 10 ActiveX-->C:\Windows\system32\Macromed\Flash\FlashUtil10h_ActiveX.exe -maintain activex
Adobe Flash Player 10 Plugin-->C:\Windows\system32\Macromed\Flash\FlashUtil10h_Plugin.exe -maintain plugin
Adobe Reader 9.3.3 - Deutsch-->MsiExec.exe /I{AC76BA86-7AD7-1031-7B44-A93000000001}
Adobe Shockwave Player 11.5-->"C:\Windows\system32\Adobe\Shockwave 11\uninstaller.exe"
Advertising Center-->MsiExec.exe /X{b2ec4a38-b545-4a00-8214-13fe0e915e6d}
Apple Application Support-->MsiExec.exe /I{B2D328BE-45AD-4D92-96F9-2151490A203E}
Apple Mobile Device Support-->MsiExec.exe /I{85991ED2-010C-4930-96FA-52F43C2CE98A}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
Auslogics Disk Defrag-->"C:\Program Files\Auslogics\Auslogics Disk Defrag\unins000.exe"
Bonjour-->MsiExec.exe /X{0CB9668D-F979-4F31-B8B8-67FE90F929F8}
CCleaner-->"C:\Program Files\CCleaner\uninst.exe"
Choice Guard-->MsiExec.exe /I{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}
Compatibility Pack für 2007 Office System-->MsiExec.exe /X{90120000-0020-0407-0000-0000000FF1CE}
CyberLink MediaShow-->"C:\Program Files\InstallShield Installation Information\{80E158EA-7181-40FE-A701-301CE6BE64AB}\Setup.exe" /z-uninstall
CyberLink MediaShow-->"C:\Program Files\InstallShield Installation Information\{80E158EA-7181-40FE-A701-301CE6BE64AB}\Setup.exe" /z-uninstall
CyberLink PhotoNow-->"C:\Program Files\InstallShield Installation Information\{D36DD326-7280-11D8-97C8-000129760CBE}\Setup.exe" /z-uninstall
CyberLink PhotoNow-->"C:\Program Files\InstallShield Installation Information\{D36DD326-7280-11D8-97C8-000129760CBE}\Setup.exe" /z-uninstall
CyberLink PowerDirector-->"C:\Program Files\InstallShield Installation Information\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}\Setup.exe" /z-uninstall
CyberLink PowerDirector-->"C:\Program Files\InstallShield Installation Information\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}\Setup.exe" /z-uninstall
CyberLink PowerDVD 8-->"C:\Program Files\InstallShield Installation Information\{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}\Setup.exe" /z-uninstall
CyberLink PowerDVD 8-->"C:\Program Files\InstallShield Installation Information\{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}\Setup.exe" /z-uninstall
CyberLink PowerProducer-->"C:\Program Files\InstallShield Installation Information\{B7A0CE06-068E-11D6-97FD-0050BACBF861}\Setup.exe" /z-uninstall
CyberLink PowerProducer-->"C:\Program Files\InstallShield Installation Information\{B7A0CE06-068E-11D6-97FD-0050BACBF861}\Setup.exe" /z-uninstall
CyberLink YouCam-->"C:\Program Files\InstallShield Installation Information\{01FB4998-33C4-4431-85ED-079E3EEFE75D}\Setup.exe" /z-uninstall
CyberLink YouCam-->"C:\Program Files\InstallShield Installation Information\{01FB4998-33C4-4431-85ED-079E3EEFE75D}\Setup.exe" /z-uninstall
DivX Plus Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
Fraps (remove only)-->"F:\fraps\uninstall.exe"
G Data AntiVirus 2011-->MsiExec.exe /I{A7FB84F1-FA4F-4B50-9AEC-4F83AB1DFEBE}
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall  /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
ICQ7-->"C:\Program Files\InstallShield Installation Information\{88EB38EF-4D2C-436D-ABD3-56B232674062}\ICQ7.exe" -runfromtemp -l0x0009 -removeonly
IrfanView (remove only)-->C:\Program Files\IrfanView\iv_uninstall.exe
iTunes-->MsiExec.exe /I{91F7F3F3-CE80-48C3-8327-7D24A0A5716A}
Java(TM) 6 Update 18-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216012FF}
Junk Mail filter update-->MsiExec.exe /I{4AB8B41B-3AF1-46BE-99B0-0ACD3B300C0A}
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU-->c:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - deu\setup.exe
Microsoft .NET Framework 3.5 Language Pack SP1 - deu-->MsiExec.exe /I{052FDD78-A6EA-3187-8386-C82F4CA3A929}
Microsoft .NET Framework 3.5 SP1-->c:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft .NET Framework 4 Client Profile DEU Language Pack-->C:\Windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\ClientLP\Setup.exe /repair /x86 /lcid 1031 /parameterfolder ClientLP
Microsoft .NET Framework 4 Client Profile DEU Language Pack-->MsiExec.exe /X{F750C986-5310-3A5A-95F8-4EC71C8AC01C}
Microsoft .NET Framework 4 Client Profile-->C:\Windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\Setup.exe /repair /x86 /parameterfolder Client
Microsoft .NET Framework 4 Client Profile-->MsiExec.exe /X{3C3901C5-3455-3E0A-A214-0B093A5070A6}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0016-0407-0000-0000000FF1CE} /uninstall {9BD40163-B95D-4B07-8991-0AB775B6D88B}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0018-0407-0000-0000000FF1CE} /uninstall {9BD40163-B95D-4B07-8991-0AB775B6D88B}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001B-0407-0000-0000000FF1CE} /uninstall {9BD40163-B95D-4B07-8991-0AB775B6D88B}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-006E-0407-0000-0000000FF1CE} /uninstall {26454C26-D259-4543-AA60-3189E09C5F76}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-00A1-0407-0000-0000000FF1CE} /uninstall {9BD40163-B95D-4B07-8991-0AB775B6D88B}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}
Microsoft Office Excel MUI (German) 2007-->MsiExec.exe /X{90120000-0016-0407-0000-0000000FF1CE}
Microsoft Office Home and Student 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall HOMESTUDENTR /dll OSETUP.DLL
Microsoft Office Home and Student 2007-->MsiExec.exe /X{91120000-002F-0000-0000-0000000FF1CE}
Microsoft Office Live Add-in 1.5-->MsiExec.exe /I{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}
Microsoft Office OneNote MUI (German) 2007-->MsiExec.exe /X{90120000-00A1-0407-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (German) 2007-->MsiExec.exe /X{90120000-0018-0407-0000-0000000FF1CE}
Microsoft Office PowerPoint Viewer 2007 (German)-->MsiExec.exe /X{95120000-00AF-0407-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Italian) 2007-->MsiExec.exe /X{90120000-001F-0410-0000-0000000FF1CE}
Microsoft Office Proofing (German) 2007-->MsiExec.exe /X{90120000-002C-0407-0000-0000000FF1CE}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0407-0000-0000000FF1CE} /uninstall {A0516415-ED61-419A-981D-93596DA74165}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {ABDDE972-355B-4AF1-89A8-DA50B7B5C045}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {F580DDD5-8D37-4998-968E-EBB76BB86787}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0410-0000-0000000FF1CE} /uninstall {322296D4-1EAE-4030-9FBC-D2787EB25FA2}
Microsoft Office Shared MUI (German) 2007-->MsiExec.exe /X{90120000-006E-0407-0000-0000000FF1CE}
Microsoft Office Word MUI (German) 2007-->MsiExec.exe /X{90120000-001B-0407-0000-0000000FF1CE}
Microsoft Silverlight-->MsiExec.exe /I{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft SQL Server 2005 Compact Edition [ENU]-->MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
Microsoft VC9 runtime libraries-->MsiExec.exe /I{797EE0CA-8165-405C-B5CE-F11EC20F1BB0}
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053-->MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{837b34e3-7c30-493c-8f6a-2b0f04e2912c}
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148-->MsiExec.exe /X{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Moorhuhn Kart Extra XXL-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DE60CAE2-4CA8-4A6A-A557-0668004FE889}\Setup.exe" -l0x7 
Mozilla Firefox (3.6.8)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB941833)-->MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 4.0 SP2 (KB973688)-->MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}
Nero 9 Essentials-->C:\Program Files\Common Files\Nero\Nero ProductInstaller 4\SetupX.exe  REMOVESERIALNUMBER="XM02-508X-MHAT-19WU-9Z3Z-0CH0-3U6E-85W5-MMHH-6647-1Z5L-7M8C-0U45-758P-0000"
Nero ControlCenter-->MsiExec.exe /X{bd5ca0da-71ad-43da-b19e-6eee0c9adc9a}
Nero Installer-->MsiExec.exe /X{e8a80433-302b-4ff1-815d-fcc8eac482ff}
Nero Online Upgrade-->MsiExec.exe /X{dba84796-8503-4ff0-af57-1747dd9a166d}
Nero StartSmart OEM-->MsiExec.exe /X{4D43D635-6FDA-4fa5-AA9B-23CF73D058EA}
Nero StartSmart-->MsiExec.exe /X{7748ac8c-18e3-43bb-959b-088faea16fb2}
neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
Nokia Connectivity Cable Driver-->MsiExec.exe /I{52D02A2B-03D2-4E34-A358-DC5D951FD296}
NVIDIA Drivers-->C:\Windows\system32\nvuninst.exe UninstallGUI
QuickTime-->MsiExec.exe /I{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}
Realtek 8169 8168 8101E 8102E Ethernet Driver-->C:\Program Files\InstallShield Installation Information\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}\setup.exe -runfromtemp -l0x0007 -removeonly
Realtek High Definition Audio Driver-->C:\Program Files\Realtek\Audio\HDA\RtlUpd.exe -r -m -nrg2709
Realtek USB 2.0 Card Reader-->C:\Program Files\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\setup.exe -runfromtemp -l0x0007 -removeonly
Revo Uninstaller 1.89-->C:\Program Files\VS Revo Group\Revo Uninstaller\uninst.exe
RTC Client API v1.2-->MsiExec.exe /X{44CDBD1B-89FB-4E02-8319-2A4C550F664A}
Security Update for 2007 Microsoft Office System (KB969559)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {69F52148-9BF6-4CDC-BF76-103DEAF3DD08}
Security Update for 2007 Microsoft Office System (KB976321)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {7F207DCA-3399-40CB-A968-6E5991B1421A}
Security Update for 2007 Microsoft Office System (KB982312)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {B0EC5722-241F-4CDA-83B4-AA5846B6F9F4}
Security Update for 2007 Microsoft Office System (KB982331)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {E8766951-2B6C-4022-86E8-80D2D1762B76}
Security Update for Microsoft Office Excel 2007 (KB982308)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {C3F9A0DC-A5D1-4BB6-870E-2953E5A2487B}
Security Update for Microsoft Office InfoPath 2007 (KB979441)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {8CCB781A-CF6B-4FCB-B6D8-59C64DF5C6DB}
Security Update for Microsoft Office PowerPoint 2007 (KB982158)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {F5B70033-E79C-4569-90BF-BC9B4E4F3F46}
Security Update for Microsoft Office system 2007 (972581)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {3D019598-7B59-447A-80AE-815B703B84FF}
Security Update for Microsoft Office system 2007 (KB969613)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {5ECEB317-CBE9-4E08-AB10-756CB6F0FB6C}
Security Update for Microsoft Office system 2007 (KB974234)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {FCD742B9-7A55-44BC-A776-F795F21FEDDC}
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {71127777-8B2C-4F97-AF7A-6CF8CAC8224D}
Security Update for Microsoft Office Word 2007 (KB982135)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {0112C750-A06F-4F92-9C40-E5C1EA9A70EB}
Spelling Dictionaries Support For Adobe Reader 9-->MsiExec.exe /I{AC76BA86-7AD7-5464-3428-900000000004}
Synaptics Pointing Device Driver-->rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall
UMTS USB Modem Manager-->C:\Program Files\UMTS USB Modem Manager\uninst.exe
Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D}
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
Update for Microsoft Office OneNote 2007 (KB980729)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {329050A9-EF80-40F9-B633-74508F54C1FF}
Update für Microsoft Office Excel 2007 Help (KB963678)-->msiexec /package {90120000-0016-0407-0000-0000000FF1CE} /uninstall {BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}
Update für Microsoft Office Powerpoint 2007 Help (KB963669)-->msiexec /package {90120000-0018-0407-0000-0000000FF1CE} /uninstall {EA160DA3-E9B5-4D03-A518-21D306665B96}
Update für Microsoft Office Word 2007 Help (KB963665)-->msiexec /package {90120000-001B-0407-0000-0000000FF1CE} /uninstall {38472199-D7B6-4833-A949-10E4EE6365A1}
Update Manager-->MsiExec.exe /I{F428D0FB-765D-40EB-BDD8-A1E7F5C597FA}
USB Video Device-->C:\Program Files\InstallShield Installation Information\{399C37FB-08AF-493B-BFED-20FBD85EDF7F}\setup.exe -runfromtemp -l0x0007 -removeonly
VC80CRTRedist - 8.0.50727.4053-->MsiExec.exe /I{5EE7D259-D137-4438-9A5F-42F432EC0421}
VCRedistSetup-->MsiExec.exe /I{3921A67A-5AB1-4E48-9444-C71814CF3027}
Viewpoint Media Player-->C:\Program Files\Viewpoint\Viewpoint Experience Technology\mtsAxInstaller.exe /u
Visual C++ 2008 x86 Runtime - (v9.0.30729)-->MsiExec.exe /X{F333A33D-125C-32A2-8DCE-5C5D14231E27}
Visual C++ 2008 x86 Runtime - v9.0.30729.01-->C:\Windows\system32\msiexec.exe /x {F333A33D-125C-32A2-8DCE-5C5D14231E27} /qb+ REBOOTPROMPT=""
VLC media player 1.1.2-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Windows Live Call-->MsiExec.exe /I{835686C5-8650-49EB-8CA0-4528B4035495}
Windows Live Communications Platform-->MsiExec.exe /I{F69E83CF-B440-43F8-89E6-6EA80712109B}
Windows Live Essentials-->C:\Program Files\Windows Live\Installer\wlarp.exe
Windows Live Essentials-->MsiExec.exe /I{DF5F687F-8018-4542-9F98-7084E9022917}
Windows Live Fotogalerie-->MsiExec.exe /X{6B96DADA-1A27-4A04-8CB2-CC45168D05FA}
Windows Live ID-Anmelde-Assistent-->MsiExec.exe /X{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}
Windows Live Mail-->MsiExec.exe /I{5A166C0B-9557-4364-A057-F946D674E6AC}
Windows Live Messenger-->MsiExec.exe /X{837B6259-6FF5-4E66-87C1-A5A15ED36FF4}
Windows Live OneCare safety scanner-->"C:\Program Files\Windows Live Safety Center\UnInstall.exe"
Windows Live OneCare safety scanner-->MsiExec.exe /X{FE0646A7-19D0-41B4-A2BB-2C35D644270D}
Windows Live Sync-->MsiExec.exe /X{8C1E2925-14F8-45AA-B999-1E2A74BF5607}
Windows Live Writer-->MsiExec.exe /X{81821BF8-DA20-4F8C-AA87-F70A274828D4}
Windows Live-Uploadtool-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
WinRAR-->C:\Program Files\WinRAR\uninstall.exe

======Hosts File======

127.0.0.1	www.007guard.com
127.0.0.1	007guard.com
127.0.0.1	008i.com
127.0.0.1	www.008k.com
127.0.0.1	008k.com
127.0.0.1	www.00hq.com
127.0.0.1	00hq.com
127.0.0.1	010402.com
127.0.0.1	www.032439.com
127.0.0.1	032439.com

======Security center information======

AS: Lavasoft Ad-Watch Live! (disabled)
AS: Windows Defender

======System event log======

Computer Name: p-PC
Event Code: 20003
Message: Der Prozess zum Hinzufügen von Dienst hwdatacard für Geräteinstanz-ID USB\VID_12D1&PID_1001&MI_02\6&1003F204&1&0002 wurde mit folgendem Status beendet: 0.
Record Number: 28129
Source Name: Microsoft-Windows-User-PnP
Time Written: 20091017154406.732800-000
Event Type: Informationen
User: NT-AUTORITÄT\SYSTEM

Computer Name: p-PC
Event Code: 20001
Message: Der Prozess zum Installieren von Treiber FileRepository\ewser2k.inf_12542008\ewser2k.inf für Geräteinstanz-ID USB\VID_12D1&PID_1001&MI_01\6&1003F204&1&0001 wurde mit folgendem Status beendet: 0.
Record Number: 28128
Source Name: Microsoft-Windows-User-PnP
Time Written: 20091017154405.982000-000
Event Type: Informationen
User: NT-AUTORITÄT\SYSTEM

Computer Name: p-PC
Event Code: 20003
Message: Der Prozess zum Hinzufügen von Dienst hwdatacard für Geräteinstanz-ID USB\VID_12D1&PID_1001&MI_01\6&1003F204&1&0001 wurde mit folgendem Status beendet: 0.
Record Number: 28127
Source Name: Microsoft-Windows-User-PnP
Time Written: 20091017154405.837000-000
Event Type: Informationen
User: NT-AUTORITÄT\SYSTEM

Computer Name: p-PC
Event Code: 20001
Message: Der Prozess zum Installieren von Treiber FileRepository\ewmdm2k.inf_3e6e8a74\ewmdm2k.inf für Geräteinstanz-ID USB\VID_12D1&PID_1001&MI_00\6&1003F204&1&0000 wurde mit folgendem Status beendet: 0.
Record Number: 28126
Source Name: Microsoft-Windows-User-PnP
Time Written: 20091017154404.982400-000
Event Type: Informationen
User: NT-AUTORITÄT\SYSTEM

Computer Name: p-PC
Event Code: 20003
Message: Der Prozess zum Hinzufügen von Dienst hwdatacard für Geräteinstanz-ID USB\VID_12D1&PID_1001&MI_00\6&1003F204&1&0000 wurde mit folgendem Status beendet: 0.
Record Number: 28125
Source Name: Microsoft-Windows-User-PnP
Time Written: 20091017154404.282800-000
Event Type: Informationen
User: NT-AUTORITÄT\SYSTEM

=====Application event log=====

Computer Name: Computername
Event Code: 105
Message: 
Record Number: 5
Source Name: PLFlash DeviceIoControl Service
Time Written: 20090706165614.000000-000
Event Type: Informationen
User: 

Computer Name: Computername
Event Code: 0
Message: 
Record Number: 4
Source Name: Nero BackItUp Scheduler 3
Time Written: 20090706165614.000000-000
Event Type: Informationen
User: 

Computer Name: WIN-CVTVHLCNH4O
Event Code: 4625
Message: Das EventSystem-Subsystem unterdrückt duplizierte Ereignisprotokolleinträge für eine Dauer von 86400 Sekunden. Dieses Zeitlimit kann durch den REG_DWORD-Wert SuppressDuplicateDuration unter folgendem Registrierungsschlüssel gesteuert werden: HKLM\Software\Microsoft\EventSystem\EventLog.
Record Number: 3
Source Name: Microsoft-Windows-EventSystem
Time Written: 20090706165610.000000-000
Event Type: Informationen
User: 

Computer Name: WIN-CVTVHLCNH4O
Event Code: 900
Message: Der Softwarelizenzierungsdienst wird gestartet.

Record Number: 2
Source Name: Microsoft-Windows-Security-Licensing-SLC
Time Written: 20090706165610.000000-000
Event Type: Informationen
User: 

Computer Name: WIN-CVTVHLCNH4O
Event Code: 1531
Message: Der Benutzerprofildienst wurde erfolgreich gestartet.  


Record Number: 1
Source Name: Microsoft-Windows-User Profiles Service
Time Written: 20090706165610.000000-000
Event Type: Informationen
User: NT-AUTORITÄT\SYSTEM

=====Security event log=====

Computer Name: Computername
Event Code: 4624
Message: Ein Konto wurde erfolgreich angemeldet.

Antragsteller:
	Sicherheits-ID:		S-1-0-0
	Kontoname:		-
	Kontodomäne:		-
	Anmelde-ID:		0x0

Anmeldetyp:			0

Neue Anmeldung:
	Sicherheits-ID:		S-1-5-18
	Kontoname:		SYSTEM
	Kontodomäne:		NT-AUTORITÄT
	Anmelde-ID:		0x3e7
	Anmelde-GUID:		{00000000-0000-0000-0000-000000000000}

Prozessinformationen:
	Prozess-ID:		0x4
	Prozessname:		

Netzwerkinformationen:
	Arbeitsstationsname:	-
	Quellnetzwerkadresse:	-
	Quellport:		-

Detaillierte Authentifizierungsinformationen:
	Anmeldeprozess:		-
	Authentifizierungspaket:	-
	Übertragene Dienste:	-
	Paketname (nur NTLM):	-
	Schlüssellänge:		0

Dieses Ereignis wird beim Erstellen einer Anmeldesitzung generiert. Es wird auf dem Computer generiert, auf den zugegriffen wurde.

Die Antragstellerfelder geben das Konto auf dem lokalen System an, von dem die Anmeldung angefordert wurde. Dies ist meistens ein Dienst wie der Serverdienst oder ein lokaler Prozess wie "Winlogon.exe" oder "Services.exe".

Das Anmeldetypfeld gibt den jeweiligen Anmeldetyp an. Die häufigsten Typen sind 2 (interaktiv) und 3 (Netzwerk).

Die Felder für die neue Anmeldung geben das Konto an, für das die Anmeldung erstellt wurde, d. h. das angemeldete Konto.

Die Netzwerkfelder geben die Quelle einer Remoteanmeldeanforderung an. der Arbeitsstationsname ist nicht immer verfügbar und kann in manchen Fällen leer bleiben.

Die Felder für die Authentifizierungsinformationen enthalten detaillierte Informationen zu dieser speziellen Anmeldeanforderung.
	 - Die Anmelde-GUID ist ein eindeutiger Bezeichner, der verwendet werden kann, um dieses Ereignis mit einem KDC-Ereignis zu korrelieren.
	- Die übertragenen Dienste geben an, welche Zwischendienste an der Anmeldeanforderung beteiligt waren.
	- Der Paketname gibt das in den NTLM-Protokollen verwendete Unterprotokoll an.
	- Die Schlüssellänge gibt die Länge des generierten Sitzungsschlüssels an. Wenn kein Sitzungsschlüssel angefordert wurde, ist dieser Wert 0.
Record Number: 5
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090706165542.176585-000
Event Type: Überwachung erfolgreich
User: 

Computer Name: Computername
Event Code: 4608
Message: Windows wird gestartet.

Dieses Ereignis wird protokolliert, wenn LSASS.EXE gestartet und das Überwachungssubsystem initialisiert wird.
Record Number: 4
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090706165542.176585-000
Event Type: Überwachung erfolgreich
User: 

Computer Name: Computername
Event Code: 4647
Message: Benutzerinitiierte Abmeldung:

Antragsteller:
	Sicherheits-ID:		S-1-5-21-3842258658-2313958565-4179438055-500
	Kontoname:		Administrator
	Kontodomäne:		COMPUTERNAME
	Anmelde-ID:		0x3bf56

Dieses Ereignis wird generiert, wenn eine Abmeldung initiiert wird, aber die Anzahl der Tokenreferenzen nicht Null ist und die Anmeldesitzung nicht zerstört werden kann. Es kann keiner Benutzerinitiierte Aktion erfolgen. Dieses Ereignis kann als Abmeldeereignis interpretiert werden.
Record Number: 3
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090306065000.720000-000
Event Type: Überwachung erfolgreich
User: 

Computer Name: Computername
Event Code: 4634
Message: Ein Konto wurde abgemeldet.

Antragsteller:
	Sicherheits-ID:		S-1-5-7
	Kontoname:		ANONYMOUS-ANMELDUNG
	Kontodomäne:		NT-AUTORITÄT
	Anmelde-ID:		0x1dcbf

Anmeldetyp:			3

Dieses Ereignis wird generiert, wenn eine Anmeldesitzung zerstört wird. Es kann anhand des Wertes der Anmelde-ID positiv mit einem Anmeldeereignis korreliert werden. Anmelde-IDs sind nur zwischen Neustarts auf demselben Computer eindeutig.
Record Number: 2
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090306064959.643600-000
Event Type: Überwachung erfolgreich
User: 

Computer Name: Computername
Event Code: 4616
Message: Die Systemzeit wurde geändert.

Antragsteller:
	Sicherheits-ID:		S-1-5-19
	Kontoname:		LOKALER DIENST
	Kontodomäne:		NT-AUTORITÄT
	Anmelde-ID:		0x3e5

Prozessinformationen:
	Prozess-ID:	0x494
	Name:		C:\Windows\System32\svchost.exe

Vorherige Zeit:		07:49:59 06.03.2009
Neue Zeit:		07:49:59 06.03.2009

Dieses Ereignis wird generiert, wenn die Systemzeit geändert wird. Es ist normal, dass der mit Systemberechtigung ausgeführte Windows-Zeitdienst die Systemzeit regelmäßig ändert. Andere Änderungen der Systemzeit können darauf hinweisen, dass der Computer manipuliert wird.
Record Number: 1
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090306064959.550000-000
Event Type: Überwachung erfolgreich
User: 

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=%CommonProgramFiles%\Microsoft Shared\Windows Live;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\QuickTime\QTSystem\;%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=x86
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 23 Stepping 10, GenuineIntel
"PROCESSOR_REVISION"=170a
"NUMBER_OF_PROCESSORS"=2
"TRACE_FORMAT_SEARCH_PATH"=\\NTREL202.ntdev.corp.microsoft.com\4F18C3A5-CA09-4DBD-B6FC-219FDD4C6BE0\TraceFormat
"DFSTRACINGON"=FALSE
"asl.log"=Destination=file;OnFirstLog=command,environment
"CLASSPATH"=.;C:\Program Files\Java\jre6\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre6\lib\ext\QTJava.zip
"PSModulePath"=%SystemRoot%\system32\WindowsPowerShell\v1.0\Modules\

-----------------EOF-----------------
         

Logfile of random's system information tool 1.08 (written by random/random)
Run by p at 2010-08-01 13:40:52
Microsoft® Windows Vista™ Home Premium  Service Pack 2
System drive C: has 302 GB (67%) free of 451 GB
Total RAM: 3066 MB (57% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:41:23, on 01.08.2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18928)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\tsnp2uvc.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\G DATA\AntiVirus\AVKTray\AVKTray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Users\p\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KSX4C9T6\windows-kb890830-v3.9[1].exe
c:\1287cab6b9e162ae02f069\mrtstub.exe
C:\Windows\system32\MRT.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
H:\RSIT.exe
C:\Program Files\trend micro\p.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://aolwebmail.aol.de/landing-page
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: ::1 localhost
O2 - BHO: G Data WebFilter Class - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files\G Data\AntiVirus\WebFilter\AvkWebIE.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: G Data WebFilter - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files\G Data\AntiVirus\WebFilter\AvkWebIE.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [tsnp2uvc] C:\Windows\tsnp2uvc.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [G Data AntiVirus Tray Application] C:\Program Files\G Data\AntiVirus\AVKTray\AVKTray.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-25/4 (file missing)
O9 - Extra 'Tools' menuitem: eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-25/4 (file missing)
O9 - Extra button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-15/4 (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-15/4 (file missing) (HKCU)
O15 - Trusted Zone: hxxp://download.windowsupdate.com
O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} (Windows Live OneCare safety scanner control) - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/de-de/wlscctrl2.cab
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: G Data AntiVirus Proxy (AVKProxy) - G Data Software AG - C:\Program Files\Common Files\G DATA\AVKProxy\AVKProxy.exe
O23 - Service: G Data Scheduler (AVKService) - G Data Software AG - C:\Program Files\G DATA\AntiVirus\AVK\AVKService.exe
O23 - Service: G Data Dateisystem Wächter (AVKWCtl) - G Data Software AG - C:\Program Files\G DATA\AntiVirus\AVK\AVKWCtl.exe
O23 - Service: Dienst "Bonjour" (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: G Data Scanner (GDScan) - G Data Software AG - C:\Program Files\Common Files\G DATA\GDScan\GDScan.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Lavasoft Ad-Aware Service - Unknown owner - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (file missing)
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exe
O23 - Service: Reset Reader (resetWinService) - Unknown owner - C:\Program Files\Realtek Semiconductor Corp\Realtek USB 2.0 Card Reader\reset.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared files\RichVideo.exe

--
End of file - 7566 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0124123D-61B4-456f-AF86-78C53A0790C5}]
G Data WebFilter - C:\Program Files\G Data\AntiVirus\WebFilter\AvkWebIE.dll [2010-03-31 657480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-06-19 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID-Anmelde-Hilfsprogramm - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18 403840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-02-19 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{0124123D-61B4-456f-AF86-78C53A0790C5} - G Data WebFilter - C:\Program Files\G Data\AntiVirus\WebFilter\AvkWebIE.dll [2010-03-31 657480]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-21 1008184]
"tsnp2uvc"=C:\Windows\tsnp2uvc.exe [2008-08-28 233472]
"NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2009-02-10 13605408]
"NvMediaCenter"=C:\Windows\system32\NvMcTray.dll [2009-02-10 92704]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2009-02-27 1434920]
"G Data AntiVirus Tray Application"=C:\Program Files\G Data\AntiVirus\AVKTray\AVKTray.exe [2010-03-31 963144]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2010-07-21 141608]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-21 125952]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-04-11 1233920]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-06-09 976832]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-06-20 35760]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM]
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe [2006-09-11 218032]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"EnableLUA"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"BindDirectlyToPropertySetStorage"=0
"NoResolveTrack"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-08-01 13:19:38 ----D---- C:\1287cab6b9e162ae02f069
2010-08-01 12:58:52 ----D---- C:\Users\p\AppData\Roaming\Malwarebytes
2010-08-01 12:58:37 ----A---- C:\Windows\system32\drivers\mbamswissarmy.sys
2010-08-01 12:58:29 ----D---- C:\ProgramData\Malwarebytes
2010-08-01 12:58:24 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-08-01 12:58:24 ----A---- C:\Windows\system32\drivers\mbam.sys
2010-08-01 12:58:00 ----D---- C:\Program Files\trend micro
2010-08-01 12:57:59 ----D---- C:\rsit
2010-08-01 12:28:32 ----D---- C:\Program Files\Windows Live Safety Center
2010-08-01 12:07:12 ----D---- C:\Program Files\iPod
2010-08-01 12:07:10 ----D---- C:\Program Files\iTunes
2010-08-01 11:28:06 ----A---- C:\Windows\msoffice.ini
2010-08-01 10:15:04 ----A---- C:\Windows\system32\drivers\bwizfgvr.sys
2010-08-01 10:01:48 ----D---- C:\Windows\system32\MpEngineStore
2010-08-01 09:49:48 ----D---- C:\Windows\CheckSur
2010-08-01 08:23:34 ----D---- C:\MGADiagToolOutput
2010-08-01 08:22:37 ----A---- C:\Windows\proxycfg.exe
2010-08-01 08:22:07 ----A---- C:\Descriptors.txt
2010-08-01 08:22:03 ----D---- C:\AULOGS
2010-08-01 08:02:34 ----D---- C:\ProgramData\Office Genuine Advantage
2010-08-01 00:17:03 ----A---- C:\Windows\system32\drivers\HookCentre.sys
2010-07-31 23:41:43 ----ASH---- C:\hiberfil.sys
2010-07-31 22:21:33 ----D---- C:\Program Files\TuneUp Utilities 2010
2010-07-31 22:08:11 ----D---- C:\Program Files\BitLocker
2010-07-31 18:56:11 ----HDC---- C:\ProgramData\{BD986C1B-72EC-4B82-B47B-6CAC4E6F494E}
2010-07-28 17:31:12 ----D---- C:\ProgramData\WindowsSearch
2010-07-20 17:34:20 ----D---- C:\Program Files\Takatis - A Tribute To Manfred Trenz
2010-07-12 17:54:35 ----D---- C:\Users\p\AppData\Roaming\SharePod
2010-07-08 17:53:06 ----D---- C:\Windows\Minidump
2010-07-08 17:20:00 ----D---- C:\Windows\pss
2010-07-04 22:22:17 ----D---- C:\Program Files\QIP 2010
2010-07-02 16:57:20 ----A---- C:\Windows\system32\XAudio2_7.dll
2010-07-02 16:57:20 ----A---- C:\Windows\system32\XAPOFX1_5.dll
2010-07-02 16:57:19 ----A---- C:\Windows\system32\xactengine3_7.dll
2010-07-02 16:57:18 ----A---- C:\Windows\system32\D3DCompiler_43.dll
2010-07-02 16:57:17 ----A---- C:\Windows\system32\d3dx11_43.dll
2010-07-02 16:57:17 ----A---- C:\Windows\system32\d3dcsx_43.dll
2010-07-02 16:57:16 ----A---- C:\Windows\system32\d3dx10_43.dll
2010-07-02 16:57:15 ----A---- C:\Windows\system32\D3DX9_43.dll
2010-07-02 16:57:14 ----A---- C:\Windows\system32\XAudio2_6.dll
2010-07-02 16:57:14 ----A---- C:\Windows\system32\XAPOFX1_4.dll
2010-07-02 16:57:13 ----A---- C:\Windows\system32\xactengine3_6.dll
2010-07-02 16:57:12 ----A---- C:\Windows\system32\X3DAudio1_7.dll
2010-07-02 16:57:11 ----A---- C:\Windows\system32\XAudio2_5.dll
2010-07-02 16:57:10 ----A---- C:\Windows\system32\xactengine3_5.dll
2010-07-02 16:57:09 ----A---- C:\Windows\system32\D3DCompiler_42.dll
2010-07-02 16:57:08 ----A---- C:\Windows\system32\d3dcsx_42.dll
2010-07-02 16:57:07 ----A---- C:\Windows\system32\d3dx11_42.dll
2010-07-02 16:57:06 ----A---- C:\Windows\system32\d3dx10_42.dll
2010-07-02 16:57:05 ----A---- C:\Windows\system32\D3DX9_42.dll
2010-07-02 16:57:04 ----A---- C:\Windows\system32\d3dx10_41.dll
2010-07-02 16:57:04 ----A---- C:\Windows\system32\D3DCompiler_41.dll
2010-07-02 16:57:03 ----A---- C:\Windows\system32\D3DX9_41.dll
2010-07-02 16:57:02 ----A---- C:\Windows\system32\XAudio2_4.dll
2010-07-02 16:57:02 ----A---- C:\Windows\system32\XAPOFX1_3.dll
2010-07-02 16:57:01 ----A---- C:\Windows\system32\xactengine3_4.dll
2010-07-02 16:57:00 ----A---- C:\Windows\system32\X3DAudio1_6.dll
2010-07-02 16:56:59 ----A---- C:\Windows\system32\d3dx10_40.dll
2010-07-02 16:56:59 ----A---- C:\Windows\system32\D3DCompiler_40.dll
2010-07-02 16:56:58 ----A---- C:\Windows\system32\D3DX9_40.dll
2010-07-02 16:56:57 ----A---- C:\Windows\system32\XAudio2_3.dll
2010-07-02 16:56:57 ----A---- C:\Windows\system32\XAPOFX1_2.dll
2010-07-02 16:56:56 ----A---- C:\Windows\system32\xactengine3_3.dll
2010-07-02 16:56:54 ----A---- C:\Windows\system32\X3DAudio1_5.dll
2010-07-02 16:56:53 ----A---- C:\Windows\system32\XAudio2_2.dll
2010-07-02 16:56:53 ----A---- C:\Windows\system32\XAPOFX1_1.dll
2010-07-02 16:56:52 ----A---- C:\Windows\system32\xactengine3_2.dll
2010-07-02 16:56:51 ----A---- C:\Windows\system32\d3dx10_39.dll
2010-07-02 16:56:51 ----A---- C:\Windows\system32\D3DCompiler_39.dll
2010-07-02 16:56:50 ----A---- C:\Windows\system32\D3DX9_39.dll
2010-07-02 16:56:49 ----A---- C:\Windows\system32\XAPOFX1_0.dll
2010-07-02 16:56:48 ----A---- C:\Windows\system32\XAudio2_1.dll
2010-07-02 16:56:48 ----A---- C:\Windows\system32\xactengine3_1.dll
2010-07-02 16:56:47 ----A---- C:\Windows\system32\X3DAudio1_4.dll
2010-07-02 16:56:46 ----A---- C:\Windows\system32\d3dx10_38.dll
2010-07-02 16:56:46 ----A---- C:\Windows\system32\D3DCompiler_38.dll
2010-07-02 16:56:45 ----A---- C:\Windows\system32\D3DX9_38.dll
2010-07-02 16:56:44 ----A---- C:\Windows\system32\XAudio2_0.dll
2010-07-02 16:56:43 ----A---- C:\Windows\system32\xactengine3_0.dll
2010-07-02 16:56:42 ----A---- C:\Windows\system32\X3DAudio1_3.dll
2010-07-02 16:56:41 ----A---- C:\Windows\system32\d3dx10_37.dll
2010-07-02 16:56:41 ----A---- C:\Windows\system32\D3DCompiler_37.dll
2010-07-02 16:56:40 ----A---- C:\Windows\system32\D3DX9_37.dll
2010-07-02 16:56:39 ----A---- C:\Windows\system32\xactengine2_10.dll
2010-07-02 16:56:38 ----A---- C:\Windows\system32\d3dx10_36.dll
2010-07-02 16:56:37 ----A---- C:\Windows\system32\D3DCompiler_36.dll
2010-07-02 16:56:36 ----A---- C:\Windows\system32\d3dx9_36.dll
2010-07-02 16:56:35 ----A---- C:\Windows\system32\xactengine2_9.dll
2010-07-02 16:56:34 ----A---- C:\Windows\system32\d3dx10_35.dll
2010-07-02 16:56:34 ----A---- C:\Windows\system32\D3DCompiler_35.dll
2010-07-02 16:56:33 ----A---- C:\Windows\system32\d3dx9_35.dll
2010-07-02 16:56:32 ----A---- C:\Windows\system32\xactengine2_8.dll
2010-07-02 16:56:32 ----A---- C:\Windows\system32\X3DAudio1_2.dll
2010-07-02 16:56:31 ----A---- C:\Windows\system32\d3dx10_34.dll
2010-07-02 16:56:31 ----A---- C:\Windows\system32\D3DCompiler_34.dll
2010-07-02 16:56:30 ----A---- C:\Windows\system32\d3dx9_34.dll
2010-07-02 16:56:29 ----A---- C:\Windows\system32\xinput1_3.dll
2010-07-02 16:56:28 ----A---- C:\Windows\system32\xactengine2_7.dll
2010-07-02 16:56:27 ----A---- C:\Windows\system32\d3dx10_33.dll
2010-07-02 16:56:27 ----A---- C:\Windows\system32\D3DCompiler_33.dll
2010-07-02 16:56:26 ----A---- C:\Windows\system32\d3dx9_33.dll
2010-07-02 16:56:25 ----A---- C:\Windows\system32\xactengine2_6.dll
2010-07-02 16:56:24 ----A---- C:\Windows\system32\xactengine2_5.dll
2010-07-02 16:56:23 ----A---- C:\Windows\system32\d3dx10.dll
2010-07-02 16:56:21 ----A---- C:\Windows\system32\xactengine2_4.dll
2010-07-02 16:56:21 ----A---- C:\Windows\system32\x3daudio1_1.dll
2010-07-02 16:56:20 ----A---- C:\Windows\system32\d3dx9_31.dll
2010-07-02 16:56:19 ----A---- C:\Windows\system32\xactengine2_3.dll
2010-07-02 16:56:18 ----A---- C:\Windows\system32\xinput1_2.dll
2010-07-02 16:56:17 ----A---- C:\Windows\system32\xinput1_1.dll
2010-07-02 16:56:17 ----A---- C:\Windows\system32\xactengine2_2.dll
2010-07-02 16:56:16 ----A---- C:\Windows\system32\xactengine2_1.dll
2010-07-02 16:55:58 ----A---- C:\Windows\system32\xactengine2_0.dll
2010-07-02 16:55:58 ----A---- C:\Windows\system32\x3daudio1_0.dll
2010-07-02 16:55:57 ----A---- C:\Windows\system32\d3dx9_29.dll
2010-07-02 16:55:55 ----A---- C:\Windows\system32\d3dx9_27.dll
2010-07-02 16:55:54 ----A---- C:\Windows\system32\d3dx9_26.dll
2010-07-02 16:55:53 ----A---- C:\Windows\system32\d3dx9_25.dll
2010-07-02 16:55:52 ----A---- C:\Windows\system32\d3dx9_24.dll

======List of files/folders modified in the last 1 months======

2010-08-01 13:40:59 ----D---- C:\Windows\Temp
2010-08-01 13:19:40 ----D---- C:\Windows\Debug
2010-08-01 13:19:37 ----D---- C:\Windows\System32
2010-08-01 13:19:37 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-08-01 13:19:36 ----D---- C:\Windows\inf
2010-08-01 13:13:46 ----D---- C:\Windows
2010-08-01 13:13:37 ----D---- C:\Windows\system32\drivers
2010-08-01 13:12:47 ----D---- C:\Windows\PCHEALTH
2010-08-01 12:58:29 ----HD---- C:\ProgramData
2010-08-01 12:58:24 ----D---- C:\Program Files
2010-08-01 12:55:45 ----SHD---- C:\System Volume Information
2010-08-01 12:30:30 ----SHD---- C:\Windows\Installer
2010-08-01 12:28:32 ----SD---- C:\Windows\Downloaded Program Files
2010-08-01 12:07:11 ----D---- C:\Program Files\Common Files\Apple
2010-08-01 11:50:59 ----D---- C:\Program Files\Common Files
2010-08-01 11:49:30 ----D---- C:\ProgramData\AOL
2010-08-01 11:41:27 ----D---- C:\Windows\winsxs
2010-08-01 10:40:59 ----D---- C:\Program Files\VS Revo Group
2010-08-01 10:39:42 ----D---- C:\Windows\system32\Tasks
2010-08-01 10:38:21 ----D---- C:\Program Files\Spybot - Search & Destroy
2010-08-01 10:38:20 ----D---- C:\ProgramData\Spybot - Search & Destroy
2010-08-01 09:51:27 ----A---- C:\Windows\win.ini
2010-08-01 09:31:39 ----D---- C:\Windows\SoftwareDistribution
2010-08-01 08:44:35 ----D---- C:\Windows\system32\drivers\etc
2010-08-01 08:22:07 ----D---- C:\Windows\rescache
2010-08-01 08:10:15 ----D---- C:\Program Files\Mozilla Firefox
2010-08-01 07:52:59 ----D---- C:\Program Files\CCleaner
2010-08-01 07:45:10 ----D---- C:\Windows\system32\catroot2
2010-08-01 00:47:20 ----D---- C:\Windows\Tasks
2010-08-01 00:24:49 ----D---- C:\ProgramData\G DATA
2010-08-01 00:16:05 ----D---- C:\Program Files\Common Files\G DATA
2010-08-01 00:15:59 ----D---- C:\Program Files\G DATA
2010-07-31 23:41:41 ----D---- C:\Windows\system32\wbem
2010-07-31 23:40:49 ----D---- C:\Windows\system32\config
2010-07-31 23:40:30 ----D---- C:\Windows\system32\en-US
2010-07-31 23:40:30 ----D---- C:\Windows\system32\de-DE
2010-07-31 23:40:30 ----D---- C:\Program Files\Internet Explorer
2010-07-31 23:40:29 ----D---- C:\Windows\system32\spool
2010-07-31 23:40:29 ----D---- C:\Windows\system32\Msdtc
2010-07-31 23:40:29 ----D---- C:\Windows\system32\CodeIntegrity
2010-07-31 23:40:28 ----D---- C:\Windows\Microsoft.NET
2010-07-31 23:40:24 ----D---- C:\Users\p\AppData\Roaming\IrfanView
2010-07-31 23:40:17 ----SHD---- C:\ProgramData\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
2010-07-31 23:40:08 ----D---- C:\Windows\registration
2010-07-31 23:18:02 ----D---- C:\Users\p\AppData\Roaming\vlc(1508)
2010-07-31 23:17:35 ----D---- C:\Windows\prefetch
2010-07-31 22:12:58 ----RSD---- C:\Windows\assembly
2010-07-31 22:10:45 ----D---- C:\Windows\system32\catroot
2010-07-31 19:23:35 ----HD---- C:\extensions.exe
2010-07-28 17:38:49 ----D---- C:\felix
2010-07-21 17:29:16 ----D---- C:\Users\p\AppData\Roaming\ICQ
2010-07-19 17:10:54 ----D---- C:\Users\p\AppData\Roaming\Zidote
2010-07-19 06:26:21 ----D---- C:\Users\p\AppData\Roaming\Umru
2010-07-08 17:11:15 ----HD---- C:\Windows\system32\GroupPolicy
2010-07-02 16:54:35 ----D---- C:\Windows\Logs
2010-07-02 12:39:06 ----A---- C:\Windows\system32\mrt.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 GDBehave;GDBehave; C:\Windows\system32\drivers\GDBehave.sys [2010-08-01 33480]
R0 Lbd;Lbd; C:\Windows\system32\DRIVERS\Lbd.sys [2010-06-05 64288]
R1 GDMnIcpt;GDMnIcpt; \??\C:\Windows\system32\drivers\MiniIcpt.sys [2010-08-01 61512]
R1 gdwfpcd;G DATA WFP CD; C:\Windows\system32\drivers\gdwfpcd32.sys [2010-08-01 40904]
R1 GRD;G Data Rootkit Detector Driver; \??\C:\Windows\system32\drivers\GRD.sys [2010-08-01 29992]
R1 MpKsl69bf2648;MpKsl69bf2648; \??\C:\Windows\system32\MpEngineStore\MpKsl69bf2648.sys [2010-08-01 28752]
R3 GearAspiWDM;GEAR ASPI Filter Driver; C:\Windows\System32\drivers\GEARAspiWDM.sys [2009-05-18 26600]
R3 HookCentre;HookCentre; \??\C:\Windows\system32\drivers\HookCentre.sys [2010-08-01 38856]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2008-10-31 2231456]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda32v.sys [2009-06-26 66080]
R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2009-02-10 7547360]
R3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh86.sys [2010-03-04 261152]
R3 RTSTOR;Realtek USB 2.0 Card Reader; C:\Windows\system32\drivers\RTSTOR.SYS [2009-03-26 64000]
R3 SNP2UVC;USB2.0 PC Camera (SNP2UVC); C:\Windows\system32\DRIVERS\snp2uvc.sys [2008-12-29 1799808]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2009-02-27 205232]
S3 BthEnum;Bluetooth-Anforderungsblocktreiber; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-04-11 22528]
S3 BthPan;Bluetooth-Gerät (PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2008-01-21 92160]
S3 BTHPORT;Bluetooth-Porttreiber; C:\Windows\System32\Drivers\BTHport.sys [2009-04-11 507904]
S3 BTHUSB;USB-Treiber für Bluetooth-Sender; C:\Windows\System32\Drivers\BTHUSB.sys [2009-04-11 29696]
S3 drmkaud;Microsoft Kernel-DRM-Audioentschlüsselung; C:\Windows\system32\drivers\drmkaud.sys [2008-01-21 5632]
S3 HdAudAddService;Microsoft 1.1 UAA-Funktionstreiber für High Definition Audio-Dienst; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\Windows\system32\DRIVERS\ewusbmdm.sys [2007-08-24 101504]
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-21 8192]
S3 MSPCLOCK;Microsoft Proxy für Streaming Clock; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-21 5888]
S3 MSPQM;Microsoft Proxy für Streaming Quality Manager; C:\Windows\system32\drivers\MSPQM.sys [2008-01-21 5504]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink-Konvertierung; C:\Windows\system32\drivers\MSTEE.sys [2008-01-21 6016]
S3 NETw5v32;Intel(R) Wireless WiFi Link Adaptertreiber für Windows Vista 32-Bit; C:\Windows\system32\DRIVERS\NETw5v32.sys [2008-04-28 3658752]
S3 RFCOMM;Bluetooth-Gerät (RFCOMM-Protokoll-TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-04-11 148992]
S3 USBAAPL;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl.sys [2009-07-09 39424]
S3 usbaudio;USB-Audiotreiber (WDM); C:\Windows\system32\drivers\usbaudio.sys [2009-04-11 73216]
S3 usbvideo;USB-Videogerät (WDM); C:\Windows\System32\Drivers\usbvideo.sys [2008-01-21 134016]
S3 wanatw;WAN Miniport (ATW); C:\Windows\system32\DRIVERS\wanatw4.sys []
S3 WINIO;WINIO; \??\C:\Windows\system32\WinIo.sys [2007-01-04 9336]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-21 83328]
S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys [2008-01-21 6656]
S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys [2008-01-21 386616]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2010-06-10 144176]
R2 AVKProxy;G Data AntiVirus Proxy; C:\Program Files\Common Files\G DATA\AVKProxy\AVKProxy.exe [2010-04-30 1147976]
R2 AVKService;G Data Scheduler; C:\Program Files\G DATA\AntiVirus\AVK\AVKService.exe [2010-03-31 410696]
R2 AVKWCtl;G Data Dateisystem Wächter; C:\Program Files\G DATA\AntiVirus\AVK\AVKWCtl.exe [2010-03-15 1279816]
R2 Bonjour Service;Dienst "Bonjour"; C:\Program Files\Bonjour\mDNSResponder.exe [2010-05-18 345376]
R2 BthServ;@%SystemRoot%\System32\bthserv.dll,-101; C:\Windows\system32\svchost.exe [2008-01-21 21504]
R2 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0; C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe [2009-07-20 935208]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2009-02-10 203296]
R2 ProtexisLicensing;ProtexisLicensing; C:\Windows\system32\PSIService.exe [2007-06-05 177704]
R2 resetWinService;Reset Reader; C:\Program Files\Realtek Semiconductor Corp\Realtek USB 2.0 Card Reader\reset.exe [2008-10-29 70656]
R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Program Files\Cyberlink\Shared files\RichVideo.exe [2009-02-25 247152]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2009-08-18 1529728]
R3 GDScan;G Data Scanner; C:\Program Files\Common Files\G DATA\GDScan\GDScan.exe [2010-04-22 339016]
R3 iPod Service;iPod-Dienst; C:\Program Files\iPod\bin\iPodService.exe [2010-07-21 540968]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S3 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-21 21504]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe []
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WPFFontCache_v0400;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100; C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]

-----------------EOF-----------------