Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: Trojaner: CleanThis, MS Removal Tool und Windows Restore

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.

Antwort
Alt 14.04.2011, 13:28   #1
berlyn
 
Trojaner: CleanThis, MS Removal Tool und Windows Restore - Standard

Trojaner: CleanThis, MS Removal Tool und Windows Restore



Liebes Trojaner-Board-Team,

ich habe mir in den letzten (vier) Tagen drei verschiedene Trojaner eingefangen:
- "CleanThis" (zweimal aufgetreten)
- "MS Removal Tool"
- "Windows Restore"

Die jeweiligen Dateien und Registry-Einträge wurden teils mit Hilfe von "Malwarebytes' Anti-Malware", teils manuell gelöscht.

Über Tipps und Hinweise, wie ich herausfinden kann, durch welche Sicherheitslücke die Trojaner jeweils durchkamen, wäre ich ebenfalls sehr dankbar.

Vorab schon mal vielen Dank!

Nachfolgend die Log-Dateien
- von "Malwarebytes' Anti-Malware" (von heute, sowie teilweise von den letzten Tagen von den befallenen Dateien)
- von OTL (von heute)
- von GMER (von heute Nacht)

MBAM-Log vom 14.04.2011:
Code:
ATTFilter
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6360

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

14.04.2011 12:26:57
mbam-log-2011-04-14 (12-26-54).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 372146
Laufzeit: 55 Minute(n), 28 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
         
MBAM-Log vom 10.04.2011 ("CleanThis", vollständiger Scan)
Code:
ATTFilter
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6323

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

10.04.2011 16:51:26
mbam-log-2011-04-10 (16-51-26).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|M:\|Z:\|)
Durchsuchte Objekte: 512846
Laufzeit: 1 Stunde(n), 18 Minute(n), 4 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 3
Infizierte Verzeichnisse: 0
Infizierte Dateien: 2

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Worm.Palevo) -> Value: Shell -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\system volume information\_restore{bfabae3d-c475-4e80-8a61-fd9f82b5bb3b}\RP688\A0097731.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\***\anwendungsdaten\gog.exe.bak (Trojan.FakeAlert) -> Quarantined and deleted successfully.
         
MBAM-Log vom 11.04.2011 ("MS Removal Tool", vollständiger Scan):
(Anmerkung: MBAM erkannte den Trojaner nicht, die Dateien und Registry-Einträge wurden manuell entfernt, gemäß der Auflistung im zugehörigen Thread hier im Forum)
Code:
ATTFilter
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6323

Windows 5.1.2600 Service Pack 3 (Safe Mode)
Internet Explorer 8.0.6001.18702

11.04.2011 14:44:35
mbam-log-2011-04-11 (14-44-35).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 376876
Laufzeit: 30 Minute(n), 14 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\dokumente und einstellungen\***\Desktop\eXplorer.exe (Heuristics.Reserved.Word.Exploit) -> Not selected for removal.
         
MBAM-Log vom 12.04.2011 ("CleanThis" (zweiter Befall), Quick-Scan):
Code:
ATTFilter
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6323

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

12.04.2011 13:35:05
mbam-log-2011-04-12 (13-35-05).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 156056
Laufzeit: 8 Minute(n), 0 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 2

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Worm.Palevo) -> Value: Shell -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\dokumente und einstellungen\***\anwendungsdaten\gog.exe.bak (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\***\Desktop\eXplorer.exe (Heuristics.Reserved.Word.Exploit) -> Not selected for removal.
         
MBAM-Log vom 13.04.2011 ("Windows Restore", Quick-Scan):
Code:
ATTFilter
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6341

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

13.04.2011 20:56:33
mbam-log-2011-04-13 (20-56-33).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 156177
Laufzeit: 3 Minute(n), 42 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 3
Infizierte Verzeichnisse: 1
Infizierte Dateien: 5

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallPaper (PUM.Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (PUM.Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (PUM.Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Infizierte Verzeichnisse:
c:\dokumente und einstellungen\***\startmenü\programme\windows restore (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Infizierte Dateien:
c:\dokumente und einstellungen\all users\anwendungsdaten\18472756.exe.bak (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\edccybpeqsptn.exe.bak (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\***\startmenü\programme\windows restore\uninstall windows restore.lnk (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\***\startmenü\programme\windows restore\windows restore.lnk (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\***\Desktop\eXplorer.exe (Heuristics.Reserved.Word.Exploit) -> Not selected for removal.
         

OTL-Log vom 14.04.2011:
Code:
ATTFilter
OTL logfile created on: 14.04.2011 12:38:09 - Run 2
OTL by OldTimer - Version 3.2.22.3     Folder = C:\Dokumente und Einstellungen\***\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 61,00% Memory free
5,00 Gb Paging File | 4,00 Gb Available in Paging File | 77,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 253,78 Gb Total Space | 52,76 Gb Free Space | 20,79% Space Free | Partition Type: NTFS
Drive M: | 444,85 Gb Total Space | 333,66 Gb Free Space | 75,00% Space Free | Partition Type: NTFS
Drive Z: | 698,63 Gb Total Space | 285,74 Gb Free Space | 40,90% Space Free | Partition Type: NTFS
 
Computer Name: ***-9B80EAF | User Name: *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Dokumente und Einstellungen\***\Desktop\08gvb8v5.exe ()
PRC - C:\Dokumente und Einstellungen\***\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\WINDOWS\system32\TUProgSt.exe (TuneUp Software)
PRC - C:\Programme\Logitech\Gaming Software\LWEMon.exe (Logitech Inc.)
PRC - C:\Programme\CDBurnerXP\NMSAccessU.exe ()
PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Programme\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)
PRC - C:\Programme\Adobe\Acrobat 7.0\Distillr\acrotray.exe (Adobe Systems Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Norton Ghost\Agent\VProSvc.exe (Symantec Corporation)
PRC - C:\Programme\Norton Ghost\Agent\VProTray.exe (Symantec Corporation)
PRC - C:\Programme\Norton Ghost\Agent\SymDB.exe (Symantec Corporation)
PRC - C:\Programme\Norton Ghost\Shared\Drivers\SymSnapService.exe (Symantec)
PRC - C:\WINDOWS\system32\oodag.exe (O&O Software GmbH)
PRC - C:\Programme\Logitech\iTouch\iTouch.exe (Logitech Inc.)
PRC - C:\Programme\Eumex 404PC\Capictrl.exe (DeTeWe AG & Co.)
PRC - C:\Programme\Gemeinsame Dateien\EPSON\EBAPI\SAgent2.exe (SEIKO EPSON CORPORATION)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Dokumente und Einstellungen\***\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\Programme\Logitech\iTouch\itchhk.dll (Logitech Inc.)
MOD - C:\Programme\Gemeinsame Dateien\Logitech\Scrolling\LGMSGHK.DLL (Logitech Inc.)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (HidServ) --  File not found
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (TuneUp.ProgramStatisticsSvc) -- C:\WINDOWS\system32\TUProgSt.exe (TuneUp Software)
SRV - (TuneUp.Defrag) -- C:\WINDOWS\system32\TuneUpDefragService.exe (TuneUp Software)
SRV - (NMSAccess) -- C:\Programme\CDBurnerXP\NMSAccessU.exe ()
SRV - (Lavasoft Ad-Aware Service) -- C:\Programme\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
SRV - (UxTuneUp) -- C:\WINDOWS\system32\uxtuneup.dll (TuneUp Software)
SRV - (rpcapd) Remote Packet Capture Protocol v.0 (experimental) -- C:\Programme\WinPcap\rpcapd.exe (CACE Technologies, Inc.)
SRV - (Macromedia Licensing Service) -- C:\Programme\Gemeinsame Dateien\Macromedia Shared\Service\Macromedia Licensing.exe ()
SRV - (Adobe LM Service) -- C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe (Adobe Systems)
SRV - (CVPND) -- C:\Programme\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)
SRV - (Norton Ghost) -- C:\Programme\Norton Ghost\Agent\VProSvc.exe (Symantec Corporation)
SRV - (SymSnapService) -- C:\Programme\Norton Ghost\Shared\Drivers\SymSnapService.exe (Symantec)
SRV - (LiveUpdate) -- C:\Programme\Symantec\LiveUpdate\LuComServer_3_2.EXE (Symantec Corporation)
SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (O&O Defrag) -- C:\WINDOWS\system32\oodag.exe (O&O Software GmbH)
SRV - (IDriverT) -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (EPSONStatusAgent2) -- C:\Programme\Gemeinsame Dateien\EPSON\EBAPI\SAgent2.exe (SEIKO EPSON CORPORATION)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (AnyDVD) -- C:\WINDOWS\system32\drivers\AnyDVD.sys (SlySoft, Inc.)
DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (WmXlCore) -- C:\WINDOWS\system32\drivers\WmXlCore.sys (Logitech Inc.)
DRV - (WmVirHid) -- C:\WINDOWS\system32\drivers\WmVirHid.sys (Logitech Inc.)
DRV - (WmBEnum) -- C:\WINDOWS\system32\drivers\WmBEnum.sys (Logitech Inc.)
DRV - (WmFilter) -- C:\WINDOWS\system32\drivers\WmFilter.sys (Logitech Inc.)
DRV - (StarOpen) -- C:\WINDOWS\System32\drivers\StarOpen.sys ()
DRV - (NPF) -- C:\WINDOWS\system32\drivers\npf.sys (CACE Technologies, Inc.)
DRV - (Lbd) -- C:\WINDOWS\system32\DRIVERS\Lbd.sys (Lavasoft AB)
DRV - (sptd) -- C:\WINDOWS\System32\Drivers\sptd.sys ()
DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (CVPNDRVA) -- C:\WINDOWS\system32\drivers\CVPNDRVA.sys (Cisco Systems, Inc.)
DRV - (DNE) -- C:\WINDOWS\system32\drivers\dne2000.sys (Deterministic Networks, Inc.)
DRV - (hotcore3) -- C:\WINDOWS\system32\drivers\hotcore3.sys (Paragon Software Group)
DRV - (WimFltr) -- C:\WINDOWS\system32\drivers\WimFltr.sys (Microsoft Corporation)
DRV - (v2imount) -- C:\WINDOWS\system32\drivers\v2imount.sys (Symantec Corporation)
DRV - (VPROEVENTMONITOR) -- C:\WINDOWS\system32\drivers\vproeventmonitor.sys (Symantec Corporation)
DRV - (symsnap) -- C:\WINDOWS\system32\DRIVERS\symsnap.sys (StorageCraft)
DRV - (vsdatant) -- C:\WINDOWS\system32\vsdatant.sys (Zone Labs, LLC)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (s125mgmt) Sony Ericsson Device 125 USB WMC Device Management Drivers (WDM) -- C:\WINDOWS\system32\drivers\s125mgmt.sys (MCCI Corporation)
DRV - (s125obex) -- C:\WINDOWS\system32\drivers\s125obex.sys (MCCI Corporation)
DRV - (s125bus) Sony Ericsson Device 125 driver (WDM) -- C:\WINDOWS\system32\drivers\s125bus.sys (MCCI Corporation)
DRV - (CVirtA) -- C:\WINDOWS\system32\drivers\CVirtA.sys (Cisco Systems, Inc.)
DRV - (RTLE8023xp) -- C:\WINDOWS\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation                           )
DRV - (SIS163u) -- C:\WINDOWS\system32\drivers\sis163u.sys (SiS Corporation)
DRV - (OODrvled) -- C:\WINDOWS\system32\DRIVERS\OODrvled.sys (O&O Software GmbH)
DRV - (itchfltr) -- C:\WINDOWS\system32\drivers\itchfltr.sys (Logitech, Inc.)
DRV - (CAPI20) -- C:\WINDOWS\System32\Drivers\CAPI20.SYS (DeTeWe Berlin)
DRV - (DETEWECP) -- C:\WINDOWS\System32\drivers\detewecp.sys (DeTeWe Berlin)
DRV - (BrPar) -- C:\WINDOWS\System32\drivers\BrPar.sys (Brother Industries Ltd.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20110323
FF - prefs.js..extensions.enabledItems: vshare@toolbar:1.0.0
FF - prefs.js..extensions.enabledItems: zotero@chnm.gmu.edu:2.1.5
FF - prefs.js..extensions.enabledItems: zoteroWinWordIntegration@zotero.org:3.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
 
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011.03.28 13:29:55 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011.03.28 13:29:55 | 000,000,000 | ---D | M]
 
[2009.07.17 21:04:30 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Extensions
[2011.04.12 15:14:22 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\94mbbu34.default\extensions
[2010.04.28 17:44:26 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\94mbbu34.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011.04.11 15:06:36 | 000,000,000 | ---D | M] (WOT) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\94mbbu34.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2010.10.24 17:10:07 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\94mbbu34.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.02.13 19:53:50 | 000,000,000 | ---D | M] (vShare Plugin) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\94mbbu34.default\extensions\vshare@toolbar
[2011.04.11 15:06:38 | 000,000,000 | ---D | M] (Zotero) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\94mbbu34.default\extensions\zotero@chnm.gmu.edu
[2011.04.11 15:06:38 | 000,000,000 | ---D | M] (Zotero WinWord Integration) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\94mbbu34.default\extensions\zoteroWinWordIntegration@zotero.org
[2011.04.12 15:14:22 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2010.04.22 17:49:34 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010.09.24 14:19:22 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2011.04.11 15:28:10 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011.04.11 15:27:59 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAMME\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011.04.11 15:27:59 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll
[2010.03.15 17:49:27 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.03.15 17:49:27 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.03.15 17:49:27 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.03.15 17:49:27 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.03.15 17:49:27 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2011.01.06 19:56:58 | 000,001,135 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (vShare Toolbar) - {043C5167-00BB-4324-AF7E-62013FAEDACF} - C:\Programme\vShare\vshare_toolbar.dll ()
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O2 - BHO: (FGCatchUrl) - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Programme\FlashGet\jccatch.dll (www.flashget.com)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.6.6209.1142\swg.dll (Google Inc.)
O2 - BHO: (WOT Helper) - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Programme\WOT\WOT.dll ()
O2 - BHO: (FlashGet GetFlash Class) - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Programme\FlashGet\getflash.dll (www.flashget.com)
O3 - HKLM\..\Toolbar: (no name) -  - No CLSID value found.
O3 - HKLM\..\Toolbar: (vShare Toolbar) - {043C5167-00BB-4324-AF7E-62013FAEDACF} - C:\Programme\vShare\vshare_toolbar.dll ()
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (WOT) - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Programme\WOT\WOT.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (vShare Toolbar) - {043C5167-00BB-4324-AF7E-62013FAEDACF} - C:\Programme\vShare\vshare_toolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (WOT) - {71576546-354D-41C9-AAE8-31F2EC22BF0D} - C:\Programme\WOT\WOT.dll ()
O4 - HKLM..\Run: [Acrobat Assistant 7.0] C:\Programme\Adobe\Acrobat 7.0\Distillr\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [Norton Ghost 14.0] C:\Programme\Norton Ghost\Agent\VProTray.exe (Symantec Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\Programme\NVIDIA Corporation\nView\nwiz.exe ()
O4 - HKLM..\Run: [Start WingMan Profiler] C:\Programme\Logitech\Gaming Software\LWEMon.exe (Logitech Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [zBrowser Launcher] C:\Programme\Logitech\iTouch\iTouch.exe (Logitech Inc.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Acrobat - Schnellstart.lnk = C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000002}\SC_Acrobat.exe ()
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\CAPI Control.lnk = C:\Programme\Eumex 404PC\Capictrl.exe (DeTeWe AG & Co.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE (SEIKO EPSON CORPORATION)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &Alles mit FlashGet laden - C:\Programme\FlashGet\JC_ALL.HTM ()
O8 - Extra context menu item: &Mit FlashGet laden - C:\Programme\FlashGet\JC_LINK.HTM ()
O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Free YouTube Download - C:\Dokumente und Einstellungen\***\Anwendungsdaten\DVDVideoSoftIEHelpers\youtubedownload.htm ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Dokumente und Einstellungen\***\Anwendungsdaten\DVDVideoSoftIEHelpers\youtubetomp3.htm ()
O8 - Extra context menu item: Google Sidewiki... - C:\Programme\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll (Google Inc.)
O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: In vorhandene PDF-Datei konvertieren - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Programme\ICQ\Icq.exe (ICQ Inc.)
O9 - Extra 'Tools' menuitem : ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Programme\ICQ\Icq.exe (ICQ Inc.)
O9 - Extra Button: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Programme\ICQ7.4\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Programme\ICQ7.4\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Programme\FlashGet\flashget.exe (FlashGet.com)
O9 - Extra 'Tools' menuitem : FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Programme\FlashGet\flashget.exe (FlashGet.com)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} hxxp://ips.poi.de/ips-opdata/operator/69189345/objects/jordan.cab (JordanUploader Class)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1262465828168 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {AC414988-E5BB-4C2C-873B-EA53D2F3D23A} hxxp://t.live.cctv.com/ieocx/CCTVUpdateInstall.dll (CCTVUpdateInstall)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\vsharechrome {3F3A4B8A-86FC-43A4-BB00-6D7EBE9D4484} - C:\Programme\vShare\vshare_toolbar.dll ()
O18 - Protocol\Handler\wot {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Programme\WOT\WOT.dll ()
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - Explorer.exe ()
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.07.16 19:32:36 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O34 - HKLM BootExecute: (OODBS) - C:\WINDOWS\System32\OODBS.exe (O&O Software GmbH)
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.04.13 21:35:55 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\VideoLAN
[2011.04.13 21:18:48 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\***\Recent
[2011.04.13 21:16:05 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\***\Desktop\OTL.exe
[2011.04.13 20:37:20 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\***\Recent(2)
[2011.04.11 15:29:06 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Java
[2011.04.11 15:28:09 | 000,157,472 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2011.04.11 15:28:09 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2011.04.11 15:28:09 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2011.04.11 15:28:09 | 000,073,728 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2011.04.11 15:27:55 | 000,000,000 | ---D | C] -- C:\Programme\Java
[2011.04.11 14:04:16 | 000,258,560 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\***\Desktop\OTH.scr
[2011.04.11 13:59:18 | 007,734,208 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Dokumente und Einstellungen\***\Desktop\Celerus.exe
[2011.04.10 15:12:31 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Malwarebytes
[2011.04.10 15:12:26 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011.04.10 15:12:26 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
[2011.04.10 15:12:25 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2011.04.10 15:12:23 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011.04.10 15:12:23 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2011.04.10 15:11:42 | 007,734,208 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Dokumente und Einstellungen\***\Desktop\mbam-setup.exe
[2011.04.08 10:42:54 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\***\Desktop\Netzwerkcontrolling - Instrumente und ihre Werkzeugunterstützung
[2011.04.05 22:18:40 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\***\Desktop\Vertrauen als Erfolgsfaktor virtueller Unternehmen
[2011.04.05 20:32:11 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\***\Desktop\Strategische Netzwerke - Evolution und Organisation
[2011.04.03 21:40:12 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\QIP
[2011.04.03 21:39:53 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\QIP 2010
[2011.04.03 21:38:38 | 000,000,000 | ---D | C] -- C:\Programme\QIP 2010
[2011.03.21 23:34:20 | 002,833,568 | ---- | C] (Adobe Systems, Inc.) -- C:\Dokumente und Einstellungen\***\Desktop\install_flash_player.exe
[9 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.04.14 12:00:04 | 000,000,496 | ---- | M] () -- C:\WINDOWS\tasks\1-Klick-Wartung.job
[2011.04.14 12:00:01 | 000,001,088 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011.04.14 11:06:54 | 000,504,657 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\unhide.exe
[2011.04.14 08:48:05 | 000,000,470 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 4).job
[2011.04.14 02:48:05 | 000,000,470 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 3).job
[2011.04.13 22:26:33 | 000,301,568 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\08gvb8v5.exe
[2011.04.13 21:22:15 | 000,000,054 | ---- | M] () -- C:\WINDOWS\System32\rp_stats.dat
[2011.04.13 21:22:15 | 000,000,039 | ---- | M] () -- C:\WINDOWS\System32\rp_rules.dat
[2011.04.13 21:22:08 | 000,002,319 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Acrobat - Schnellstart.lnk
[2011.04.13 21:21:42 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011.04.13 21:21:20 | 000,001,084 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011.04.13 21:21:15 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011.04.13 21:21:06 | 000,059,073 | ---- | M] () -- C:\WINDOWS\System32\OODBS.lor
[2011.04.13 21:16:05 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\***\Desktop\OTL.exe
[2011.04.13 21:12:37 | 000,055,296 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.04.13 14:48:37 | 000,000,470 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 1).job
[2011.04.13 00:01:10 | 000,648,288 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\Wertkette - 02.xcf
[2011.04.13 00:01:10 | 000,076,214 | ---- | M] () -- C:\Dokumente und Einstellungen\***\.recently-used.xbel
[2011.04.13 00:00:23 | 000,648,288 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\Wertkette - 01.xcf
[2011.04.12 20:50:39 | 000,000,470 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2011.04.12 20:50:38 | 000,000,470 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 2).job
[2011.04.12 18:24:47 | 000,042,143 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\Wertkette.JPG
[2011.04.12 16:59:36 | 003,674,442 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\IOS 1 Gesamtveranstaltung WS 07_08.pdf
[2011.04.12 09:51:05 | 000,030,276 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\picture-0002.jpg
[2011.04.11 15:27:57 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll
[2011.04.11 15:27:57 | 000,157,472 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2011.04.11 15:27:57 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2011.04.11 15:27:57 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2011.04.11 15:27:57 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2011.04.11 14:52:43 | 000,531,178 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2011.04.11 14:52:43 | 000,505,598 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011.04.11 14:52:43 | 000,106,658 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2011.04.11 14:52:43 | 000,089,062 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011.04.11 14:04:16 | 000,258,560 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\***\Desktop\OTH.scr
[2011.04.11 14:01:29 | 000,000,130 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\hosts-perm.bat
[2011.04.11 13:59:24 | 007,734,208 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Dokumente und Einstellungen\***\Desktop\Celerus.exe
[2011.04.11 13:56:25 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2011.04.11 13:55:07 | 001,006,778 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\eXplorer.exe
[2011.04.10 17:06:29 | 000,000,211 | -HS- | M] () -- C:\boot.ini
[2011.04.10 15:11:45 | 007,734,208 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Dokumente und Einstellungen\***\Desktop\mbam-setup.exe
[2011.04.10 15:09:40 | 001,006,778 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\rkill.com
[2011.04.10 14:18:05 | 000,001,917 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2011.04.09 22:33:10 | 006,708,420 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\IEEE Std 610.12-1990 - IEEE Standard Glossary of Software Engineering Terminology.pdf
[2011.04.09 11:57:00 | 000,573,419 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\Comparative Economic Organization - Williamson - 1991 - ASQ36-2.pdf
[2011.04.07 10:41:29 | 002,885,259 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\Neither Market Nor Hierarchy - Powell - 1990.pdf
[2011.04.07 10:19:45 | 001,156,365 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\The Nature of the Firm - Coase - 1937.pdf
[2011.04.03 14:06:31 | 020,586,196 | ---- | M] () -- C:\vlc-1.1.8-win32.exe
[2011.04.01 08:48:14 | 000,000,040 | ---- | M] () -- C:\WINDOWS\ PDF
[2011.04.01 08:48:10 | 000,000,040 | ---- | M] () -- C:\WINDOWS\nspool
[2011.03.21 23:34:20 | 002,833,568 | ---- | M] (Adobe Systems, Inc.) -- C:\Dokumente und Einstellungen\***\Desktop\install_flash_player.exe
[2011.03.18 15:03:14 | 000,001,147 | ---- | M] () -- C:\WINDOWS\APDFPRP.INI
[2011.03.16 17:20:32 | 000,137,656 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys
[9 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.04.14 11:06:53 | 000,504,657 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\unhide.exe
[2011.04.13 22:26:33 | 000,301,568 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\08gvb8v5.exe
[2011.04.13 00:01:10 | 000,648,288 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\Wertkette - 02.xcf
[2011.04.13 00:01:10 | 000,076,214 | ---- | C] () -- C:\Dokumente und Einstellungen\***\.recently-used.xbel
[2011.04.12 22:03:24 | 000,648,288 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\Wertkette - 01.xcf
[2011.04.12 18:24:47 | 000,042,143 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\Wertkette.JPG
[2011.04.12 16:59:35 | 003,674,442 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\IOS 1 Gesamtveranstaltung WS 07_08.pdf
[2011.04.12 09:51:15 | 000,030,276 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\picture-0002.jpg
[2011.04.11 14:01:29 | 000,000,130 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\hosts-perm.bat
[2011.04.11 13:55:03 | 001,006,778 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\eXplorer.exe
[2011.04.10 15:09:40 | 001,006,778 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\rkill.com
[2011.04.09 22:33:10 | 006,708,420 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\IEEE Std 610.12-1990 - IEEE Standard Glossary of Software Engineering Terminology.pdf
[2011.04.09 11:57:00 | 000,573,419 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\Comparative Economic Organization - Williamson - 1991 - ASQ36-2.pdf
[2011.04.07 10:41:28 | 002,885,259 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\Neither Market Nor Hierarchy - Powell - 1990.pdf
[2011.04.07 10:19:45 | 001,156,365 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\The Nature of the Firm - Coase - 1937.pdf
[2011.04.03 14:06:16 | 020,586,196 | ---- | C] () -- C:\vlc-1.1.8-win32.exe
[2011.04.01 08:48:14 | 000,000,040 | ---- | C] () -- C:\WINDOWS\ PDF
[2011.04.01 08:48:10 | 000,000,040 | ---- | C] () -- C:\WINDOWS\nspool
[2011.03.18 15:02:03 | 000,001,147 | ---- | C] () -- C:\WINDOWS\APDFPRP.INI
[2011.03.18 15:01:41 | 000,149,504 | ---- | C] () -- C:\WINDOWS\UNWISE.EXE
[2011.01.06 19:49:26 | 000,028,672 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\data.dll
[2010.11.15 02:12:16 | 000,138,608 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2010.11.15 02:12:08 | 000,234,576 | ---- | C] () -- C:\WINDOWS\System32\PnkBstrB.exe
[2010.11.15 02:12:02 | 000,075,064 | ---- | C] () -- C:\WINDOWS\System32\PnkBstrA.exe
[2010.11.12 15:50:25 | 000,240,592 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb0.bin
[2010.11.12 15:50:23 | 000,240,592 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb1.bin
[2010.11.12 15:50:23 | 000,000,001 | ---- | C] () -- C:\WINDOWS\System32\nvdrssel.bin
[2010.11.12 15:50:14 | 002,293,194 | ---- | C] () -- C:\WINDOWS\System32\nvdata.bin
[2010.10.04 16:09:13 | 000,000,046 | ---- | C] () -- C:\WINDOWS\System32\DonationCoder_urlsnooper_InstallInfo.dat
[2010.09.07 21:39:44 | 000,007,168 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys
[2010.09.07 16:01:51 | 000,319,488 | R--- | C] () -- C:\WINDOWS\System32\MafiaSetup.exe
[2010.02.02 03:48:24 | 000,000,054 | ---- | C] () -- C:\WINDOWS\System32\rp_stats.dat
[2010.02.02 03:48:24 | 000,000,044 | ---- | C] () -- C:\WINDOWS\System32\statistics.dat
[2010.02.02 03:48:24 | 000,000,039 | ---- | C] () -- C:\WINDOWS\System32\rp_rules.dat
[2009.12.02 18:52:28 | 000,000,056 | ---- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2009.10.20 20:19:30 | 000,053,299 | ---- | C] () -- C:\WINDOWS\System32\pthreadVC.dll
[2009.09.11 14:39:01 | 000,000,690 | ---- | C] () -- C:\WINDOWS\CVMiniViewer.ini
[2009.08.28 18:35:52 | 000,000,600 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\PUTTY.RND
[2009.08.22 20:15:52 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2009.08.14 18:39:45 | 000,000,123 | -HS- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\.zreglib
[2009.07.29 16:28:44 | 000,000,032 | ---- | C] () -- C:\WINDOWS\CD_Start.INI
[2009.07.21 23:18:56 | 000,000,150 | ---- | C] () -- C:\WINDOWS\Sierra.ini
[2009.07.21 00:50:23 | 000,055,296 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.07.20 20:57:19 | 000,015,688 | ---- | C] () -- C:\WINDOWS\System32\lsdelete.exe
[2009.07.17 23:06:37 | 000,002,528 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\$_hpcst$.hpc
[2009.07.17 21:04:14 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2009.07.17 20:30:06 | 000,000,059 | ---- | C] () -- C:\WINDOWS\WINPHONE.INI
[2009.07.17 20:06:28 | 000,168,448 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2009.07.17 20:06:28 | 000,000,038 | ---- | C] () -- C:\WINDOWS\avisplitter.ini
[2009.07.17 20:06:26 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2009.07.17 20:06:26 | 000,881,664 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2009.07.17 20:06:26 | 000,205,824 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2009.07.17 20:06:24 | 000,085,504 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2009.07.17 16:22:25 | 000,000,140 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2009.07.17 15:37:48 | 000,000,453 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI
[2009.07.17 15:37:48 | 000,000,137 | ---- | C] () -- C:\WINDOWS\BRVIDEO.INI
[2009.07.17 15:37:48 | 000,000,040 | ---- | C] () -- C:\WINDOWS\opt_1430.ini
[2009.07.17 15:37:48 | 000,000,039 | ---- | C] () -- C:\WINDOWS\BRDIAG.INI
[2009.07.17 15:37:48 | 000,000,026 | ---- | C] () -- C:\WINDOWS\brpp2ka.ini
[2009.07.17 15:37:48 | 000,000,023 | ---- | C] () -- C:\WINDOWS\Brownie.ini
[2009.07.17 15:37:48 | 000,000,000 | ---- | C] () -- C:\WINDOWS\BROHL143.INI
[2009.07.17 15:37:48 | 000,000,000 | ---- | C] () -- C:\WINDOWS\brmx2001.ini
[2009.07.17 15:37:29 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\BROSNMP.DLL
[2009.07.17 15:37:29 | 000,026,624 | ---- | C] () -- C:\WINDOWS\System32\BRGSRC32.DLL
[2009.07.17 15:37:29 | 000,004,608 | ---- | C] () -- C:\WINDOWS\System32\BRGSRC16.DLL
[2009.07.17 15:37:28 | 000,013,109 | ---- | C] () -- C:\WINDOWS\HL-1430.INI
[2009.07.17 15:37:24 | 000,000,030 | ---- | C] () -- C:\WINDOWS\System32\BRSS01A.ini
[2009.07.17 14:57:00 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\ChCfg.exe
[2009.07.17 14:45:04 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2009.07.16 20:56:38 | 000,215,144 | R--- | C] () -- C:\WINDOWS\patchw32.dll
[2009.07.16 20:54:10 | 000,215,144 | R--- | C] () -- C:\WINDOWS\pw32a.dll
[2009.07.16 20:24:06 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2009.07.16 20:23:12 | 000,146,808 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2009.07.16 19:55:10 | 004,244,744 | ---- | C] () -- C:\WINDOWS\System32\qtp-mt334.dll
[2009.07.16 19:55:10 | 000,247,560 | ---- | C] () -- C:\WINDOWS\System32\prgiso.dll
[2009.07.16 19:55:10 | 000,013,576 | ---- | C] () -- C:\WINDOWS\System32\wnaspi32.dll
[2009.07.16 19:53:41 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\BASSMOD.dll
[2009.07.16 19:34:01 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2009.07.16 19:30:26 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2009.01.13 12:29:00 | 000,197,408 | ---- | C] () -- C:\WINDOWS\System32\vpnapi.dll
[2009.01.13 12:28:44 | 000,193,312 | ---- | C] () -- C:\WINDOWS\System32\CSGina.dll
[2008.08.07 22:07:31 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\unwlsdrv.exe
[2008.05.16 14:01:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2006.01.20 11:12:16 | 000,340,026 | R--- | C] () -- C:\WINDOWS\System32\LIBBZ2.dll
[2006.01.12 17:47:46 | 000,094,208 | ---- | C] () -- C:\WINDOWS\System32\clkwise.dll
[2004.08.04 14:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2004.08.04 14:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004.08.04 14:00:00 | 000,531,178 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2004.08.04 14:00:00 | 000,505,598 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2004.08.04 14:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004.08.04 14:00:00 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2004.08.04 14:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004.08.04 14:00:00 | 000,106,658 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2004.08.04 14:00:00 | 000,089,062 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2004.08.04 14:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2004.08.04 14:00:00 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2004.08.04 14:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004.08.04 14:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004.08.04 14:00:00 | 000,004,461 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2004.08.04 14:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2004.08.04 14:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2003.02.20 17:53:42 | 000,005,702 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2000.09.14 02:03:00 | 000,000,145 | ---- | C] () -- C:\WINDOWS\System32\EBPPORT.DAT
 
========== LOP Check ==========
 
[2010.09.07 21:39:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Canneverbe Limited
[2009.09.14 21:05:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJ
[2009.09.14 19:18:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJEGV
[2009.10.29 18:10:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJScan
[2009.10.31 16:56:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CCTV
[2009.07.17 20:38:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DAEMON Tools Lite
[2010.10.04 16:07:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DonationCoder
[2010.10.14 14:33:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Locktime
[2009.08.14 18:39:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SlySoft
[2009.08.07 15:58:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\T-Online
[2009.10.06 23:28:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Teleca
[2011.04.01 01:01:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
[2011.03.01 22:50:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TrackMania
[2010.09.24 20:04:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software
[2009.07.23 22:52:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Ubisoft
[2010.08.31 17:30:48 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{55A29068-F2CE-456C-9148-C869879E2357}
[2009.08.07 17:34:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{C4C0E335-EDDF-46A0-A57D-F3802AE44275}
[2009.10.15 12:47:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}
[2010.12.24 21:24:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Amazon
[2010.09.07 21:39:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Canneverbe Limited
[2009.10.29 18:10:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Canon
[2009.07.20 13:18:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\DAEMON Tools Lite
[2010.04.26 11:37:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Dev-Cpp
[2010.10.04 16:09:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\DonationCoder
[2010.10.24 17:53:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\DVDVideoSoftIEHelpers
[2009.10.29 22:29:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Greenshot
[2011.04.13 00:01:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\gtk-2.0
[2011.04.10 14:49:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\ICQ
[2010.03.09 15:40:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\ILOG
[2010.10.21 13:25:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\inkscape
[2010.01.12 15:24:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\JDeveloper
[2010.10.14 14:34:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Locktime
[2011.02.20 00:15:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\MyPhoneExplorer
[2011.04.03 21:40:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\QIP
[2009.10.12 17:45:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\ScummVM
[2010.11.04 13:18:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Sierra
[2010.07.04 11:31:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\SQL Developer
[2009.08.28 18:07:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Subversion
[2009.10.06 23:29:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Teleca
[2009.07.25 01:14:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\TheLastRipper
[2009.07.17 17:10:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\TuneUp Software
[2009.07.23 23:55:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Ubisoft
[2009.08.07 15:45:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\uniblue
[2011.02.13 19:53:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\vShare
[2011.04.14 12:00:04 | 000,000,496 | ---- | M] () -- C:\WINDOWS\Tasks\1-Klick-Wartung.job
[2011.04.13 14:48:37 | 000,000,470 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Daily 1).job
[2011.04.12 20:50:38 | 000,000,470 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Daily 2).job
[2011.04.14 02:48:05 | 000,000,470 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Daily 3).job
[2011.04.14 08:48:05 | 000,000,470 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Daily 4).job
[2011.04.12 20:50:39 | 000,000,470 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job
 
========== Purity Check ==========
 
 
 
========== Files - Unicode (All) ==========
[2011.04.01 08:49:32 | 000,000,042 | ---- | M] ()(C:\WINDOWS\??) -- C:\WINDOWS\฀⃀
[2011.04.01 08:49:32 | 000,000,042 | ---- | C] ()(C:\WINDOWS\??) -- C:\WINDOWS\฀⃀
[2011.03.19 23:07:09 | 000,000,040 | ---- | M] ()(C:\WINDOWS\??') -- C:\WINDOWS\Ȫ趨'
[2011.03.19 23:07:09 | 000,000,040 | ---- | C] ()(C:\WINDOWS\??') -- C:\WINDOWS\Ȫ趨'
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 40 bytes -> C:\WINDOWS\system32:896b29c3.zreglib
@Alternate Data Stream - 24 bytes -> C:\WINDOWS:0ADB507A9315A1DE
@Alternate Data Stream - 229 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:8FF81EB0

< End of report >
         
OTL-Extra-Log vom 14.04.2011:
Code:
ATTFilter
OTL Extras logfile created on: 14.04.2011 12:38:09 - Run 2
OTL by OldTimer - Version 3.2.22.3     Folder = C:\Dokumente und Einstellungen\***\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 61,00% Memory free
5,00 Gb Paging File | 4,00 Gb Available in Paging File | 77,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 253,78 Gb Total Space | 52,76 Gb Free Space | 20,79% Space Free | Partition Type: NTFS
Drive M: | 444,85 Gb Total Space | 333,66 Gb Free Space | 75,00% Space Free | Partition Type: NTFS
Drive Z: | 698,63 Gb Total Space | 285,74 Gb Free Space | 40,90% Space Free | Partition Type: NTFS
 
Computer Name: ***-9B80EAF | User Name: *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.js [@ = JSFile] -- C:\Programme\Macromedia\Dreamweaver MX 2004\Dreamweaver.exe (Macromedia, Inc.)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
jsfile [edit] -- "C:\Programme\Macromedia\Dreamweaver 8\dreamweaver.exe" "%1" (Macromedia, Inc.)
jsfile [open] -- "C:\Programme\Macromedia\Dreamweaver MX 2004\Dreamweaver.exe" "%1" (Macromedia, Inc.)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
"AntiSpyWareDisableNotify" = 0
"InternetSettingsDisableNotify" = 0
"UacDisableNotify" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"26675:TCP" = 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"26675:TCP" = 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"33334:TCP" = 33334:TCP:*:Enabled:SST
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Programme\ICQ7.4\ICQ.exe" = C:\Programme\ICQ7.4\ICQ.exe:*:Enabled:ICQ7.4 -- (ICQ, LLC.)
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\ICQ\Icq.exe" = C:\Programme\ICQ\Icq.exe:*:Enabled:ICQ -- (ICQ Inc.)
"C:\Games\Ubisoft\Assassin's Creed\AssassinsCreed_Dx9.exe" = C:\Games\Ubisoft\Assassin's Creed\AssassinsCreed_Dx9.exe:*:Enabled:Assassin's Creed Dx9 -- (Ubisoft)
"C:\Games\Ubisoft\Assassin's Creed\AssassinsCreed_Dx10.exe" = C:\Games\Ubisoft\Assassin's Creed\AssassinsCreed_Dx10.exe:*:Enabled:Assassin's Creed Dx10 -- (Ubisoft)
"C:\Games\Ubisoft\Assassin's Creed\AssassinsCreed_Launcher.exe" = C:\Games\Ubisoft\Assassin's Creed\AssassinsCreed_Launcher.exe:*:Enabled:Assassin's Creed Update -- (Ubisoft)
"C:\Programme\TVAnts\Tvants.exe" = C:\Programme\TVAnts\Tvants.exe:*:Enabled:TVAnts -- (Zhejiang University)
"C:\Programme\VideoLAN\VLC\vlc.exe" = C:\Programme\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player -- ()
"C:\Programme\SopCast\adv\SopAdver.exe" = C:\Programme\SopCast\adv\SopAdver.exe:*:Enabled:SopCast Adver -- (www.sopcast.com)
"C:\Programme\SopCast\SopCast.exe" = C:\Programme\SopCast\SopCast.exe:*:Enabled:SopCast Main Application -- (www.sopcast.com)
"C:\Programme\xampp\mysql\bin\mysqld.exe" = C:\Programme\xampp\mysql\bin\mysqld.exe:*:Enabled:mysqld -- ()
"C:\Programme\xampp\apache\bin\httpd.exe" = C:\Programme\xampp\apache\bin\httpd.exe:*:Enabled:Apache HTTP Server -- (Apache Software Foundation)
"C:\Programme\FlashGet\flashget.exe" = C:\Programme\FlashGet\flashget.exe:*:Enabled:Flashget -- (FlashGet.com)
"C:\Programme\Steam\Steam.exe" = C:\Programme\Steam\Steam.exe:*:Enabled:Steam -- (Valve Corporation)
"C:\Programme\ICQ7.4\ICQ.exe" = C:\Programme\ICQ7.4\ICQ.exe:*:Enabled:ICQ7.4 -- (ICQ, LLC.)
"C:\Programme\Steam\SteamApps\common\mafia ii\pc\mafia2.exe" = C:\Programme\Steam\SteamApps\common\mafia ii\pc\mafia2.exe:*:Enabled:Mafia II -- (2K Czech)
"C:\Programme\QIP 2010\qip.exe" = C:\Programme\QIP 2010\qip.exe:*:Enabled:QIP 2010 -- (QIP)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01CEF48F-41F2-4A43-82F2-25D23D68C1D4}" = Cuttermaran 1.69a
"{036AA4D4-6D32-11D4-9875-00105ACE7734}" = Logitech iTouch Software
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{05BB2EC5-6BEF-4DDC-9E75-BEE7B161157A}" = Macromedia Dreamweaver MX 2004
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0F022A2E-7022-497D-90A5-0F46746D8275}" = Macromedia Extension Manager
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_CNQ2413" = CanoScan LiDE 100 Scanner Driver
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216024FF}" = Java(TM) 6 Update 24
"{2715D1D6-2B81-4DD5-A9DC-6EFF4D5E0993}" = Ahead Nero Burning Rom PlugIn Pack 2.0.2 by MadHacker2k4
"{2BD5C305-1B27-4D41-B690-7A61172D2FEB}" = Macromedia Flash 8
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{44025BD7-AD10-4769-99AE-6378FD0303D6}" = Macromedia Dreamweaver 8
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{53480150-81CB-4A86-B378-86B6F08AF80B}" = O&O DriveLED
"{53480370-6CA2-47EC-BC05-02B4B9271C31}" = O&O Defrag Professional Edition
"{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}" = Skype web features
"{55A29068-F2CE-456C-9148-C869879E2357}" = TuneUp Utilities 2009
"{578FA426-47C0-4A3F-98A4-01ACD26B7556}" = LEGO Star Wars II
"{60D32CDC-E3BE-4578-BA10-29322307CDDC}" = Logitech Gaming Software 5.10
"{68EB2C37-083A-4303-B5D8-41FA67E50B8F}_is1" = Poedit
"{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37}" = ICQ7.4
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{80AE0E0A-5579-4015-9C1A-35F2F2CE5673}" = Emergency 4
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8BF2C401-02CE-424D-BC26-6C4F9FB446B6}" = Macromedia Flash 8 Video Encoder
"{8CFA9151-6404-409A-AF22-4632D04582FD}" = Assassin's Creed
"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90120000-00D1-0409-0000-0000000FF1CE}" = Microsoft Office Access database engine 2007 (English)
"{90510407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Visio Professional 2003
"{99052DB7-9592-4522-A558-5417BBAD48EE}" = Microsoft ActiveSync
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A2842BC5-6694-427B-A4D9-6EE48AB5B03C}" = Clicktionary
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-1033-F400-7760-000000000002}" = Adobe Acrobat 7.0 Professional - English, Français, Deutsch
"{B0255743-165B-4BD5-8DA8-37DFB9930014}" = Norton Ghost
"{B2FE1952-0186-46c3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 260.99
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 260.99
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NView" = NVIDIA nView 135.36
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.10.0514
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B9242864-2841-4ADE-86E0-8F90F91B04DD}" = Logitech Gaming Software
"{B9DB4C76-01A4-46D5-8910-F7AA6376DBAF}" = NVIDIA PhysX
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C2C284D2-6BD7-3B34-B0C5-B2CAED168DF7}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - DEU
"{C314CE45-3392-3B73-B4E1-139CD41CA933}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - DEU
"{C5ADA65A-7828-4D85-B071-ECC52B51F794}" = Sony Ericsson PC Suite 1.20.173
"{C82185E8-C27B-4EF4-2009-2222BC2C2B6D}" = Microsoft MapPoint Europe 2009
"{C887C75D-2636-41F6-BB7B-FD4B0314C1E1}" = Paragon Partition Manager 9.0 Professional
"{C911A0C2-2236-3164-AA47-F2566C01AE5E}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1
"{DB6BD5D5-8482-45C0-99CF-745C5B924497}" = WOT für Internet Explorer
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{DF315348-721C-40B8-BAE2-58C6C7D935A2}" = Empire Earth II
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{E914A24F-2412-4374-B420-86D21D6D444A}" = LEGO Star Wars
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F3C1DE9E-5E16-4BA9-B854-7B53A45E3579}" = Cisco Systems VPN Client 5.0.05.0290
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Ad-Aware" = Ad-Aware
"Adobe Acrobat 7.0 Professional - EFG" = Adobe Acrobat 7.1.0 Professional - English, Français, Deutsch
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Amazon MP3-Downloader" = Amazon MP3-Downloader 1.0.9
"AnyDVD" = AnyDVD
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Baphomets Fluch" = Baphomets Fluch
"Baphomets Fluch II" = Baphomets Fluch
"Beneath a Steel Sky" = Beneath a Steel Sky
"Brother HL-1430" = Brother HL-1430
"CloneDVD2" = CloneDVD2
"Dev-C++" = Dev-C++ 5 beta 9 release (4.9.9.2)
"DVD Shrink_is1" = DVD Shrink 3.2
"EAX Unified" = EAX Unified
"EPSON Printer and Utilities" = EPSON-Drucker-Software
"Eumex 404PC" = Telekom Eumex 404PC
"FileZilla Client" = FileZilla Client 3.0.11
"FlashGet" = FlashGet 1.9.6.1073
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4
"Free YouTube Download_is1" = Free YouTube Download 2.10
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.9
"Full Spectrum Warrior" = Full Spectrum Warrior (remove only)
"Greenshot_is1" = Greenshot
"IBM ILOG OPL-CPLEX Analyst Studio Teaching Edition Trial 6.3" = IBM ILOG OPL-CPLEX Analyst Studio Teaching Edition Trial 6.3
"ICQ" = ICQ
"ie8" = Windows Internet Explorer 8
"Inkscape" = Inkscape 0.48.0
"InstallShield_{578FA426-47C0-4A3F-98A4-01ACD26B7556}" = LEGO Star Wars II
"InstallShield_{E914A24F-2412-4374-B420-86D21D6D444A}" = LEGO Star Wars
"KLiteCodecPack_is1" = K-Lite Mega Codec Pack 5.0.0
"LiveUpdate" = LiveUpdate 3.2 (Symantec Corporation)
"Mafia" = Mafia
"Mafia Game" = Mafia Game
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"Mozilla Firefox (3.6.16)" = Mozilla Firefox (3.6.16)
"MP Navigator EX 2.0" = Canon MP Navigator EX 2.0
"MPE" = MyPhoneExplorer
"Nero - Burning Rom!UninstallKey" = Nero 6 Ultra Edition
"NVIDIA nView Desktop Manager" = NVIDIA nView Desktop Manager
"Oracle Fusion Middleware 11.1.1.2.0" = Oracle Fusion Middleware 11.1.1.2.0
"ScummVM_is1" = ScummVM 1.0.0rc1
"SiS163u" = Fujitsu Siemens Computers WLAN 802.11b/g D1705/D1706
"SopCast" = SopCast 3.2.4
"Steam App 340" = Half-Life 2: Lost Coast
"Steam App 50130" = Mafia II
"TheLastRipper" = TheLastRipper 1.4
"TmNationsForever_is1" = TmNationsForever
"TVAnts 1.0" = TVAnts 1.0
"Uninstall_is1" = Uninstall 1.0.0.1
"Urban Terror_is1" = Urban Terror 4.1
"URLSnooper 2_is1" = URL Snooper v2.28.01
"Veetle TV" = Veetle TV 0.9.18
"VLC media player" = VLC media player 1.1.8
"vShare" = vShare Plugin
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinGimp-2.0_is1" = GIMP 2.6.6
"WinPcapInst" = WinPcap 4.1.1
"WinRAR archiver" = WinRAR
"Wolfenstein - Enemy Territory" = Wolfenstein - Enemy Territory
"Write-N-Cite" = Write-N-Cite
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"QIP 2010" = QIP 2010 3.1.5216
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 28.03.2011 12:49:46 | Computer Name = ***-9B80EAF | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung acrobat.exe, Version 7.0.8.218, fehlgeschlagenes
 Modul acrobat.dll, Version 7.1.0.649, Fehleradresse 0x002ae086.
 
Error - 29.03.2011 11:25:21 | Computer Name = ***-9B80EAF | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung acrobat.exe, Version 7.0.8.218, fehlgeschlagenes
 Modul acrobat.dll, Version 7.1.0.649, Fehleradresse 0x002ae086.
 
Error - 31.03.2011 08:48:44 | Computer Name = ***-9B80EAF | Source = Lavasoft Ad-Aware Service | ID = 0
Description = 
 
Error - 03.04.2011 15:16:10 | Computer Name = ***-9B80EAF | Source = Microsoft Office 11 | ID = 2001
Description = Rejected Safe Mode action : Microsoft Office Outlook.
 
Error - 05.04.2011 14:48:43 | Computer Name = ***-9B80EAF | Source = Lavasoft Ad-Aware Service | ID = 0
Description = 
 
Error - 06.04.2011 07:31:51 | Computer Name = ***-9B80EAF | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung acrobat.exe, Version 7.0.8.218, fehlgeschlagenes
 Modul acrobat.dll, Version 7.1.0.649, Fehleradresse 0x002ae086.
 
Error - 06.04.2011 16:54:53 | Computer Name = ***-9B80EAF | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung VISIO.EXE, Version 11.0.3216.0, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 07.04.2011 14:48:35 | Computer Name = ***-9B80EAF | Source = Lavasoft Ad-Aware Service | ID = 0
Description = 
 
Error - 09.04.2011 02:48:37 | Computer Name = ***-9B80EAF | Source = Lavasoft Ad-Aware Service | ID = 0
Description = 
 
Error - 13.04.2011 08:48:36 | Computer Name = ***-9B80EAF | Source = Lavasoft Ad-Aware Service | ID = 0
Description = 
 
[ System Events ]
Error - 13.04.2011 14:58:50 | Computer Name = ***-9B80EAF | Source = W32Time | ID = 39452701
Description = Der Zeitanbieter "NtpClient" wurde für die Zeiterfassung von mehreren
 Zeitquellen  konfiguriert. Es ist jedoch Keine der Quellen verfügbar. Innerhalb  der
 nächsten 15 Minuten wird kein Versuch unternommen, eine Verbindung  mit der Quelle
 herzustellen.  Der NtpClient verfügt über keine Quelle mit genauer Zeit.
 
Error - 13.04.2011 15:00:44 | Computer Name = ***-9B80EAF | Source = W32Time | ID = 39452689
Description = Zeitabieter "NtpClient": Beim DNS-Lookup für den manuell konfigurierten
 Peer  "time.windows.com,0x1" ist ein Fehler aufgetreten. Der DNS-Lookup wird in 15
 Minuten  wiederholt.  Fehler: Der Host war bei einem Socketvorgang nicht erreichbar.
 (0x80072751)
 
Error - 13.04.2011 15:00:44 | Computer Name = ***-9B80EAF | Source = W32Time | ID = 39452701
Description = Der Zeitanbieter "NtpClient" wurde für die Zeiterfassung von mehreren
 Zeitquellen  konfiguriert. Es ist jedoch Keine der Quellen verfügbar. Innerhalb  der
 nächsten 15 Minuten wird kein Versuch unternommen, eine Verbindung  mit der Quelle
 herzustellen.  Der NtpClient verfügt über keine Quelle mit genauer Zeit.
 
Error - 13.04.2011 15:21:23 | Computer Name = ***-9B80EAF | Source = sr | ID = 1
Description = Beim Verarbeiten der Datei "" auf Volume "HarddiskVolume2" ist im 
Wiederherstellungsfilter der unerwartete Fehler "0xC0000001" aufgetreten. Die Volumeüberwachung
 wurde angehalten.
 
Error - 13.04.2011 15:21:31 | Computer Name = ***-9B80EAF | Source = W32Time | ID = 39452689
Description = Zeitabieter "NtpClient": Beim DNS-Lookup für den manuell konfigurierten
 Peer  "time.windows.com,0x1" ist ein Fehler aufgetreten. Der DNS-Lookup wird in 15
 Minuten  wiederholt.  Fehler: Der Host war bei einem Socketvorgang nicht erreichbar.
 (0x80072751)
 
Error - 13.04.2011 15:21:31 | Computer Name = ***-9B80EAF | Source = W32Time | ID = 39452701
Description = Der Zeitanbieter "NtpClient" wurde für die Zeiterfassung von mehreren
 Zeitquellen  konfiguriert. Es ist jedoch Keine der Quellen verfügbar. Innerhalb  der
 nächsten 14 Minuten wird kein Versuch unternommen, eine Verbindung  mit der Quelle
 herzustellen.  Der NtpClient verfügt über keine Quelle mit genauer Zeit.
 
Error - 13.04.2011 15:21:32 | Computer Name = ***-9B80EAF | Source = W32Time | ID = 39452689
Description = Zeitabieter "NtpClient": Beim DNS-Lookup für den manuell konfigurierten
 Peer  "time.windows.com,0x1" ist ein Fehler aufgetreten. Der DNS-Lookup wird in 15
 Minuten  wiederholt.  Fehler: Der Host war bei einem Socketvorgang nicht erreichbar.
 (0x80072751)
 
Error - 13.04.2011 15:21:32 | Computer Name = ***-9B80EAF | Source = W32Time | ID = 39452701
Description = Der Zeitanbieter "NtpClient" wurde für die Zeiterfassung von mehreren
 Zeitquellen  konfiguriert. Es ist jedoch Keine der Quellen verfügbar. Innerhalb  der
 nächsten 15 Minuten wird kein Versuch unternommen, eine Verbindung  mit der Quelle
 herzustellen.  Der NtpClient verfügt über keine Quelle mit genauer Zeit.
 
Error - 13.04.2011 15:24:08 | Computer Name = ***-9B80EAF | Source = W32Time | ID = 39452689
Description = Zeitabieter "NtpClient": Beim DNS-Lookup für den manuell konfigurierten
 Peer  "time.windows.com,0x1" ist ein Fehler aufgetreten. Der DNS-Lookup wird in 15
 Minuten  wiederholt.  Fehler: Der Host war bei einem Socketvorgang nicht erreichbar.
 (0x80072751)
 
Error - 13.04.2011 15:24:08 | Computer Name = ***-9B80EAF | Source = W32Time | ID = 39452701
Description = Der Zeitanbieter "NtpClient" wurde für die Zeiterfassung von mehreren
 Zeitquellen  konfiguriert. Es ist jedoch Keine der Quellen verfügbar. Innerhalb  der
 nächsten 15 Minuten wird kein Versuch unternommen, eine Verbindung  mit der Quelle
 herzustellen.  Der NtpClient verfügt über keine Quelle mit genauer Zeit.
 
[ TuneUp Events ]
Error - 10.04.2011 09:12:33 | Computer Name = ***-9B80EAF | Source = TuneUp Program Statistics | ID = 131840
Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO
 ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2011-04-10 15:12:33', '\device\harddiskvolume2\programme\malwarebytes'
 anti-malware\mbam.exe','2024',0)
 
Error - 10.04.2011 09:12:48 | Computer Name = ***-9B80EAF | Source = TuneUp Program Statistics | ID = 131840
Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO
 ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2011-04-10 15:12:48', '\device\harddiskvolume2\programme\malwarebytes'
 anti-malware\mbam.exe','936',0)
 
Error - 10.04.2011 14:14:59 | Computer Name = ***-9B80EAF | Source = TuneUp Program Statistics | ID = 131840
Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO
 ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2011-04-10 20:14:59', '\device\harddiskvolume2\programme\malwarebytes'
 anti-malware\mbam.exe','4060',0)
 
Error - 12.04.2011 07:26:04 | Computer Name = ***-9B80EAF | Source = TuneUp Program Statistics | ID = 131840
Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO
 ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2011-04-12 13:26:04', '\device\harddiskvolume2\programme\malwarebytes'
 anti-malware\mbam.exe','1312',0)
 
Error - 13.04.2011 14:35:29 | Computer Name = ***-9B80EAF | Source = TuneUp Program Statistics | ID = 131840
Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO
 ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2011-04-13 20:35:29', '\device\harddiskvolume2\programme\malwarebytes'
 anti-malware\mbam.exe','2092',0)
 
Error - 13.04.2011 14:51:49 | Computer Name = ***-9B80EAF | Source = TuneUp Program Statistics | ID = 131840
Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO
 ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2011-04-13 20:51:49', '\device\harddiskvolume2\programme\malwarebytes'
 anti-malware\mbam.exe','840',0)
 
Error - 13.04.2011 15:22:06 | Computer Name = ***-9B80EAF | Source = TuneUp Program Statistics | ID = 131840
Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO
 ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2011-04-13 21:22:06', '\device\harddiskvolume2\programme\malwarebytes'
 anti-malware\mbam.exe','3540',0)
 
 
< End of report >
         
GMER-Log vom 13. bzw. 14.04.2011:
Code:
ATTFilter
GMER 1.0.15.15570 - hxxp://www.gmer.net
Rootkit scan 2011-04-14 10:41:21
Windows 5.1.2600 Service Pack 3 Harddisk1\DR1 -> \Device\Ide\IdeDeviceP3T0L0-1a SAMSUNG_HD753LJ rev.1AA01117
Running: 08gvb8v5.exe; Driver: C:\DOKUME~1\***\LOKALE~1\Temp\uwwdypog.sys


---- System - GMER 1.0.15 ----

SSDT            B858848E                                                                                                                       ZwCreateKey
SSDT            B8588484                                                                                                                       ZwCreateThread
SSDT            B8588493                                                                                                                       ZwDeleteKey
SSDT            B858849D                                                                                                                       ZwDeleteValueKey
SSDT            spoc.sys                                                                                                                       ZwEnumerateKey [0xF7454CA4]
SSDT            spoc.sys                                                                                                                       ZwEnumerateValueKey [0xF7455032]
SSDT            B85884A2                                                                                                                       ZwLoadKey
SSDT            spoc.sys                                                                                                                       ZwOpenKey [0xF74360C0]
SSDT            B8588470                                                                                                                       ZwOpenProcess
SSDT            B8588475                                                                                                                       ZwOpenThread
SSDT            spoc.sys                                                                                                                       ZwQueryKey [0xF745510A]
SSDT            spoc.sys                                                                                                                       ZwQueryValueKey [0xF7454F8A]
SSDT            B85884AC                                                                                                                       ZwReplaceKey
SSDT            B85884A7                                                                                                                       ZwRestoreKey
SSDT            B8588498                                                                                                                       ZwSetValueKey

INT 0x83        ?                                                                                                                              8A206BF8
INT 0xA4        ?                                                                                                                              8A206BF8
INT 0xB4        ?                                                                                                                              8A192BF8
INT 0xB4        ?                                                                                                                              8A192BF8
INT 0xB4        ?                                                                                                                              8A206BF8
INT 0xB4        ?                                                                                                                              8A192BF8

---- Kernel code sections - GMER 1.0.15 ----

.text           ntoskrnl.exe!ZwYieldExecution + 14A                                                                                            804E49A4 2 Bytes  [84, 84]
.text           ntoskrnl.exe!ZwYieldExecution + 452                                                                                            804E4CAC 2 Bytes  [98, 84]
?               feaax.sys                                                                                                                      Das System kann die angegebene Datei nicht finden. !
?               spoc.sys                                                                                                                       Das System kann die angegebene Datei nicht finden. !
.text           C:\WINDOWS\system32\DRIVERS\nv4_mini.sys                                                                                       section is writeable [0xB6C343A0, 0x5CC259, 0xE8000020]
.text           USBPORT.SYS!DllUnload                                                                                                          B6BD78AC 5 Bytes  JMP 8A2061D8 
.text           axitr6w4.SYS                                                                                                                   B6B37386 35 Bytes  [00, 00, 00, 00, 00, 00, 20, ...]
.text           axitr6w4.SYS                                                                                                                   B6B373AA 24 Bytes  [00, 00, 00, 00, 00, 00, 00, ...]
.text           axitr6w4.SYS                                                                                                                   B6B373C4 3 Bytes  [00, 70, 02] {ADD [EAX+0x2], DH}
.text           axitr6w4.SYS                                                                                                                   B6B373C9 1 Byte  [30]
.text           axitr6w4.SYS                                                                                                                   B6B373C9 11 Bytes  [30, 00, 00, 00, 5C, 02, 00, ...] {XOR [EAX], AL; ADD [EAX], AL; POP ESP; ADD AL, [EAX]; ADD [EAX], AL; ADD [EAX], AL}
.text           ...                                                                                                                            

---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT             \WINDOWS\System32\Drivers\SCSIPORT.SYS[ntoskrnl.exe!DbgBreakPoint]                                                             8A1952D8
IAT             pci.sys[ntoskrnl.exe!IoDetachDevice]                                                                                           [F7467C4C] spoc.sys
IAT             pci.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack]                                                                              [F7467CA0] spoc.sys
IAT             atapi.sys[HAL.dll!READ_PORT_UCHAR]                                                                                             [F7437042] spoc.sys
IAT             atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT]                                                                                     [F743713E] spoc.sys
IAT             atapi.sys[HAL.dll!READ_PORT_USHORT]                                                                                            [F74370C0] spoc.sys
IAT             atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT]                                                                                    [F7437800] spoc.sys
IAT             atapi.sys[HAL.dll!WRITE_PORT_UCHAR]                                                                                            [F74376D6] spoc.sys
IAT             \SystemRoot\system32\DRIVERS\USBPORT.SYS[ntoskrnl.exe!DbgBreakPoint]                                                           8A2062D8
IAT             \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR]                                                             [F7446E9C] spoc.sys
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!RtlInitUnicodeString]                                                   8800001C
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!swprintf]                                                               001CB286
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!KeSetEvent]                                                             C61AEB00
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!IoCreateSymbolicLink]                                                   001C8186
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!IoGetConfigurationInformation]                                          86C61200
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!IoDeleteSymbolicLink]                                                   00001C83
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!MmFreeMappingAddress]                                                   8E868801
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!IoFreeErrorLogEntry]                                                    8800001C
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!IoDisconnectInterrupt]                                                  001CAA86
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!MmUnmapIoSpace]                                                         80968B00
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!ObReferenceObjectByPointer]                                             8900001C
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!IofCompleteRequest]                                                     001C9C96
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!RtlCompareUnicodeString]                                                C6168B00
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!IofCallDriver]                                                          001CB986
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!MmAllocateMappingAddress]                                               428A0A00
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!IoAllocateErrorLogEntry]                                                BA86880C
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!IoConnectInterrupt]                                                     8B00001C
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!IoDetachDevice]                                                         24A48DFA
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!KeWaitForSingleObject]                                                  00000000
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!KeInitializeEvent]                                                      4B8BDF8B
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!KeCancelTimer]                                                          8D3F0304
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!RtlAnsiStringToUnicodeString]                                           CB033043
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!RtlInitAnsiString]                                                      0673C13B
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!IoBuildDeviceIoControlRequest]                                          C13B0003
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!IoQueueWorkItem]                                                        8366FA72
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!MmMapIoSpace]                                                           75000E7B
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!IoInvalidateDeviceRelations]                                            0B7D80E3
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!IoReportDetectedDevice]                                                 307B8D00
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!IoReportResourceForDetection]                                           00AA840F
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!RtlxAnsiStringToUnicodeSize]                                            83660000
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!NlsMbCodePageTag]                                                       6A000E7A
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!PoRequestPowerIrp]                                                      C6647400
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!KeInsertByKeyDeviceQueue]                                               001CBB86
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!PoRegisterDeviceForIdleDetection]                                       4F8B0200
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!sprintf]                                                                968D5140
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!MmMapLockedPagesSpecifyCache]                                           00001C90
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!ObfDereferenceObject]                                                   2266E852
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!IoGetAttachedDeviceReference]                                           478B0000
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!IoInvalidateDeviceState]                                                50016A40
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!ZwClose]                                                                1CAC8E8D
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!ObReferenceObjectByHandle]                                              E8510000
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!ZwCreateDirectoryObject]                                                00002254
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!IoBuildSynchronousFsdRequest]                                           6A18538B
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!PoStartNextPowerIrp]                                                    868D5200
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!IoCreateDevice]                                                         00001C98
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!RtlCopyUnicodeString]                                                   2242E850
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!IoAllocateDriverObjectExtension]                                        4B8B0000
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!RtlQueryRegistryValues]                                                 51016A18
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!ZwOpenKey]                                                              1CB4968D
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!RtlFreeUnicodeString]                                                   E8520000
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!IoStartTimer]                                                           00002230
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!KeInitializeTimer]                                                      8A05478A
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!IoInitializeTimer]                                                      001CBB8E
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!KeInitializeDpc]                                                        30C48300
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!KeInitializeSpinLock]                                                   1CBD8688
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!IoInitializeIrp]                                                        80E90000
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!ZwCreateKey]                                                            C6000000
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!RtlAppendUnicodeStringToString]                                         001CBB86
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!RtlIntegerToUnicodeString]                                              438B0100
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!ZwSetValueKey]                                                          8E8D5018
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!KeInsertQueueDpc]                                                       00001C90
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!KefAcquireSpinLockAtDpcLevel]                                           2202E851
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!IoStartPacket]                                                          538B0000
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!KefReleaseSpinLockFromDpcLevel]                                         52016A18
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!IoBuildAsynchronousFsdRequest]                                          1CAC868D
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!IoFreeMdl]                                                              E8500000
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!MmUnlockPages]                                                          000021F0
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!IoWriteErrorLogEntry]                                                   8A05478A
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!KeRemoveByKeyDeviceQueue]                                               001CBB8E
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!MmMapLockedPagesWithReservedMapping]                                    18C48300
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!MmUnmapReservedMapping]                                                 1CBD8688
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!KeSynchronizeExecution]                                                 43EB0000
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!IoStartNextPacket]                                                      320C538A
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!KeBugCheckEx]                                                           88F93BC0
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!KeRemoveDeviceQueue]                                                    001CBB96
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!KeSetTimer]                                                             F6317300
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!_allmul]                                                                74070647
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!MmProbeAndLockPages]                                                    75C0841A
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!_except_handler3]                                                       05578A0B
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!PoSetPowerState]                                                        968801B0
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!IoOpenDeviceRegistryKey]                                                00001CBD
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!RtlWriteRegistryValue]                                                  57B60F66
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!RtlDeleteRegistryValue]                                                 533B6604
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!_aulldiv]                                                               03087408
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!strstr]                                                                 72F93B3F
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!_strupr]                                                                8A09EBDA
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!KeQuerySystemTime]                                                      86880547
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!IoWMIRegistrationControl]                                               00001CBD
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!KeTickCount]                                                            88084B8A
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!IoAttachDeviceToDeviceStack]                                            001CBE8E
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!IoDeleteDevice]                                                         40578B00
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!ExAllocatePoolWithTag]                                                  8D52006A
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!IoAllocateWorkItem]                                                     001CC086
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!IoAllocateIrp]                                                          81E85000
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!IoAllocateMdl]                                                          8B000021
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!MmBuildMdlForNonPagedPool]                                              001CB88E
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!MmLockPagableDataSection]                                               BC968B00
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!IoGetDriverObjectExtension]                                             8900001C
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!MmUnlockPagableImageSection]                                            001CC48E
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!ExFreePoolWithTag]                                                      C8968900
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!IoFreeIrp]                                                              8B00001C
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!IoFreeWorkItem]                                                         016A4047
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!InitSafeBootMode]                                                       CCC68150
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!RtlCompareMemory]                                                       5600001C
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!PoCallDriver]                                                           002157E8
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!memmove]                                                                18C48300
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[ntoskrnl.exe!MmHighestUserAddress]                                                   5D5B5E5F
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[HAL.dll!KfAcquireSpinLock]                                                           18C4830E
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[HAL.dll!READ_PORT_UCHAR]                                                             1C8D9E88
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[HAL.dll!KeGetCurrentIrql]                                                            9E880000
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[HAL.dll!KfRaiseIrql]                                                                 00001CA9
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[HAL.dll!KfLowerIrql]                                                                 0E798366
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[HAL.dll!HalGetInterruptVector]                                                       74AAB000
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[HAL.dll!HalTranslateBusAddress]                                                      8186C636
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[HAL.dll!KeStallExecutionProcessor]                                                   1A00001C
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[HAL.dll!KfReleaseSpinLock]                                                           1C8386C6
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[HAL.dll!READ_PORT_BUFFER_USHORT]                                                     C6020000
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[HAL.dll!READ_PORT_USHORT]                                                            001C8E86
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[HAL.dll!WRITE_PORT_BUFFER_USHORT]                                                    86C60200
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[HAL.dll!WRITE_PORT_UCHAR]                                                            00001CAA
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[WMILIB.SYS!WmiSystemControl]                                                         8800001C
IAT             \SystemRoot\System32\Drivers\axitr6w4.SYS[WMILIB.SYS!WmiCompleteRequest]                                                       001CB19E

---- User IAT/EAT - GMER 1.0.15 ----

IAT             C:\Programme\Cisco Systems\VPN Client\cvpnd.exe[816] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!GetProcAddress]            [00F52BC8] C:\WINDOWS\system32\VSINIT.dll (TrueVector Service/Zone Labs, LLC)
IAT             C:\Programme\Cisco Systems\VPN Client\cvpnd.exe[816] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!UnhandledExceptionFilter]  [00F52CE9] C:\WINDOWS\system32\VSINIT.dll (TrueVector Service/Zone Labs, LLC)
IAT             C:\Programme\Cisco Systems\VPN Client\cvpnd.exe[816] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!TerminateProcess]          [00F52CB8] C:\WINDOWS\system32\VSINIT.dll (TrueVector Service/Zone Labs, LLC)

---- Devices - GMER 1.0.15 ----

Device          \FileSystem\Ntfs \Ntfs                                                                                                         8A1911F8

AttachedDevice  \FileSystem\Ntfs \Ntfs                                                                                                         OODrvled.sys (O&O DriveLED Pro Filter Driver/O&O Software GmbH)
AttachedDevice  \FileSystem\Ntfs \Ntfs                                                                                                         symsnap.sys (StorageCraft Volume Snap-Shot/StorageCraft)

Device          \Driver\usbstor \Device\0000008e                                                                                               89816500
Device          \Driver\NetBT \Device\NetBT_Tcpip_{DA975F48-2362-4C9C-9815-30456140069F}                                                       898BA500
Device          \Driver\usbuhci \Device\USBPDO-0                                                                                               89F301F8
Device          \Driver\dmio \Device\DmControl\DmIoDaemon                                                                                      8A2081F8
Device          \Driver\dmio \Device\DmControl\DmConfig                                                                                        8A2081F8
Device          \Driver\dmio \Device\DmControl\DmPnP                                                                                           8A2081F8
Device          \Driver\dmio \Device\DmControl\DmInfo                                                                                          8A2081F8
Device          \Driver\usbuhci \Device\USBPDO-1                                                                                               89F301F8
Device          \Driver\usbuhci \Device\USBPDO-2                                                                                               89F301F8
Device          \Driver\usbuhci \Device\USBPDO-3                                                                                               89F301F8
Device          \Driver\PCI_PNP5456 \Device\00000054                                                                                           spoc.sys
Device          \Driver\usbehci \Device\USBPDO-4                                                                                               89EF71F8
Device          \Driver\Ftdisk \Device\HarddiskVolume1                                                                                         8A1931F8

AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume1                                                                                         hotcore3.sys (Hotbackup helper driver/Paragon Software Group)
AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume1                                                                                         symsnap.sys (StorageCraft Volume Snap-Shot/StorageCraft)

Device          \Driver\Ftdisk \Device\HarddiskVolume2                                                                                         8A1931F8

AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume2                                                                                         hotcore3.sys (Hotbackup helper driver/Paragon Software Group)
AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume2                                                                                         symsnap.sys (StorageCraft Volume Snap-Shot/StorageCraft)

Device          \Driver\Cdrom \Device\CdRom0                                                                                                   89ED51F8
Device          \Driver\atapi \Device\Ide\IdePort0                                                                                             [F783AB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device          \Driver\atapi \Device\Ide\IdePort1                                                                                             [F783AB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device          \Driver\atapi \Device\Ide\IdePort2                                                                                             [F783AB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device          \Driver\atapi \Device\Ide\IdeDeviceP2T1L0-e                                                                                    [F783AB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device          \Driver\atapi \Device\Ide\IdeDeviceP2T0L0-6                                                                                    [F783AB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device          \Driver\atapi \Device\Ide\IdePort3                                                                                             [F783AB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device          \Driver\atapi \Device\Ide\IdeDeviceP3T0L0-1a                                                                                   [F783AB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device          \Driver\atapi \Device\Ide\IdeDeviceP3T1L0-22                                                                                   [F783AB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device          \Driver\Ftdisk \Device\HarddiskVolume3                                                                                         8A1931F8

AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume3                                                                                         hotcore3.sys (Hotbackup helper driver/Paragon Software Group)
AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume3                                                                                         symsnap.sys (StorageCraft Volume Snap-Shot/StorageCraft)

Device          \Driver\Cdrom \Device\CdRom1                                                                                                   89ED51F8
Device          \Driver\Cdrom \Device\CdRom2                                                                                                   89ED51F8
Device          \Driver\Cdrom \Device\CdRom3                                                                                                   89ED51F8
Device          \Driver\Cdrom \Device\CdRom4                                                                                                   89ED51F8
Device          \Driver\Cdrom \Device\CdRom5                                                                                                   89ED51F8
Device          \Driver\NetBT \Device\NetBt_Wins_Export                                                                                        898BA500
Device          \Driver\NetBT \Device\NetbiosSmb                                                                                               898BA500
Device          \Driver\sptd \Device\3880542956                                                                                                spoc.sys
Device          \Driver\usbstor \Device\00000089                                                                                               89816500
Device          \Driver\usbuhci \Device\USBFDO-0                                                                                               89F301F8
Device          \Driver\usbuhci \Device\USBFDO-1                                                                                               89F301F8
Device          \FileSystem\MRxSmb \Device\LanmanDatagramReceiver                                                                              89895500
Device          \Driver\usbuhci \Device\USBFDO-2                                                                                               89F301F8
Device          \FileSystem\MRxSmb \Device\LanmanRedirector                                                                                    89895500
Device          \Driver\usbuhci \Device\USBFDO-3                                                                                               89F301F8
Device          \Driver\usbehci \Device\USBFDO-4                                                                                               89EF71F8
Device          \Driver\Ftdisk \Device\FtControl                                                                                               8A1931F8
Device          \Driver\NetBT \Device\NetBT_Tcpip_{42E01E41-318F-489C-A715-DB2BA8210801}                                                       898BA500
Device          \Driver\usbstor \Device\0000008a                                                                                               89816500
Device          \Driver\usbstor \Device\0000008b                                                                                               89816500
Device          \Driver\usbstor \Device\0000008c                                                                                               89816500
Device          \Driver\axitr6w4 \Device\Scsi\axitr6w41Port4Path0Target3Lun0                                                                   89E831F8
Device          \Driver\axitr6w4 \Device\Scsi\axitr6w41Port4Path0Target0Lun0                                                                   89E831F8
Device          \Driver\axitr6w4 \Device\Scsi\axitr6w41Port4Path0Target2Lun0                                                                   89E831F8
Device          \Driver\axitr6w4 \Device\Scsi\axitr6w41                                                                                        89E831F8
Device          \Driver\axitr6w4 \Device\Scsi\axitr6w41Port4Path0Target1Lun0                                                                   89E831F8
Device          \Driver\usbstor \Device\0000008d                                                                                               89816500
Device          \FileSystem\Cdfs \Cdfs                                                                                                         89817500

---- Registry - GMER 1.0.15 ----

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1                                                                             771343423
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2                                                                             285507792
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0                                                                             1
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC                                               
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                            C:\Programme\DAEMON Tools Lite\
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                            0
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                         0x78 0x70 0x09 0xD1 ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001                                      
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                                   0x20 0x01 0x00 0x00 ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                                0x4E 0xED 0x8F 0xCC ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0                                 
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                           0x54 0x9B 0x15 0xBD ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1                                 
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12                           0x2A 0xBC 0x71 0xA7 ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq2                                 
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq2@hdf12                           0x8A 0xF3 0xD5 0x92 ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq3                                 
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq3@hdf12                           0x53 0x69 0x33 0x1E ...
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)                           
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                                C:\Programme\DAEMON Tools Lite\
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                                0
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                             0x78 0x70 0x09 0xD1 ...
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)                  
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                                       0x20 0x01 0x00 0x00 ...
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                                    0x4E 0xED 0x8F 0xCC ...
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)             
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                               0x54 0x9B 0x15 0xBD ...
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1 (not active ControlSet)             
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12                               0x2A 0xBC 0x71 0xA7 ...
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq2 (not active ControlSet)             
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq2@hdf12                               0x8A 0xF3 0xD5 0x92 ...
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq3 (not active ControlSet)             
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq3@hdf12                               0x53 0x69 0x33 0x1E ...
Reg             HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System                                                                          
Reg             HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OODEFRAG08.00.00.01WORKSTATION                                           2D7F452B5CC4D53D929A171EB54F6EF3072FE30362F3C25C826A5832C44CC85C01C157A9DBF006F64427E8D56BF22591EBC568E77CE65257D5DB99BA2883F028549674C9B6441697B60B583A05AADC7794B17D6BCB8686787C7CC125A0CDE95C60FD3CC7DC0E342E5D10AD16415E7A9554242E0BF87119B1440942BE64A7E28A0BD82661B143A50EDE6302BA4F1D7820AAB1DA47A36E5836AD9E5EDA1E2EA008F3717A588EFA43CE959345F9D415621051D536245EE72701ECBF31CCED2678F0EBF0D7753FF2F84A0F173A2D6B9DDA20336EC92AAD6B7B4DEAD2A5EFE6F3D621F768AE018208C6211044F5AF9F2D1752F0B9EF678B2BFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A9C6AECB7A5D1407A6A0AC4980AC79335D575E7D6A3B9808EFF75B9D2DDEBC641F2C11C0D4208F64FDAE183FC9EC378EAAE182CCB66E327B31411E3AFD00791F8DB385BCEB06FD5717E90A39C44F7485AD4D652B1A157434B7FBBE1875F7E15A7559FD8F4E1CA91D212BF03ED35050315E4BC19107BDCD407CE0B866A0B6B96784B4D2D34D89C43E9B8AA2732E648AF3B4938A4A3AD1ABF90BEABBBAE4B73ABA7BA28F8590F574E71F66A65CDF0855D63A27E3064639ECE08458288C767410ED31437387968E53EDD35FB9664C36D702104
Reg             HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OODLED02.00.00.02WSSV                                                    BBBBCB2418C182E67546FB583D7F00167DC7AA22F3DC2B7075EBB276542F3C971E8B2A27B393664DA3D28102C2B9FC00F5AEB54824762B2BB48F09F029313782A9F9D4410F99DEEACFE4E9AD5032B64DF5E9FB0D0DA529ABDD4B1E23F5F5F29382BA596FD5EB42585A83C0539E64572133F729070E6CC040A1AB625F62A31C67F310065E99746E9E43C8571FC4A30D110BE4B27D6BA0112ED258882B7BB4E0906955F07451F4C3BA3262C3714392082B7A54CCF04B6BBC2EE8880841B077F69274F570C85401262070935D60FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A9C6AECB7A5D1407A6A0AC4980AC79335D575E7D6A3B9808BC6FDAADD8F6DFAC8398CDC482F2B72A3A8D9C5C823665F6AAB73A14860B9C39999E86D6B1DFF6F107A627D02F2756E485936ABFC704CCC915E2408E0C5321502077C0BE8F73D976F18EC0AC39E8DC2E51897B92124E1E4C2403456D3A165D5519BF55225D18F50A75DC19804173BC515B619E8BDC436BE9390F88958515256F33119332A5C402302670306C8D152A50405FA5D4C7A40A3E1E4F4B60852A8F78FBDA4F949B09F320FEFC890008309FDE039DE48D944B959BFAE2D597764177FEE9606060910588455E0C2EC3403BD8660987B6482BA26C09623AF17DB7D9FA4653B6A22

---- EOF - GMER 1.0.15 ----
         

Alt 14.04.2011, 15:09   #2
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Trojaner: CleanThis, MS Removal Tool und Windows Restore - Standard

Trojaner: CleanThis, MS Removal Tool und Windows Restore



Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
ATTFilter
:OTL
@Alternate Data Stream - 40 bytes -> C:\WINDOWS\system32:896b29c3.zreglib
@Alternate Data Stream - 24 bytes -> C:\WINDOWS:0ADB507A9315A1DE
@Alternate Data Stream - 229 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:8FF81EB0
:Commands
[purity]
[resethosts]
[emptytemp]
         
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.
__________________

__________________

Alt 14.04.2011, 17:17   #3
berlyn
 
Trojaner: CleanThis, MS Removal Tool und Windows Restore - Standard

Trojaner: CleanThis, MS Removal Tool und Windows Restore



Vielen Dank soweit!

OTL-Fix durchgeführt:
Code:
ATTFilter
All processes killed
========== OTL ==========
ADS C:\WINDOWS\system32:896b29c3.zreglib deleted successfully.
ADS C:\WINDOWS:0ADB507A9315A1DE deleted successfully.
ADS C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:8FF81EB0 deleted successfully.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
[EMPTYTEMP]
 
User: All Users
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: ***
->Temp folder emptied: 2096360520 bytes
->Temporary Internet Files folder emptied: 200037533 bytes
->Java cache emptied: 84808335 bytes
->FireFox cache emptied: 130237253 bytes
->Flash cache emptied: 392464 bytes
 
User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 3212868 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 3023018 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2605373 bytes
%systemroot%\System32 .tmp files removed: 2951 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 425317 bytes
RecycleBin emptied: 249680 bytes
 
Total Files Cleaned = 2.405,00 mb
 
 
OTL by OldTimer - Version 3.2.22.3 log created on 04142011_180552

Files\Folders moved on Reboot...
C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Temp\WCESLog.log moved successfully.
C:\WINDOWS\temp\Perflib_Perfdata_17a8.dat moved successfully.
File\Folder C:\WINDOWS\temp\Perflib_Perfdata_21ec.dat not found!

Registry entries deleted on Reboot...
         
__________________

Alt 14.04.2011, 17:49   #4
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Trojaner: CleanThis, MS Removal Tool und Windows Restore - Standard

Trojaner: CleanThis, MS Removal Tool und Windows Restore



Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html
__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Alt 14.04.2011, 18:02   #5
berlyn
 
Trojaner: CleanThis, MS Removal Tool und Windows Restore - Standard

Trojaner: CleanThis, MS Removal Tool und Windows Restore



TDSSKiller-Log:
Code:
ATTFilter
2011/04/14 18:56:47.0453 4064	TDSS rootkit removing tool 2.4.21.0 Mar 10 2011 12:26:28
2011/04/14 18:56:47.0453 4064	================================================================================
2011/04/14 18:56:47.0453 4064	SystemInfo:
2011/04/14 18:56:47.0453 4064	
2011/04/14 18:56:47.0453 4064	OS Version: 5.1.2600 ServicePack: 3.0
2011/04/14 18:56:47.0453 4064	Product type: Workstation
2011/04/14 18:56:47.0453 4064	ComputerName: ***-9B80EAF
2011/04/14 18:56:47.0453 4064	UserName: ***
2011/04/14 18:56:47.0453 4064	Windows directory: C:\WINDOWS
2011/04/14 18:56:47.0453 4064	System windows directory: C:\WINDOWS
2011/04/14 18:56:47.0453 4064	Processor architecture: Intel x86
2011/04/14 18:56:47.0453 4064	Number of processors: 4
2011/04/14 18:56:47.0453 4064	Page size: 0x1000
2011/04/14 18:56:47.0453 4064	Boot type: Normal boot
2011/04/14 18:56:47.0453 4064	================================================================================
2011/04/14 18:56:48.0046 4064	Initialize success
2011/04/14 18:56:57.0968 0584	================================================================================
2011/04/14 18:56:57.0968 0584	Scan started
2011/04/14 18:56:57.0968 0584	Mode: Manual; 
2011/04/14 18:56:57.0968 0584	================================================================================
2011/04/14 18:56:58.0171 0584	ACPI            (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2011/04/14 18:56:58.0203 0584	ACPIEC          (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\drivers\ACPIEC.sys
2011/04/14 18:56:58.0234 0584	aec             (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
2011/04/14 18:56:58.0265 0584	AFD             (7e775010ef291da96ad17ca4b17137d7) C:\WINDOWS\System32\drivers\afd.sys
2011/04/14 18:56:58.0359 0584	AnyDVD          (40c279a23bd43553bfba6e88a9b38ae2) C:\WINDOWS\system32\Drivers\AnyDVD.sys
2011/04/14 18:56:58.0359 0584	Arp1394         (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
2011/04/14 18:56:58.0421 0584	AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2011/04/14 18:56:58.0437 0584	atapi           (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
2011/04/14 18:56:58.0468 0584	Atmarpc         (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2011/04/14 18:56:58.0500 0584	audstub         (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2011/04/14 18:56:58.0578 0584	avgio           (0b497c79824f8e1bf22fa6aacd3de3a0) C:\Programme\Avira\AntiVir Desktop\avgio.sys
2011/04/14 18:56:58.0625 0584	avgntflt        (47b879406246ffdced59e18d331a0e7d) C:\WINDOWS\system32\DRIVERS\avgntflt.sys
2011/04/14 18:56:58.0640 0584	avipbb          (5fedef54757b34fb611b9ec8fb399364) C:\WINDOWS\system32\DRIVERS\avipbb.sys
2011/04/14 18:56:58.0671 0584	Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2011/04/14 18:56:58.0703 0584	BrPar           (2fe6d5be0629f706197b30c0aa05de30) C:\WINDOWS\System32\drivers\BrPar.sys
2011/04/14 18:56:58.0750 0584	CAPI20          (90f82e0d33b35a5a1813ca3623fad102) C:\WINDOWS\System32\Drivers\CAPI20.SYS
2011/04/14 18:56:58.0765 0584	cbidf2k         (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2011/04/14 18:56:58.0796 0584	Cdaudio         (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2011/04/14 18:56:58.0796 0584	Cdfs            (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
2011/04/14 18:56:58.0812 0584	Cdrom           (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2011/04/14 18:56:58.0890 0584	CVirtA          (b5ecadf7708960f1818c7fa015f4c239) C:\WINDOWS\system32\DRIVERS\CVirtA.sys
2011/04/14 18:56:58.0921 0584	CVPNDRVA        (d46b2e0eeaf349f2085f8b164e462156) C:\WINDOWS\system32\Drivers\CVPNDRVA.sys
2011/04/14 18:56:58.0953 0584	DETEWECP        (d24bab151777f35f24651ae40005510b) C:\WINDOWS\System32\drivers\detewecp.sys
2011/04/14 18:56:58.0968 0584	Disk            (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
2011/04/14 18:56:59.0000 0584	dmboot          (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys
2011/04/14 18:56:59.0015 0584	dmio            (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys
2011/04/14 18:56:59.0031 0584	dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2011/04/14 18:56:59.0046 0584	DMusic          (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
2011/04/14 18:56:59.0046 0584	DNE             (694616f813fb627a32c9e32dec133078) C:\WINDOWS\system32\DRIVERS\dne2000.sys
2011/04/14 18:56:59.0078 0584	drmkaud         (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
2011/04/14 18:56:59.0109 0584	ElbyCDIO        (d71233d7ccc2e64f8715a20428d5a33b) C:\WINDOWS\system32\Drivers\ElbyCDIO.sys
2011/04/14 18:56:59.0125 0584	Fastfat         (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
2011/04/14 18:56:59.0140 0584	Fdc             (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
2011/04/14 18:56:59.0140 0584	Fips            (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys
2011/04/14 18:56:59.0156 0584	Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
2011/04/14 18:56:59.0156 0584	FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
2011/04/14 18:56:59.0171 0584	Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2011/04/14 18:56:59.0187 0584	Ftdisk          (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2011/04/14 18:56:59.0203 0584	GEARAspiWDM     (5dc17164f66380cbfefd895c18467773) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
2011/04/14 18:56:59.0203 0584	Gpc             (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2011/04/14 18:56:59.0234 0584	HDAudBus        (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
2011/04/14 18:56:59.0265 0584	HidUsb          (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2011/04/14 18:56:59.0281 0584	hotcore3        (45afa1226e57123ae68696813b1da213) C:\WINDOWS\system32\drivers\hotcore3.sys
2011/04/14 18:56:59.0328 0584	HTTP            (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
2011/04/14 18:56:59.0359 0584	i8042prt        (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
2011/04/14 18:56:59.0375 0584	Imapi           (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
2011/04/14 18:56:59.0500 0584	IntcAzAudAddService (1ebde650d97a8eccdc1cc4a0804647cd) C:\WINDOWS\system32\drivers\RtkHDAud.sys
2011/04/14 18:56:59.0546 0584	intelppm        (4c7d2750158ed6e7ad642d97bffae351) C:\WINDOWS\system32\DRIVERS\intelppm.sys
2011/04/14 18:56:59.0562 0584	Ip6Fw           (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
2011/04/14 18:56:59.0578 0584	IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2011/04/14 18:56:59.0593 0584	IpInIp          (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2011/04/14 18:56:59.0609 0584	IpNat           (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2011/04/14 18:56:59.0625 0584	IPSec           (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2011/04/14 18:56:59.0640 0584	IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
2011/04/14 18:56:59.0656 0584	isapnp          (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2011/04/14 18:56:59.0671 0584	itchfltr        (8f1ba487b35f0c8f637e05113aa815f8) C:\WINDOWS\system32\DRIVERS\itchfltr.sys
2011/04/14 18:56:59.0687 0584	Kbdclass        (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2011/04/14 18:56:59.0703 0584	kbdhid          (b6d6c117d771c98130497265f26d1882) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
2011/04/14 18:56:59.0718 0584	kmixer          (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
2011/04/14 18:56:59.0734 0584	KSecDD          (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
2011/04/14 18:56:59.0765 0584	Lbd             (713cd5267abfb86fe90a72e384e82a38) C:\WINDOWS\system32\DRIVERS\Lbd.sys
2011/04/14 18:56:59.0796 0584	mnmdd           (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2011/04/14 18:56:59.0828 0584	Modem           (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys
2011/04/14 18:56:59.0828 0584	Mouclass        (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2011/04/14 18:56:59.0843 0584	mouhid          (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2011/04/14 18:56:59.0859 0584	MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
2011/04/14 18:56:59.0875 0584	MRxDAV          (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2011/04/14 18:56:59.0906 0584	MRxSmb          (f3aefb11abc521122b67095044169e98) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2011/04/14 18:56:59.0921 0584	Msfs            (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
2011/04/14 18:56:59.0937 0584	MSKSSRV         (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2011/04/14 18:56:59.0953 0584	MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2011/04/14 18:56:59.0968 0584	MSPQM           (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
2011/04/14 18:56:59.0984 0584	mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2011/04/14 18:57:00.0000 0584	Mup             (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys
2011/04/14 18:57:00.0015 0584	NDIS            (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
2011/04/14 18:57:00.0031 0584	NdisTapi        (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2011/04/14 18:57:00.0046 0584	Ndisuio         (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2011/04/14 18:57:00.0062 0584	NdisWan         (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2011/04/14 18:57:00.0078 0584	NDProxy         (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
2011/04/14 18:57:00.0093 0584	NetBIOS         (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
2011/04/14 18:57:00.0093 0584	NetBT           (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
2011/04/14 18:57:00.0140 0584	NIC1394         (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
2011/04/14 18:57:00.0187 0584	NPF             (b9730495e0cf674680121e34bd95a73b) C:\WINDOWS\system32\drivers\npf.sys
2011/04/14 18:57:00.0203 0584	Npfs            (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
2011/04/14 18:57:00.0218 0584	Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
2011/04/14 18:57:00.0234 0584	Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2011/04/14 18:57:00.0406 0584	nv              (b9b1bb146eb9a83dcf0f5635b09d3d43) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
2011/04/14 18:57:00.0531 0584	NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2011/04/14 18:57:00.0531 0584	NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2011/04/14 18:57:00.0562 0584	ohci1394        (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
2011/04/14 18:57:00.0578 0584	OODrvled        (e1ae4d2b84e304f374a198f27c0812bb) C:\WINDOWS\system32\DRIVERS\OODrvled.sys
2011/04/14 18:57:00.0593 0584	Parport         (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\DRIVERS\parport.sys
2011/04/14 18:57:00.0609 0584	PartMgr         (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
2011/04/14 18:57:00.0625 0584	ParVdm          (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys
2011/04/14 18:57:00.0640 0584	PCI             (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys
2011/04/14 18:57:00.0656 0584	PCIIde          (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\DRIVERS\pciide.sys
2011/04/14 18:57:00.0687 0584	Pcmcia          (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\drivers\Pcmcia.sys
2011/04/14 18:57:00.0765 0584	PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2011/04/14 18:57:00.0765 0584	PSched          (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
2011/04/14 18:57:00.0781 0584	Ptilink         (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2011/04/14 18:57:00.0828 0584	RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2011/04/14 18:57:00.0843 0584	Rasl2tp         (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2011/04/14 18:57:00.0843 0584	RasPppoe        (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2011/04/14 18:57:00.0859 0584	Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2011/04/14 18:57:00.0890 0584	Rdbss           (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2011/04/14 18:57:00.0890 0584	RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2011/04/14 18:57:00.0906 0584	rdpdr           (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
2011/04/14 18:57:00.0921 0584	RDPWD           (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
2011/04/14 18:57:00.0937 0584	redbook         (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys
2011/04/14 18:57:00.0968 0584	RTLE8023xp      (25be98c05808c57e4d8d26477dc12d39) C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys
2011/04/14 18:57:00.0984 0584	s125bus         (06847aa6f3a9bf7c44134d00a2e578c0) C:\WINDOWS\system32\DRIVERS\s125bus.sys
2011/04/14 18:57:01.0015 0584	s125mgmt        (82b14c51de76825ec769a6374e4c57d6) C:\WINDOWS\system32\DRIVERS\s125mgmt.sys
2011/04/14 18:57:01.0046 0584	s125obex        (bedfc5707c356fd073bf1a4afe442d91) C:\WINDOWS\system32\DRIVERS\s125obex.sys
2011/04/14 18:57:01.0062 0584	sbp2port        (b244960e5a1db8e9d5d17086de37c1e4) C:\WINDOWS\system32\DRIVERS\sbp2port.sys
2011/04/14 18:57:01.0078 0584	Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2011/04/14 18:57:01.0093 0584	serenum         (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
2011/04/14 18:57:01.0109 0584	Serial          (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\DRIVERS\serial.sys
2011/04/14 18:57:01.0125 0584	Sfloppy         (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
2011/04/14 18:57:01.0171 0584	SIS163u         (4edc881c138e778feb9bd24cbc6b33ed) C:\WINDOWS\system32\DRIVERS\sis163u.sys
2011/04/14 18:57:01.0203 0584	SONYPVU1        (a1eceeaa5c5e74b2499eb51d38185b84) C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS
2011/04/14 18:57:01.0218 0584	splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
2011/04/14 18:57:01.0265 0584	sptd            (d15da1ba189770d93eea2d7e18f95af9) C:\WINDOWS\system32\Drivers\sptd.sys
2011/04/14 18:57:01.0265 0584	Suspicious file (NoAccess): C:\WINDOWS\system32\Drivers\sptd.sys. md5: d15da1ba189770d93eea2d7e18f95af9
2011/04/14 18:57:01.0265 0584	sptd - detected Locked file (1)
2011/04/14 18:57:01.0281 0584	sr              (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys
2011/04/14 18:57:01.0296 0584	Srv             (0f6aefad3641a657e18081f52d0c15af) C:\WINDOWS\system32\DRIVERS\srv.sys
2011/04/14 18:57:01.0343 0584	ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
2011/04/14 18:57:01.0375 0584	StarOpen        (f92254b0bcfcd10caac7bccc7cb7f467) C:\WINDOWS\system32\drivers\StarOpen.sys
2011/04/14 18:57:01.0390 0584	swenum          (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
2011/04/14 18:57:01.0390 0584	swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
2011/04/14 18:57:01.0437 0584	symsnap         (c9273531eac75ee225e3170fb6107fa3) C:\WINDOWS\system32\DRIVERS\symsnap.sys
2011/04/14 18:57:01.0468 0584	sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
2011/04/14 18:57:01.0484 0584	Tcpip           (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2011/04/14 18:57:01.0515 0584	TDPIPE          (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
2011/04/14 18:57:01.0531 0584	TDTCP           (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
2011/04/14 18:57:01.0546 0584	TermDD          (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
2011/04/14 18:57:01.0593 0584	Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
2011/04/14 18:57:01.0625 0584	Update          (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
2011/04/14 18:57:01.0656 0584	usbccgp         (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2011/04/14 18:57:01.0671 0584	usbehci         (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2011/04/14 18:57:01.0687 0584	usbhub          (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2011/04/14 18:57:01.0703 0584	usbprint        (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
2011/04/14 18:57:01.0734 0584	usbscan         (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
2011/04/14 18:57:01.0750 0584	usbstor         (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2011/04/14 18:57:01.0765 0584	usbuhci         (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
2011/04/14 18:57:01.0781 0584	v2imount        (b4d63048d6358e7c6ab61b98b8cff263) C:\WINDOWS\system32\DRIVERS\v2imount.sys
2011/04/14 18:57:01.0781 0584	VgaSave         (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
2011/04/14 18:57:01.0812 0584	VolSnap         (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys
2011/04/14 18:57:01.0828 0584	VPROEVENTMONITOR (e78781b2c86c92a0a738df566460f716) C:\WINDOWS\system32\drivers\VProEventMonitor.sys
2011/04/14 18:57:01.0843 0584	vsdatant        (0354ba3a5ba5e28cc247eb5f5dd8793c) C:\WINDOWS\system32\vsdatant.sys
2011/04/14 18:57:01.0875 0584	Wanarp          (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2011/04/14 18:57:01.0890 0584	wdmaud          (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
2011/04/14 18:57:01.0921 0584	WimFltr         (f9ad3a5e3fd7e0bdb18b8202b0fdd4e4) C:\WINDOWS\system32\DRIVERS\wimfltr.sys
2011/04/14 18:57:01.0937 0584	WmBEnum         (5d410936831f7fb58eff941eac3f6d3d) C:\WINDOWS\system32\drivers\WmBEnum.sys
2011/04/14 18:57:01.0984 0584	WmFilter        (7a13cfde92956ca61a0927d766c5ad4f) C:\WINDOWS\system32\drivers\WmFilter.sys
2011/04/14 18:57:02.0015 0584	WmVirHid        (6f04646bc690f8bbfc344be32a60796d) C:\WINDOWS\system32\drivers\WmVirHid.sys
2011/04/14 18:57:02.0015 0584	WmXlCore        (1d6ca43d562333f4dfb40bcef2453f3a) C:\WINDOWS\system32\drivers\WmXlCore.sys
2011/04/14 18:57:02.0156 0584	================================================================================
2011/04/14 18:57:02.0156 0584	Scan finished
2011/04/14 18:57:02.0156 0584	================================================================================
2011/04/14 18:57:02.0171 2492	Detected object count: 1
2011/04/14 18:57:30.0609 2492	sptd            (d15da1ba189770d93eea2d7e18f95af9) C:\WINDOWS\system32\Drivers\sptd.sys
2011/04/14 18:57:30.0609 2492	Suspicious file (NoAccess): C:\WINDOWS\system32\Drivers\sptd.sys. md5: d15da1ba189770d93eea2d7e18f95af9
2011/04/14 18:57:30.0640 2492	C:\WINDOWS\system32\Drivers\sptd.sys - copied to quarantine
2011/04/14 18:57:30.0640 2492	Locked file(sptd) - User select action: Quarantine
         


Alt 14.04.2011, 18:05   #6
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Trojaner: CleanThis, MS Removal Tool und Windows Restore - Standard

Trojaner: CleanThis, MS Removal Tool und Windows Restore



SPTD ist ok, den hättest du so lassen können.

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.
__________________
--> Trojaner: CleanThis, MS Removal Tool und Windows Restore

Alt 15.04.2011, 17:13   #7
berlyn
 
Trojaner: CleanThis, MS Removal Tool und Windows Restore - Standard

Trojaner: CleanThis, MS Removal Tool und Windows Restore



Okay, danke, SPTD ist ja noch da...

CF wurde mittlerweile auch ausgeführt:
Code:
ATTFilter
ComboFix 11-04-14.03 - *** 15.04.2011  17:55:35.1.4 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.49.1031.18.3071.2618 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\***\Desktop\cofi.exe
AV: AntiVir Desktop *Enabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\dokumente und einstellungen\All Users\Anwendungsdaten\Adobe Systems
c:\dokumente und einstellungen\All Users\Anwendungsdaten\Adobe Systems\Product licenses\B2896000.dat
c:\dokumente und einstellungen\All Users\Anwendungsdaten\data.dll
c:\dokumente und einstellungen\***\Desktop\install_flash_player.exe
c:\dokumente und einstellungen\***\WINDOWS
c:\programme\INSTALL.LOG
.
.
(((((((((((((((((((((((   Dateien erstellt von 2011-03-15 bis 2011-04-15  ))))))))))))))))))))))))))))))
.
.
2011-04-15 07:43 . 2011-04-15 07:43	--------	d-----w-	c:\programme\CCleaner
2011-04-14 16:57 . 2011-04-14 16:57	--------	d-----w-	C:\TDSSKiller_Quarantine
2011-04-14 16:05 . 2011-04-14 16:05	--------	d-----w-	C:\_OTL
2011-04-13 19:20 . 2011-04-13 19:20	--------	d-----w-	c:\windows\system32\wbem\Repository
2011-04-11 13:29 . 2011-04-11 13:29	--------	d-----w-	c:\programme\Gemeinsame Dateien\Java
2011-04-11 13:28 . 2011-04-11 13:27	73728	----a-w-	c:\windows\system32\javacpl.cpl
2011-04-11 13:27 . 2011-04-11 13:27	--------	d-----w-	c:\programme\Java
2011-04-10 13:12 . 2011-04-10 13:12	--------	d-----w-	c:\dokumente und einstellungen\***\Anwendungsdaten\Malwarebytes
2011-04-10 13:12 . 2010-12-20 16:09	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2011-04-10 13:12 . 2011-04-10 13:12	--------	d-----w-	c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2011-04-10 13:12 . 2011-04-10 14:51	--------	d-----w-	c:\programme\Malwarebytes' Anti-Malware
2011-04-10 13:12 . 2010-12-20 16:08	20952	----a-w-	c:\windows\system32\drivers\mbam.sys
2011-04-03 19:40 . 2011-04-03 19:40	--------	d-----w-	c:\dokumente und einstellungen\***\Anwendungsdaten\QIP
2011-04-03 19:38 . 2011-04-12 14:38	--------	d-----w-	c:\programme\QIP 2010
2011-04-03 12:06 . 2011-04-03 12:06	20586196	----a-w-	C:\vlc-1.1.8-win32.exe
2011-03-18 13:01 . 1999-06-25 09:55	149504	----a-w-	c:\windows\UNWISE.EXE
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-11 13:27 . 2010-04-22 15:49	472808	----a-w-	c:\windows\system32\deployJava1.dll
2011-03-16 15:20 . 2009-07-17 12:36	137656	----a-w-	c:\windows\system32\drivers\avipbb.sys
2011-02-09 13:53 . 2004-08-04 12:00	270848	----a-w-	c:\windows\system32\sbe.dll
2011-02-09 13:53 . 2004-08-04 12:00	186880	----a-w-	c:\windows\system32\encdec.dll
2011-02-02 07:58 . 2009-07-16 17:29	2067456	----a-w-	c:\windows\system32\mstscax.dll
2011-01-27 11:57 . 2009-07-16 17:29	677888	----a-w-	c:\windows\system32\mstsc.exe
2011-01-21 14:44 . 2004-08-04 12:00	440832	----a-w-	c:\windows\system32\shimgvw.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-07-17 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"zBrowser Launcher"="c:\programme\Logitech\iTouch\iTouch.exe" [2004-03-18 892928]
"RTHDCPL"="RTHDCPL.EXE" [2007-07-05 16380416]
"Start WingMan Profiler"="c:\programme\Logitech\Gaming Software\LWEMon.exe" [2010-06-14 153672]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-10-16 110696]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-10-16 13851752]
"nwiz"="c:\programme\NVIDIA Corporation\nView\nwiz.exe" [2010-08-25 1753192]
"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2010-10-29 249064]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\dokumente und einstellungen\Default User\Startmen\Programme\Autostart\
DSL-Manager.lnk - c:\programme\DSL-Manager\DslMgr.exe [N/A]
.
c:\dokumente und einstellungen\Default User\Startmen\Programme\Autostart\
DSL-Manager.lnk - c:\programme\DSL-Manager\DslMgr.exe [N/A]
.
c:\dokumente und einstellungen\Default User\Startmen\Programme\Autostart\
DSL-Manager.lnk - c:\programme\DSL-Manager\DslMgr.exe [N/A]
.
c:\dokumente und einstellungen\Default User\Startmen\Programme\Autostart\
DSL-Manager.lnk - c:\programme\DSL-Manager\DslMgr.exe [N/A]
.
c:\dokumente und einstellungen\All Users\Startmen\Programme\Autostart\
CAPI Control.lnk - c:\programme\Eumex 404PC\Capictrl.exe [2009-7-17 274432]
EPSON Status Monitor 3 Environment Check 2.lnk - c:\windows\system32\spool\drivers\w32x86\3\E_SRCV02.EXE [2011-2-21 135680]
.
c:\dokumente und einstellungen\Default User\Startmen\Programme\Autostart\
DSL-Manager.lnk - c:\programme\DSL-Manager\DslMgr.exe [N/A]
.
c:\dokumente und einstellungen\Default User\Startmen\Programme\Autostart\
DSL-Manager.lnk - c:\programme\DSL-Manager\DslMgr.exe [N/A]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	autocheck autochk *\0OODBS\0lsdelete
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
.
[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Adobe Acrobat - Schnellstart.lnk]
path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Acrobat - Schnellstart.lnk
backup=c:\windows\pss\Adobe Acrobat - Schnellstart.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Clicktionary.lnk]
path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\Clicktionary.lnk
backup=c:\windows\pss\Clicktionary.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^VPN Client.lnk]
path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\VPN Client.lnk
backup=c:\windows\pss\VPN Client.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0]
2008-04-23 00:08	483328	----a-w-	c:\programme\Adobe\Acrobat 7.0\Distillr\acrotray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AnyDVD]
2011-01-06 18:00	4763256	----a-w-	c:\programme\SlySoft\AnyDVD\AnyDVDtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avgnt]
2010-11-04 16:00	281768	----a-w-	c:\programme\Avira\AntiVir Desktop\avgnt.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2009-04-23 13:51	691656	----a-w-	c:\programme\DAEMON Tools Lite\daemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware (reboot)]
2010-12-20 16:08	963976	----a-w-	c:\programme\Malwarebytes' Anti-Malware\mbam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Mirabilis ICQ]
2003-10-14 16:36	38984	----a-w-	c:\progra~1\ICQ\ICQNet.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Norton Ghost 14.0]
2008-01-19 18:01	2245984	----a-w-	c:\programme\Norton Ghost\Agent\VProTray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2009-10-09 12:11	25623336	----a-r-	c:\programme\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
2005-10-26 14:17	159744	----a-r-	c:\programme\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2011-01-16 23:57	1242448	----a-w-	c:\programme\Steam\steam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-07-17 14:45	39408	----a-w-	c:\programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"AntiVirService"=2 (0x2)
"AntiVirSchedulerService"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"MSConfig"=c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
"NeroFilterCheck"=c:\windows\system32\NeroCheck.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Programme\\ICQ\\Icq.exe"=
"c:\programme\Microsoft ActiveSync\rapimgr.exe"= c:\programme\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\programme\Microsoft ActiveSync\wcescomm.exe"= c:\programme\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\programme\Microsoft ActiveSync\WCESMgr.exe"= c:\programme\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Games\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx9.exe"=
"c:\\Games\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx10.exe"=
"c:\\Games\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Launcher.exe"=
"c:\\Programme\\TVAnts\\Tvants.exe"=
"c:\\Programme\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Programme\\SopCast\\adv\\SopAdver.exe"=
"c:\\Programme\\SopCast\\SopCast.exe"=
"c:\\Programme\\xampp\\mysql\\bin\\mysqld.exe"=
"c:\\Programme\\xampp\\apache\\bin\\httpd.exe"=
"c:\\Programme\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Programme\\Skype\\Phone\\Skype.exe"=
"c:\\Programme\\FlashGet\\flashget.exe"=
"c:\\Programme\\Steam\\Steam.exe"=
"c:\\Programme\\ICQ7.4\\ICQ.exe"=
"c:\\Programme\\Steam\\SteamApps\\common\\mafia ii\\pc\\mafia2.exe"=
"c:\\Programme\\QIP 2010\\qip.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"33334:TCP"= 33334:TCP:SST
.
R0 hotcore3;hotcore3;c:\windows\system32\drivers\hotcore3.sys [16.07.2009 19:55 39472]
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [17.07.2009 20:33 64288]
R0 OODrvled;OODrvled;c:\windows\system32\drivers\OODrvled.sys [17.08.2004 10:35 15488]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [17.07.2009 17:34 721904]
R2 CAPI20;Eumex 404PC;c:\windows\system32\drivers\Capi20.sys [17.07.2009 20:30 235952]
R2 DETEWECP;Telekom ISDN Port;c:\windows\system32\drivers\detewecp.sys [17.07.2009 20:30 38480]
R2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [20.10.2009 20:19 50704]
R2 Symantec SymSnap VSS Provider;Symantec SymSnap VSS Provider;c:\windows\system32\dllhost.exe [04.08.2004 14:00 5120]
R3 SymSnapService;SymSnapService;c:\programme\Norton Ghost\Shared\Drivers\SymSnapService.exe [20.12.2007 17:13 1553896]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.03.2010 13:16 130384]
S2 gupdate;Google Update Service (gupdate);c:\programme\Google\Update\GoogleUpdate.exe [06.02.2010 15:00 135664]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\programme\Lavasoft\Ad-Aware\AAWService.exe [24.09.2009 13:17 1181328]
S3 dsltestSp5;dsltestSp5 NDIS Protocol Driver;c:\windows\system32\Drivers\dsltestSp5.sys --> c:\windows\system32\Drivers\dsltestSp5.sys [?]
S3 SIS163u;SiS163 usb Wireless LAN Adapter Driver;c:\windows\system32\drivers\sis163u.sys [07.08.2008 22:07 215040]
S3 TSMPacket;DSL-Manager Service;c:\windows\system32\DRIVERS\tsmpkt.sys --> c:\windows\system32\DRIVERS\tsmpkt.sys [?]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.03.2010 13:16 753504]
S4 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [17.07.2009 14:36 135336]
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - VPROEVENTMONITOR
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp
.
Inhalt des "geplante Tasks" Ordners
.
2011-04-15 c:\windows\Tasks\1-Klick-Wartung.job
- c:\programme\TuneUp Utilities 2009\OneClickStarter.exe [2009-11-16 10:45]
.
2011-04-15 c:\windows\Tasks\Ad-Aware Update (Daily 1).job
- c:\programme\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 19:48]
.
2011-04-15 c:\windows\Tasks\Ad-Aware Update (Daily 2).job
- c:\programme\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 19:48]
.
2011-04-15 c:\windows\Tasks\Ad-Aware Update (Daily 3).job
- c:\programme\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 19:48]
.
2011-04-15 c:\windows\Tasks\Ad-Aware Update (Daily 4).job
- c:\programme\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 19:48]
.
2011-04-15 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\programme\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 19:48]
.
2011-04-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-02-06 13:00]
.
2011-04-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-02-06 13:00]
.
.
------- Zusätzlicher Suchlauf -------
.
IE: &Alles mit FlashGet laden - c:\programme\FlashGet\jc_all.htm
IE: &Mit FlashGet laden - c:\programme\FlashGet\jc_link.htm
IE: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - c:\programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - c:\programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Auswahl in Adobe PDF konvertieren - c:\programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Auswahl in vorhandene PDF-Datei konvertieren - c:\programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Free YouTube Download - c:\dokumente und einstellungen\***\Anwendungsdaten\DVDVideoSoftIEHelpers\youtubedownload.htm
IE: Free YouTube to Mp3 Converter - c:\dokumente und einstellungen\***\Anwendungsdaten\DVDVideoSoftIEHelpers\youtubetomp3.htm
IE: Google Sidewiki... - c:\programme\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
IE: In Adobe PDF konvertieren - c:\programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: In vorhandene PDF-Datei konvertieren - c:\programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Verknüpfungsziel in Adobe PDF konvertieren - c:\programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - c:\programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: {{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - c:\programme\ICQ7.4\ICQ.exe
TCP: {42E01E41-318F-489C-A715-DB2BA8210801} = 62.109.123.7 213.191.92.86
DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} - hxxp://ips.poi.de/ips-opdata/operator/69189345/objects/jordan.cab
DPF: {AC414988-E5BB-4C2C-873B-EA53D2F3D23A} - hxxp://t.live.cctv.com/ieocx/CCTVUpdateInstall.dll
FF - ProfilePath - c:\dokumente und einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\94mbbu34.default\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\programme\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter: jqs@sun.com - c:\programme\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: WOT: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} - %profile%\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
FF - Ext: vShare Plugin: vshare@toolbar - %profile%\extensions\vshare@toolbar
FF - Ext: Zotero: zotero@chnm.gmu.edu - %profile%\extensions\zotero@chnm.gmu.edu
FF - Ext: Zotero WinWord Integration: zoteroWinWordIntegration@zotero.org - %profile%\extensions\zoteroWinWordIntegration@zotero.org
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: content.max.tokenizing.time - 200000
FF - user.js: content.notify.interval - 100000
FF - user.js: content.switch.threshold - 650000
FF - user.js: nglayout.initialpaint.delay - 300
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2011-04-15 17:57
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse... 
.
Scanne versteckte Autostarteinträge... 
.
Scanne versteckte Dateien... 
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10o_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10o_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€–€|ÿÿÿÿÀ•€|ù•6~*]
"7040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG08.00.00.01WORKSTATION"="2D7F452B5CC4D53D929A171EB54F6EF3072FE30362F3C25C826A5832C44CC85C01C157A9DBF006F64427E8D56BF22591EBC568E77CE65257D5DB99BA2883F028549674C9B6441697B60B583A05AADC7794B17D6BCB8686787C7CC125A0CDE95C60FD3CC7DC0E342E5D10AD16415E7A9554242E0BF87119B1440942BE64A7E28A0BD82661B143A50EDE6302BA4F1D7820AAB1DA47A36E5836AD9E5EDA1E2EA008F3717A588EFA43CE959345F9D415621051D536245EE72701ECBF31CCED2678F0EBF0D7753FF2F84A0F173A2D6B9DDA20336EC92AAD6B7B4DEAD2A5EFE6F3D621F768AE018208C6211044F5AF9F2D1752F0B9EF678B2BFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A9C6AECB7A5D1407A6A0AC4980AC79335D575E7D6A3B9808EFF75B9D2DDEBC641F2C11C0D4208F64FDAE183FC9EC378EAAE182CCB66E327B31411E3AFD00791F8DB385BCEB06FD5717E90A39C44F7485AD4D652B1A157434B7FBBE1875F7E15A7559FD8F4E1CA91D212BF03ED35050315E4BC19107BDCD407CE0B866A0B6B96784B4D2D34D89C43E9B8AA2732E648AF3B4938A4A3AD1ABF90BEABBBAE4B73ABA7BA28F8590F574E71F66A65CDF0855D63A27E3064639ECE08458288C767410ED31437387968E53EDD35FB9664C36D7021045275711E5E59A1CAC96B9E1EBDD3D0DF9719EAC82EF45785A4DDDA5F02DC56976E1B5D4C7DEED9B3050800524370A0D6EB173F808CB87607F84F4763FE4948C83D6FC9ED514C65DECD386122226D8428E1015F0D6DDF2F13E38449A290185567AFAEC4F0D3435D3B153541274A5D3D20A9B7361AB8E69A5C67644C33D79D4B3AEF6A71F68646D011236D6DCA729C5F6D419E4E8C7BC708A8D7C54F50E39DEAAB52A36956D3D46FE65175CA35295A07DA5FDA27D6F3AB3444C4336092F1F28CFE82402912249BD79C6431CE70A417AC57BF649656BCD7E8700EE90AC3C7DD750E7AB5CC39189F0AF163FAC816A7C0BC414E2DA3C8830C39E6A5F6DDE511D38EA133AF6B3C872A5F7F4400A9914072E86F4563DF217919A6810233C75113737F1927CEAB9DAEA44B8CB3016AF2B94E627E418B9CC6B90BA583B7F4F18207B69CDCE54B284DF50566FC42E94175650D85670A47CE0DE46037276EC5BC5A98D85FAF658AD9571708E2CCF0E2EF641D54CDAE929181CCD3B76D19518FBCDDA04E5067DCF9FC22E913E13A054EEC89B37308D620C023D196E3AA5ACE0B0D464E80813973BAFB539EA5F5BACBDC65C99F8935C34E392D8A55117AE945D59D47C3C91DABE49E86B38A80D53AF370B537393ACC6FA7A0956DA49FCC46B54BE99DC7148A634613BB6576A07D9A9E273A5E274D3E3155184F027B17C5112C28A43C3EE9758F6"
"OODLED02.00.00.02WSSV"="BBBBCB2418C182E67546FB583D7F00167DC7AA22F3DC2B7075EBB276542F3C971E8B2A27B393664DA3D28102C2B9FC00F5AEB54824762B2BB48F09F029313782A9F9D4410F99DEEACFE4E9AD5032B64DF5E9FB0D0DA529ABDD4B1E23F5F5F29382BA596FD5EB42585A83C0539E64572133F729070E6CC040A1AB625F62A31C67F310065E99746E9E43C8571FC4A30D110BE4B27D6BA0112ED258882B7BB4E0906955F07451F4C3BA3262C3714392082B7A54CCF04B6BBC2EE8880841B077F69274F570C85401262070935D60FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A9C6AECB7A5D1407A6A0AC4980AC79335D575E7D6A3B9808BC6FDAADD8F6DFAC8398CDC482F2B72A3A8D9C5C823665F6AAB73A14860B9C39999E86D6B1DFF6F107A627D02F2756E485936ABFC704CCC915E2408E0C5321502077C0BE8F73D976F18EC0AC39E8DC2E51897B92124E1E4C2403456D3A165D5519BF55225D18F50A75DC19804173BC515B619E8BDC436BE9390F88958515256F33119332A5C402302670306C8D152A50405FA5D4C7A40A3E1E4F4B60852A8F78FBDA4F949B09F320FEFC890008309FDE039DE48D944B959BFAE2D597764177FEE9606060910588455E0C2EC3403BD8660987B6482BA26C09623AF17DB7D9FA4653B6A22403EE40BE03F62DAFE440D8021EDE788D15A9AE3DC59CEC43CE8900C3F6CBF4618A1060E1136E13B2CD5CE28370B78CD58372C4A77DA29C9361772A22745B3C0BEAC3EE3498F5782FF543816F91FB571447A658E8C4BAD48ABCE068404F795E0C08FCB8F2806772FA783B81FD776644A7577FD5D73BA67135CF95E5316F8DC8C06AC14F8B9D6BA05F999D731BFE09BF6950CCF07C63FBD09A30F999BB235169FA402985232305A21BBED8AD6763C8BB246F721F15A52556321385B8581A53B57E5A62F291AC059B6070F0C7B84ADEAD1798661C924C5EE66657C53D37E878A384ACAD75603593B6D4DDF92096B6578FF45236E31C08BAEE197B5BE9BA077430BA50602B5120AE9F92591F573D1613DEE347FE3A09EA9FDB1D2377BD78D254DAC182E3F956322486A6D71FD21E35469C00C6F4A3E86D47A1BB176602BC0AF5A62FA4360A981499A095734B3CDBC57ACF58435F6C7B6A3F36AFC102C284D20C9B8B3AE7C6725484A5D2E90A7F52608C026F5598A137A26814A9B43B4E83B51EC453EC9D60F2E3B1534A9D56CE8AFD2D3FBD3512944637F939CCA216B61E9D06B2788A92CADE98C06AD814BD9E47FCE01A2BC3CC5C85B1FCAAB2E32B5371DB7378608212BE2CAAA6AE50F663287CA000A8998261D3857BCEEC6674A6C04B26682E62E9FDB809B829E8F7157DE8538E3884DB197A170DE5218AE87549DDAC13BBEECC"
.
Zeit der Fertigstellung: 2011-04-15  17:58:56
ComboFix-quarantined-files.txt  2011-04-15 15:58
.
Vor Suchlauf: 14 Verzeichnis(se), 58.949.836.800 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 58.915.741.696 Bytes frei
.
WindowsXP-KB310994-SP2-Pro-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - 8791608850865399CB916296260BDAE7
         

Alt 15.04.2011, 18:18   #8
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Trojaner: CleanThis, MS Removal Tool und Windows Restore - Standard

Trojaner: CleanThis, MS Removal Tool und Windows Restore



Combofix - Scripten

1. Starte das Notepad (Start / Ausführen / notepad[Enter])

2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein.

Code:
ATTFilter
Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"=-
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"=-
"33334:TCP"=-
         
3. Speichere im Notepad als CFScript.txt auf dem Desktop.

4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall.
(Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !)

5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.



6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien:
Combofix.txt

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!
__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Alt 15.04.2011, 18:56   #9
berlyn
 
Trojaner: CleanThis, MS Removal Tool und Windows Restore - Standard

Trojaner: CleanThis, MS Removal Tool und Windows Restore



Skript mit CF ausgeführt:
Code:
ATTFilter
ComboFix 11-04-14.03 - *** 15.04.2011  19:37:38.2.4 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.49.1031.18.3071.2574 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\***\Desktop\cofi.exe
Benutzte Befehlsschalter :: c:\dokumente und einstellungen\***\Desktop\CFScript.txt
AV: AntiVir Desktop *Enabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
.
(((((((((((((((((((((((   Dateien erstellt von 2011-03-15 bis 2011-04-15  ))))))))))))))))))))))))))))))
.
.
2011-04-15 07:43 . 2011-04-15 07:43	--------	d-----w-	c:\programme\CCleaner
2011-04-14 16:57 . 2011-04-14 16:57	--------	d-----w-	C:\TDSSKiller_Quarantine
2011-04-14 16:05 . 2011-04-14 16:05	--------	d-----w-	C:\_OTL
2011-04-13 19:20 . 2011-04-13 19:20	--------	d-----w-	c:\windows\system32\wbem\Repository
2011-04-11 13:29 . 2011-04-11 13:29	--------	d-----w-	c:\programme\Gemeinsame Dateien\Java
2011-04-11 13:28 . 2011-04-11 13:27	73728	----a-w-	c:\windows\system32\javacpl.cpl
2011-04-11 13:27 . 2011-04-11 13:27	--------	d-----w-	c:\programme\Java
2011-04-10 13:12 . 2011-04-10 13:12	--------	d-----w-	c:\dokumente und einstellungen\***\Anwendungsdaten\Malwarebytes
2011-04-10 13:12 . 2010-12-20 16:09	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2011-04-10 13:12 . 2011-04-10 13:12	--------	d-----w-	c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2011-04-10 13:12 . 2011-04-10 14:51	--------	d-----w-	c:\programme\Malwarebytes' Anti-Malware
2011-04-10 13:12 . 2010-12-20 16:08	20952	----a-w-	c:\windows\system32\drivers\mbam.sys
2011-04-03 19:40 . 2011-04-03 19:40	--------	d-----w-	c:\dokumente und einstellungen\***\Anwendungsdaten\QIP
2011-04-03 19:38 . 2011-04-12 14:38	--------	d-----w-	c:\programme\QIP 2010
2011-03-18 13:01 . 1999-06-25 09:55	149504	----a-w-	c:\windows\UNWISE.EXE
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-11 13:27 . 2010-04-22 15:49	472808	----a-w-	c:\windows\system32\deployJava1.dll
2011-03-16 15:20 . 2009-07-17 12:36	137656	----a-w-	c:\windows\system32\drivers\avipbb.sys
2011-03-07 05:33 . 2009-07-16 17:30	692736	----a-w-	c:\windows\system32\inetcomm.dll
2011-03-04 06:36 . 2004-08-04 12:00	420864	----a-w-	c:\windows\system32\vbscript.dll
2011-03-03 13:53 . 2004-08-04 12:00	1858048	----a-w-	c:\windows\system32\win32k.sys
2011-02-22 23:05 . 2004-08-04 12:00	916480	----a-w-	c:\windows\system32\wininet.dll
2011-02-22 23:05 . 2004-08-04 12:00	43520	----a-w-	c:\windows\system32\licmgr10.dll
2011-02-22 23:05 . 2004-08-04 12:00	1469440	----a-w-	c:\windows\system32\inetcpl.cpl
2011-02-22 11:41 . 2004-08-04 12:00	385024	----a-w-	c:\windows\system32\html.iec
2011-02-17 13:18 . 2004-08-04 12:00	455936	----a-w-	c:\windows\system32\drivers\mrxsmb.sys
2011-02-17 13:18 . 2004-08-04 12:00	357888	----a-w-	c:\windows\system32\drivers\srv.sys
2011-02-17 12:54 . 2008-05-05 05:25	5632	----a-w-	c:\windows\system32\xpsp4res.dll
2011-02-15 12:56 . 2004-08-04 12:00	290432	----a-w-	c:\windows\system32\atmfd.dll
2011-02-09 13:53 . 2004-08-04 12:00	270848	----a-w-	c:\windows\system32\sbe.dll
2011-02-09 13:53 . 2004-08-04 12:00	186880	----a-w-	c:\windows\system32\encdec.dll
2011-02-08 13:33 . 2004-08-04 12:00	978944	----a-w-	c:\windows\system32\mfc42.dll
2011-02-08 13:33 . 2004-08-04 12:00	974848	----a-w-	c:\windows\system32\mfc42u.dll
2011-02-02 07:58 . 2009-07-16 17:29	2067456	----a-w-	c:\windows\system32\mstscax.dll
2011-01-27 11:57 . 2009-07-16 17:29	677888	----a-w-	c:\windows\system32\mstsc.exe
2011-01-21 14:44 . 2004-08-04 12:00	440832	----a-w-	c:\windows\system32\shimgvw.dll
.
.
(((((((((((((((((((((((((((((   SnapShot@2011-04-15_15.57.59   )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-04-15 17:35 . 2011-04-15 17:35	16384              c:\windows\Temp\Perflib_Perfdata_c50.dat
+ 2011-04-15 17:35 . 2011-04-15 17:35	16384              c:\windows\Temp\Perflib_Perfdata_ac4.dat
+ 2004-08-04 12:00 . 2011-04-15 17:09	89268              c:\windows\system32\perfc009.dat
- 2004-08-04 12:00 . 2010-12-20 23:52	66560              c:\windows\system32\mshtmled.dll
+ 2004-08-04 12:00 . 2011-02-22 23:05	66560              c:\windows\system32\mshtmled.dll
+ 2009-03-08 02:31 . 2011-02-22 23:05	55296              c:\windows\system32\msfeedsbs.dll
- 2009-03-08 02:31 . 2010-12-20 23:52	55296              c:\windows\system32\msfeedsbs.dll
+ 2004-08-04 12:00 . 2011-02-22 23:05	25600              c:\windows\system32\jsproxy.dll
- 2004-08-04 12:00 . 2010-12-20 23:52	25600              c:\windows\system32\jsproxy.dll
- 2004-08-04 12:00 . 2008-04-14 02:22	45568              c:\windows\system32\dnsrslvr.dll
+ 2004-08-04 12:00 . 2009-04-20 17:17	45568              c:\windows\system32\dnsrslvr.dll
+ 2009-07-17 18:32 . 2011-02-22 23:05	12800              c:\windows\system32\dllcache\xpshims.dll
- 2009-07-17 18:32 . 2010-12-20 23:52	12800              c:\windows\system32\dllcache\xpshims.dll
- 2009-03-08 02:31 . 2010-12-20 23:52	66560              c:\windows\system32\dllcache\mshtmled.dll
+ 2009-03-08 02:31 . 2011-02-22 23:05	66560              c:\windows\system32\dllcache\mshtmled.dll
- 2009-07-29 14:23 . 2010-12-20 23:52	55296              c:\windows\system32\dllcache\msfeedsbs.dll
+ 2009-07-29 14:23 . 2011-02-22 23:05	55296              c:\windows\system32\dllcache\msfeedsbs.dll
+ 2009-03-08 02:34 . 2011-02-22 23:05	43520              c:\windows\system32\dllcache\licmgr10.dll
- 2009-03-08 02:34 . 2010-12-20 23:52	43520              c:\windows\system32\dllcache\licmgr10.dll
+ 2009-03-08 02:33 . 2011-02-22 23:05	25600              c:\windows\system32\dllcache\jsproxy.dll
- 2009-03-08 02:33 . 2010-12-20 23:52	25600              c:\windows\system32\dllcache\jsproxy.dll
+ 2009-04-20 17:17 . 2009-04-20 17:17	45568              c:\windows\system32\dllcache\dnsrslvr.dll
+ 2009-07-16 17:35 . 2011-04-15 17:26	32768              c:\windows\system32\config\systemprofile\Lokale Einstellungen\Verlauf\History.IE5\index.dat
- 2009-07-16 17:35 . 2011-04-14 16:23	32768              c:\windows\system32\config\systemprofile\Lokale Einstellungen\Verlauf\History.IE5\index.dat
- 2009-07-16 17:35 . 2011-04-14 16:23	32768              c:\windows\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-16 17:35 . 2011-04-15 17:26	32768              c:\windows\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-16 17:35 . 2011-04-14 16:23	16384              c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2011-04-15 17:26 . 2011-04-15 17:26	16384              c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2011-02-10 02:10 . 2011-02-10 02:10	56656              c:\windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll
- 2010-03-18 11:16 . 2010-03-18 11:16	56656              c:\windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll
+ 2011-04-15 17:10 . 2011-04-15 17:10	87408              c:\windows\Microsoft.NET\assembly\GAC_MSIL\WindowsFormsIntegration\v4.0_4.0.0.0__31bf3856ad364e35\WindowsFormsIntegration.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	87408              c:\windows\Microsoft.NET\assembly\GAC_MSIL\WindowsFormsIntegration\v4.0_4.0.0.0__31bf3856ad364e35\WindowsFormsIntegration.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	93024              c:\windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll
+ 2011-04-15 17:10 . 2011-04-15 17:10	93024              c:\windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll
+ 2011-04-15 17:10 . 2011-04-15 17:10	35688              c:\windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationProvider\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	35688              c:\windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationProvider\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll
+ 2011-04-15 17:10 . 2011-04-15 17:10	17784              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Presentation\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Presentation.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	17784              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Presentation\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Presentation.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	58240              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Input.Manipulations\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Input.Manipulations.dll
+ 2011-04-15 17:10 . 2011-04-15 17:10	58240              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Input.Manipulations\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Input.Manipulations.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	44920              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.ApplicationServices\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.ApplicationServices.dll
+ 2011-04-15 17:09 . 2011-04-15 17:09	44920              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.ApplicationServices\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.ApplicationServices.dll
+ 2011-04-15 17:10 . 2011-04-15 17:10	37240              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Channels\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Channels.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	37240              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Channels\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Channels.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	64352              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll
+ 2011-04-15 17:09 . 2011-04-15 17:09	64352              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	51032              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Device\v4.0_4.0.0.0__b77a5c561934e089\System.Device.dll
+ 2011-04-15 17:09 . 2011-04-15 17:09	51032              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Device\v4.0_4.0.0.0__b77a5c561934e089\System.Device.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	50552              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.DataSetExtensions\v4.0_4.0.0.0__b77a5c561934e089\System.Data.DataSetExtensions.dll
+ 2011-04-15 17:09 . 2011-04-15 17:09	50552              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.DataSetExtensions\v4.0_4.0.0.0__b77a5c561934e089\System.Data.DataSetExtensions.dll
+ 2011-04-15 17:09 . 2011-04-15 17:09	81784              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	81784              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
+ 2011-04-15 17:09 . 2011-04-15 17:09	81800              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\v4.0_4.0.0.0__31bf3856ad364e35\System.ComponentModel.DataAnnotations.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	81800              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\v4.0_4.0.0.0__31bf3856ad364e35\System.ComponentModel.DataAnnotations.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	39784              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.AddIn.Contract\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.AddIn.Contract.dll
+ 2011-04-15 17:09 . 2011-04-15 17:09	39784              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.AddIn.Contract\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.AddIn.Contract.dll
+ 2011-04-15 17:09 . 2011-04-15 17:09	68952              c:\windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	68952              c:\windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll
+ 2011-04-15 17:09 . 2011-04-15 17:09	12128              c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualC\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
- 2010-08-03 12:57 . 2010-08-03 12:57	12128              c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualC\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
+ 2011-04-15 17:09 . 2011-04-15 17:09	97680              c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	97680              c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll
+ 2011-04-15 17:09 . 2011-04-15 17:09	17240              c:\windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	17240              c:\windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
+ 2011-04-15 17:09 . 2011-04-15 17:09	78168              c:\windows\Microsoft.NET\assembly\GAC_32\ISymWrapper\v4.0_4.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	78168              c:\windows\Microsoft.NET\assembly\GAC_32\ISymWrapper\v4.0_4.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
+ 2011-04-15 17:09 . 2011-04-15 17:09	81248              c:\windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	81248              c:\windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
+ 2011-04-15 17:06 . 2010-12-20 23:52	12800              c:\windows\ie8updates\KB2497640-IE8\xpshims.dll
+ 2011-04-15 17:06 . 2010-12-20 23:52	66560              c:\windows\ie8updates\KB2497640-IE8\mshtmled.dll
+ 2011-04-15 17:06 . 2010-12-20 23:52	55296              c:\windows\ie8updates\KB2497640-IE8\msfeedsbs.dll
+ 2011-04-15 17:06 . 2010-12-20 23:52	43520              c:\windows\ie8updates\KB2497640-IE8\licmgr10.dll
+ 2011-04-15 17:06 . 2010-12-20 23:52	25600              c:\windows\ie8updates\KB2497640-IE8\jsproxy.dll
+ 2011-04-15 17:12 . 2011-04-15 17:12	60928              c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationProvider\368187bcb570d202a019fc7c53b1df4c\UIAutomationProvider.ni.dll
+ 2011-04-15 17:42 . 2011-04-15 17:42	94208              c:\windows\assembly\NativeImages_v2.0.50727_32\System.ComponentMod#\636ed65b7e5481320e3010b78a5e6cfa\System.ComponentModel.DataAnnotations.ni.dll
+ 2011-04-15 17:42 . 2011-04-15 17:42	82944              c:\windows\assembly\NativeImages_v2.0.50727_32\System.AddIn.Contra#\f83b1e8dd8c90490c8d924826c8b107d\System.AddIn.Contract.ni.dll
+ 2011-04-15 17:12 . 2011-04-15 17:12	47104              c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\2740ba673b1040f1995f13c6044da64c\PresentationFontCache.ni.exe
+ 2011-04-15 17:11 . 2011-04-15 17:11	39424              c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationCFFRast#\8514e7de63d46b6f8232ef70d93a1650\PresentationCFFRasterizer.ni.dll
+ 2011-04-15 17:42 . 2011-04-15 17:42	74752              c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\8905268997c77a27c7f9c54aeba37f24\Microsoft.Build.Framework.ni.dll
+ 2011-04-15 17:42 . 2011-04-15 17:42	65024              c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\11bb8ef375848eb1c074da1afd5cecdc\Microsoft.Build.Framework.ni.dll
+ 2011-04-15 17:14 . 2011-04-15 17:14	14336              c:\windows\assembly\NativeImages_v2.0.50727_32\dfsvc\6d74b9308a1517bfe959e597c3dd2427\dfsvc.ni.exe
+ 2011-04-15 17:14 . 2011-04-15 17:14	25600              c:\windows\assembly\NativeImages_v2.0.50727_32\Accessibility\fdf7f1404f4a5c7f5a0463d8e7a442e4\Accessibility.ni.dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	77824              c:\windows\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
- 2010-10-10 12:39 . 2010-10-10 12:39	77824              c:\windows\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	81920              c:\windows\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
- 2010-10-10 12:39 . 2010-10-10 12:39	81920              c:\windows\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
- 2010-10-10 12:40 . 2010-10-10 12:40	81920              c:\windows\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	81920              c:\windows\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	32768              c:\windows\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
- 2010-10-10 12:39 . 2010-10-10 12:39	32768              c:\windows\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
- 2010-10-10 12:40 . 2010-10-10 12:40	12800              c:\windows\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	12800              c:\windows\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	28672              c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
- 2010-10-10 12:40 . 2010-10-10 12:40	28672              c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	77824              c:\windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll
- 2010-10-10 12:40 . 2010-10-10 12:40	77824              c:\windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll
- 2010-10-10 12:40 . 2010-10-10 12:40	36864              c:\windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	36864              c:\windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
- 2010-10-10 12:39 . 2010-10-10 12:39	77824              c:\windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	77824              c:\windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	13312              c:\windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
- 2010-10-10 12:39 . 2010-10-10 12:39	13312              c:\windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
- 2010-10-10 12:40 . 2010-10-10 12:40	10752              c:\windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	10752              c:\windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	72192              c:\windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
- 2010-10-10 12:40 . 2010-10-10 12:40	72192              c:\windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
- 2010-10-10 12:39 . 2010-10-10 12:39	69120              c:\windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	69120              c:\windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	8192              c:\windows\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e\IEExecRemote.dll
- 2010-10-10 12:39 . 2010-10-10 12:39	8192              c:\windows\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e\IEExecRemote.dll
- 2010-10-10 12:39 . 2010-10-10 12:39	7168              c:\windows\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	7168              c:\windows\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
- 2010-10-10 12:40 . 2010-10-10 12:40	5632              c:\windows\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	5632              c:\windows\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
- 2010-10-10 12:39 . 2010-10-10 12:39	6656              c:\windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	6656              c:\windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
- 2010-10-10 12:39 . 2010-10-10 12:39	8192              c:\windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	8192              c:\windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll
+ 2011-04-15 17:09 . 2011-04-15 17:09	109568              c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492\System.EnterpriseServices.Wrapper.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	109568              c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492\System.EnterpriseServices.Wrapper.dll
+ 2011-04-15 17:09 . 2011-04-15 17:09	246128              c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492\System.EnterpriseServices.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	246128              c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492\System.EnterpriseServices.dll
- 2010-10-10 12:40 . 2010-10-10 12:40	113664              c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	113664              c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
- 2010-10-10 12:40 . 2010-10-10 12:40	258048              c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	258048              c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
+ 2004-08-04 12:00 . 2011-04-15 17:09	505804              c:\windows\system32\perfh009.dat
+ 2004-08-04 12:00 . 2011-04-15 17:09	531384              c:\windows\system32\perfh007.dat
+ 2004-08-04 12:00 . 2011-04-15 17:09	106864              c:\windows\system32\perfc007.dat
- 2004-08-04 12:00 . 2010-12-20 23:52	206848              c:\windows\system32\occache.dll
+ 2004-08-04 12:00 . 2011-02-22 23:05	206848              c:\windows\system32\occache.dll
+ 2004-08-04 12:00 . 2008-06-20 16:02	247296              c:\windows\system32\mswsock.dll
- 2004-08-04 12:00 . 2008-06-20 17:46	247296              c:\windows\system32\mswsock.dll
+ 2004-08-04 12:00 . 2011-02-22 23:05	611840              c:\windows\system32\mstime.dll
- 2004-08-04 12:00 . 2010-12-20 23:52	611840              c:\windows\system32\mstime.dll
+ 2009-03-08 02:32 . 2011-02-22 23:05	602112              c:\windows\system32\msfeeds.dll
- 2009-03-08 02:32 . 2010-12-20 23:52	602112              c:\windows\system32\msfeeds.dll
- 2004-08-04 12:00 . 2009-12-09 05:53	726528              c:\windows\system32\jscript.dll
+ 2004-08-04 12:00 . 2011-03-04 06:36	726528              c:\windows\system32\jscript.dll
- 2004-08-04 12:00 . 2010-12-20 23:52	184320              c:\windows\system32\iepeers.dll
+ 2004-08-04 12:00 . 2011-02-22 23:05	184320              c:\windows\system32\iepeers.dll
- 2004-08-04 12:00 . 2010-12-20 23:52	387584              c:\windows\system32\iedkcs32.dll
+ 2004-08-04 12:00 . 2011-02-22 23:05	387584              c:\windows\system32\iedkcs32.dll
+ 2004-08-04 12:00 . 2011-02-18 11:49	173568              c:\windows\system32\ie4uinit.exe
- 2004-08-04 12:00 . 2010-12-20 12:55	173568              c:\windows\system32\ie4uinit.exe
+ 2009-07-16 18:23 . 2011-04-15 17:16	146808              c:\windows\system32\FNTCACHE.DAT
- 2009-07-16 18:23 . 2011-02-21 16:18	146808              c:\windows\system32\FNTCACHE.DAT
- 2004-08-04 12:00 . 2008-08-14 10:04	138496              c:\windows\system32\drivers\afd.sys
+ 2004-08-04 12:00 . 2008-10-16 14:43	138496              c:\windows\system32\drivers\afd.sys
+ 2004-08-04 12:00 . 2011-03-03 06:54	149504              c:\windows\system32\dnsapi.dll
- 2009-03-08 02:34 . 2010-12-20 23:52	916480              c:\windows\system32\dllcache\wininet.dll
+ 2009-03-08 02:34 . 2011-02-22 23:05	916480              c:\windows\system32\dllcache\wininet.dll
+ 2008-05-09 10:54 . 2011-03-04 06:36	420864              c:\windows\system32\dllcache\vbscript.dll
+ 2009-07-17 13:33 . 2011-02-17 13:18	357888              c:\windows\system32\dllcache\srv.sys
- 2009-03-08 02:34 . 2010-12-20 23:52	206848              c:\windows\system32\dllcache\occache.dll
+ 2009-03-08 02:34 . 2011-02-22 23:05	206848              c:\windows\system32\dllcache\occache.dll
+ 2008-06-20 17:46 . 2008-06-20 16:02	247296              c:\windows\system32\dllcache\mswsock.dll
- 2008-06-20 17:46 . 2008-06-20 17:46	247296              c:\windows\system32\dllcache\mswsock.dll
- 2009-03-08 02:32 . 2010-12-20 23:52	611840              c:\windows\system32\dllcache\mstime.dll
+ 2009-03-08 02:32 . 2011-02-22 23:05	611840              c:\windows\system32\dllcache\mstime.dll
- 2009-07-29 14:23 . 2010-12-20 23:52	602112              c:\windows\system32\dllcache\msfeeds.dll
+ 2009-07-29 14:23 . 2011-02-22 23:05	602112              c:\windows\system32\dllcache\msfeeds.dll
+ 2009-07-17 13:33 . 2011-02-17 13:18	455936              c:\windows\system32\dllcache\mrxsmb.sys
+ 2010-09-18 10:22 . 2011-02-08 13:33	974848              c:\windows\system32\dllcache\mfc42u.dll
- 2010-09-18 10:22 . 2010-09-18 10:22	974848              c:\windows\system32\dllcache\mfc42u.dll
+ 2010-10-12 23:10 . 2011-02-08 13:33	978944              c:\windows\system32\dllcache\mfc42.dll
- 2008-05-09 10:54 . 2009-12-09 05:53	726528              c:\windows\system32\dllcache\jscript.dll
+ 2008-05-09 10:54 . 2011-03-04 06:36	726528              c:\windows\system32\dllcache\jscript.dll
- 2009-07-17 13:32 . 2010-06-09 07:43	692736              c:\windows\system32\dllcache\inetcomm.dll
+ 2009-07-17 13:32 . 2011-03-07 05:33	692736              c:\windows\system32\dllcache\inetcomm.dll
- 2009-07-17 18:32 . 2010-12-20 23:52	247808              c:\windows\system32\dllcache\ieproxy.dll
+ 2009-07-17 18:32 . 2011-02-22 23:05	247808              c:\windows\system32\dllcache\ieproxy.dll
+ 2009-03-08 02:31 . 2011-02-22 23:05	184320              c:\windows\system32\dllcache\iepeers.dll
- 2009-03-08 02:31 . 2010-12-20 23:52	184320              c:\windows\system32\dllcache\iepeers.dll
+ 2010-06-12 20:44 . 2011-02-22 23:05	743424              c:\windows\system32\dllcache\iedvtool.dll
- 2010-06-12 20:44 . 2010-12-20 23:52	743424              c:\windows\system32\dllcache\iedvtool.dll
+ 2009-03-08 12:09 . 2011-02-22 23:05	387584              c:\windows\system32\dllcache\iedkcs32.dll
- 2009-03-08 12:09 . 2010-12-20 23:52	387584              c:\windows\system32\dllcache\iedkcs32.dll
- 2009-03-08 02:32 . 2010-12-20 12:55	173568              c:\windows\system32\dllcache\ie4uinit.exe
+ 2009-03-08 02:32 . 2011-02-18 11:49	173568              c:\windows\system32\dllcache\ie4uinit.exe
+ 2008-06-20 17:46 . 2011-03-03 06:54	149504              c:\windows\system32\dllcache\dnsapi.dll
+ 2010-04-20 05:29 . 2011-02-15 12:56	290432              c:\windows\system32\dllcache\atmfd.dll
- 2008-06-20 11:40 . 2008-08-14 10:04	138496              c:\windows\system32\dllcache\afd.sys
+ 2008-06-20 11:40 . 2008-10-16 14:43	138496              c:\windows\system32\dllcache\afd.sys
+ 2009-10-15 10:43 . 2011-04-15 17:26	262144              c:\windows\system32\config\systemprofile\IETldCache\index.dat
- 2009-10-15 10:43 . 2010-08-28 19:19	262144              c:\windows\system32\config\systemprofile\IETldCache\index.dat
+ 2011-02-10 02:10 . 2011-02-10 02:10	517448              c:\windows\Microsoft.NET\Framework\v4.0.30319\SOS.dll
- 2010-03-18 11:16 . 2010-03-18 11:16	517448              c:\windows\Microsoft.NET\Framework\v4.0.30319\SOS.dll
- 2010-03-18 11:16 . 2010-03-18 11:16	955728              c:\windows\Microsoft.NET\Framework\v4.0.30319\mscordbi.dll
+ 2011-02-10 02:10 . 2011-02-10 02:10	955728              c:\windows\Microsoft.NET\Framework\v4.0.30319\mscordbi.dll
+ 2011-02-10 02:10 . 2011-02-10 02:10	385864              c:\windows\Microsoft.NET\Framework\v4.0.30319\clrjit.dll
- 2010-03-18 11:16 . 2010-03-18 11:16	385864              c:\windows\Microsoft.NET\Framework\v4.0.30319\clrjit.dll
+ 2011-01-18 02:39 . 2011-01-18 02:39	388936              c:\windows\Microsoft.NET\Framework\v2.0.50727\SOS.dll
- 2010-05-11 04:40 . 2010-05-11 04:40	388936              c:\windows\Microsoft.NET\Framework\v2.0.50727\SOS.dll
+ 2011-01-18 02:39 . 2011-01-18 02:39	363856              c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
+ 2011-01-18 02:39 . 2011-01-18 02:39	989016              c:\windows\Microsoft.NET\Framework\v2.0.50727\mscordacwks.dll
- 2010-05-11 04:40 . 2010-05-11 04:40	989016              c:\windows\Microsoft.NET\Framework\v2.0.50727\mscordacwks.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	350592              c:\windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationClientsideProviders\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationClientsideProviders.dll
+ 2011-04-15 17:10 . 2011-04-15 17:10	350592              c:\windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationClientsideProviders\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationClientsideProviders.dll
+ 2011-04-15 17:10 . 2011-04-15 17:10	163168              c:\windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationClient\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationClient.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	163168              c:\windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationClient\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationClient.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	138592              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml.Linq\v4.0_4.0.0.0__b77a5c561934e089\System.Xml.Linq.dll
+ 2011-04-15 17:09 . 2011-04-15 17:09	138592              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml.Linq\v4.0_4.0.0.0__b77a5c561934e089\System.Xml.Linq.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	699224              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Xaml\v4.0_4.0.0.0__b77a5c561934e089\System.Xaml.dll
+ 2011-04-15 17:10 . 2011-04-15 17:10	699224              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Xaml\v4.0_4.0.0.0__b77a5c561934e089\System.Xaml.dll
+ 2011-04-15 17:10 . 2011-04-15 17:10	857960              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Services\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	857960              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Services\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll
+ 2011-04-15 17:10 . 2011-04-15 17:10	675672              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Speech\v4.0_4.0.0.0__31bf3856ad364e35\System.Speech.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	675672              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Speech\v4.0_4.0.0.0__31bf3856ad364e35\System.Speech.dll
+ 2011-04-15 17:09 . 2011-04-15 17:09	113512              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	113512              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	129912              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Routing\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Routing.dll
+ 2011-04-15 17:10 . 2011-04-15 17:10	129912              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Routing\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Routing.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	390008              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Discovery\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Discovery.dll
+ 2011-04-15 17:10 . 2011-04-15 17:10	390008              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Discovery\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Discovery.dll
+ 2011-04-15 17:10 . 2011-04-15 17:10	505208              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Activities\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Activities.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	505208              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Activities\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Activities.dll
+ 2011-04-15 17:09 . 2011-04-15 17:09	261472              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	261472              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	122264              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
+ 2011-04-15 17:10 . 2011-04-15 17:10	122264              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	291184              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
+ 2011-04-15 17:10 . 2011-04-15 17:10	291184              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
+ 2011-04-15 17:10 . 2011-04-15 17:10	349568              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.DurableInstancing\v4.0_4.0.0.0__31bf3856ad364e35\System.Runtime.DurableInstancing.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	349568              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.DurableInstancing\v4.0_4.0.0.0__31bf3856ad364e35\System.Runtime.DurableInstancing.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	231760              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Net\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Net.dll
+ 2011-04-15 17:09 . 2011-04-15 17:09	231760              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Net\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Net.dll
+ 2011-04-15 17:10 . 2011-04-15 17:10	253280              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Messaging\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	253280              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Messaging\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	378720              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll
+ 2011-04-15 17:09 . 2011-04-15 17:09	378720              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	134528              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Instrumentation\v4.0_4.0.0.0__b77a5c561934e089\System.Management.Instrumentation.dll
+ 2011-04-15 17:09 . 2011-04-15 17:09	134528              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Instrumentation\v4.0_4.0.0.0__b77a5c561934e089\System.Management.Instrumentation.dll
+ 2011-04-15 17:10 . 2011-04-15 17:10	123736              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Log\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.IO.Log.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	123736              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Log\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.IO.Log.dll
+ 2011-04-15 17:10 . 2011-04-15 17:10	392552              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	392552              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll
+ 2011-04-15 17:10 . 2011-04-15 17:10	125816              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel.Selectors\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.Selectors.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	125816              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel.Selectors\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.Selectors.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	120152              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll
+ 2011-04-15 17:09 . 2011-04-15 17:09	120152              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	607064              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
+ 2011-04-15 17:09 . 2011-04-15 17:09	607064              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
+ 2011-04-15 17:09 . 2011-04-15 17:09	395120              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	395120              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	182144              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices.Protocols\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll
+ 2011-04-15 17:09 . 2011-04-15 17:09	182144              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices.Protocols\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll
+ 2011-04-15 17:09 . 2011-04-15 17:09	285072              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices.AccountManagement\v4.0_4.0.0.0__b77a5c561934e089\System.DirectoryServices.AccountManagement.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	285072              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices.AccountManagement\v4.0_4.0.0.0__b77a5c561934e089\System.DirectoryServices.AccountManagement.dll
+ 2011-04-15 17:09 . 2011-04-15 17:09	829280              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	829280              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
+ 2011-04-15 17:09 . 2011-04-15 17:09	747360              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	747360              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
+ 2011-04-15 17:09 . 2011-04-15 17:09	436600              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Services.Client\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Services.Client.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	436600              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Services.Client\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Services.Client.dll
+ 2011-04-15 17:09 . 2011-04-15 17:09	683872              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Linq\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Linq.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	683872              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Linq\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Linq.dll
+ 2011-04-15 17:09 . 2011-04-15 17:09	409448              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	409448              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	210816              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.Composition\v4.0_4.0.0.0__b77a5c561934e089\System.ComponentModel.Composition.dll
+ 2011-04-15 17:09 . 2011-04-15 17:09	210816              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.Composition\v4.0_4.0.0.0__b77a5c561934e089\System.ComponentModel.Composition.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	149848              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.AddIn\v4.0_4.0.0.0__b77a5c561934e089\System.AddIn.dll
+ 2011-04-15 17:09 . 2011-04-15 17:09	149848              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.AddIn\v4.0_4.0.0.0__b77a5c561934e089\System.AddIn.dll
+ 2011-04-15 17:10 . 2011-04-15 17:10	122248              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities.DurableInstancing\v4.0_4.0.0.0__31bf3856ad364e35\System.Activities.DurableInstancing.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	122248              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities.DurableInstancing\v4.0_4.0.0.0__31bf3856ad364e35\System.Activities.DurableInstancing.dll
+ 2011-04-15 17:10 . 2011-04-15 17:10	525704              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities.Core.Presentation\v4.0_4.0.0.0__31bf3856ad364e35\System.Activities.Core.Presentation.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	525704              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities.Core.Presentation\v4.0_4.0.0.0__31bf3856ad364e35\System.Activities.Core.Presentation.dll
+ 2011-04-15 17:09 . 2011-04-15 17:09	112976              c:\windows\Microsoft.NET\assembly\GAC_MSIL\sysglobl\v4.0_4.0.0.0__b03f5f7f11d50a3a\sysglobl.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	112976              c:\windows\Microsoft.NET\assembly\GAC_MSIL\sysglobl\v4.0_4.0.0.0__b03f5f7f11d50a3a\sysglobl.dll
+ 2011-04-15 17:10 . 2011-04-15 17:10	581464              c:\windows\Microsoft.NET\assembly\GAC_MSIL\ReachFramework\v4.0_4.0.0.0__31bf3856ad364e35\ReachFramework.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	581464              c:\windows\Microsoft.NET\assembly\GAC_MSIL\ReachFramework\v4.0_4.0.0.0__31bf3856ad364e35\ReachFramework.dll
+ 2011-04-15 17:10 . 2011-04-15 17:10	832856              c:\windows\Microsoft.NET\assembly\GAC_MSIL\PresentationUI\v4.0_4.0.0.0__31bf3856ad364e35\PresentationUI.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	832856              c:\windows\Microsoft.NET\assembly\GAC_MSIL\PresentationUI\v4.0_4.0.0.0__31bf3856ad364e35\PresentationUI.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	194424              c:\windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Royale\v4.0_4.0.0.0__31bf3856ad364e35\PresentationFramework.Royale.dll
+ 2011-04-15 17:10 . 2011-04-15 17:10	194424              c:\windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Royale\v4.0_4.0.0.0__31bf3856ad364e35\PresentationFramework.Royale.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	478576              c:\windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Luna\v4.0_4.0.0.0__31bf3856ad364e35\PresentationFramework.Luna.dll
+ 2011-04-15 17:10 . 2011-04-15 17:10	478576              c:\windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Luna\v4.0_4.0.0.0__31bf3856ad364e35\PresentationFramework.Luna.dll
+ 2011-04-15 17:10 . 2011-04-15 17:10	167288              c:\windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Classic\v4.0_4.0.0.0__31bf3856ad364e35\PresentationFramework.Classic.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	167288              c:\windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Classic\v4.0_4.0.0.0__31bf3856ad364e35\PresentationFramework.Classic.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	232304              c:\windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Aero\v4.0_4.0.0.0__31bf3856ad364e35\PresentationFramework.Aero.dll
+ 2011-04-15 17:10 . 2011-04-15 17:10	232304              c:\windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Aero\v4.0_4.0.0.0__31bf3856ad364e35\PresentationFramework.Aero.dll
+ 2011-04-15 17:09 . 2011-04-15 17:09	661352              c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	661352              c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	349576              c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll
+ 2011-04-15 17:09 . 2011-04-15 17:09	349576              c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	387960              c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.dll
+ 2011-04-15 17:09 . 2011-04-15 17:09	387960              c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.dll
+ 2011-04-15 17:09 . 2011-04-15 17:09	746336              c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.JScript\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	746336              c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.JScript\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
+ 2011-04-15 17:09 . 2011-04-15 17:09	505184              c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	505184              c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	269672              c:\windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll
+ 2011-04-15 17:10 . 2011-04-15 17:10	269672              c:\windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	334688              c:\windows\Microsoft.NET\assembly\GAC_32\System.Printing\v4.0_4.0.0.0__31bf3856ad364e35\System.Printing.dll
+ 2011-04-15 17:10 . 2011-04-15 17:10	334688              c:\windows\Microsoft.NET\assembly\GAC_32\System.Printing\v4.0_4.0.0.0__31bf3856ad364e35\System.Printing.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	109568              c:\windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
+ 2011-04-15 17:09 . 2011-04-15 17:09	109568              c:\windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
+ 2011-04-15 17:09 . 2011-04-15 17:09	246128              c:\windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	246128              c:\windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	170368              c:\windows\Microsoft.NET\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.Dtc.dll
+ 2011-04-15 17:09 . 2011-04-15 17:09	170368              c:\windows\Microsoft.NET\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.Dtc.dll
+ 2011-04-15 17:13 . 2010-03-10 06:15	420352              c:\windows\ie8updates\KB2510531-IE8\vbscript.dll
+ 2011-04-15 17:13 . 2010-07-05 13:14	388984              c:\windows\ie8updates\KB2510531-IE8\spuninst\updspapi.dll
+ 2011-04-15 17:13 . 2010-07-05 13:14	234872              c:\windows\ie8updates\KB2510531-IE8\spuninst\spuninst.exe
+ 2011-04-15 17:13 . 2009-12-09 05:53	726528              c:\windows\ie8updates\KB2510531-IE8\jscript.dll
+ 2011-04-15 17:06 . 2010-12-20 23:52	916480              c:\windows\ie8updates\KB2497640-IE8\wininet.dll
+ 2011-04-15 17:07 . 2010-07-05 13:14	388984              c:\windows\ie8updates\KB2497640-IE8\spuninst\updspapi.dll
+ 2011-04-15 17:07 . 2010-07-05 13:14	234872              c:\windows\ie8updates\KB2497640-IE8\spuninst\spuninst.exe
+ 2011-04-15 17:06 . 2010-12-20 23:52	206848              c:\windows\ie8updates\KB2497640-IE8\occache.dll
+ 2011-04-15 17:06 . 2010-12-20 23:52	611840              c:\windows\ie8updates\KB2497640-IE8\mstime.dll
+ 2011-04-15 17:06 . 2010-12-20 23:52	602112              c:\windows\ie8updates\KB2497640-IE8\msfeeds.dll
+ 2011-04-15 17:06 . 2010-12-20 23:52	247808              c:\windows\ie8updates\KB2497640-IE8\ieproxy.dll
+ 2011-04-15 17:06 . 2010-12-20 23:52	184320              c:\windows\ie8updates\KB2497640-IE8\iepeers.dll
+ 2011-04-15 17:06 . 2010-12-20 23:52	743424              c:\windows\ie8updates\KB2497640-IE8\iedvtool.dll
+ 2011-04-15 17:06 . 2010-12-20 23:52	387584              c:\windows\ie8updates\KB2497640-IE8\iedkcs32.dll
+ 2011-04-15 17:06 . 2010-12-20 12:55	173568              c:\windows\ie8updates\KB2497640-IE8\ie4uinit.exe
+ 2009-07-17 13:33 . 2011-02-17 13:18	455936              c:\windows\Driver Cache\i386\mrxsmb.sys
+ 2011-04-15 17:10 . 2011-04-15 17:10	721920              c:\windows\assembly\NativeImages_v4.0.30319_32\System.Security\df00a90a0ca189eb49b071dfd9530347\System.Security.ni.dll
+ 2011-04-15 17:10 . 2011-04-15 17:10	144896              c:\windows\assembly\NativeImages_v4.0.30319_32\System.Numerics\f2304201110addb8170997ff442e87fc\System.Numerics.ni.dll
+ 2011-04-15 17:11 . 2011-04-15 17:11	373248              c:\windows\assembly\NativeImages_v4.0.30319_32\System.Dynamic\f9b335b9f86afcae5a54949288010a0f\System.Dynamic.ni.dll
+ 2011-04-15 17:11 . 2011-04-15 17:11	223744              c:\windows\assembly\NativeImages_v4.0.30319_32\System.Drawing.Desi#\bbb1323c2a613d3f4e9cfce17e03ee70\System.Drawing.Design.ni.dll
+ 2011-04-15 17:10 . 2011-04-15 17:10	973312              c:\windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\f7f7d2aa985906327e256d05472bdeb3\System.Configuration.ni.dll
+ 2011-04-15 17:11 . 2011-04-15 17:11	690176              c:\windows\assembly\NativeImages_v4.0.30319_32\System.ComponentMod#\50925baa7781cd6b13b345750b78cac2\System.ComponentModel.Composition.ni.dll
+ 2011-04-15 17:11 . 2011-04-15 17:11	656896              c:\windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\ea81a1bfc0d3e8840be37dffb83fc12e\PresentationFramework.Luna.ni.dll
+ 2011-04-15 17:10 . 2011-04-15 17:10	327168              c:\windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\e4498a63f9913a5d47d26de0da220fdc\PresentationFramework.Royale.ni.dll
+ 2011-04-15 17:11 . 2011-04-15 17:11	283648              c:\windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\debfd1ead83df514b9a663bf3601669f\PresentationFramework.Classic.ni.dll
+ 2011-04-15 17:11 . 2011-04-15 17:11	450048              c:\windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\bc6292c4e40c4bf27d35ec5a8065893f\PresentationFramework.Aero.ni.dll
+ 2011-04-15 17:42 . 2011-04-15 17:42	321536              c:\windows\assembly\NativeImages_v2.0.50727_32\WsatConfig\95de80b860252231b46014f58226e473\WsatConfig.ni.exe
+ 2011-04-15 17:12 . 2011-04-15 17:12	240128              c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\715710f5a31a494ed5c0ec0874dafe3e\WindowsFormsIntegration.ni.dll
+ 2011-04-15 17:12 . 2011-04-15 17:12	187904              c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationTypes\017be0e6c5f1810f15a696157cd5e2c2\UIAutomationTypes.ni.dll
+ 2011-04-15 17:12 . 2011-04-15 17:12	447488              c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClient\bec5b0a93df12eb26c02c877a4eae678\UIAutomationClient.ni.dll
+ 2011-04-15 17:42 . 2011-04-15 17:42	679936              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Security\9e91cca51a5ed6fb13b67558109d2726\System.Security.ni.dll
+ 2011-04-15 17:43 . 2011-04-15 17:43	311296              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\fa6a58394a1f162eecce4cd8af0875c3\System.Runtime.Serialization.Formatters.Soap.ni.dll
+ 2011-04-15 17:43 . 2011-04-15 17:43	998400              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Management\042658de519bb1e22ec5925092061892\System.Management.ni.dll
+ 2011-04-15 17:43 . 2011-04-15 17:43	330752              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Management.I#\d6ae8171ae6fd4fe83add34e6d70e5b5\System.Management.Instrumentation.ni.dll
+ 2011-04-15 17:14 . 2011-04-15 17:14	381440              c:\windows\assembly\NativeImages_v2.0.50727_32\System.IO.Log\abd5a61d39e474f12b30ccbbe6277667\System.IO.Log.ni.dll
+ 2011-04-15 17:14 . 2011-04-15 17:14	212992              c:\windows\assembly\NativeImages_v2.0.50727_32\System.IdentityMode#\12c4dba6d4ff0278d208c283d9ed7670\System.IdentityModel.Selectors.ni.dll
+ 2011-04-15 17:43 . 2011-04-15 17:43	280064              c:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\ff5c7a52497d892f3a3206384d46b5e7\System.EnterpriseServices.Wrapper.dll
+ 2011-04-15 17:43 . 2011-04-15 17:43	627712              c:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\ff5c7a52497d892f3a3206384d46b5e7\System.EnterpriseServices.ni.dll
+ 2011-04-15 17:12 . 2011-04-15 17:12	208384              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing.Desi#\e6b7128278d8c0e8382a5685f5b196c6\System.Drawing.Design.ni.dll
+ 2011-04-15 17:43 . 2011-04-15 17:43	881152              c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\8ef56bf47fc2fc4204e0fcc1f32bab01\System.DirectoryServices.AccountManagement.ni.dll
+ 2011-04-15 17:43 . 2011-04-15 17:43	455680              c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\447d7b4a7d0add13f8d2086088bcc41c\System.DirectoryServices.Protocols.ni.dll
+ 2011-04-15 17:43 . 2011-04-15 17:43	354816              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Service#\ce2afe8854ee9cdc834b6f392348c882\System.Data.Services.Design.ni.dll
+ 2011-04-15 17:43 . 2011-04-15 17:43	939008              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Service#\03d4658290e300e437e745ef4a613b59\System.Data.Services.Client.ni.dll
+ 2011-04-15 17:43 . 2011-04-15 17:43	756736              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Entity.#\7ce21a2855bb7731de4dab797e69f3f6\System.Data.Entity.Design.ni.dll
+ 2011-04-15 17:42 . 2011-04-15 17:42	135680              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.DataSet#\ea57694aea47c05853516c9bb2ad54b4\System.Data.DataSetExtensions.ni.dll
+ 2011-04-15 17:42 . 2011-04-15 17:42	971264              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\3d6b4509225efde2a4e3db77205f8a51\System.Configuration.ni.dll
+ 2011-04-15 17:43 . 2011-04-15 17:43	141312              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\f312bb844670ebc7458fec9e6b2568b3\System.Configuration.Install.ni.dll
+ 2011-04-15 17:42 . 2011-04-15 17:42	633856              c:\windows\assembly\NativeImages_v2.0.50727_32\System.AddIn\afd9595f07a8c68b26e81cf995957f56\System.AddIn.ni.dll
+ 2011-04-15 17:42 . 2011-04-15 17:42	366080              c:\windows\assembly\NativeImages_v2.0.50727_32\SMSvcHost\3a42b2fbafe93d7b9395e328bea35afa\SMSvcHost.ni.exe
+ 2011-04-15 17:14 . 2011-04-15 17:14	256000              c:\windows\assembly\NativeImages_v2.0.50727_32\SMDiagnostics\97ff96d3fc8d0b10ea294f320acf821e\SMDiagnostics.ni.dll
+ 2011-04-15 17:14 . 2011-04-15 17:14	320512              c:\windows\assembly\NativeImages_v2.0.50727_32\ServiceModelReg\28ed0e9efd938b05b4f53e0d90046701\ServiceModelReg.ni.exe
+ 2011-04-15 17:12 . 2011-04-15 17:12	368128              c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\ffe13679e6b3e36e5cb6c47f8c4faf9c\PresentationFramework.Aero.ni.dll
+ 2011-04-15 17:12 . 2011-04-15 17:12	224768              c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\dbb40299379f2009c140ddadb04231b4\PresentationFramework.Classic.ni.dll
+ 2011-04-15 17:12 . 2011-04-15 17:12	258048              c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\a34cd33cec1bdfebe4a3910bceb8723b\PresentationFramework.Royale.ni.dll
+ 2011-04-15 17:12 . 2011-04-15 17:12	539648              c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\689bb394bcb437ed085c22a43aba30c6\PresentationFramework.Luna.ni.dll
+ 2011-04-15 17:42 . 2011-04-15 17:42	133632              c:\windows\assembly\NativeImages_v2.0.50727_32\MSBuild\5670e74887ef1025c6a8c056ffe86b38\MSBuild.ni.exe
+ 2011-04-15 17:14 . 2011-04-15 17:14	386560              c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\653732002ebf5c68f69150a60e145e6a\Microsoft.Transactions.Bridge.Dtc.ni.dll
+ 2011-04-15 17:42 . 2011-04-15 17:42	175104              c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\cc62770393640302bd4d7e442b1e49a4\Microsoft.Build.Utilities.v3.5.ni.dll
+ 2011-04-15 17:42 . 2011-04-15 17:42	144384              c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\352bff1ee71ce114e225f849038dc48d\Microsoft.Build.Utilities.ni.dll
+ 2011-04-15 17:42 . 2011-04-15 17:42	839680              c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\7345f4d2d7157bf49de4158e8f2b6847\Microsoft.Build.Engine.ni.dll
+ 2011-04-15 17:42 . 2011-04-15 17:42	222720              c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Con#\d7dba901ddd410ca1a0156d0f2a27533\Microsoft.Build.Conversion.v3.5.ni.dll
+ 2011-04-15 17:42 . 2011-04-15 17:42	220672              c:\windows\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\010552e529d130ce914765b0801e2367\CustomMarshalers.ni.dll
+ 2011-04-15 17:14 . 2011-04-15 17:14	410112              c:\windows\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\6861f639b13967e9b014b44bbb7c5d4c\ComSvcConfig.ni.exe
+ 2011-04-15 17:14 . 2011-04-15 17:14	842240              c:\windows\assembly\NativeImages_v2.0.50727_32\AspNetMMCExt\800da7dec567fadf3392091e9f01ecb9\AspNetMMCExt.ni.dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	839680              c:\windows\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll
- 2010-10-10 12:39 . 2010-10-10 12:39	839680              c:\windows\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll
- 2010-10-10 12:39 . 2010-10-10 12:39	835584              c:\windows\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	835584              c:\windows\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
- 2010-10-10 12:40 . 2010-10-10 12:40	114688              c:\windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	114688              c:\windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
- 2010-10-10 12:40 . 2010-10-10 12:40	258048              c:\windows\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	258048              c:\windows\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll
- 2010-10-10 12:40 . 2010-10-10 12:40	131072              c:\windows\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	131072              c:\windows\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
- 2010-10-10 12:40 . 2010-10-10 12:40	303104              c:\windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	303104              c:\windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
- 2010-10-10 12:40 . 2010-10-10 12:40	258048              c:\windows\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	258048              c:\windows\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll
- 2010-10-10 12:40 . 2010-10-10 12:40	372736              c:\windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	372736              c:\windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
- 2010-10-10 12:40 . 2010-10-10 12:40	626688              c:\windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	626688              c:\windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
- 2010-10-10 12:40 . 2010-10-10 12:40	401408              c:\windows\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	401408              c:\windows\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	188416              c:\windows\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll
- 2010-10-10 12:39 . 2010-10-10 12:39	188416              c:\windows\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll
- 2010-10-10 12:40 . 2010-10-10 12:40	970752              c:\windows\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	970752              c:\windows\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	745472              c:\windows\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
- 2010-10-10 12:40 . 2010-10-10 12:40	745472              c:\windows\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	425984              c:\windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
- 2010-10-10 12:40 . 2010-10-10 12:40	425984              c:\windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	110592              c:\windows\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll
- 2010-10-10 12:40 . 2010-10-10 12:40	110592              c:\windows\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	659456              c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
- 2010-10-10 12:40 . 2010-10-10 12:40	659456              c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
- 2010-10-10 12:40 . 2010-10-10 12:40	372736              c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	372736              c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	110592              c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll
- 2010-10-10 12:40 . 2010-10-10 12:40	110592              c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll
- 2010-10-10 12:40 . 2010-10-10 12:40	749568              c:\windows\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	749568              c:\windows\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
- 2010-10-10 12:40 . 2010-10-10 12:40	655360              c:\windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	655360              c:\windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	348160              c:\windows\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
- 2010-10-10 12:40 . 2010-10-10 12:40	348160              c:\windows\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	507904              c:\windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll
- 2010-10-10 12:39 . 2010-10-10 12:39	507904              c:\windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll
- 2010-10-10 12:40 . 2010-10-10 12:40	261632              c:\windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	261632              c:\windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
- 2010-10-10 12:40 . 2010-10-10 12:40	113664              c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	113664              c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	258048              c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
- 2010-10-10 12:40 . 2010-10-10 12:40	258048              c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
- 2010-10-10 12:40 . 2010-10-10 12:40	486400              c:\windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	486400              c:\windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
+ 2011-04-15 17:05 . 2010-10-23 00:50	1748992              c:\windows\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.6002.22509_x-ww_c7dad023\GdiPlus.dll
- 2004-08-04 12:00 . 2010-12-20 23:52	1210880              c:\windows\system32\urlmon.dll
+ 2004-08-04 12:00 . 2011-02-22 23:05	1210880              c:\windows\system32\urlmon.dll
+ 2004-08-04 12:00 . 2011-02-22 23:05	5962240              c:\windows\system32\mshtml.dll
- 2009-03-08 02:32 . 2010-12-20 23:52	1991680              c:\windows\system32\iertutil.dll
+ 2009-03-08 02:32 . 2011-02-22 23:05	1991680              c:\windows\system32\iertutil.dll
+ 2009-04-19 19:46 . 2011-03-03 13:53	1858048              c:\windows\system32\dllcache\win32k.sys
+ 2009-03-08 02:34 . 2011-02-22 23:05	1210880              c:\windows\system32\dllcache\urlmon.dll
- 2009-03-08 02:34 . 2010-12-20 23:52	1210880              c:\windows\system32\dllcache\urlmon.dll
+ 2009-03-08 02:41 . 2011-02-22 23:05	5962240              c:\windows\system32\dllcache\mshtml.dll
+ 2009-07-17 18:32 . 2011-02-22 23:05	1991680              c:\windows\system32\dllcache\iertutil.dll
- 2009-07-17 18:32 . 2010-12-20 23:52	1991680              c:\windows\system32\dllcache\iertutil.dll
- 2010-03-18 11:16 . 2010-03-18 11:16	5196112              c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll
+ 2011-02-10 02:10 . 2011-02-10 02:10	5196112              c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll
+ 2011-02-10 02:10 . 2011-02-10 02:10	1142104              c:\windows\Microsoft.NET\Framework\v4.0.30319\mscordacwks.dll
+ 2011-02-10 02:10 . 2011-02-10 02:10	6735176              c:\windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
+ 2011-01-18 02:39 . 2011-01-18 02:39	5813072              c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
+ 2011-01-18 02:39 . 2011-01-18 02:39	4550656              c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll
- 2010-05-11 04:40 . 2010-05-11 04:40	4550656              c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	1303896              c:\windows\Microsoft.NET\assembly\GAC_MSIL\WindowsBase\v4.0_4.0.0.0__31bf3856ad364e35\WindowsBase.dll
+ 2011-04-15 17:10 . 2011-04-15 17:10	1303896              c:\windows\Microsoft.NET\assembly\GAC_MSIL\WindowsBase\v4.0_4.0.0.0__31bf3856ad364e35\WindowsBase.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	3481928              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll
+ 2011-04-15 17:09 . 2011-04-15 17:09	3481928              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll
+ 2011-04-15 17:09 . 2011-04-15 17:09	2207568              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	2207568              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	4982120              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
+ 2011-04-15 17:09 . 2011-04-15 17:09	4982120              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	1711496              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms.DataVisualization\v4.0_4.0.0.0__31bf3856ad364e35\System.Windows.Forms.DataVisualization.dll
+ 2011-04-15 17:09 . 2011-04-15 17:09	1711496              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms.DataVisualization\v4.0_4.0.0.0__31bf3856ad364e35\System.Windows.Forms.DataVisualization.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	6067048              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll
+ 2011-04-15 17:10 . 2011-04-15 17:10	6067048              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll
+ 2011-04-15 17:10 . 2011-04-15 17:10	1026936              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Serialization.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	1026936              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Serialization.dll
+ 2011-04-15 17:09 . 2011-04-15 17:09	4464480              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Entity\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Entity.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	4464480              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Entity\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Entity.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	1339736              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll
+ 2011-04-15 17:09 . 2011-04-15 17:09	1339736              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll
+ 2011-04-15 17:10 . 2011-04-15 17:10	1199968              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities\v4.0_4.0.0.0__31bf3856ad364e35\System.Activities.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	1199968              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities\v4.0_4.0.0.0__31bf3856ad364e35\System.Activities.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	1462648              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities.Presentation\v4.0_4.0.0.0__31bf3856ad364e35\System.Activities.Presentation.dll
+ 2011-04-15 17:10 . 2011-04-15 17:10	1462648              c:\windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities.Presentation\v4.0_4.0.0.0__31bf3856ad364e35\System.Activities.Presentation.dll
+ 2011-04-15 17:10 . 2011-04-15 17:10	6346600              c:\windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework\v4.0_4.0.0.0__31bf3856ad364e35\PresentationFramework.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	6346600              c:\windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework\v4.0_4.0.0.0__31bf3856ad364e35\PresentationFramework.dll
+ 2011-04-15 17:09 . 2011-04-15 17:09	2970968              c:\windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	2970968              c:\windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll
+ 2011-04-15 17:10 . 2011-04-15 17:10	3545952              c:\windows\Microsoft.NET\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\PresentationCore.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	3545952              c:\windows\Microsoft.NET\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\PresentationCore.dll
+ 2011-04-15 17:09 . 2011-04-15 17:09	5196112              c:\windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	5196112              c:\windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll
+ 2011-04-15 17:09 . 2011-04-15 17:09	2989456              c:\windows\Microsoft.NET\assembly\GAC_32\Microsoft.VisualBasic.Activities.Compiler\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Activities.Compiler.dll
- 2010-08-03 12:57 . 2010-08-03 12:57	2989456              c:\windows\Microsoft.NET\assembly\GAC_32\Microsoft.VisualBasic.Activities.Compiler\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Activities.Compiler.dll
+ 2011-04-15 17:06 . 2010-12-20 23:52	1210880              c:\windows\ie8updates\KB2497640-IE8\urlmon.dll
+ 2011-04-15 17:06 . 2010-12-20 23:52	5961216              c:\windows\ie8updates\KB2497640-IE8\mshtml.dll
+ 2011-04-15 17:06 . 2010-12-20 23:52	1991680              c:\windows\ie8updates\KB2497640-IE8\iertutil.dll
+ 2011-04-15 17:10 . 2011-04-15 17:10	3779072              c:\windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\8d8cf1d60737d945a526fb11577d4b8a\WindowsBase.ni.dll
+ 2011-04-15 17:10 . 2011-04-15 17:10	9000960              c:\windows\assembly\NativeImages_v4.0.30319_32\System\7abfd34ae39103ceccdfb8b262ed6a97\System.ni.dll
+ 2011-04-15 17:10 . 2011-04-15 17:10	5571584              c:\windows\assembly\NativeImages_v4.0.30319_32\System.Xml\eb45dda4b68ae7f29995c3a3d909fbe7\System.Xml.ni.dll
+ 2011-04-15 17:11 . 2011-04-15 17:11	1651200              c:\windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\526f0a9717cbd8a50d09a10b5ce81c0d\System.Drawing.ni.dll
+ 2011-04-15 17:11 . 2011-04-15 17:11	6754816              c:\windows\assembly\NativeImages_v4.0.30319_32\System.Data\adc8f2f7dff3233f2d72bcef8e58226a\System.Data.ni.dll
+ 2011-04-15 17:11 . 2011-04-15 17:11	2538496              c:\windows\assembly\NativeImages_v4.0.30319_32\System.Data.SqlXml\c25dda9b477a33f9f235292114bb535c\System.Data.SqlXml.ni.dll
+ 2011-04-15 17:11 . 2011-04-15 17:11	2499072              c:\windows\assembly\NativeImages_v4.0.30319_32\System.Data.Linq\8e0d083a7ad85b579d176e3594b5f3b8\System.Data.Linq.ni.dll
+ 2011-04-15 17:10 . 2011-04-15 17:10	7025664              c:\windows\assembly\NativeImages_v4.0.30319_32\System.Core\69b1f8a15cdfb26e30c8761fa4f96940\System.Core.ni.dll
+ 2011-04-15 17:11 . 2011-04-15 17:11	1612288              c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.CSharp\32454400da56267e19961852345d7a62\Microsoft.CSharp.ni.dll
+ 2011-04-15 17:11 . 2011-04-15 17:11	3325440              c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\76e431fde1b252312b331f7108259fda\WindowsBase.ni.dll
+ 2011-04-15 17:12 . 2011-04-15 17:12	1049600              c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClients#\9e022c95e79f2b6f383a501ad99f08a9\UIAutomationClientsideProviders.ni.dll
+ 2011-04-15 17:11 . 2011-04-15 17:11	7949824              c:\windows\assembly\NativeImages_v2.0.50727_32\System\f02cf6430a9fc77908a74ab6925cb73c\System.ni.dll
+ 2011-04-15 17:12 . 2011-04-15 17:12	5450752              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\b06e49ed8cbe07dbb90e313fa634b27b\System.Xml.ni.dll
+ 2011-04-15 17:12 . 2011-04-15 17:12	1917952              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Speech\dd128c8e21e7fa14c12b71df9892d046\System.Speech.ni.dll
+ 2011-04-15 17:14 . 2011-04-15 17:14	2345472              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\85090bd451617e204ffda625b8d9fc30\System.Runtime.Serialization.ni.dll
+ 2011-04-15 17:12 . 2011-04-15 17:12	1035776              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Printing\85a7a7aace114e78fc6c9b219bcd5551\System.Printing.ni.dll
+ 2011-04-15 17:14 . 2011-04-15 17:14	1070080              c:\windows\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\86c59378e9a43bf101a10ad452a4bb8e\System.IdentityModel.ni.dll
+ 2011-04-15 17:12 . 2011-04-15 17:12	1587200              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\d912066086a59f09424c7c69f95e2c55\System.Drawing.ni.dll
+ 2011-04-15 17:43 . 2011-04-15 17:43	1116672              c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\c05d9332116964104c721e97f7ce1058\System.DirectoryServices.ni.dll
+ 2011-04-15 17:43 . 2011-04-15 17:43	1801216              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Deployment\0118c0c73ea5c77bda7b10b188102ab6\System.Deployment.ni.dll
+ 2011-04-15 17:12 . 2011-04-15 17:12	6616576              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data\1337829e3df6888464a17aab78bb9b8f\System.Data.ni.dll
+ 2011-04-15 17:42 . 2011-04-15 17:42	2510336              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.SqlXml\ba3ca7a93e227c32ce7b50d0a7ba935f\System.Data.SqlXml.ni.dll
+ 2011-04-15 17:43 . 2011-04-15 17:43	1328128              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Services\2de52be5da96059651b5bec800cb4605\System.Data.Services.ni.dll
+ 2011-04-15 17:12 . 2011-04-15 17:12	2516480              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Linq\11f1306e0e311a0d0cbd139fb2fa4c36\System.Data.Linq.ni.dll
+ 2011-04-15 17:43 . 2011-04-15 17:43	9924096              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Entity\6f83243158f28669aac9577fdb3d5aaf\System.Data.Entity.ni.dll
+ 2011-04-15 17:12 . 2011-04-15 17:12	2295296              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Core\684fe21837d3cf3e5935bbd0a7f53141\System.Core.ni.dll
+ 2011-04-15 17:12 . 2011-04-15 17:12	2128896              c:\windows\assembly\NativeImages_v2.0.50727_32\ReachFramework\12efddabe6fe35be21246c88ed9bf8ab\ReachFramework.ni.dll
+ 2011-04-15 17:12 . 2011-04-15 17:12	1657856              c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationUI\257c9327ba9cc5cd87f58de224aa2e0d\PresentationUI.ni.dll
+ 2011-04-15 17:11 . 2011-04-15 17:11	1451008              c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationBuildTa#\2faf279f73d492469a21f3e74d18955d\PresentationBuildTasks.ni.dll
+ 2011-04-15 17:42 . 2011-04-15 17:42	1712128              c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\269103939243ec6929739c8b9a645c0d\Microsoft.VisualBasic.ni.dll
+ 2011-04-15 17:14 . 2011-04-15 17:14	1093120              c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\bf7bd26d2828e35156814018939ce4f6\Microsoft.Transactions.Bridge.ni.dll
+ 2011-04-15 17:42 . 2011-04-15 17:42	1620992              c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\f5eb1e42ccd0f67f7496b94a31949cd0\Microsoft.Build.Tasks.ni.dll
+ 2011-04-15 17:42 . 2011-04-15 17:42	1966080              c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\cc7f05675a5cd8014222be1483d6beaf\Microsoft.Build.Tasks.v3.5.ni.dll
+ 2011-04-15 17:42 . 2011-04-15 17:42	1888768              c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\41cf95aa4ff5765b515d3252abc6353b\Microsoft.Build.Engine.ni.dll
- 2010-10-10 12:40 . 2010-10-10 12:40	3182592              c:\windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	3182592              c:\windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
- 2010-10-10 12:40 . 2010-10-10 12:40	2048000              c:\windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	2048000              c:\windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll
- 2010-10-10 12:39 . 2010-10-10 12:39	5025792              c:\windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	5025792              c:\windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
- 2010-10-10 12:39 . 2010-10-10 12:39	5062656              c:\windows\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	5062656              c:\windows\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	5242880              c:\windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll
- 2010-10-10 12:39 . 2010-10-10 12:39	5242880              c:\windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll
- 2010-10-10 12:40 . 2010-10-10 12:40	2933248              c:\windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	2933248              c:\windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
- 2010-10-10 12:40 . 2010-10-10 12:40	4550656              c:\windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
+ 2011-04-15 17:08 . 2011-04-15 17:08	4550656              c:\windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
+ 2009-07-17 14:30 . 2011-04-15 17:13	39828936              c:\windows\system32\MRT.exe
+ 2009-03-08 02:39 . 2011-02-22 23:05	11080704              c:\windows\system32\ieframe.dll
- 2009-03-08 02:39 . 2010-12-21 04:22	11080704              c:\windows\system32\ieframe.dll
- 2009-07-17 18:32 . 2010-12-21 04:22	11080704              c:\windows\system32\dllcache\ieframe.dll
+ 2009-07-17 18:32 . 2011-02-22 23:05	11080704              c:\windows\system32\dllcache\ieframe.dll
+ 2011-02-11 06:43 . 2011-02-11 06:43	10951168              c:\windows\Installer\50b6a3.msp
+ 2011-02-11 18:47 . 2011-02-11 18:47	12028928              c:\windows\Installer\50b694.msp
+ 2011-04-15 17:06 . 2010-12-21 04:22	11080704              c:\windows\ie8updates\KB2497640-IE8\ieframe.dll
+ 2011-04-15 17:11 . 2011-04-15 17:11	13006336              c:\windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\85b61e27d3c08c0c8ff19deb75912e1d\System.Windows.Forms.ni.dll
+ 2011-04-15 17:11 . 2011-04-15 17:11	10847744              c:\windows\assembly\NativeImages_v4.0.30319_32\System.Design\52846d07f7717330921b70d23e36b34c\System.Design.ni.dll
+ 2011-04-15 17:11 . 2011-04-15 17:11	17629184              c:\windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\f1e3e74b135fcd61fa30090a2c2596a6\PresentationFramework.ni.dll
+ 2011-04-15 17:11 . 2011-04-15 17:11	11058176              c:\windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\3fe193ac81b9eafd76aafeec99bdbf6a\PresentationCore.ni.dll
+ 2011-04-15 17:10 . 2011-04-15 17:10	14415872              c:\windows\assembly\NativeImages_v4.0.30319_32\mscorlib\eb4e1e70734f6efb9c7de7ec5f452c9e\mscorlib.ni.dll
+ 2011-04-15 17:12 . 2011-04-15 17:12	12430848              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\ed2bf0d86229128c194a872f70fe15ee\System.Windows.Forms.ni.dll
+ 2011-04-15 17:14 . 2011-04-15 17:14	17403904              c:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel\b5f24d96334ea08b99350421450d3ba4\System.ServiceModel.ni.dll
+ 2011-04-15 17:12 . 2011-04-15 17:12	10683392              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Design\5aeadb9ff9a86f49130de5976a9f1744\System.Design.ni.dll
+ 2011-04-15 17:12 . 2011-04-15 17:12	14328320              c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\1a5d89d569e2e12842daf4d87c57361a\PresentationFramework.ni.dll
+ 2011-04-15 17:12 . 2011-04-15 17:12	12215808              c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\46c57d845e55232a89e98101075cd455\PresentationCore.ni.dll
+ 2011-04-15 17:11 . 2011-04-15 17:11	11490816              c:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62d5f089dd51f18472a7caf1593d9f6b\mscorlib.ni.dll
.
-- Snapshot auf jetziges Datum zurückgesetzt --
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-07-17 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"zBrowser Launcher"="c:\programme\Logitech\iTouch\iTouch.exe" [2004-03-18 892928]
"RTHDCPL"="RTHDCPL.EXE" [2007-07-05 16380416]
"Start WingMan Profiler"="c:\programme\Logitech\Gaming Software\LWEMon.exe" [2010-06-14 153672]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-10-16 110696]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-10-16 13851752]
"nwiz"="c:\programme\NVIDIA Corporation\nView\nwiz.exe" [2010-08-25 1753192]
"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2010-10-29 249064]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\dokumente und einstellungen\Default User\Startmen\Programme\Autostart\
DSL-Manager.lnk - c:\programme\DSL-Manager\DslMgr.exe [N/A]
.
c:\dokumente und einstellungen\Default User\Startmen\Programme\Autostart\
DSL-Manager.lnk - c:\programme\DSL-Manager\DslMgr.exe [N/A]
.
c:\dokumente und einstellungen\Default User\Startmen\Programme\Autostart\
DSL-Manager.lnk - c:\programme\DSL-Manager\DslMgr.exe [N/A]
.
c:\dokumente und einstellungen\Default User\Startmen\Programme\Autostart\
DSL-Manager.lnk - c:\programme\DSL-Manager\DslMgr.exe [N/A]
.
c:\dokumente und einstellungen\All Users\Startmen\Programme\Autostart\
EPSON Status Monitor 3 Environment Check 2.lnk - c:\windows\system32\spool\drivers\w32x86\3\E_SRCV02.EXE [2011-2-21 135680]
.
c:\dokumente und einstellungen\Default User\Startmen\Programme\Autostart\
DSL-Manager.lnk - c:\programme\DSL-Manager\DslMgr.exe [N/A]
.
c:\dokumente und einstellungen\Default User\Startmen\Programme\Autostart\
DSL-Manager.lnk - c:\programme\DSL-Manager\DslMgr.exe [N/A]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	autocheck autochk *\0OODBS\0lsdelete
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
.
[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Adobe Acrobat - Schnellstart.lnk]
path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Acrobat - Schnellstart.lnk
backup=c:\windows\pss\Adobe Acrobat - Schnellstart.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^CAPI Control.lnk]
path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\CAPI Control.lnk
backup=c:\windows\pss\CAPI Control.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Clicktionary.lnk]
path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\Clicktionary.lnk
backup=c:\windows\pss\Clicktionary.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^VPN Client.lnk]
path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\VPN Client.lnk
backup=c:\windows\pss\VPN Client.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0]
2008-04-23 00:08	483328	----a-w-	c:\programme\Adobe\Acrobat 7.0\Distillr\acrotray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AnyDVD]
2011-01-06 18:00	4763256	----a-w-	c:\programme\SlySoft\AnyDVD\AnyDVDtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avgnt]
2010-11-04 16:00	281768	----a-w-	c:\programme\Avira\AntiVir Desktop\avgnt.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2009-04-23 13:51	691656	----a-w-	c:\programme\DAEMON Tools Lite\daemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware (reboot)]
2010-12-20 16:08	963976	----a-w-	c:\programme\Malwarebytes' Anti-Malware\mbam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Mirabilis ICQ]
2003-10-14 16:36	38984	----a-w-	c:\progra~1\ICQ\ICQNet.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Norton Ghost 14.0]
2008-01-19 18:01	2245984	----a-w-	c:\programme\Norton Ghost\Agent\VProTray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2009-10-09 12:11	25623336	----a-r-	c:\programme\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
2005-10-26 14:17	159744	----a-r-	c:\programme\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2011-01-16 23:57	1242448	----a-w-	c:\programme\Steam\steam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-07-17 14:45	39408	----a-w-	c:\programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"MSConfig"=c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
"NeroFilterCheck"=c:\windows\system32\NeroCheck.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Programme\\ICQ\\Icq.exe"=
"c:\programme\Microsoft ActiveSync\rapimgr.exe"= c:\programme\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\programme\Microsoft ActiveSync\wcescomm.exe"= c:\programme\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\programme\Microsoft ActiveSync\WCESMgr.exe"= c:\programme\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Games\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx9.exe"=
"c:\\Games\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx10.exe"=
"c:\\Games\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Launcher.exe"=
"c:\\Programme\\TVAnts\\Tvants.exe"=
"c:\\Programme\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Programme\\SopCast\\adv\\SopAdver.exe"=
"c:\\Programme\\SopCast\\SopCast.exe"=
"c:\\Programme\\xampp\\mysql\\bin\\mysqld.exe"=
"c:\\Programme\\xampp\\apache\\bin\\httpd.exe"=
"c:\\Programme\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Programme\\Skype\\Phone\\Skype.exe"=
"c:\\Programme\\FlashGet\\flashget.exe"=
"c:\\Programme\\Steam\\Steam.exe"=
"c:\\Programme\\ICQ7.4\\ICQ.exe"=
"c:\\Programme\\Steam\\SteamApps\\common\\mafia ii\\pc\\mafia2.exe"=
"c:\\Programme\\QIP 2010\\qip.exe"=
.
R0 hotcore3;hotcore3;c:\windows\system32\drivers\hotcore3.sys [16.07.2009 19:55 39472]
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [17.07.2009 20:33 64288]
R0 OODrvled;OODrvled;c:\windows\system32\drivers\OODrvled.sys [17.08.2004 10:35 15488]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [17.07.2009 17:34 721904]
R2 CAPI20;Eumex 404PC;c:\windows\system32\drivers\Capi20.sys [17.07.2009 20:30 235952]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.03.2010 13:16 130384]
R2 DETEWECP;Telekom ISDN Port;c:\windows\system32\drivers\detewecp.sys [17.07.2009 20:30 38480]
R2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [20.10.2009 20:19 50704]
R2 Symantec SymSnap VSS Provider;Symantec SymSnap VSS Provider;c:\windows\system32\dllhost.exe [04.08.2004 14:00 5120]
R3 SymSnapService;SymSnapService;c:\programme\Norton Ghost\Shared\Drivers\SymSnapService.exe [20.12.2007 17:13 1553896]
S2 gupdate;Google Update Service (gupdate);c:\programme\Google\Update\GoogleUpdate.exe [06.02.2010 15:00 135664]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\programme\Lavasoft\Ad-Aware\AAWService.exe [24.09.2009 13:17 1181328]
S3 dsltestSp5;dsltestSp5 NDIS Protocol Driver;c:\windows\system32\Drivers\dsltestSp5.sys --> c:\windows\system32\Drivers\dsltestSp5.sys [?]
S3 SIS163u;SiS163 usb Wireless LAN Adapter Driver;c:\windows\system32\drivers\sis163u.sys [07.08.2008 22:07 215040]
S3 TSMPacket;DSL-Manager Service;c:\windows\system32\DRIVERS\tsmpkt.sys --> c:\windows\system32\DRIVERS\tsmpkt.sys [?]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.03.2010 13:16 753504]
S4 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [17.07.2009 14:36 135336]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp
.
Inhalt des "geplante Tasks" Ordners
.
2011-04-15 c:\windows\Tasks\1-Klick-Wartung.job
- c:\programme\TuneUp Utilities 2009\OneClickStarter.exe [2009-11-16 10:45]
.
2011-04-15 c:\windows\Tasks\Ad-Aware Update (Daily 1).job
- c:\programme\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 19:48]
.
2011-04-15 c:\windows\Tasks\Ad-Aware Update (Daily 2).job
- c:\programme\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 19:48]
.
2011-04-15 c:\windows\Tasks\Ad-Aware Update (Daily 3).job
- c:\programme\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 19:48]
.
2011-04-15 c:\windows\Tasks\Ad-Aware Update (Daily 4).job
- c:\programme\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 19:48]
.
2011-04-15 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\programme\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 19:48]
.
2011-04-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-02-06 13:00]
.
2011-04-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-02-06 13:00]
.
.
------- Zusätzlicher Suchlauf -------
.
IE: &Alles mit FlashGet laden - c:\programme\FlashGet\jc_all.htm
IE: &Mit FlashGet laden - c:\programme\FlashGet\jc_link.htm
IE: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - c:\programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - c:\programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Auswahl in Adobe PDF konvertieren - c:\programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Auswahl in vorhandene PDF-Datei konvertieren - c:\programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Free YouTube Download - c:\dokumente und einstellungen\***\Anwendungsdaten\DVDVideoSoftIEHelpers\youtubedownload.htm
IE: Free YouTube to Mp3 Converter - c:\dokumente und einstellungen\***\Anwendungsdaten\DVDVideoSoftIEHelpers\youtubetomp3.htm
IE: Google Sidewiki... - c:\programme\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
IE: In Adobe PDF konvertieren - c:\programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: In vorhandene PDF-Datei konvertieren - c:\programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Verknüpfungsziel in Adobe PDF konvertieren - c:\programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - c:\programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: {{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - c:\programme\ICQ7.4\ICQ.exe
DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} - hxxp://ips.poi.de/ips-opdata/operator/69189345/objects/jordan.cab
DPF: {AC414988-E5BB-4C2C-873B-EA53D2F3D23A} - hxxp://t.live.cctv.com/ieocx/CCTVUpdateInstall.dll
FF - ProfilePath - c:\dokumente und einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\94mbbu34.default\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\programme\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter: jqs@sun.com - c:\programme\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: WOT: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} - %profile%\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
FF - Ext: vShare Plugin: vshare@toolbar - %profile%\extensions\vshare@toolbar
FF - Ext: Zotero: zotero@chnm.gmu.edu - %profile%\extensions\zotero@chnm.gmu.edu
FF - Ext: Zotero WinWord Integration: zoteroWinWordIntegration@zotero.org - %profile%\extensions\zoteroWinWordIntegration@zotero.org
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: content.max.tokenizing.time - 200000
FF - user.js: content.notify.interval - 100000
FF - user.js: content.switch.threshold - 650000
FF - user.js: nglayout.initialpaint.delay - 300
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2011-04-15 19:43
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse... 
.
Scanne versteckte Autostarteinträge... 
.
Scanne versteckte Dateien... 
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10o_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10o_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€–€|ÿÿÿÿÀ•€|ù•6~*]
"7040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG08.00.00.01WORKSTATION"="2D7F452B5CC4D53D929A171EB54F6EF3072FE30362F3C25C826A5832C44CC85C01C157A9DBF006F64427E8D56BF22591EBC568E77CE65257D5DB99BA2883F028549674C9B6441697B60B583A05AADC7794B17D6BCB8686787C7CC125A0CDE95C60FD3CC7DC0E342E5D10AD16415E7A9554242E0BF87119B1440942BE64A7E28A0BD82661B143A50EDE6302BA4F1D7820AAB1DA47A36E5836AD9E5EDA1E2EA008F3717A588EFA43CE959345F9D415621051D536245EE72701ECBF31CCED2678F0EBF0D7753FF2F84A0F173A2D6B9DDA20336EC92AAD6B7B4DEAD2A5EFE6F3D621F768AE018208C6211044F5AF9F2D1752F0B9EF678B2BFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A9C6AECB7A5D1407A6A0AC4980AC79335D575E7D6A3B9808EFF75B9D2DDEBC641F2C11C0D4208F64FDAE183FC9EC378EAAE182CCB66E327B31411E3AFD00791F8DB385BCEB06FD5717E90A39C44F7485AD4D652B1A157434B7FBBE1875F7E15A7559FD8F4E1CA91D212BF03ED35050315E4BC19107BDCD407CE0B866A0B6B96784B4D2D34D89C43E9B8AA2732E648AF3B4938A4A3AD1ABF90BEABBBAE4B73ABA7BA28F8590F574E71F66A65CDF0855D63A27E3064639ECE08458288C767410ED31437387968E53EDD35FB9664C36D7021045275711E5E59A1CAC96B9E1EBDD3D0DF9719EAC82EF45785A4DDDA5F02DC56976E1B5D4C7DEED9B3050800524370A0D6EB173F808CB87607F84F4763FE4948C83D6FC9ED514C65DECD386122226D8428E1015F0D6DDF2F13E38449A290185567AFAEC4F0D3435D3B153541274A5D3D20A9B7361AB8E69A5C67644C33D79D4B3AEF6A71F68646D011236D6DCA729C5F6D419E4E8C7BC708A8D7C54F50E39DEAAB52A36956D3D46FE65175CA35295A07DA5FDA27D6F3AB3444C4336092F1F28CFE82402912249BD79C6431CE70A417AC57BF649656BCD7E8700EE90AC3C7DD750E7AB5CC39189F0AF163FAC816A7C0BC414E2DA3C8830C39E6A5F6DDE511D38EA133AF6B3C872A5F7F4400A9914072E86F4563DF217919A6810233C75113737F1927CEAB9DAEA44B8CB3016AF2B94E627E418B9CC6B90BA583B7F4F18207B69CDCE54B284DF50566FC42E94175650D85670A47CE0DE46037276EC5BC5A98D85FAF658AD9571708E2CCF0E2EF641D54CDAE929181CCD3B76D19518FBCDDA04E5067DCF9FC22E913E13A054EEC89B37308D620C023D196E3AA5ACE0B0D464E80813973BAFB539EA5F5BACBDC65C99F8935C34E392D8A55117AE945D59D47C3C91DABE49E86B38A80D53AF370B537393ACC6FA7A0956DA49FCC46B54BE99DC7148A634613BB6576A07D9A9E273A5E274D3E3155184F027B17C5112C28A43C3EE9758F6"
"OODLED02.00.00.02WSSV"="BBBBCB2418C182E67546FB583D7F00167DC7AA22F3DC2B7075EBB276542F3C971E8B2A27B393664DA3D28102C2B9FC00F5AEB54824762B2BB48F09F029313782A9F9D4410F99DEEACFE4E9AD5032B64DF5E9FB0D0DA529ABDD4B1E23F5F5F29382BA596FD5EB42585A83C0539E64572133F729070E6CC040A1AB625F62A31C67F310065E99746E9E43C8571FC4A30D110BE4B27D6BA0112ED258882B7BB4E0906955F07451F4C3BA3262C3714392082B7A54CCF04B6BBC2EE8880841B077F69274F570C85401262070935D60FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A9C6AECB7A5D1407A6A0AC4980AC79335D575E7D6A3B9808BC6FDAADD8F6DFAC8398CDC482F2B72A3A8D9C5C823665F6AAB73A14860B9C39999E86D6B1DFF6F107A627D02F2756E485936ABFC704CCC915E2408E0C5321502077C0BE8F73D976F18EC0AC39E8DC2E51897B92124E1E4C2403456D3A165D5519BF55225D18F50A75DC19804173BC515B619E8BDC436BE9390F88958515256F33119332A5C402302670306C8D152A50405FA5D4C7A40A3E1E4F4B60852A8F78FBDA4F949B09F320FEFC890008309FDE039DE48D944B959BFAE2D597764177FEE9606060910588455E0C2EC3403BD8660987B6482BA26C09623AF17DB7D9FA4653B6A22403EE40BE03F62DAFE440D8021EDE788D15A9AE3DC59CEC43CE8900C3F6CBF4618A1060E1136E13B2CD5CE28370B78CD58372C4A77DA29C9361772A22745B3C0BEAC3EE3498F5782FF543816F91FB571447A658E8C4BAD48ABCE068404F795E0C08FCB8F2806772FA783B81FD776644A7577FD5D73BA67135CF95E5316F8DC8C06AC14F8B9D6BA05F999D731BFE09BF6950CCF07C63FBD09A30F999BB235169FA402985232305A21BBED8AD6763C8BB246F721F15A52556321385B8581A53B57E5A62F291AC059B6070F0C7B84ADEAD1798661C924C5EE66657C53D37E878A384ACAD75603593B6D4DDF92096B6578FF45236E31C08BAEE197B5BE9BA077430BA50602B5120AE9F92591F573D1613DEE347FE3A09EA9FDB1D2377BD78D254DAC182E3F956322486A6D71FD21E35469C00C6F4A3E86D47A1BB176602BC0AF5A62FA4360A981499A095734B3CDBC57ACF58435F6C7B6A3F36AFC102C284D20C9B8B3AE7C6725484A5D2E90A7F52608C026F5598A137A26814A9B43B4E83B51EC453EC9D60F2E3B1534A9D56CE8AFD2D3FBD3512944637F939CCA216B61E9D06B2788A92CADE98C06AD814BD9E47FCE01A2BC3CC5C85B1FCAAB2E32B5371DB7378608212BE2CAAA6AE50F663287CA000A8998261D3857BCEEC6674A6C04B26682E62E9FDB809B829E8F7157DE8538E3884DB197A170DE5218AE87549DDAC13BBEECC"
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'explorer.exe'(11496)
c:\windows\system32\webcheck.dll
.
Zeit der Fertigstellung: 2011-04-15  19:44:14
ComboFix-quarantined-files.txt  2011-04-15 17:44
.
Vor Suchlauf: 16 Verzeichnis(se), 58.113.204.224 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 58.036.039.680 Bytes frei
.
- - End Of File - - 797BFD34F3732BC95D85C8B290DBB85C
         

Alt 15.04.2011, 20:40   #10
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Trojaner: CleanThis, MS Removal Tool und Windows Restore - Standard

Trojaner: CleanThis, MS Removal Tool und Windows Restore



Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.


Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.
  • Doppelklick auf die MBRCheck.exe.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Das Tool braucht nur wenige Sekunden.
  • Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.
Poste mir bitte den Inhalt des .txt Dokumentes
__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Alt 16.04.2011, 10:26   #11
berlyn
 
Trojaner: CleanThis, MS Removal Tool und Windows Restore - Standard

Trojaner: CleanThis, MS Removal Tool und Windows Restore



Danke soweit!

GMER-Log:
Code:
ATTFilter
GMER 1.0.15.15570 - hxxp://www.gmer.net
Rootkit scan 2011-04-16 11:13:54
Windows 5.1.2600 Service Pack 3 Harddisk1\DR1 -> \Device\Ide\IdeDeviceP3T0L0-1a SAMSUNG_HD753LJ rev.1AA01117
Running: 08gvb8v5.exe; Driver: C:\DOKUME~1\***\LOKALE~1\Temp\uwwdypog.sys


---- System - GMER 1.0.15 ----

SSDT            B7E3D3E6                                                                                                                       ZwCreateKey
SSDT            B7E3D3DC                                                                                                                       ZwCreateThread
SSDT            B7E3D3EB                                                                                                                       ZwDeleteKey
SSDT            B7E3D3F5                                                                                                                       ZwDeleteValueKey
SSDT            spsc.sys                                                                                                                       ZwEnumerateKey [0xF74F4CA4]
SSDT            spsc.sys                                                                                                                       ZwEnumerateValueKey [0xF74F5032]
SSDT            B7E3D3FA                                                                                                                       ZwLoadKey
SSDT            spsc.sys                                                                                                                       ZwOpenKey [0xF74D60C0]
SSDT            B7E3D3C8                                                                                                                       ZwOpenProcess
SSDT            B7E3D3CD                                                                                                                       ZwOpenThread
SSDT            spsc.sys                                                                                                                       ZwQueryKey [0xF74F510A]
SSDT            spsc.sys                                                                                                                       ZwQueryValueKey [0xF74F4F8A]
SSDT            B7E3D404                                                                                                                       ZwReplaceKey
SSDT            B7E3D3FF                                                                                                                       ZwRestoreKey
SSDT            B7E3D3F0                                                                                                                       ZwSetValueKey

INT 0x83        ?                                                                                                                              89EB7EC0
INT 0xA4        ?                                                                                                                              89EB7EC0
INT 0xB4        ?                                                                                                                              8A193BF8
INT 0xB4        ?                                                                                                                              8A193BF8
INT 0xB4        ?                                                                                                                              89EB7EC0
INT 0xB4        ?                                                                                                                              8A193BF8

---- Kernel code sections - GMER 1.0.15 ----

?               spsc.sys                                                                                                                       Das System kann die angegebene Datei nicht finden. !
.text           C:\WINDOWS\system32\DRIVERS\nv4_mini.sys                                                                                       section is writeable [0xB6B273A0, 0x5CC259, 0xE8000020]
.text           USBPORT.SYS!DllUnload                                                                                                          B6ACA8AC 5 Bytes  JMP 89EB74A0 
.text           aytdyfp0.SYS                                                                                                                   B6A06386 35 Bytes  [00, 00, 00, 00, 00, 00, 20, ...]
.text           aytdyfp0.SYS                                                                                                                   B6A063AA 24 Bytes  [00, 00, 00, 00, 00, 00, 00, ...]
.text           aytdyfp0.SYS                                                                                                                   B6A063C4 3 Bytes  [00, 70, 02] {ADD [EAX+0x2], DH}
.text           aytdyfp0.SYS                                                                                                                   B6A063C9 1 Byte  [30]
.text           aytdyfp0.SYS                                                                                                                   B6A063C9 11 Bytes  [30, 00, 00, 00, 5C, 02, 00, ...] {XOR [EAX], AL; ADD [EAX], AL; POP ESP; ADD AL, [EAX]; ADD [EAX], AL; ADD [EAX], AL}
.text           ...                                                                                                                            

---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT             \WINDOWS\System32\Drivers\SCSIPORT.SYS[ntoskrnl.exe!DbgBreakPoint]                                                             8A1962D8
IAT             pci.sys[ntoskrnl.exe!IoDetachDevice]                                                                                           [F7507C4C] spsc.sys
IAT             pci.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack]                                                                              [F7507CA0] spsc.sys
IAT             atapi.sys[HAL.dll!READ_PORT_UCHAR]                                                                                             [F74D7042] spsc.sys
IAT             atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT]                                                                                     [F74D713E] spsc.sys
IAT             atapi.sys[HAL.dll!READ_PORT_USHORT]                                                                                            [F74D70C0] spsc.sys
IAT             atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT]                                                                                    [F74D7800] spsc.sys
IAT             atapi.sys[HAL.dll!WRITE_PORT_UCHAR]                                                                                            [F74D76D6] spsc.sys
IAT             \SystemRoot\system32\DRIVERS\USBPORT.SYS[ntoskrnl.exe!DbgBreakPoint]                                                           89EB75A0
IAT             \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR]                                                             [F74E6E9C] spsc.sys
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!RtlInitUnicodeString]                                                   8800001C
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!swprintf]                                                               001CB286
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!KeSetEvent]                                                             C61AEB00
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!IoCreateSymbolicLink]                                                   001C8186
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!IoGetConfigurationInformation]                                          86C61200
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!IoDeleteSymbolicLink]                                                   00001C83
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!MmFreeMappingAddress]                                                   8E868801
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!IoFreeErrorLogEntry]                                                    8800001C
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!IoDisconnectInterrupt]                                                  001CAA86
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!MmUnmapIoSpace]                                                         80968B00
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!ObReferenceObjectByPointer]                                             8900001C
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!IofCompleteRequest]                                                     001C9C96
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!RtlCompareUnicodeString]                                                C6168B00
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!IofCallDriver]                                                          001CB986
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!MmAllocateMappingAddress]                                               428A0A00
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!IoAllocateErrorLogEntry]                                                BA86880C
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!IoConnectInterrupt]                                                     8B00001C
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!IoDetachDevice]                                                         24A48DFA
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!KeWaitForSingleObject]                                                  00000000
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!KeInitializeEvent]                                                      4B8BDF8B
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!KeCancelTimer]                                                          8D3F0304
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!RtlAnsiStringToUnicodeString]                                           CB033043
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!RtlInitAnsiString]                                                      0673C13B
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!IoBuildDeviceIoControlRequest]                                          C13B0003
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!IoQueueWorkItem]                                                        8366FA72
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!MmMapIoSpace]                                                           75000E7B
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!IoInvalidateDeviceRelations]                                            0B7D80E3
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!IoReportDetectedDevice]                                                 307B8D00
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!IoReportResourceForDetection]                                           00AA840F
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!RtlxAnsiStringToUnicodeSize]                                            83660000
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!NlsMbCodePageTag]                                                       6A000E7A
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!PoRequestPowerIrp]                                                      C6647400
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!KeInsertByKeyDeviceQueue]                                               001CBB86
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!PoRegisterDeviceForIdleDetection]                                       4F8B0200
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!sprintf]                                                                968D5140
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!MmMapLockedPagesSpecifyCache]                                           00001C90
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!ObfDereferenceObject]                                                   2266E852
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!IoGetAttachedDeviceReference]                                           478B0000
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!IoInvalidateDeviceState]                                                50016A40
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!ZwClose]                                                                1CAC8E8D
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!ObReferenceObjectByHandle]                                              E8510000
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!ZwCreateDirectoryObject]                                                00002254
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!IoBuildSynchronousFsdRequest]                                           6A18538B
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!PoStartNextPowerIrp]                                                    868D5200
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!IoCreateDevice]                                                         00001C98
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!RtlCopyUnicodeString]                                                   2242E850
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!IoAllocateDriverObjectExtension]                                        4B8B0000
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!RtlQueryRegistryValues]                                                 51016A18
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!ZwOpenKey]                                                              1CB4968D
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!RtlFreeUnicodeString]                                                   E8520000
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!IoStartTimer]                                                           00002230
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!KeInitializeTimer]                                                      8A05478A
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!IoInitializeTimer]                                                      001CBB8E
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!KeInitializeDpc]                                                        30C48300
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!KeInitializeSpinLock]                                                   1CBD8688
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!IoInitializeIrp]                                                        80E90000
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!ZwCreateKey]                                                            C6000000
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!RtlAppendUnicodeStringToString]                                         001CBB86
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!RtlIntegerToUnicodeString]                                              438B0100
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!ZwSetValueKey]                                                          8E8D5018
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!KeInsertQueueDpc]                                                       00001C90
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!KefAcquireSpinLockAtDpcLevel]                                           2202E851
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!IoStartPacket]                                                          538B0000
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!KefReleaseSpinLockFromDpcLevel]                                         52016A18
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!IoBuildAsynchronousFsdRequest]                                          1CAC868D
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!IoFreeMdl]                                                              E8500000
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!MmUnlockPages]                                                          000021F0
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!IoWriteErrorLogEntry]                                                   8A05478A
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!KeRemoveByKeyDeviceQueue]                                               001CBB8E
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!MmMapLockedPagesWithReservedMapping]                                    18C48300
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!MmUnmapReservedMapping]                                                 1CBD8688
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!KeSynchronizeExecution]                                                 43EB0000
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!IoStartNextPacket]                                                      320C538A
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!KeBugCheckEx]                                                           88F93BC0
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!KeRemoveDeviceQueue]                                                    001CBB96
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!KeSetTimer]                                                             F6317300
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!_allmul]                                                                74070647
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!MmProbeAndLockPages]                                                    75C0841A
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!_except_handler3]                                                       05578A0B
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!PoSetPowerState]                                                        968801B0
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!IoOpenDeviceRegistryKey]                                                00001CBD
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!RtlWriteRegistryValue]                                                  57B60F66
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!RtlDeleteRegistryValue]                                                 533B6604
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!_aulldiv]                                                               03087408
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!strstr]                                                                 72F93B3F
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!_strupr]                                                                8A09EBDA
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!KeQuerySystemTime]                                                      86880547
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!IoWMIRegistrationControl]                                               00001CBD
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!KeTickCount]                                                            88084B8A
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!IoAttachDeviceToDeviceStack]                                            001CBE8E
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!IoDeleteDevice]                                                         40578B00
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!ExAllocatePoolWithTag]                                                  8D52006A
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!IoAllocateWorkItem]                                                     001CC086
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!IoAllocateIrp]                                                          81E85000
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!IoAllocateMdl]                                                          8B000021
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!MmBuildMdlForNonPagedPool]                                              001CB88E
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!MmLockPagableDataSection]                                               BC968B00
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!IoGetDriverObjectExtension]                                             8900001C
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!MmUnlockPagableImageSection]                                            001CC48E
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!ExFreePoolWithTag]                                                      C8968900
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!IoFreeIrp]                                                              8B00001C
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!IoFreeWorkItem]                                                         016A4047
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!InitSafeBootMode]                                                       CCC68150
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!RtlCompareMemory]                                                       5600001C
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!PoCallDriver]                                                           002157E8
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!memmove]                                                                18C48300
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[ntoskrnl.exe!MmHighestUserAddress]                                                   5D5B5E5F
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[HAL.dll!KfAcquireSpinLock]                                                           18C4830E
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[HAL.dll!READ_PORT_UCHAR]                                                             1C8D9E88
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[HAL.dll!KeGetCurrentIrql]                                                            9E880000
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[HAL.dll!KfRaiseIrql]                                                                 00001CA9
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[HAL.dll!KfLowerIrql]                                                                 0E798366
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[HAL.dll!HalGetInterruptVector]                                                       74AAB000
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[HAL.dll!HalTranslateBusAddress]                                                      8186C636
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[HAL.dll!KeStallExecutionProcessor]                                                   1A00001C
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[HAL.dll!KfReleaseSpinLock]                                                           1C8386C6
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[HAL.dll!READ_PORT_BUFFER_USHORT]                                                     C6020000
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[HAL.dll!READ_PORT_USHORT]                                                            001C8E86
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[HAL.dll!WRITE_PORT_BUFFER_USHORT]                                                    86C60200
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[HAL.dll!WRITE_PORT_UCHAR]                                                            00001CAA
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[WMILIB.SYS!WmiSystemControl]                                                         8800001C
IAT             \SystemRoot\System32\Drivers\aytdyfp0.SYS[WMILIB.SYS!WmiCompleteRequest]                                                       001CB19E

---- User IAT/EAT - GMER 1.0.15 ----

IAT             C:\Programme\Cisco Systems\VPN Client\cvpnd.exe[148] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!GetProcAddress]            [00F52BC8] C:\WINDOWS\system32\VSINIT.dll (TrueVector Service/Zone Labs, LLC)
IAT             C:\Programme\Cisco Systems\VPN Client\cvpnd.exe[148] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!UnhandledExceptionFilter]  [00F52CE9] C:\WINDOWS\system32\VSINIT.dll (TrueVector Service/Zone Labs, LLC)
IAT             C:\Programme\Cisco Systems\VPN Client\cvpnd.exe[148] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!TerminateProcess]          [00F52CB8] C:\WINDOWS\system32\VSINIT.dll (TrueVector Service/Zone Labs, LLC)

---- Devices - GMER 1.0.15 ----

Device          \FileSystem\Ntfs \Ntfs                                                                                                         8A1921F8

AttachedDevice  \FileSystem\Ntfs \Ntfs                                                                                                         OODrvled.sys (O&O DriveLED Pro Filter Driver/O&O Software GmbH)
AttachedDevice  \FileSystem\Ntfs \Ntfs                                                                                                         symsnap.sys (StorageCraft Volume Snap-Shot/StorageCraft)

Device          \Driver\usbstor \Device\0000008e                                                                                               8996C500
Device          \Driver\usbstor \Device\0000008f                                                                                               8996C500
Device          \Driver\NetBT \Device\NetBT_Tcpip_{DA975F48-2362-4C9C-9815-30456140069F}                                                       899A1500
Device          \Driver\usbuhci \Device\USBPDO-0                                                                                               89EB41F8
Device          \Driver\dmio \Device\DmControl\DmIoDaemon                                                                                      8A2071F8
Device          \Driver\dmio \Device\DmControl\DmConfig                                                                                        8A2071F8
Device          \Driver\dmio \Device\DmControl\DmPnP                                                                                           8A2071F8
Device          \Driver\dmio \Device\DmControl\DmInfo                                                                                          8A2071F8
Device          \Driver\usbuhci \Device\USBPDO-1                                                                                               89EB41F8
Device          \Driver\usbuhci \Device\USBPDO-2                                                                                               89EB41F8
Device          \Driver\usbuhci \Device\USBPDO-3                                                                                               89EB41F8
Device          \Driver\usbehci \Device\USBPDO-4                                                                                               89E871F8
Device          \Driver\PCI_PNP0016 \Device\00000055                                                                                           spsc.sys
Device          \Driver\PCI_PNP0016 \Device\00000055                                                                                           spsc.sys

AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                                                      Lbd.sys (Boot Driver/Lavasoft AB)

Device          \Driver\Ftdisk \Device\HarddiskVolume1                                                                                         8A1941F8

AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume1                                                                                         hotcore3.sys (Hotbackup helper driver/Paragon Software Group)
AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume1                                                                                         symsnap.sys (StorageCraft Volume Snap-Shot/StorageCraft)

Device          \Driver\Ftdisk \Device\HarddiskVolume2                                                                                         8A1941F8

AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume2                                                                                         hotcore3.sys (Hotbackup helper driver/Paragon Software Group)
AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume2                                                                                         symsnap.sys (StorageCraft Volume Snap-Shot/StorageCraft)

Device          \Driver\Cdrom \Device\CdRom0                                                                                                   89E72500
Device          \Driver\atapi \Device\Ide\IdePort0                                                                                             [F7978B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device          \Driver\atapi \Device\Ide\IdePort1                                                                                             [F7978B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device          \Driver\atapi \Device\Ide\IdePort2                                                                                             [F7978B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device          \Driver\atapi \Device\Ide\IdeDeviceP2T1L0-e                                                                                    [F7978B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device          \Driver\atapi \Device\Ide\IdeDeviceP2T0L0-6                                                                                    [F7978B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device          \Driver\atapi \Device\Ide\IdePort3                                                                                             [F7978B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device          \Driver\atapi \Device\Ide\IdeDeviceP3T0L0-1a                                                                                   [F7978B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device          \Driver\atapi \Device\Ide\IdeDeviceP3T1L0-22                                                                                   [F7978B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device          \Driver\Ftdisk \Device\HarddiskVolume3                                                                                         8A1941F8

AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume3                                                                                         hotcore3.sys (Hotbackup helper driver/Paragon Software Group)
AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume3                                                                                         symsnap.sys (StorageCraft Volume Snap-Shot/StorageCraft)

Device          \Driver\Cdrom \Device\CdRom1                                                                                                   89E72500
Device          \Driver\Cdrom \Device\CdRom2                                                                                                   89E72500
Device          \Driver\Cdrom \Device\CdRom3                                                                                                   89E72500
Device          \Driver\Cdrom \Device\CdRom4                                                                                                   89E72500
Device          \Driver\Cdrom \Device\CdRom5                                                                                                   89E72500
Device          \Driver\NetBT \Device\NetBt_Wins_Export                                                                                        899A1500
Device          \Driver\NetBT \Device\NetbiosSmb                                                                                               899A1500
Device          \Driver\sptd \Device\3503297516                                                                                                spsc.sys
Device          \Driver\usbuhci \Device\USBFDO-0                                                                                               89EB41F8
Device          \Driver\usbuhci \Device\USBFDO-1                                                                                               89EB41F8
Device          \FileSystem\MRxSmb \Device\LanmanDatagramReceiver                                                                              8998A500
Device          \Driver\usbuhci \Device\USBFDO-2                                                                                               89EB41F8
Device          \FileSystem\MRxSmb \Device\LanmanRedirector                                                                                    8998A500
Device          \Driver\usbuhci \Device\USBFDO-3                                                                                               89EB41F8
Device          \Driver\usbehci \Device\USBFDO-4                                                                                               89E871F8
Device          \Driver\Ftdisk \Device\FtControl                                                                                               8A1941F8
Device          \Driver\usbstor \Device\0000008a                                                                                               8996C500
Device          \Driver\usbstor \Device\0000008b                                                                                               8996C500
Device          \Driver\usbstor \Device\0000008c                                                                                               8996C500
Device          \Driver\aytdyfp0 \Device\Scsi\aytdyfp01Port4Path0Target2Lun0                                                                   89D681F8
Device          \Driver\aytdyfp0 \Device\Scsi\aytdyfp01Port4Path0Target0Lun0                                                                   89D681F8
Device          \Driver\aytdyfp0 \Device\Scsi\aytdyfp01                                                                                        89D681F8
Device          \Driver\aytdyfp0 \Device\Scsi\aytdyfp01Port4Path0Target1Lun0                                                                   89D681F8
Device          \Driver\aytdyfp0 \Device\Scsi\aytdyfp01Port4Path0Target3Lun0                                                                   89D681F8
Device          \Driver\usbstor \Device\0000008d                                                                                               8996C500
Device          \FileSystem\Cdfs \Cdfs                                                                                                         899A4500

---- Registry - GMER 1.0.15 ----

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1                                                                             771343423
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2                                                                             285507792
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0                                                                             1
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC                                               
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                            C:\Programme\DAEMON Tools Lite\
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                            0
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                         0x78 0x70 0x09 0xD1 ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001                                      
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                                   0x20 0x01 0x00 0x00 ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                                0x4E 0xED 0x8F 0xCC ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0                                 
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                           0x54 0x9B 0x15 0xBD ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1                                 
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12                           0x2A 0xBC 0x71 0xA7 ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq2                                 
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq2@hdf12                           0x8A 0xF3 0xD5 0x92 ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq3                                 
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq3@hdf12                           0x53 0x69 0x33 0x1E ...
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)                           
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                                C:\Programme\DAEMON Tools Lite\
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                                0
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                             0x78 0x70 0x09 0xD1 ...
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)                  
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                                       0x20 0x01 0x00 0x00 ...
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                                    0x4E 0xED 0x8F 0xCC ...
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)             
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                               0x54 0x9B 0x15 0xBD ...
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1 (not active ControlSet)             
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12                               0x2A 0xBC 0x71 0xA7 ...
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq2 (not active ControlSet)             
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq2@hdf12                               0x8A 0xF3 0xD5 0x92 ...
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq3 (not active ControlSet)             
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq3@hdf12                               0x53 0x69 0x33 0x1E ...
Reg             HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System                                                                          
Reg             HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OODEFRAG08.00.00.01WORKSTATION                                           2D7F452B5CC4D53D929A171EB54F6EF3072FE30362F3C25C826A5832C44CC85C01C157A9DBF006F64427E8D56BF22591EBC568E77CE65257D5DB99BA2883F028549674C9B6441697B60B583A05AADC7794B17D6BCB8686787C7CC125A0CDE95C60FD3CC7DC0E342E5D10AD16415E7A9554242E0BF87119B1440942BE64A7E28A0BD82661B143A50EDE6302BA4F1D7820AAB1DA47A36E5836AD9E5EDA1E2EA008F3717A588EFA43CE959345F9D415621051D536245EE72701ECBF31CCED2678F0EBF0D7753FF2F84A0F173A2D6B9DDA20336EC92AAD6B7B4DEAD2A5EFE6F3D621F768AE018208C6211044F5AF9F2D1752F0B9EF678B2BFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A9C6AECB7A5D1407A6A0AC4980AC79335D575E7D6A3B9808EFF75B9D2DDEBC641F2C11C0D4208F64FDAE183FC9EC378EAAE182CCB66E327B31411E3AFD00791F8DB385BCEB06FD5717E90A39C44F7485AD4D652B1A157434B7FBBE1875F7E15A7559FD8F4E1CA91D212BF03ED35050315E4BC19107BDCD407CE0B866A0B6B96784B4D2D34D89C43E9B8AA2732E648AF3B4938A4A3AD1ABF90BEABBBAE4B73ABA7BA28F8590F574E71F66A65CDF0855D63A27E3064639ECE08458288C767410ED31437387968E53EDD35FB9664C36D702104
Reg             HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OODLED02.00.00.02WSSV                                                    BBBBCB2418C182E67546FB583D7F00167DC7AA22F3DC2B7075EBB276542F3C971E8B2A27B393664DA3D28102C2B9FC00F5AEB54824762B2BB48F09F029313782A9F9D4410F99DEEACFE4E9AD5032B64DF5E9FB0D0DA529ABDD4B1E23F5F5F29382BA596FD5EB42585A83C0539E64572133F729070E6CC040A1AB625F62A31C67F310065E99746E9E43C8571FC4A30D110BE4B27D6BA0112ED258882B7BB4E0906955F07451F4C3BA3262C3714392082B7A54CCF04B6BBC2EE8880841B077F69274F570C85401262070935D60FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A9C6AECB7A5D1407A6A0AC4980AC79335D575E7D6A3B9808BC6FDAADD8F6DFAC8398CDC482F2B72A3A8D9C5C823665F6AAB73A14860B9C39999E86D6B1DFF6F107A627D02F2756E485936ABFC704CCC915E2408E0C5321502077C0BE8F73D976F18EC0AC39E8DC2E51897B92124E1E4C2403456D3A165D5519BF55225D18F50A75DC19804173BC515B619E8BDC436BE9390F88958515256F33119332A5C402302670306C8D152A50405FA5D4C7A40A3E1E4F4B60852A8F78FBDA4F949B09F320FEFC890008309FDE039DE48D944B959BFAE2D597764177FEE9606060910588455E0C2EC3403BD8660987B6482BA26C09623AF17DB7D9FA4653B6A22

---- EOF - GMER 1.0.15 ----
         
OSAM-Log:
Code:
ATTFilter
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 11:18:44 on 16.04.2011

OS: Windows XP Professional Service Pack 3 (Build 2600)
Default Browser: Microsoft Corporation Internet Explorer 8.00.6001.18702

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Boot Execute]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Session Manager )-----
"BootExecute" - "O&O Software GmbH" - C:\WINDOWS\system32\OODBS.exe
"BootExecute" - ? - C:\WINDOWS\system32\lsdelete.exe  (File found, but it contains no detailed information)

[Common]
-----( %SystemRoot%\Tasks )-----
"Ad-Aware Update (Daily 1).job" - "Lavasoft" - C:\Programme\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe
"Ad-Aware Update (Daily 2).job" - "Lavasoft" - C:\Programme\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe
"Ad-Aware Update (Daily 3).job" - "Lavasoft" - C:\Programme\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe
"Ad-Aware Update (Daily 4).job" - "Lavasoft" - C:\Programme\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe
"Ad-Aware Update (Weekly).job" - "Lavasoft" - C:\Programme\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
"1-Klick-Wartung.job" - "TuneUp Software GmbH" - C:\Programme\TuneUp Utilities 2009\OneClickStarter.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"infocardcpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\infocardcpl.cpl
"javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl
"nvcpl.cpl" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvcpl.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"Avira AntiVir Personal - Free Antivirus " - "Avira GmbH" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl
"ECSEPM" - "Sony Ericsson Mobile Communications AB" - C:\Programme\Sony Ericsson\Mobile2\Mobile Phone Monitor\ecsepm.cpl
"SYMLIVE" - "Symantec Corporation" - C:\Programme\Symantec\LiveUpdate\S32LUCP2.CPL

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"AnyDVD" (AnyDVD) - "SlySoft, Inc." - C:\WINDOWS\System32\Drivers\AnyDVD.sys
"avgio" (avgio) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avgio.sys
"avgntflt" (avgntflt) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avipbb.sys
"aytdyfp0" (aytdyfp0) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\aytdyfp0.sys  (Hidden registry entry, rootkit activity | File signed by Microsoft)
"BrPar" (BrPar) - "Brother Industries Ltd." - C:\WINDOWS\System32\drivers\BrPar.sys
"catchme" (catchme) - ? - C:\DOKUME~1\***\LOKALE~1\Temp\catchme.sys  (File not found)
"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys  (File not found)
"Cisco Systems Inc. IPSec Driver" (CVPNDRVA) - "Cisco Systems, Inc." - C:\WINDOWS\system32\Drivers\CVPNDRVA.sys
"Deterministic Network Enhancer Miniport" (DNE) - "Deterministic Networks, Inc." - C:\WINDOWS\System32\DRIVERS\dne2000.sys
"DSL-Manager Service" (TSMPacket) - ? - C:\WINDOWS\System32\DRIVERS\tsmpkt.sys  (File not found)
"dsltestSp5 NDIS Protocol Driver" (dsltestSp5) - ? - C:\WINDOWS\System32\Drivers\dsltestSp5.sys  (File not found)
"ElbyCDIO Driver" (ElbyCDIO) - "Elaborate Bytes AG" - C:\WINDOWS\System32\Drivers\ElbyCDIO.sys
"Eumex 404PC" (CAPI20) - "DeTeWe Berlin" - C:\WINDOWS\System32\Drivers\CAPI20.SYS
"hotcore3" (hotcore3) - "Paragon Software Group" - C:\WINDOWS\System32\drivers\hotcore3.sys
"i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys  (File not found)
"Lbd" (Lbd) - "Lavasoft AB" - C:\WINDOWS\System32\DRIVERS\Lbd.sys
"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)
"NetGroup Packet Filter Driver" (NPF) - "CACE Technologies, Inc." - C:\WINDOWS\System32\drivers\npf.sys
"OODrvled" (OODrvled) - "O&O Software GmbH" - C:\WINDOWS\System32\DRIVERS\OODrvled.sys
"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)
"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)
"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)
"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)
"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)
"sptd" (sptd) - "Duplex Secure Ltd." - C:\WINDOWS\System32\Drivers\sptd.sys  (File is exclusively opened, access blocked)
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\ssmdrv.sys
"StarOpen" (StarOpen) - ? - C:\WINDOWS\system32\drivers\StarOpen.sys  (File found, but it contains no detailed information)
"Symantec V2i Mount Driver" (v2imount) - "Symantec Corporation" - C:\WINDOWS\System32\DRIVERS\v2imount.sys
"Symantec Volume Snap Shot Driver" (symsnap) - "StorageCraft" - C:\WINDOWS\System32\DRIVERS\symsnap.sys
"Telekom ISDN Port" (DETEWECP) - "DeTeWe Berlin" - C:\WINDOWS\System32\drivers\detewecp.sys
"uwwdypog" (uwwdypog) - ? - C:\DOKUME~1\***\LOKALE~1\Temp\uwwdypog.sys  (Hidden registry entry, rootkit activity | File not found)
"VPROEVENTMONITOR" (VPROEVENTMONITOR) - "Symantec Corporation" - C:\WINDOWS\system32\drivers\VProEventMonitor.sys
"vsdatant" (vsdatant) - "Zone Labs, LLC" - C:\WINDOWS\system32\vsdatant.sys
"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)
"WimFltr" (WimFltr) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\wimfltr.sys

[Explorer]
-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----
{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{807553E5-5146-11D5-A672-00B0D022E945} "text/xml" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{32505114-5902-49B2-880A-1F7738E5A384} "Data Page Plugable Protocal mso-offdap11 Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
{3D9F03FA-7A94-11D3-BE81-0050048385D1} "Data Page Pluggable Protocol mso-offdap Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL
{3F3A4B8A-86FC-43A4-BB00-6D7EBE9D4484} "vsharechrome" - ? -   (File not found | COM-object registry key not found)
{C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} "WOT Protocol" - "Against Intuition Oy" - C:\Programme\WOT\WOT.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802} "Acrobat Elements Context Menu" - "Adobe Systems Inc." - C:\Programme\Adobe\Acrobat 7.0\Acrobat Elements\ContextMenu.dll
{D66DC78C-4F61-447F-942B-3FB6980118CF} "CInfoTipShellExt Class" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Visio11\VISSHE.DLL
{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - deskpan.dll  (File not found)
{1CDB2949-8F65-4355-8456-263E7C208A5D} "Desktop Explorer" - "NVIDIA Corporation" - C:\Programme\NVIDIA Corporation\nView\nvshell.dll
{1E9B04FB-F9E5-4718-997B-B8DA88302A47} "Desktop Explorer Menu" - "NVIDIA Corporation" - C:\Programme\NVIDIA Corporation\nView\nvshell.dll
{A70C977A-BF00-412C-90B7-034C51DA2439} "DesktopContext Class" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvcpl.dll
{1D2680C9-0E2A-469d-B787-065558BC7D43} "Fusion Cache" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{F802F260-519B-11D1-BB5D-0060974C6013} "ICQ Shell Extension" - "ICQ" - C:\Programme\ICQ\ICQShExt.dll
{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -   (File not found | COM-object registry key not found)
{506F4668-F13E-4AA1-BB04-B43203AB3CC0} "ImageExtractorShellExt Class" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Visio11\VISSHE.DLL
{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -   (File not found | COM-object registry key not found)
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Programme\Microsoft Office\OFFICE11\msohev.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll
{00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll
{49BF5420-FA7F-11cf-8011-00A0C90A8F78} "Mobiles Gerät" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Wcesview.dll
{FFB699E0-306A-11d3-8BD1-00104B6F7516} "NVIDIA CPL Extension" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvcpl.dll
{1E9B04FB-F9E5-4718-997B-B8DA88302A48} "nView Desktop Context Menu" - "NVIDIA Corporation" - C:\Programme\NVIDIA Corporation\nView\nvshell.dll
{0006F045-0000-0000-C000-000000000046} "Outlook-Dateisymbolerweiterung" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\shlext.dll
{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll
{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -   (File not found | COM-object registry key not found)
{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll
{A5110426-177D-4e08-AB3F-785F10B4439C} "Sony Ericsson Datei-Manager" - "Sony Ericsson Mobile Communications AB" - C:\Programme\Sony Ericsson\Mobile2\File Manager\fmgrgui.dll
{4838CD50-7E5D-4811-9B17-C47A85539F28} "TuneUp Disk Space Explorer Shell Extension" - "TuneUp Software" - C:\Programme\TuneUp Utilities 2009\DseShExt-x86.dll
{4858E7D9-8E12-45a3-B6A3-1CD128C9D403} "TuneUp Shredder Shell Extension" - "TuneUp Software" - C:\Programme\TuneUp Utilities 2009\SDShelEx-win32.dll
{44440D00-FF19-4AFC-B765-9A0970567D97} "TuneUp Theme Extension" - "TuneUp Software" - C:\WINDOWS\System32\uxtuneup.dll
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Programme\WinRAR\rarext.dll  (File found, but it contains no detailed information)

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "Adobe PDF" - "Adobe Systems Incorporated" - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
<binary data> "Google Toolbar" - "Google Inc." - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll
ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)
<binary data> "WOT" - "Against Intuition Oy" - C:\Programme\WOT\WOT.dll
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{AC414988-E5BB-4C2C-873B-EA53D2F3D23A} "CCTVUpdateInstall" - "CCTV International Networks Co.,Ltd" - C:\WINDOWS\Downloaded Program Files\CCTVUpdateInstall.dll / hxxp://t.live.cctv.com/ieocx/CCTVUpdateInstall.dll
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_24.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_24.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_24.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
{34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} "JordanUploader Class" - "IPLabs GmbH" - C:\WINDOWS\Downloaded Program Files\JordanApplet.dll / hxxp://ips.poi.de/ips-opdata/operator/69189345/objects/jordan.cab
{166B1BCA-3F9C-11CF-8075-444553540000} "Shockwave ActiveX Control" - "Adobe Systems, Inc." - C:\WINDOWS\system32\Adobe\Director\SwDir.dll / hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\WINDOWS\system32\Macromed\Flash\Flash10o.ocx / hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
{17492023-C23A-453E-A040-C7C580BBF700} "Windows Genuine Advantage Validation Tool" - "Microsoft Corporation" - C:\WINDOWS\system32\legitcheckcontrol.dll / hxxp://go.microsoft.com/fwlink/?linkid=39204
{E2883E8F-472F-4FB0-9522-AC9BF37916A7} "{E2883E8F-472F-4FB0-9522-AC9BF37916A7}" - ? -   (File not found | COM-object registry key not found) / hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} "ClsidExtension" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\INetRepl.dll
{77BF5300-1474-4EC7-9980-D32B190E9B07} "ClsidExtension" - "Skype Technologies S.A." - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
{2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} "Create Mobile Favorite" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\INetRepl.dll
"FlashGet" - "FlashGet.com" - C:\Programme\FlashGet\FlashGet.exe
"ICQ Pro" - "ICQ Inc." - C:\PROGRA~1\ICQ\ICQ.exe
"ICQ7.4" - "ICQ, LLC." - C:\Programme\ICQ7.4\ICQ.exe
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Recherchieren" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
{77BF5300-1474-4EC7-9980-D32B190E9B07} "Skype" - "Skype Technologies S.A." - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
<binary data> "Adobe PDF" - "Adobe Systems Incorporated" - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
<binary data> "Google Toolbar" - "Google Inc." - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll
{71576546-354D-41c9-AAE8-31F2EC22BF0D} "WOT" - "Against Intuition Oy" - C:\Programme\WOT\WOT.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "AcroIEHlprObj Class" - "Adobe Systems Incorporated" - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
{AE7CD045-E861-484f-8273-0445EE161910} "Adobe PDF Conversion Toolbar Helper" - "Adobe Systems Incorporated" - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
{2F364306-AA45-47B5-9F9D-39A8B94E7EF7} "FGCatchUrl" - "www.flashget.com" - C:\Programme\FlashGet\jccatch.dll
{F156768E-81EF-470C-9057-481BA8380DBA} "FlashGet GetFlash Class" - "www.flashget.com" - C:\Programme\FlashGet\getflash.dll
{AA58ED58-01DD-4d91-8333-CF10577473F7} "Google Toolbar Helper" - "Google Inc." - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} "Google Toolbar Notifier BHO" - "Google Inc." - C:\Programme\Google\GoogleToolbarNotifier\5.6.6209.1142\swg.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jp2ssv.dll
{E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
{22BF413B-C6D2-4d91-82A9-A0F997BA588C} "Skype add-on (mastermind)" - "Skype Technologies S.A." - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
{C920E44A-7F78-4E64-BDD7-A57026E7FEB7} "WOT Helper" - "Against Intuition Oy" - C:\Programme\WOT\WOT.dll

[Logon]
-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini
"EPSON Status Monitor 3 Environment Check 2.lnk" - "SEIKO EPSON CORPORATION" - C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE  (Shortcut exists | File exists)
-----( %UserProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\***\Startmenü\Programme\Autostart\desktop.ini
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"H/PC Connection Agent" - "Microsoft Corporation" - "C:\Programme\Microsoft ActiveSync\wcescomm.exe"
"swg" - "Google Inc." - "C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"NvCplDaemon" - "NVIDIA Corporation" - RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
"NvMediaCenter" - "NVIDIA Corporation" - RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
"nwiz" - "NVIDIA Corporation" - C:\Programme\NVIDIA Corporation\nView\nwiz.exe /installquiet
"Start WingMan Profiler" - "Logitech Inc." - C:\Programme\Logitech\Gaming Software\LWEMon.exe /noui
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"
"zBrowser Launcher" - "Logitech Inc." - C:\Programme\Logitech\iTouch\iTouch.exe

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"Adobe PDF Port" - "Adobe Systems Incorporated." - C:\WINDOWS\system32\AdobePDF.dll
"Microsoft Document Imaging Writer Monitor" - "Microsoft Corporation" - C:\WINDOWS\system32\mdimon.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"Adobe LM Service" (Adobe LM Service) - "Adobe Systems" - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
"ASP.NET-Zustandsdienst" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
"Cisco Systems, Inc. VPN Service" (CVPND) - "Cisco Systems, Inc." - C:\Programme\Cisco Systems\VPN Client\cvpnd.exe
"EPSON Printer Status Agent2" (EPSONStatusAgent2) - "SEIKO EPSON CORPORATION" - C:\Programme\Gemeinsame Dateien\EPSON\EBAPI\SAgent2.exe
"Google Software Updater" (gusvc) - "Google" - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe
"Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jqs.exe
"Lavasoft Ad-Aware Service" (Lavasoft Ad-Aware Service) - "Lavasoft" - C:\Programme\Lavasoft\Ad-Aware\AAWService.exe
"LiveUpdate" (LiveUpdate) - "Symantec Corporation" - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
"Macromedia Licensing Service" (Macromedia Licensing Service) - ? - C:\Programme\Gemeinsame Dateien\Macromedia Shared\Service\Macromedia Licensing.exe
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"NMSAccess" (NMSAccess) - ? - C:\Programme\CDBurnerXP\NMSAccessU.exe  (File found, but it contains no detailed information)
"Norton Ghost" (Norton Ghost) - "Symantec Corporation" - C:\Programme\Norton Ghost\Agent\VProSvc.exe
"NVIDIA Display Driver Service" (nvsvc) - "NVIDIA Corporation" - C:\WINDOWS\system32\nvsvc32.exe
"O&O Defrag" (O&O Defrag) - "O&O Software GmbH" - C:\WINDOWS\system32\oodag.exe
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE
"PnkBstrA" (PnkBstrA) - ? - C:\WINDOWS\system32\PnkBstrA.exe  (File found, but it contains no detailed information)
"Remote Packet Capture Protocol v.0 (experimental)" (rpcapd) - "CACE Technologies, Inc." - C:\Programme\WinPcap\rpcapd.exe
"SymSnapService" (SymSnapService) - "Symantec" - C:\Programme\Norton Ghost\Shared\Drivers\SymSnapService.exe
"TuneUp Designerweiterung" (UxTuneUp) - "TuneUp Software" - C:\WINDOWS\System32\uxtuneup.dll
"TuneUp Drive Defrag-Dienst" (TuneUp.Defrag) - "TuneUp Software" - C:\WINDOWS\System32\TuneUpDefragService.exe
"TuneUp Program Statistics Service" (TuneUp.ProgramStatisticsSvc) - "TuneUp Software" - C:\WINDOWS\System32\TUProgSt.exe
"Windows CardSpace" (idsvc) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
"Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
"Windows Presentation Foundation Font Cache 4.0.0.0" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

[Winlogon]
-----( HKCU\Control Panel\IOProcs )-----
"MVB" - ? - mvfs32.dll  (File not found)
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----
"WgaLogon" - "Microsoft Corporation" - C:\WINDOWS\system32\WgaLogon.dll

===[ Logfile end ]=========================================[ Logfile end ]===

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru
         
MBRCheck-Log:
Code:
ATTFilter
MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:			
Windows Version:		Windows XP Professional
Windows Information:		Service Pack 3 (build 2600)
Logical Drives Mask:		0x0202ffe4

Kernel Drivers (total 143):
  0x804D7000 \WINDOWS\system32\ntoskrnl.exe
  0x80701000 \WINDOWS\system32\hal.dll
  0xF7987000 \WINDOWS\system32\KDCOM.DLL
  0xF7897000 \WINDOWS\system32\BOOTVID.dll
  0xF74D5000 spsc.sys
  0xF7989000 \WINDOWS\System32\Drivers\WMILIB.SYS
  0xF74BD000 \WINDOWS\System32\Drivers\SCSIPORT.SYS
  0xF748E000 ACPI.sys
  0xF747D000 pci.sys
  0xF75F7000 ohci1394.sys
  0xF7607000 \WINDOWS\system32\DRIVERS\1394BUS.SYS
  0xF7617000 isapnp.sys
  0xF7A4F000 pciide.sys
  0xF7707000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
  0xF7627000 MountMgr.sys
  0xF7858000 ftdisk.sys
  0xF798B000 dmload.sys
  0xF7832000 dmio.sys
  0xF770F000 PartMgr.sys
  0xF7717000 hotcore3.sys
  0xF7637000 VolSnap.sys
  0xF796F000 atapi.sys
  0xF7647000 disk.sys
  0xF7657000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
  0xB87E0000 fltmgr.sys
  0xB87CE000 sr.sys
  0xF7667000 Lbd.sys
  0xF789B000 OODrvled.sys
  0xB870E000 symsnap.sys
  0xB86F7000 KSecDD.sys
  0xB866A000 Ntfs.sys
  0xB863D000 NDIS.sys
  0xF7677000 sbp2port.sys
  0xB8623000 Mup.sys
  0xF76D7000 \SystemRoot\system32\DRIVERS\nic1394.sys
  0xB8155000 \SystemRoot\system32\DRIVERS\intelppm.sys
  0xB6B27000 \SystemRoot\system32\DRIVERS\nv4_mini.sys
  0xB6B13000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
  0xB6AEB000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
  0xB6AD6000 \SystemRoot\system32\DRIVERS\Rtenicxp.sys
  0xB7C9E000 \SystemRoot\system32\DRIVERS\usbuhci.sys
  0xB6AB2000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
  0xB7C96000 \SystemRoot\system32\DRIVERS\usbehci.sys
  0xB8145000 \SystemRoot\system32\DRIVERS\serial.sys
  0xB83A3000 \SystemRoot\system32\DRIVERS\serenum.sys
  0xB6A9E000 \SystemRoot\system32\DRIVERS\parport.sys
  0xB8135000 \SystemRoot\system32\DRIVERS\i8042prt.sys
  0xB839F000 \SystemRoot\system32\DRIVERS\itchfltr.sys
  0xF7767000 \SystemRoot\system32\DRIVERS\kbdclass.sys
  0xF776F000 \SystemRoot\system32\DRIVERS\mouclass.sys
  0xB6A85000 \SystemRoot\System32\Drivers\AnyDVD.sys
  0xB8125000 \SystemRoot\system32\DRIVERS\cdrom.sys
  0xB8115000 \SystemRoot\system32\DRIVERS\redbook.sys
  0xB6A62000 \SystemRoot\system32\DRIVERS\ks.sys
  0xB839B000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
  0xB8105000 \SystemRoot\system32\DRIVERS\imapi.sys
  0xB6A06000 \SystemRoot\System32\Drivers\aytdyfp0.SYS
  0xF77DF000 \SystemRoot\System32\Drivers\Modem.SYS
  0xB69E7000 \SystemRoot\system32\DRIVERS\dne2000.sys
  0xF7AC0000 \SystemRoot\system32\DRIVERS\audstub.sys
  0xB80F5000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
  0xB7BD6000 \SystemRoot\system32\DRIVERS\ndistapi.sys
  0xB69D0000 \SystemRoot\system32\DRIVERS\ndiswan.sys
  0xB80E5000 \SystemRoot\system32\DRIVERS\raspppoe.sys
  0xB80D5000 \SystemRoot\system32\DRIVERS\raspptp.sys
  0xF77E7000 \SystemRoot\system32\DRIVERS\TDI.SYS
  0xB69BF000 \SystemRoot\system32\DRIVERS\psched.sys
  0xB80C5000 \SystemRoot\system32\DRIVERS\msgpc.sys
  0xF77EF000 \SystemRoot\system32\DRIVERS\ptilink.sys
  0xF77F7000 \SystemRoot\system32\DRIVERS\raspti.sys
  0xB693F000 \SystemRoot\system32\DRIVERS\rdpdr.sys
  0xB7DFC000 \SystemRoot\system32\DRIVERS\termdd.sys
  0xF79D5000 \SystemRoot\system32\DRIVERS\swenum.sys
  0xB68E1000 \SystemRoot\system32\DRIVERS\update.sys
  0xF794B000 \SystemRoot\system32\DRIVERS\mssmbios.sys
  0xB85FB000 \SystemRoot\system32\drivers\WmBEnum.sys
  0xB7DEC000 \SystemRoot\system32\drivers\WmXlCore.sys
  0xB7DDC000 \SystemRoot\System32\Drivers\NDProxy.SYS
  0xB4356000 \SystemRoot\system32\drivers\RtkHDAud.sys
  0xB4332000 \SystemRoot\system32\drivers\portcls.sys
  0xB7DBC000 \SystemRoot\system32\drivers\drmk.sys
  0xB7DAC000 \SystemRoot\system32\DRIVERS\usbhub.sys
  0xF79DD000 \SystemRoot\system32\DRIVERS\USBD.SYS
  0xF79DF000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
  0xF7A88000 \SystemRoot\System32\Drivers\Null.SYS
  0xF79E1000 \SystemRoot\System32\Drivers\Beep.SYS
  0xF781F000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
  0xF7737000 \SystemRoot\System32\drivers\vga.sys
  0xF79E3000 \SystemRoot\System32\Drivers\mnmdd.SYS
  0xF79E5000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
  0xF7777000 \SystemRoot\System32\Drivers\Msfs.SYS
  0xB7CDE000 \SystemRoot\System32\Drivers\Npfs.SYS
  0xB7BE2000 \SystemRoot\system32\DRIVERS\rasacd.sys
  0xB42AF000 \SystemRoot\system32\DRIVERS\ipsec.sys
  0xB4256000 \SystemRoot\system32\DRIVERS\tcpip.sys
  0xB422E000 \SystemRoot\system32\DRIVERS\netbt.sys
  0xB4208000 \SystemRoot\system32\DRIVERS\ipnat.sys
  0xB7D9C000 \SystemRoot\system32\DRIVERS\wanarp.sys
  0xB41E6000 \SystemRoot\System32\drivers\afd.sys
  0xB7D8C000 \SystemRoot\system32\DRIVERS\netbios.sys
  0xB7CD6000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
  0xB7D7C000 \SystemRoot\system32\DRIVERS\arp1394.sys
  0xB41BB000 \SystemRoot\system32\DRIVERS\rdbss.sys
  0xB4123000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
  0xB7D6C000 \SystemRoot\System32\Drivers\Fips.SYS
  0xF76C7000 \SystemRoot\System32\Drivers\ElbyCDIO.sys
  0xB40FD000 \SystemRoot\system32\DRIVERS\avipbb.sys
  0xF79E9000 \??\C:\Programme\Avira\AntiVir Desktop\avgio.sys
  0xF76F7000 \SystemRoot\System32\Drivers\Cdfs.SYS
  0xB4326000 \SystemRoot\system32\DRIVERS\usbscan.sys
  0xB7CCE000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
  0xB7CC6000 \SystemRoot\system32\DRIVERS\usbprint.sys
  0xB406D000 \SystemRoot\System32\Drivers\dump_atapi.sys
  0xF79ED000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
  0xBF800000 \SystemRoot\System32\win32k.sys
  0xB431A000 \SystemRoot\System32\drivers\Dxapi.sys
  0xB7CBE000 \SystemRoot\System32\watchdog.sys
  0xBD000000 \SystemRoot\System32\drivers\dxg.sys
  0xB85AB000 \SystemRoot\System32\drivers\dxgthk.sys
  0xBD012000 \SystemRoot\System32\nv4_disp.dll
  0xBD623000 \SystemRoot\System32\ATMFD.DLL
  0xB33D6000 \SystemRoot\system32\DRIVERS\avgntflt.sys
  0xB3298000 \SystemRoot\System32\Drivers\CAPI20.SYS
  0xB33EF000 \SystemRoot\system32\DRIVERS\ndisuio.sys
  0xB2FDB000 \SystemRoot\system32\drivers\wdmaud.sys
  0xB31C8000 \SystemRoot\system32\drivers\sysaudio.sys
  0xB2E87000 \SystemRoot\system32\drivers\WmVirHid.sys
  0xB2DCB000 \SystemRoot\system32\drivers\HIDCLASS.SYS
  0xB2E7F000 \SystemRoot\system32\DRIVERS\kbdhid.sys
  0xB2E7B000 \SystemRoot\system32\DRIVERS\mouhid.sys
  0xB2B76000 \SystemRoot\system32\DRIVERS\mrxdav.sys
  0xF77B7000 \SystemRoot\System32\drivers\BrPar.sys
  0xB30D8000 \SystemRoot\System32\drivers\detewecp.sys
  0xF79AB000 \SystemRoot\System32\Drivers\ParVdm.SYS
  0xB2ABE000 \??\C:\WINDOWS\system32\Drivers\CVPNDRVA.sys
  0xB294E000 \SystemRoot\system32\DRIVERS\srv.sys
  0xB2C53000 \SystemRoot\system32\drivers\npf.sys
  0xB40BD000 \SystemRoot\system32\DRIVERS\v2imount.sys
  0xB2280000 \SystemRoot\System32\Drivers\HTTP.sys
  0xB2178000 \??\C:\WINDOWS\system32\drivers\VProEventMonitor.sys
  0xABB93000 \??\C:\DOKUME~1\***\LOKALE~1\Temp\uwwdypog.sys
  0xABB68000 \SystemRoot\system32\drivers\kmixer.sys
  0x7C910000 \WINDOWS\system32\ntdll.dll

Processes (total 48):
       0 System Idle Process
       4 System
     988 C:\WINDOWS\system32\smss.exe
    1252 csrss.exe
    1352 C:\WINDOWS\system32\winlogon.exe
    1420 C:\WINDOWS\system32\services.exe
    1432 C:\WINDOWS\system32\lsass.exe
    1644 C:\WINDOWS\system32\nvsvc32.exe
    1704 C:\WINDOWS\system32\svchost.exe
    1792 svchost.exe
    1952 C:\WINDOWS\system32\svchost.exe
     244 svchost.exe
     332 svchost.exe
     712 C:\WINDOWS\system32\BRSVC01A.EXE
     816 C:\WINDOWS\system32\BRSS01A.EXE
     824 C:\WINDOWS\system32\spoolsv.exe
    1216 C:\WINDOWS\explorer.exe
    1380 C:\Programme\Logitech\iTouch\iTouch.exe
    1388 C:\WINDOWS\RTHDCPL.exe
    1396 C:\Programme\Logitech\Gaming Software\LWEMon.exe
    1504 C:\WINDOWS\system32\rundll32.exe
    1664 C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
    1728 C:\Programme\Microsoft ActiveSync\wcescomm.exe
    1872 C:\PROGRA~1\MICROS~3\rapimgr.exe
    1944 svchost.exe
     148 C:\Programme\Cisco Systems\VPN Client\cvpnd.exe
     320 C:\Programme\Gemeinsame Dateien\EPSON\EBAPI\SAgent2.exe
     772 C:\Programme\Java\jre6\bin\jqs.exe
     920 C:\Programme\CDBurnerXP\NMSAccessU.exe
    1852 C:\Programme\Norton Ghost\Agent\VProSvc.exe
    2220 C:\WINDOWS\system32\oodag.exe
    2248 C:\WINDOWS\system32\PnkBstrA.exe
    2288 C:\WINDOWS\system32\svchost.exe
    2408 C:\WINDOWS\system32\dllhost.exe
    2464 C:\WINDOWS\system32\TUProgSt.exe
    3492 C:\WINDOWS\system32\wscntfy.exe
    3732 C:\WINDOWS\system32\dllhost.exe
    3848 C:\WINDOWS\system32\wbem\wmiapsrv.exe
     660 C:\Programme\Norton Ghost\Shared\Drivers\SymSnapService.exe
    2444 msdtc.exe
     512 alg.exe
    3872 SymDB.exe
    5188 C:\WINDOWS\system32\ctfmon.exe
    3172 C:\Programme\Adobe\Acrobat 7.0\Distillr\acrotray.exe
    2676 C:\WINDOWS\system32\taskmgr.exe
    5068 C:\Programme\Mozilla Firefox\firefox.exe
    4012 C:\Programme\Mozilla Firefox\plugin-container.exe
    1752 C:\Dokumente und Einstellungen\***\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive1 at offset 0x00000000`00007e00  (NTFS)
\\.\M: --> \\.\PhysicalDrive1 at offset 0x0000003f`71fcd000  (NTFS)
\\.\Z: --> \\.\PhysicalDrive0 at offset 0x00000000`007e0000  (NTFS)

PhysicalDrive1 Model Number: SAMSUNGHD753LJ, Rev: 1AA01117
PhysicalDrive0 Model Number: ST3750630AS, Rev: SD2A    

      Size  Device Name          MBR Status
  --------------------------------------------
    698 GB  \\.\PhysicalDrive1   Windows XP MBR code detected
            SHA1: ADFE55CD0C6ED2E00B22375835E4C2736CE9AD11
    698 GB  \\.\PhysicalDrive0   Windows XP MBR code detected
            SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A


Done!
         

Alt 16.04.2011, 12:14   #12
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Trojaner: CleanThis, MS Removal Tool und Windows Restore - Standard

Trojaner: CleanThis, MS Removal Tool und Windows Restore



Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SUPERAntiSpyware und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!
__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Alt 17.04.2011, 09:10   #13
berlyn
 
Trojaner: CleanThis, MS Removal Tool und Windows Restore - Standard

Trojaner: CleanThis, MS Removal Tool und Windows Restore



MBAM-Log:
Code:
ATTFilter
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6360

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

16.04.2011 15:50:54
mbam-log-2011-04-16 (15-50-54).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 361093
Laufzeit: 57 Minute(n), 5 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
         
SASW-Log:
Code:
ATTFilter
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 04/16/2011 at 06:15 PM

Application Version : 4.50.1002

Core Rules Database Version : 6854
Trace Rules Database Version: 4666

Scan type       : Complete Scan
Total Scan Time : 02:14:51

Memory items scanned      : 599
Memory threats detected   : 0
Registry items scanned    : 7614
Registry threats detected : 0
File items scanned        : 356241
File threats detected     : 46

Adware.Tracking Cookie
	C:\Dokumente und Einstellungen\***\Cookies\***@advertising[2].txt
	C:\Dokumente und Einstellungen\***\Cookies\***@bs.serving-sys[1].txt
	C:\Dokumente und Einstellungen\***\Cookies\***@doubleclick[1].txt
	C:\Dokumente und Einstellungen\***\Cookies\***@xiti[1].txt
	C:\Dokumente und Einstellungen\***\Cookies\***@zedo[1].txt
	C:\Dokumente und Einstellungen\***\Cookies\***@ad3.adfarm1.adition[2].txt
	C:\Dokumente und Einstellungen\***\Cookies\***@legolas-media[1].txt
	C:\Dokumente und Einstellungen\***\Cookies\***@www.burstnet[1].txt
	C:\Dokumente und Einstellungen\***\Cookies\***@zanox[2].txt
	C:\Dokumente und Einstellungen\***\Cookies\***@media.etaphotel[2].txt
	C:\Dokumente und Einstellungen\***\Cookies\***@ad4.adfarm1.adition[1].txt
	C:\Dokumente und Einstellungen\***\Cookies\***@ads.creative-serving[2].txt
	C:\Dokumente und Einstellungen\***\Cookies\***@msnportal.112.2o7[1].txt
	C:\Dokumente und Einstellungen\***\Cookies\***@im.banner.t-online[1].txt
	C:\Dokumente und Einstellungen\***\Cookies\***@imrworldwide[2].txt
	C:\Dokumente und Einstellungen\***\Cookies\***@interclick[2].txt
	C:\Dokumente und Einstellungen\***\Cookies\***@de.sitestat[1].txt
	C:\Dokumente und Einstellungen\***\Cookies\***@apmebf[2].txt
	C:\Dokumente und Einstellungen\***\Cookies\***@ads.comicskingdom[1].txt
	C:\Dokumente und Einstellungen\***\Cookies\***@a1.interclick[1].txt
	C:\Dokumente und Einstellungen\***\Cookies\***@realmedia[1].txt
	C:\Dokumente und Einstellungen\***\Cookies\***@tracking.quisma[1].txt
	C:\Dokumente und Einstellungen\***\Cookies\***@tracking.hannoversche[2].txt
	C:\Dokumente und Einstellungen\***\Cookies\***@serving-sys[1].txt
	C:\Dokumente und Einstellungen\***\Cookies\***@traffictrack[1].txt
	C:\Dokumente und Einstellungen\***\Cookies\***@adfarm1.adition[1].txt
	C:\Dokumente und Einstellungen\***\Cookies\***@tacoda.at.atwola[1].txt
	C:\Dokumente und Einstellungen\***\Cookies\***@revsci[1].txt
	C:\Dokumente und Einstellungen\***\Cookies\***@ad.zanox[1].txt
	C:\Dokumente und Einstellungen\***\Cookies\***@www.etracker[2].txt
	C:\Dokumente und Einstellungen\***\Cookies\***@casalemedia[2].txt
	C:\Dokumente und Einstellungen\***\Cookies\***@atdmt[2].txt
	C:\Dokumente und Einstellungen\***\Cookies\***@tradedoubler[2].txt
	C:\Dokumente und Einstellungen\***\Cookies\***@ar.atwola[1].txt
	C:\Dokumente und Einstellungen\***\Cookies\***@de.sitestat[2].txt
	C:\Dokumente und Einstellungen\***\Cookies\***@webmasterplan[2].txt
	C:\Dokumente und Einstellungen\***\Cookies\***@banner.holidaycheck[1].txt
	C:\Dokumente und Einstellungen\***\Cookies\***@ad2.adfarm1.adition[2].txt
	C:\Dokumente und Einstellungen\***\Cookies\***@kingdigital.122.2o7[1].txt
	C:\Dokumente und Einstellungen\***\Cookies\***@invitemedia[1].txt
	C:\Dokumente und Einstellungen\***\Cookies\***@burstnet[2].txt
	C:\Dokumente und Einstellungen\***\Cookies\***@discountfan[2].txt
	C:\Dokumente und Einstellungen\***\Cookies\***@collective-media[2].txt
	C:\Dokumente und Einstellungen\***\Cookies\***@at.atwola[2].txt
	C:\Dokumente und Einstellungen\***\Cookies\***@fastclick[1].txt
	media.etaphotel.com [ C:\Dokumente und Einstellungen\***\Anwendungsdaten\Macromedia\Flash Player\#SharedObjects\RZFWDGVF ]
         

Alt 17.04.2011, 20:31   #14
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Trojaner: CleanThis, MS Removal Tool und Windows Restore - Standard

Trojaner: CleanThis, MS Removal Tool und Windows Restore



Sieht ok aus, da wurden nur Cookies gefunden.
Noch Probleme oder weitere Funde in der Zwischenzeit?
__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Alt 17.04.2011, 20:44   #15
berlyn
 
Trojaner: CleanThis, MS Removal Tool und Windows Restore - Standard

Trojaner: CleanThis, MS Removal Tool und Windows Restore



Vielen Dank für die schnelle Hilfe!
Nein, keine weiteren Probleme, auch keine weiteren Funde in der Zwischenzeit.

Antwort

Themen zu Trojaner: CleanThis, MS Removal Tool und Windows Restore
0x00000001, 0xc0000001, 5 minuten, ad-aware, alternate, avgntflt.sys, avira, bho, cdburnerxp, cleanthis, converter, desktop, disabletaskmgr, error, firefox, flash player, hal.dll, heuristics.reserved.word.exploit, homepage, location, logfile, mozilla, mp3, ms removal tool, oldtimer, otl.exe, realtek, rundll, saver, scan, sched.exe, searchplugins, security, shell32.dll, software, sptd.sys, staropen, studio, symantec, system, tcp, trojaner, trojaner eingefangen, usb, usbport.sys, windows, windows internet, windows restore, wlan



Ähnliche Themen: Trojaner: CleanThis, MS Removal Tool und Windows Restore


  1. KB3035583 GWX Removal Tool - Windows 10 Upgrade verhindern mit einem Klick (by burningice)
    Alles rund um Windows - 20.12.2017 (120)
  2. DHL Mail auf den Link geclickt - Trojaner lässt mich kein removal tool installieren
    Log-Analyse und Auswertung - 09.06.2015 (13)
  3. Ms Removal tool
    Plagegeister aller Art und deren Bekämpfung - 22.05.2011 (1)
  4. MS Removal Tool - dwn.exe + csrss.exe
    Plagegeister aller Art und deren Bekämpfung - 16.05.2011 (11)
  5. 'Microsoft Windows malicious software removal tool' öffnet sich beim Hochfahren
    Plagegeister aller Art und deren Bekämpfung - 04.05.2011 (1)
  6. Befall mit MS Removal Tool
    Log-Analyse und Auswertung - 26.04.2011 (18)
  7. Endgültige Beseitigung von MS Removal Tool
    Log-Analyse und Auswertung - 20.04.2011 (1)
  8. MS Removal Tool auf Vista
    Log-Analyse und Auswertung - 17.04.2011 (19)
  9. Trojaner, Viren und MS Removal Tool etc.
    Antiviren-, Firewall- und andere Schutzprogramme - 16.04.2011 (8)
  10. MS Removal Tool
    Plagegeister aller Art und deren Bekämpfung - 13.04.2011 (23)
  11. Hilfe Riesen-Trojaner? MS Removal Tool
    Plagegeister aller Art und deren Bekämpfung - 03.04.2011 (4)
  12. MS Removal Tool entfernen
    Anleitungen, FAQs & Links - 27.03.2011 (2)
  13. Conficker/ cleanup tool oder removal tool ?
    Plagegeister aller Art und deren Bekämpfung - 23.04.2009 (0)
  14. boot - removal tool
    Plagegeister aller Art und deren Bekämpfung - 31.01.2007 (4)
  15. Microsoft Windows Malicious Software Removal Tool 1.8
    Plagegeister aller Art und deren Bekämpfung - 14.09.2005 (4)
  16. Search the web Trojaner und SpHjfix removal tool
    Log-Analyse und Auswertung - 03.07.2004 (2)

Zum Thema Trojaner: CleanThis, MS Removal Tool und Windows Restore - Liebes Trojaner-Board-Team, ich habe mir in den letzten (vier) Tagen drei verschiedene Trojaner eingefangen: - "CleanThis" (zweimal aufgetreten) - "MS Removal Tool" - "Windows Restore" Die jeweiligen Dateien und Registry-Einträge - Trojaner: CleanThis, MS Removal Tool und Windows Restore...
Archiv
Du betrachtest: Trojaner: CleanThis, MS Removal Tool und Windows Restore auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.