Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: TR/Kazy.mekml.1 durch Antivir entdeckt - OTL bereits durchgeführt !

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.

Antwort
Alt 27.04.2011, 08:34   #1
TBODY
 
TR/Kazy.mekml.1 durch Antivir entdeckt - OTL bereits durchgeführt ! - Böse

TR/Kazy.mekml.1 durch Antivir entdeckt - OTL bereits durchgeführt !



Hallo zusammen,
ich habe den TR/Kazy.mekml.1 auf meinem PC entdeckt´, bin aber Laie und weiß nicht so recht weiter. Aufgrund anderer Beiträge habe ich ein OTL Scan gemacht u. poste 2 Reports anbei. Ich brauchdringend Hilfe, weil ich natürlich meine Daten nicht ordentlich gesichert habe.
Vielen Dank schon mal im Voraus !!!

Report 1

OTL logfile created on: 27.04.2011 07:44:51 - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = J:\
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

511,00 Mb Total Physical Memory | 166,00 Mb Available Physical Memory | 33,00% Memory free
1,00 Gb Paging File | 1,00 Gb Available in Paging File | 75,00% Paging File free
Paging file location(s): c:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 74,49 Gb Total Space | 56,86 Gb Free Space | 76,33% Space Free | Partition Type: NTFS
Drive E: | 232,81 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive J: | 3,96 Gb Total Space | 3,69 Gb Free Space | 93,05% Space Free | Partition Type: FAT32

Computer Name: PCBEYER | User Name: Beyer | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - J:\OTL.exe (OldTimer Tools)
PRC - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\sFGtypQnwU.exe (WinTrust)
PRC - C:\Programme\Cisco Systems\SSL VPN Client\Agent.exe (Cisco Systems, Inc.)
PRC - C:\Programme\AntiVir PersonalEdition Classic\sched.exe (Avira GmbH)
PRC - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe (Avira GmbH)
PRC - C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe (Avira GmbH)
PRC - C:\Programme\Windows NT\Zubehör\wordpad.exe (Microsoft Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe (Zone Labs, LLC)
PRC - C:\WINDOWS\system32\Zonelabs\vsmon.exe (Zone Labs, LLC)
PRC - C:\WINDOWS\system32\FxRedir.exe (Canon Inc)
PRC - C:\Programme\Canon\MultiPASS4\mpservic.exe (Canon Inc)
PRC - C:\Programme\Microsoft Office\Office\WINWORD.EXE (Microsoft Corporation)


========== Modules (SafeList) ==========

MOD - J:\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (STCAgent) -- C:\Programme\Cisco Systems\SSL VPN Client\Agent.exe (Cisco Systems, Inc.)
SRV - (AntiVirScheduler) -- C:\Programme\AntiVir PersonalEdition Classic\sched.exe (Avira GmbH)
SRV - (AntiVirService) -- C:\Programme\AntiVir PersonalEdition Classic\avguard.exe (Avira GmbH)
SRV - (vsmon) -- C:\WINDOWS\System32\Zonelabs\vsmon.exe (Zone Labs, LLC)
SRV - (de_serv) -- C:\Programme\Gemeinsame Dateien\AVM\De_serv.exe (AVM Berlin)
SRV - (MpService) -- C:\Programme\Canon\MultiPASS4\mpservic.exe (Canon Inc)


========== Driver Services (SafeList) ==========

DRV - (CSVirtA) -- C:\WINDOWS\system32\drivers\CSVirtA.sys (Cisco Systems, Inc.)
DRV - (avgntflt) -- C:\Programme\AntiVir PersonalEdition Classic\avgntflt.sys (Avira GmbH)
DRV - (avgio) -- C:\Programme\AntiVir PersonalEdition Classic\avgio.sys (Avira GmbH)
DRV - (gameenum) -- C:\WINDOWS\system32\drivers\gameenum.sys (Microsoft Corporation)
DRV - (HPFXFAX) -- C:\WINDOWS\system32\drivers\hpfxfax.sys (Hewlett Packard)
DRV - (HPFXBULK) -- C:\WINDOWS\system32\drivers\hpfxbulk.sys (Hewlett Packard)
DRV - (vsdatant) -- C:\WINDOWS\system32\vsdatant.sys (Zone Labs, LLC)
DRV - (srescan) -- C:\WINDOWS\system32\ZoneLabs\srescan.sys (Zone Labs, LLC)
DRV - (fpcibase) -- C:\WINDOWS\system32\drivers\fpcibase.sys (AVM Berlin)
DRV - (AVMCOWAN) -- C:\WINDOWS\system32\drivers\avmcowan.sys (AVM GmbH)
DRV - (rtl8139) NT-Treiber für Realtek RTL8139(A/B/C) -- C:\WINDOWS\system32\drivers\rtl8139.sys (Realtek Semiconductor Corporation)
DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (MVDCODEC) -- C:\WINDOWS\system32\drivers\atinmdxx.sys (ATI Technologies Inc.)
DRV - (atinrvxx) -- C:\WINDOWS\system32\drivers\atinrvxx.sys (ATI Technologies Inc.)
DRV - (ATIXSAudio) -- C:\WINDOWS\system32\drivers\atinxsxx.sys (ATI Technologies Inc.)
DRV - (ativraxx) -- C:\WINDOWS\system32\drivers\atinraxx.sys (ATI Technologies Inc.)
DRV - (TTDec) -- C:\WINDOWS\system32\drivers\atinttxx.sys (ATI Technologies Inc.)
DRV - (ATITUNEP) -- C:\WINDOWS\system32\drivers\atintuxx.sys (ATI Technologies Inc.)
DRV - (SiSide) -- C:\WINDOWS\System32\DRIVERS\siside.sys (Silicon Integrated Systems Corp.)
DRV - (ALCXWDM) Service for Avance AC97 Audio (WDM) -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Avance Logic, Inc.)
DRV - (AVMPORT) -- C:\WINDOWS\System32\drivers\avmport.sys (AVM Berlin)
DRV - (SNXPPAL) -- C:\WINDOWS\system32\drivers\snxppal.sys (Thesycon GmbH, Germany)
DRV - (cis1284) -- C:\WINDOWS\system32\drivers\cis1284.sys (Canon)
DRV - (hpt3xx) -- C:\WINDOWS\System32\DRIVERS\hpt3xx.sys (HighPoint Technologies, Inc.)
DRV - (ms_mpu401) -- C:\WINDOWS\system32\drivers\msmpu401.sys (Microsoft Corporation)
DRV - (nv4) -- C:\WINDOWS\system32\drivers\nv4.sys (NVIDIA Corporation)
DRV - (AVMWAN) -- C:\WINDOWS\system32\drivers\avmwan.sys (AVM GmbH)
DRV - (SNXPCARD) -- C:\WINDOWS\system32\drivers\snxpcard.sys (Sunix)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie


IE - HKU\.DEFAULT\..\URLSearchHook: {CE000994-A58C-4441-8938-744CD72AB27F} - Reg Error: Key error. File not found
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\..\URLSearchHook: {CE000994-A58C-4441-8938-744CD72AB27F} - Reg Error: Key error. File not found
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1779672970-4065617495-2210005112-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKU\S-1-5-21-1779672970-4065617495-2210005112-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.mieden.de/
IE - HKU\S-1-5-21-1779672970-4065617495-2210005112-1005\..\URLSearchHook: {7b13ec3e-999a-4b70-b9cb-2617b8323822} - C:\Programme\Zynga\tbZyn0.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-1779672970-4065617495-2210005112-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "hxxp://start.mozilla.org/firefox?client=firefox-a&rls=org.mozilla:de-DEfficial"


[2006.08.31 16:27:23 | 000,000,000 | -H-D | M] (No name found) -- C:\Dokumente und Einstellungen\Beyer\Anwendungsdaten\Mozilla\Firefox\Profiles\flivwk5y.default\extensions
[2006.09.04 15:14:09 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
File not found (No name found) -- C:\PROGRAMME\MOZILLA FIREFOX\EXTENSIONS\TALKBACK@MOZILLA.ORG

O1 HOSTS File: ([2006.09.07 10:08:23 | 000,000,824 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Zynga Toolbar) - {7b13ec3e-999a-4b70-b9cb-2617b8323822} - C:\Programme\Zynga\tbZyn0.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Zynga Toolbar) - {7b13ec3e-999a-4b70-b9cb-2617b8323822} - C:\Programme\Zynga\tbZyn0.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-1779672970-4065617495-2210005112-1005\..\Toolbar\WebBrowser: (Zynga Toolbar) - {7B13EC3E-999A-4B70-B9CB-2617B8323822} - C:\Programme\Zynga\tbZyn0.dll (Conduit Ltd.)
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [fxredir] C:\WINDOWS\system32\FxRedir.exe (Canon Inc)
O4 - HKLM..\Run: [Zone Labs Client] C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe (Zone Labs, LLC)
O4 - HKU\S-1-5-21-1779672970-4065617495-2210005112-1005..\Run: [sFGtypQnwU] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\sFGtypQnwU.exe (WinTrust)
O4 - Startup: C:\Dokumente und Einstellungen\Beyer\Startmenü\Programme\Autostart\FriFax32.exe (AVM Berlin)
O4 - Startup: C:\Dokumente und Einstellungen\Beyer\Startmenü\Programme\Autostart\FRITZ!fon.lnk = C:\Programme\FRITZ!\FriFon32.exe (AVM Berlin)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1779672970-4065617495-2210005112-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1779672970-4065617495-2210005112-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {264AED84-12F1-4CA1-8AA7-EB939AE58D8D} https://194.113.240.10/CACHE/webvpn/stc/1/binaries/stcweb.cab (STCWeb Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab (Java Plug-in 1.5.0_09)
O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab (Java Plug-in 1.5.0_10)
O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab (Java Plug-in 1.5.0_11)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Java Plug-in 1.6.0_01)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {F57D17AE-CE37-4BC8-B232-EA57747BE5E7} hxxp://66.230.146.53/EPlugin_DE2.cab (Reg Error: Key error.)
O18 - Protocol\Handler\cetihpz {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Programme\HP\hpcoretech\comp\hpuiprot.dll (Hewlett-Packard Company)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll ()
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Beyer\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Beyer\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2002.01.30 13:13:25 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found


SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vds - Service
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: nm - Service
SafeBootNet: nm.sys - Driver
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: UploadMgr - Service
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 11.0.3
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 11.0.3
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015C} - Microsoft DirectX
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\System32\Rundll32.exe C:\WINDOWS\System32\mscories.dll,Install
ActiveX: {8b15971b-5355-4c82-8c07-7e181ea07608} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\fxsocm.inf,Fax.Install.PerUser
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {94de52c8-2d59-4f1b-883e-79663d2d9a8c} - Fax Provider
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E78BFA60-5393-4C38-82AB-E8019E464EB4} - .NET Framework
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {eddbec60-89cb-44ef-8291-0850fd28ff6a} - Q832894
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.ffds - C:\WINDOWS\System32\ffdshow.ax ()
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.SP55 - SP5X_32.DLL File not found
Drivers32: VIDC.SP56 - SP5X_32.DLL File not found
Drivers32: VIDC.SP57 - SP5X_32.DLL File not found
Drivers32: VIDC.SP58 - SP5X_32.DLL File not found
Drivers32: VIDC.VP40 - C:\WINDOWS\System32\vp4vfw.dll (On2.com)
Drivers32: wave1 - C:\WINDOWS\System32\serwvdrv.dll (Microsoft Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902109354000384)

========== Files/Folders - Created Within 30 Days ==========

[2011.04.27 07:45:30 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\Beyer\Recent
[2011.04.26 15:34:32 | 000,000,000 | -H-D | C] -- C:\Dokumente und Einstellungen\Beyer\Startmenü\Programme\Windows Recovery
[2011.04.26 14:58:48 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Adobe
[2011.04.26 14:01:05 | 000,569,344 | ---- | C] (WinTrust) -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\sFGtypQnwU.exe
[2011.04.13 07:10:15 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\HP
[2004.11.24 21:25:50 | 000,335,872 | ---- | C] ( ) -- C:\WINDOWS\System32\drvc.dll
[2002.10.29 12:39:49 | 001,432,836 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\v90drv.sys
[2002.10.29 12:39:49 | 000,175,160 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\slnthal.sys
[10 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\Dokumente und Einstellungen\Beyer\Desktop\*.tmp files -> C:\Dokumente und Einstellungen\Beyer\Desktop\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011.04.27 07:40:37 | 000,048,882 | -H-- | M] () -- C:\WINDOWS\System32\vsconfig.xml
[2011.04.27 07:39:08 | 000,001,374 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011.04.27 07:38:48 | 000,000,256 | ---- | M] () -- C:\WINDOWS\tasks\Adressbuch.job
[2011.04.27 07:38:40 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011.04.27 07:18:20 | 000,000,128 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\~18079540
[2011.04.27 07:14:11 | 000,487,424 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\18079540.exe
[2011.04.26 15:44:31 | 000,000,392 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\18079540
[2011.04.26 15:40:43 | 000,000,831 | -H-- | M] () -- C:\Dokumente und Einstellungen\Beyer\Desktop\Windows Recovery.lnk
[2011.04.26 15:37:04 | 000,000,144 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\~18079540r
[2011.04.26 14:01:15 | 000,003,688 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011.04.26 14:01:01 | 000,569,344 | ---- | M] (WinTrust) -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\sFGtypQnwU.exe
[2011.04.20 12:23:26 | 000,002,257 | -H-- | M] () -- C:\Dokumente und Einstellungen\Beyer\Desktop\A&B für Windows.lnk
[2011.04.14 09:07:09 | 000,002,513 | -H-- | M] () -- C:\Dokumente und Einstellungen\Beyer\Desktop\Microsoft Excel.lnk
[2011.04.05 13:48:36 | 000,002,477 | -H-- | M] () -- C:\Dokumente und Einstellungen\Beyer\Desktop\Microsoft Word.lnk
[2011.04.01 15:21:50 | 000,158,571 | -H-- | M] () -- C:\Dokumente und Einstellungen\Beyer\Eigene Dateien\GEHODUR-S3__2-41.pdf
[10 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\Dokumente und Einstellungen\Beyer\Desktop\*.tmp files -> C:\Dokumente und Einstellungen\Beyer\Desktop\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011.04.27 07:14:10 | 000,487,424 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\18079540.exe
[2011.04.26 15:40:43 | 000,000,831 | -H-- | C] () -- C:\Dokumente und Einstellungen\Beyer\Desktop\Windows Recovery.lnk
[2011.04.26 15:37:04 | 000,000,144 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\~18079540r
[2011.04.26 15:37:04 | 000,000,128 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\~18079540
[2011.04.26 15:34:19 | 000,000,392 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\18079540
[2011.04.01 15:21:50 | 000,158,571 | -H-- | C] () -- C:\Dokumente und Einstellungen\Beyer\Eigene Dateien\GEHODUR-S3__2-41.pdf
[2011.01.24 13:55:11 | 000,199,532 | ---- | C] () -- C:\WINDOWS\hppins12.dat
[2011.01.24 13:55:11 | 000,007,855 | ---- | C] () -- C:\WINDOWS\hppmdl12.dat
[2011.01.24 13:47:08 | 000,000,608 | -HS- | C] () -- C:\WINDOWS\System32\winzvprt5.sys
[2011.01.24 13:33:36 | 000,000,665 | R--- | C] () -- C:\WINDOWS\System32\hppapr12.dat
[2008.08.11 15:47:25 | 000,003,688 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2007.10.20 08:22:55 | 000,442,368 | ---- | C] () -- C:\WINDOWS\System32\dvmsg.dll
[2006.09.08 13:38:18 | 000,004,212 | -H-- | C] () -- C:\WINDOWS\System32\zllictbl.dat
[2006.09.08 13:38:01 | 000,796,584 | ---- | C] () -- C:\WINDOWS\System32\libeay32_0.9.6l.dll
[2006.09.06 07:33:47 | 000,000,305 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\addr_file.html
[2006.09.04 15:14:03 | 000,000,167 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2006.03.07 09:02:02 | 000,038,879 | ---- | C] () -- C:\WINDOWS\hpomdl03.dat
[2006.03.07 09:02:02 | 000,029,575 | ---- | C] () -- C:\WINDOWS\hpoins03.dat
[2006.03.07 09:00:48 | 000,565,248 | R--- | C] () -- C:\WINDOWS\System32\hpotscl.dll
[2006.03.07 08:55:18 | 000,038,879 | ---- | C] () -- C:\WINDOWS\hpomdl03.dat.temp
[2006.03.07 08:55:18 | 000,029,575 | ---- | C] () -- C:\WINDOWS\hpoins03.dat.temp
[2005.09.06 12:13:45 | 000,000,000 | ---- | C] () -- C:\WINDOWS\asym.ini
[2005.08.23 12:51:51 | 000,000,138 | -H-- | C] () -- C:\Dokumente und Einstellungen\Beyer\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2005.08.23 12:28:20 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2005.04.06 11:34:03 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2005.04.06 11:33:46 | 000,004,125 | ---- | C] () -- C:\WINDOWS\mozver.dat
[2005.02.25 08:03:58 | 000,000,258 | ---- | C] () -- C:\WINDOWS\EDTSPLUS.INI
[2004.11.11 16:55:32 | 000,061,440 | R--- | C] () -- C:\WINDOWS\scrub2k.exe
[2004.11.11 16:55:32 | 000,000,104 | R--- | C] () -- C:\WINDOWS\hpw1100k.ini
[2004.11.11 16:54:04 | 000,002,462 | ---- | C] () -- C:\WINDOWS\hpbj1100.ini
[2004.10.12 08:40:56 | 002,255,360 | ---- | C] () -- C:\WINDOWS\System32\libavcodec.dll
[2004.10.12 08:39:47 | 000,028,160 | ---- | C] () -- C:\WINDOWS\System32\ff_wmv9.dll
[2004.10.12 08:39:06 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\ff_theora.dll
[2004.10.09 08:40:16 | 000,454,144 | ---- | C] () -- C:\WINDOWS\System32\ff_x264.dll
[2004.10.05 10:16:07 | 000,395,776 | ---- | C] () -- C:\WINDOWS\System32\libmplayer.dll
[2004.10.03 19:50:53 | 000,129,024 | ---- | C] () -- C:\WINDOWS\System32\ff_mpeg2enc.dll
[2004.10.01 13:20:57 | 000,000,052 | ---- | C] () -- C:\WINDOWS\Pex.INI
[2004.10.01 13:17:04 | 000,000,625 | ---- | C] () -- C:\WINDOWS\Ulead32.ini
[2004.08.02 14:20:40 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2003.12.12 10:42:14 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\ati2evxx.dll
[2003.12.12 10:40:50 | 000,397,312 | ---- | C] () -- C:\WINDOWS\System32\ati2evxx.exe
[2003.08.06 11:09:10 | 000,045,056 | --S- | C] () -- C:\WINDOWS\NDNuninstall5_20.exe
[2003.06.23 09:05:15 | 000,001,012 | ---- | C] () -- C:\Programme\EXP_KALK.KLK
[2003.06.23 09:05:15 | 000,000,080 | ---- | C] () -- C:\Programme\Export.NFO
[2003.04.10 10:33:05 | 000,000,148 | ---- | C] () -- C:\WINDOWS\bau_vor4.ini
[2003.03.25 14:52:42 | 000,000,062 | ---- | C] () -- C:\WINDOWS\WISO.INI
[2003.03.25 14:27:11 | 000,000,221 | ---- | C] () -- C:\WINDOWS\BUHL.INI
[2003.03.25 11:32:04 | 000,000,022 | ---- | C] () -- C:\WINDOWS\INTUSB.DAT
[2003.03.25 11:30:57 | 000,001,828 | ---- | C] () -- C:\WINDOWS\QUICKEN.INI
[2003.03.25 11:30:57 | 000,000,185 | ---- | C] () -- C:\WINDOWS\Intuprof.ini
[2002.12.06 14:03:20 | 000,004,029 | ---- | C] () -- C:\WINDOWS\cb.ini
[2002.12.04 11:54:31 | 000,000,000 | ---- | C] () -- C:\Programme\Export.LVZ
[2002.12.02 16:30:06 | 000,072,192 | -H-- | C] () -- C:\Dokumente und Einstellungen\Beyer\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2002.12.02 10:43:02 | 000,284,160 | ---- | C] () -- C:\WINDOWS\unin0407.exe
[2002.11.25 15:17:32 | 000,020,900 | ---- | C] () -- C:\WINDOWS\System32\MpUpMon.dll
[2002.11.25 15:10:49 | 000,000,033 | ---- | C] () -- C:\WINDOWS\MPC600F.INI
[2002.11.25 14:06:48 | 000,000,078 | ---- | C] () -- C:\WINDOWS\psuite.ini
[2002.11.16 10:36:47 | 000,000,403 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2002.11.16 10:16:20 | 000,000,000 | ---- | C] () -- C:\WINDOWS\distlib.ini
[2002.10.29 14:26:15 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2002.10.29 12:39:49 | 000,425,984 | ---- | C] () -- C:\WINDOWS\sllights.exe
[2002.10.29 12:39:49 | 000,322,948 | ---- | C] () -- C:\WINDOWS\System32\drivers\slntamr.sys
[2002.10.29 12:39:49 | 000,151,552 | ---- | C] () -- C:\WINDOWS\System32\amr_cpl.dll
[2002.10.29 12:39:49 | 000,073,728 | ---- | C] () -- C:\WINDOWS\smcfg.exe
[2002.10.28 11:00:10 | 000,389,352 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2002.10.28 11:00:10 | 000,378,532 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2002.10.28 11:00:10 | 000,063,788 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2002.10.28 11:00:10 | 000,052,706 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2002.10.28 11:00:09 | 000,000,680 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2002.10.28 11:00:04 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2002.10.28 10:59:46 | 000,173,080 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2002.10.28 10:59:46 | 000,003,776 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2002.10.28 10:59:45 | 000,023,504 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2002.10.28 10:55:42 | 000,004,348 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2002.10.28 10:55:42 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2002.10.28 10:55:42 | 000,000,849 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2001.09.25 11:41:26 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2001.09.25 11:40:24 | 000,004,486 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2001.08.18 15:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2001.08.18 15:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2001.08.18 15:00:00 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2001.08.18 15:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2001.08.18 15:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2001.08.18 15:00:00 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2001.08.18 15:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2001.08.18 15:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[1999.04.30 00:00:00 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\MSRTEDIT.DLL

========== LOP Check ==========

[2011.04.27 06:30:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic
[2005.12.14 08:47:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Canon
[2006.09.05 09:14:58 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Dpi
[2009.03.11 16:41:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software
[2009.03.11 16:40:40 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{55A29068-F2CE-456C-9148-C869879E2357}
[2002.10.29 12:56:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\InterTrust
[2005.09.06 12:29:11 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Beyer\Anwendungsdaten\FileMaker
[2010.12.21 15:21:50 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Beyer\Anwendungsdaten\FRITZ!
[2002.10.29 12:56:34 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Beyer\Anwendungsdaten\InterTrust
[2007.01.31 16:36:53 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Beyer\Anwendungsdaten\Leadertech
[2008.01.07 17:00:16 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Beyer\Anwendungsdaten\Tobit
[2009.03.11 16:42:05 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Beyer\Anwendungsdaten\TuneUp Software
[2011.04.27 07:38:48 | 000,000,256 | ---- | M] () -- C:\WINDOWS\Tasks\Adressbuch.job

========== Purity Check ==========



========== Custom Scans ==========


< %ALLUSERSPROFILE%\Application Data\*. >

< %ALLUSERSPROFILE%\Application Data\*.exe /s >

< %APPDATA%\*. >
[2010.06.12 12:51:49 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Beyer\Anwendungsdaten\Adobe
[2007.01.04 08:13:09 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Beyer\Anwendungsdaten\AdobeUM
[2005.09.06 12:29:11 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Beyer\Anwendungsdaten\FileMaker
[2010.12.21 15:21:50 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Beyer\Anwendungsdaten\FRITZ!
[2007.07.02 14:44:30 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Beyer\Anwendungsdaten\Google
[2002.10.29 12:46:23 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Beyer\Anwendungsdaten\Help
[2002.10.28 10:55:24 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Beyer\Anwendungsdaten\Identities
[2002.10.29 12:56:34 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Beyer\Anwendungsdaten\InterTrust
[2007.01.31 16:36:53 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Beyer\Anwendungsdaten\Leadertech
[2008.01.07 16:39:27 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Beyer\Anwendungsdaten\Macromedia
[2005.08.23 12:57:01 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\Beyer\Anwendungsdaten\Microsoft
[2002.11.16 10:34:28 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Beyer\Anwendungsdaten\Microsoft Web Folders
[2005.04.06 11:34:03 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Beyer\Anwendungsdaten\Mozilla
[2004.08.30 13:01:52 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Beyer\Anwendungsdaten\MSN6
[2006.08.31 15:53:28 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Beyer\Anwendungsdaten\Sun
[2006.08.31 16:27:25 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Beyer\Anwendungsdaten\Talkback
[2008.01.07 17:00:16 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Beyer\Anwendungsdaten\Tobit
[2009.03.11 16:42:05 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Beyer\Anwendungsdaten\TuneUp Software
[2007.12.04 16:16:41 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Beyer\Anwendungsdaten\WinRAR

< %APPDATA%\*.exe /s >
[2009.12.21 17:43:13 | 001,956,072 | -H-- | M] (Adobe Systems Incorporated) -- C:\Dokumente und Einstellungen\Beyer\Anwendungsdaten\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe
[2002.12.03 14:00:53 | 000,001,078 | RH-- | M] () -- C:\Dokumente und Einstellungen\Beyer\Anwendungsdaten\Microsoft\Installer\{38316E99-1901-4A48-8F84-424961244064}\_3d634f61.exe
[2007.07.02 14:44:07 | 000,026,694 | RH-- | M] () -- C:\Dokumente und Einstellungen\Beyer\Anwendungsdaten\Microsoft\Installer\{407B9B5C-DAC5-4F44-A756-B57CAB4E6A8B}\ARPPRODUCTICON.exe
[2007.07.02 14:44:07 | 000,026,694 | RH-- | M] () -- C:\Dokumente und Einstellungen\Beyer\Anwendungsdaten\Microsoft\Installer\{407B9B5C-DAC5-4F44-A756-B57CAB4E6A8B}\googleearth.exe1_407B9B5CDAC54F44A756B57CAB4E6A8B.exe
[2007.07.02 14:44:07 | 000,026,694 | RH-- | M] () -- C:\Dokumente und Einstellungen\Beyer\Anwendungsdaten\Microsoft\Installer\{407B9B5C-DAC5-4F44-A756-B57CAB4E6A8B}\googleearth.exe_407B9B5CDAC54F44A756B57CAB4E6A8B.exe
[2007.07.02 14:44:07 | 000,026,694 | RH-- | M] () -- C:\Dokumente und Einstellungen\Beyer\Anwendungsdaten\Microsoft\Installer\{407B9B5C-DAC5-4F44-A756-B57CAB4E6A8B}\UNINST_Uninstall_G_3DE5E7D47B88403CA3FD2017A8240C5B.exe

< %SYSTEMDRIVE%\*.exe >


< MD5 for: AGP440.SYS >
[2004.08.04 01:10:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2008.11.14 15:39:27 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2004.08.04 01:10:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:AGP440.sys
[2008.11.14 15:39:27 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys
[2004.08.03 23:07:42 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\i386\AGP440.SYS

< MD5 for: ATAPI.SYS >
[2004.08.04 01:10:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2008.11.14 15:39:27 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2004.08.04 01:10:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:atapi.sys
[2008.11.14 15:39:27 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2008.04.14 04:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008.04.14 04:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll

< MD5 for: EXPLORER.EXE >
[2007.06.13 15:10:08 | 001,036,288 | ---- | M] (Microsoft Corporation) MD5=331ED93570BAF3CFE30340298762CD56 -- C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
[2008.04.14 04:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\explorer.exe
[2008.04.14 04:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe

< MD5 for: NETLOGON.DLL >
[2008.04.14 04:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008.04.14 04:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll

< MD5 for: SCECLI.DLL >
[2008.04.14 04:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008.04.14 04:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll

< MD5 for: USER32.DLL >
[2005.03.02 20:19:56 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=4C90159A69A5FD3EB39C71411F28FCFF -- C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll
[2007.03.08 17:48:39 | 000,579,584 | ---- | M] (Microsoft Corporation) MD5=78785EFF8CB90CEC1862A4CCFD9A3C3A -- C:\WINDOWS\$hf_mig$\KB925902\SP2QFE\user32.dll
[2008.04.14 04:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\ServicePackFiles\i386\user32.dll
[2008.04.14 04:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll

< MD5 for: USERINIT.EXE >
[2008.04.14 04:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008.04.14 04:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe

< MD5 for: WINLOGON.EXE >
[2008.04.14 04:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008.04.14 04:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe

< MD5 for: WS2IFSL.SYS >
[2001.08.18 15:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys
[2001.08.18 15:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2005.12.14 09:25:47 | 000,524,288 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2005.12.14 08:19:16 | 000,262,144 | ---- | M] () -- C:\WINDOWS\system32\config\security.sav
[2005.12.14 09:25:47 | 020,447,232 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2005.12.14 09:25:49 | 007,077,888 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

========== Files - Unicode (All) ==========
[2009.03.16 07:27:05 | 000,000,173 | ---- | M] ()(C:\WINDOWS\??AVSCAN-20090316-062705-078716F1.avp) -- C:\WINDOWS\媰ɎAVSCAN-20090316-062705-078716F1.avp
[2009.03.16 07:27:05 | 000,000,173 | ---- | C] ()(C:\WINDOWS\??AVSCAN-20090316-062705-078716F1.avp) -- C:\WINDOWS\媰ɎAVSCAN-20090316-062705-078716F1.avp

< End of report >



Report 2

OTL Extras logfile created on: 27.04.2011 07:44:51 - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = J:\
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

511,00 Mb Total Physical Memory | 166,00 Mb Available Physical Memory | 33,00% Memory free
1,00 Gb Paging File | 1,00 Gb Available in Paging File | 75,00% Paging File free
Paging file location(s): c:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 74,49 Gb Total Space | 56,86 Gb Free Space | 76,33% Space Free | Partition Type: NTFS
Drive E: | 232,81 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive J: | 3,96 Gb Total Space | 3,69 Gb Free Space | 93,05% Space Free | Partition Type: FAT32

Computer Name: PCBEYER | User Name: Beyer | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Programme\Microsoft Office\Office\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Programme\Microsoft Office\Office\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring" = 1

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\tuloxFreeWBE\FreeDict.exe" = C:\Programme\tuloxFreeWBE\FreeDict.exe:*:Enabled:tulox-Wörterbuch -- (GEKKO Software GmbH)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00000407-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Premium
"{0BEDBD4E-2D34-47B5-9973-57E62B29307C}" = ATI Control Panel
"{0FABD3D7-3036-4e78-B29D-58957ADB0A12}" = HP PSC & OfficeJet 3.5
"{1F7473D9-6C0B-4F5A-8FA4-AB8AD78CBE54}" = DocProc
"{242B9150-74EC-4606-AAB1-2F0C719378D7}" = hp business inkjet 1100
"{24C8FBF7-26C6-48ca-834B-A4E5C09E362F}" = AiO_Scan
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 11
"{29B50D30-EAFC-4cea-9F76-3A0E3729E9B0}" = SkinsHP1
"{300D9EF4-2721-4cb4-A6C3-FB2337CFEA2D}" = AIOMinimal
"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6
"{3248F0A8-6813-11D6-A77B-00B0D0150090}" = J2SE Runtime Environment 5.0 Update 9
"{3248F0A8-6813-11D6-A77B-00B0D0150100}" = J2SE Runtime Environment 5.0 Update 10
"{3248F0A8-6813-11D6-A77B-00B0D0150110}" = J2SE Runtime Environment 5.0 Update 11
"{3248F0A8-6813-11D6-A77B-00B0D0160010}" = Java(TM) SE Runtime Environment 6 Update 1
"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java(TM) 6 Update 2
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java(TM) 6 Update 3
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java(TM) 6 Update 5
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{34957B51-9676-41CE-9E52-44AE91B73F1C}" = HP Software Update
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{38316E99-1901-4A48-8F84-424961244064}" = AuB für Windows
"{3CF78481-FB7B-4B51-99A2-D5E0CD0B3AAF}" = HPSystemDiagnostics
"{407B9B5C-DAC5-4F44-A756-B57CAB4E6A8B}" = Google Earth
"{48242276-DB89-42e8-9678-BD4280D7B99A}" = Copy
"{4BDFD2CE-6329-42E4-9801-9B3D1F10D79B}" = Adobe® Photoshop® Album Starter Edition 3.0
"{52A69E11-7CEB-4a7d-9607-68BA4F39A89B}" = DeviceDiscovery
"{57C7C46A-D35D-492d-A328-4F8C9B5B4B52}" = PrintScreen
"{5ACE69F0-A3E8-44eb-88C1-0A841E700180}" = TrayApp
"{62F79C52-E264-44ab-ABC2-7BEA2962C70D}" = 5500Trb
"{63F2408D-A675-4d97-A256-70EACB6B9B4A}" = AiOSoftware
"{66AED2E9-E9E3-4894-B656-FD552800551F}" = hppManualsCM2320
"{687FEF8A-8597-40b4-832C-297EA3F35817}" = BufferChm
"{6D4E56A1-22EE-44d8-BD14-7B9FB7F80D1B}" = 5500_Help
"{70B136AF-D9EC-4462-9F40-E733017A7568}" = Vorlagenmanager für die Sicherheitsfachkraft
"{723C033E-63EA-4227-BAB2-0AA8693C16EB}" = Director
"{73C23496-A105-4b6f-B8F0-22523DFE4E4E}" = 5500
"{745A92AF-53B4-41A7-91C3-9B026B1D5897}" = InstantShare
"{75A79BA0-4317-4CE6-924C-B0B3175EBEF9}" = hppscanCM2320
"{766273C1-A39B-47EB-ACE8-DEBDD8094BCC}" = overland
"{80533B67-C407-485D-8B5D-63BB8ED9D878}" = Scan
"{8777AC6D-89F9-4793-8266-DE406F343E89}" = QFolder
"{8A508AAA-3B69-4326-B89E-A6166FA05D3C}" = Canon MultiPASS Suite 4.00
"{90510407-6D54-11D4-BEE3-00C04F990354}" = Microsoft Visio Professional 2002 [DEU]
"{995F2783-8311-49BF-833E-DB659774B4F6}" = hppFonts
"{99EE30D2-A7EA-486C-9AD4-57C8583375BF}" = hppSendFaxCM2320
"{9B03C535-3AEA-4ef2-B326-0A01A2207034}" = CreativeProjects
"{9DE3F260-B88E-42CE-90E7-73C78C37D95E}" = 32 Bit HP BiDi Channel Components Installer
"{A2500497-FD32-493e-B8E5-28D6728DBEF5}" = Readme
"{A4D7B764-4140-11D4-88EB-0050DA3579C0}" = Nero
"{AA7D2DB9-9E45-406F-8ECD-4B5FFB0A4250}" = Microsoft Visio Viewer 2002
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC76BA86-7AD7-1031-7B44-A82000000003}" = Adobe Reader 8.2.6 - Deutsch
"{AF226123-1A6F-4ec1-8DEF-E35E7A0D0127}" = Fax
"{B226235F-51A4-4090-B5DB-5482A28D1B0F}" = hppFaxDrvCM2320
"{BC339BFD-F550-471a-8D26-4D08126C62F7}" = SkinsHP2
"{BF0C558D-BB2C-4819-88E1-1921D2BA7E00}" = hppCLJCM2320
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CBE3E0AF-73BB-4c21-8B96-B09E003EDE7F}" = QuickProjects
"{CCB9B81A-167F-4832-B305-D2A0430840B3}" = WebReg
"{CDBFDD5B-50E0-4021-94AF-516B80509ABE}" = 5500Tour
"{D186329B-1B4D-408D-ABEC-EA5CE1F182C9}" = Overland
"{D1901237-60AE-4659-8A07-073588714967}" = hppScanToCM2320
"{D99A8E3A-AE5A-4692-8B19-6F16D454E240}" = Destination Component
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{E8BFBD0A-8002-4dc9-869C-E495FA9DCE7A}" = PhotoGallery
"{ECF3E482-9188-4e29-9C31-E02FD8DC74C0}" = HP Color LaserJet CM2320 MFP Series 3.0
"{EF94DF68-3144-4503-8F11-D022D2176E32}" = hppFaxUtilityCM2320
"{f9ab2228-3312-4a73-b6f9-936d70e112ef}.sdb" = Microsoft Driver Compatibility Database
"{FF841249-0D6B-41D7-8013-953EE3A33263}" = hppQFolderCM2320
"ABC Amber Audio Converter" = ABC Amber Audio Converter
"Adobe Acrobat 4.0" = Adobe Acrobat 4.0
"Adobe Acrobat 5.0" = Adobe Acrobat 5.0
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"AntiVir PersonalEdition Classic" = Avira AntiVir Personal - Free Antivirus
"ATI Display Driver" = ATI Display Driver
"AVM ISDN CAPI Port" = AVM ISDN CAPI Port
"Cisco Systems SSL VPN Client" = Cisco SSL VPN Client
"EVEREST Home Edition_is1" = EVEREST Home Edition v2.20
"FRITZ! 2.0" = AVM FRITZ!
"Großer Reiseplaner" = Großer Reiseplaner
"HP Imaging Device Functions" = HP Imaging Device Functions 10.0
"HP Photo & Imaging" = HP Image Zone 3.5
"ie8" = Windows Internet Explorer 8
"MGI_PHOTOSUITE_V806" = MGI PhotoSuite 8.1 (nur entfernen)
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"PgTools" = PgTools
"Satsuki Decoder Pack" = Satsuki Decoder Pack
"SIKA® TechnoBau-CD 2003" = SIKA® TechnoBau-CD 2003
"WinRAR archiver" = WinRAR archiver
"WISO Investmentfonds1.01" = WISO Investmentfonds
"ZoneAlarm" = ZoneAlarm
"Zynga Toolbar" = Zynga Toolbar

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 26.04.2011 03:38:06 | Computer Name = PCBEYER | Source = STCAgent | ID = 50331649
Description = Function: DeleteRoute Return code: 0xFE060007 File: e:\temp\build\workspace\SSLClient\Agent\ChangeRouteTable.cpp
Line:
759 Description: ROUTETABLE_ERROR_DELETEIPFORWARDENTRY_FAILED

Error - 26.04.2011 03:38:06 | Computer Name = PCBEYER | Source = STCAgent | ID = 50331649
Description = Function: DeleteRoute Return code: 0xFE060007 File: e:\temp\build\workspace\SSLClient\Agent\ChangeRouteTable.cpp
Line:
759 Description: ROUTETABLE_ERROR_DELETEIPFORWARDENTRY_FAILED

Error - 26.04.2011 03:38:06 | Computer Name = PCBEYER | Source = STCAgent | ID = 50331649
Description = Function: DeleteRoute Return code: 0xFE060007 File: e:\temp\build\workspace\SSLClient\Agent\ChangeRouteTable.cpp
Line:
759 Description: ROUTETABLE_ERROR_DELETEIPFORWARDENTRY_FAILED

Error - 26.04.2011 03:38:06 | Computer Name = PCBEYER | Source = STCAgent | ID = 50331649
Description = Function: AddRoute Return code: 0xFE060006 File: e:\temp\build\workspace\SSLClient\Agent\ChangeRouteTable.cpp
Line:
258 Description: ROUTETABLE_ERROR_CREATEIPFORWARDENTRY_FAILED

Error - 26.04.2011 08:43:17 | Computer Name = PCBEYER | Source = STCAgent | ID = 50331650
Description = Termination reason code 10 [FAST_USER_SWITCH]

Error - 26.04.2011 08:48:55 | Computer Name = PCBEYER | Source = STCAgent | ID = 50331650
Description = Termination reason code 10 [FAST_USER_SWITCH]

Error - 26.04.2011 09:33:57 | Computer Name = PCBEYER | Source = STCAgent | ID = 50331650
Description = Termination reason code 10 [FAST_USER_SWITCH]

Error - 27.04.2011 00:28:00 | Computer Name = PCBEYER | Source = STCAgent | ID = 50331650
Description = Termination reason code 10 [FAST_USER_SWITCH]

Error - 27.04.2011 01:13:58 | Computer Name = PCBEYER | Source = STCAgent | ID = 50331650
Description = Termination reason code 10 [FAST_USER_SWITCH]

Error - 27.04.2011 01:39:00 | Computer Name = PCBEYER | Source = STCAgent | ID = 50331650
Description = Termination reason code 10 [FAST_USER_SWITCH]

[ System Events ]
Error - 27.04.2011 00:28:11 | Computer Name = PCBEYER | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Microsoft Legacy Modem Driver" wurde aufgrund folgenden
Fehlers nicht gestartet: %%1058

Error - 27.04.2011 00:29:49 | Computer Name = PCBEYER | Source = Service Control Manager | ID = 7022
Description = Der Dienst "HP CUE DeviceDiscovery Service" wurde nicht ordnungsgemäß
gestartet.

Error - 27.04.2011 01:14:01 | Computer Name = PCBEYER | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Icatch(IV) Video Camera Device" wurde aufgrund folgenden
Fehlers nicht gestartet: %%2

Error - 27.04.2011 01:14:01 | Computer Name = PCBEYER | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Microsoft Legacy Modem Driver" wurde aufgrund folgenden
Fehlers nicht gestartet: %%1058

Error - 27.04.2011 01:15:37 | Computer Name = PCBEYER | Source = Service Control Manager | ID = 7022
Description = Der Dienst "HP CUE DeviceDiscovery Service" wurde nicht ordnungsgemäß
gestartet.

Error - 27.04.2011 01:16:32 | Computer Name = PCBEYER | Source = Service Control Manager | ID = 7009
Description = Zeitüberschreitung (30000 ms) beim Verbindungsversuch mit Dienst IMAPI-CD-Brenn-COM-Dienste.

Error - 27.04.2011 01:16:32 | Computer Name = PCBEYER | Source = Service Control Manager | ID = 7000
Description = Der Dienst "IMAPI-CD-Brenn-COM-Dienste" wurde aufgrund folgenden Fehlers
nicht gestartet: %%1053

Error - 27.04.2011 01:38:51 | Computer Name = PCBEYER | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Icatch(IV) Video Camera Device" wurde aufgrund folgenden
Fehlers nicht gestartet: %%2

Error - 27.04.2011 01:38:51 | Computer Name = PCBEYER | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Microsoft Legacy Modem Driver" wurde aufgrund folgenden
Fehlers nicht gestartet: %%1058

Error - 27.04.2011 01:40:22 | Computer Name = PCBEYER | Source = Service Control Manager | ID = 7022
Description = Der Dienst "HP CUE DeviceDiscovery Service" wurde nicht ordnungsgemäß
gestartet.


< End of report >

Alt 27.04.2011, 09:36   #2
markusg
/// Malware-holic
 
TR/Kazy.mekml.1 durch Antivir entdeckt - OTL bereits durchgeführt ! - Standard

TR/Kazy.mekml.1 durch Antivir entdeckt - OTL bereits durchgeführt !



warum ist avira veraltet, version 10 ist aktuell, du hast version 8
machen wir später.

• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.

:OTL
PRC - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\sFGtypQnwU.exe (WinTrust)
O4 - HKU\S-1-5-21-1779672970-4065617495-2210005112-1005..\Run: [sFGtypQnwU] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\sFGtypQnwU.exe (WinTrust)
[2011.04.26 15:34:32 | 000,000,000 | -H-D | C] -- C:\Dokumente und Einstellungen\Beyer\Startmenü\Programme\Windows Recovery
[2011.04.27 07:18:20 | 000,000,128 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\~18079540
[2011.04.27 07:14:11 | 000,487,424 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\18079540.exe
[2011.04.26 15:44:31 | 000,000,392 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\18079540
[2011.04.26 15:40:43 | 000,000,831 | -H-- | M] () -- C:\Dokumente und Einstellungen\Beyer\Desktop\Windows Recovery.lnk
[2011.04.26 15:37:04 | 000,000,144 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\~18079540r

:Files
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\sFGtypQnwU.exe

:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.

lade unhide:
http://www.trojaner-board.de/54791-a...ner-board.html
__________________

__________________

Antwort

Themen zu TR/Kazy.mekml.1 durch Antivir entdeckt - OTL bereits durchgeführt !
.dll, 0x00000001, 32 bit, 4d36e972-e325-11ce-bfc1-08002be10318, adobe, antivir, avgntflt.sys, avira, besitzer, bho, bin aber laie, c:\windows\system32\rundll32.exe, conduit, converter, desktop, disabletaskmgr, einstellungen, entfernen, error, explorer, failed, firefox, format, hewlett packard, location, logfile, object, officejet, oldtimer, otl scan, realtek, registry, rundll, saver, scan, sched.exe, security, security update, software, tcp, tr/kazy.mekml.1, udp, windows internet



Ähnliche Themen: TR/Kazy.mekml.1 durch Antivir entdeckt - OTL bereits durchgeführt !


  1. TR/kazy.mekml.1 - OTL durchgeführt, wie gehts weiter
    Log-Analyse und Auswertung - 01.06.2011 (30)
  2. TR/Kazy.mekml.1,Schwierigkeiten mit Load.exe, Malwarebytes durchgeführt
    Log-Analyse und Auswertung - 18.05.2011 (35)
  3. TR/Kazy.mekml.1 aus einer email eingefangen, obwohl Antivir nix festgestellt hat
    Log-Analyse und Auswertung - 13.05.2011 (32)
  4. AntiVir Fund: TR/Kazy.mekml.1
    Log-Analyse und Auswertung - 10.05.2011 (19)
  5. Antivir findet TR/Kazy.mekml.1, Scans bereits durchgeführt
    Log-Analyse und Auswertung - 02.05.2011 (22)
  6. Festplatte beschädigt. Private Daten sind in Gefahr. AntiVir Fund: TR/Kazy.mekml.1
    Plagegeister aller Art und deren Bekämpfung - 01.05.2011 (16)
  7. Windows Recovery? TR/Kazy.mekml.1 eingefangen laut AntiVir!
    Log-Analyse und Auswertung - 30.04.2011 (6)
  8. AntiVir meldet TR/Kazy.mekml.1, OTLogfile
    Log-Analyse und Auswertung - 29.04.2011 (10)
  9. TR/Kazy.mekml.1 gefunden, OTL Scan durchgeführt
    Log-Analyse und Auswertung - 28.04.2011 (1)
  10. TR/Kazy.mekml.1 gefunden, OTL Scan bereits durchgeführt
    Plagegeister aller Art und deren Bekämpfung - 28.04.2011 (1)
  11. Avira Antivir findet TR/Kazy.mekml.1
    Log-Analyse und Auswertung - 27.04.2011 (4)
  12. Probleme durch TR/Kazy.mekml.1
    Log-Analyse und Auswertung - 26.04.2011 (12)
  13. Antivir findet TR/Kazy.mekml.1
    Log-Analyse und Auswertung - 21.04.2011 (10)
  14. Antivir zeigt TR/Kazy.mekml.1 als Trojaner an
    Log-Analyse und Auswertung - 21.04.2011 (12)
  15. Trojaner TR/kazy.mekml.1 (laut AntiVir) ?
    Log-Analyse und Auswertung - 21.04.2011 (20)
  16. Trojaner TR/Kazy.mekml.1 - OTL txt.files bereits erstellt
    Plagegeister aller Art und deren Bekämpfung - 21.04.2011 (39)
  17. Probleme nach Benutzung von Malwarebytes, Antivir-Fund: TR/Kazy.mekml.1
    Plagegeister aller Art und deren Bekämpfung - 20.04.2011 (25)

Zum Thema TR/Kazy.mekml.1 durch Antivir entdeckt - OTL bereits durchgeführt ! - Hallo zusammen, ich habe den TR/Kazy.mekml.1 auf meinem PC entdeckt´, bin aber Laie und weiß nicht so recht weiter. Aufgrund anderer Beiträge habe ich ein OTL Scan gemacht u. poste - TR/Kazy.mekml.1 durch Antivir entdeckt - OTL bereits durchgeführt !...
Archiv
Du betrachtest: TR/Kazy.mekml.1 durch Antivir entdeckt - OTL bereits durchgeführt ! auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.