Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Weiterleitung nach google Suche + amazon Daten ausgepäht (https://www.trojaner-board.de/111365-weiterleitung-google-suche-amazon-daten-ausgepaeht.html)

motzerrobo 13.03.2012 01:20
Weiterleitung nach google Suche + amazon Daten ausgepäht
 
Hallo Trojaner-board,

vor zwei Wochen wurde ich Opfer eines Angriffs, welcher meine Einloggdaten für meinen amazon Account als "Beute" zur Folge hatte. Amazon hat zum Glück den 900€ Geschenkgutschein der Nachts um 3:00 Uhr gekauft wurde storniert und mein Konto gesperrt. In direkte Verbindung mit meinem System habe ich es nicht gebracht, da keinerlei Anzeichen oder ungewöhnliches im Vorfeld aufgetreten ist. Seit dieser Woche jedoch werde ich zu dubiosen Seiten weitergeleitet, wenn ich die goolge-Suche verwende. Ich habe dazu schon einige Themen hier gefunden und nachgelesen - deshalb habe ich jetzt einen Malware Full Scan gemacht und diese Logfile (siehe Anhang) wurde erzeugt. Dazu habe ich mit dem CC-Cleaner temporäre Files gelöscht und die Registry gecleant. Antivir findet seit heute schon 11 Mal "HTML-Scriptvirus HTML/Infected.WebPage.Gen2" und zusätzlich einmal "TR/Spy.Gen" . Da habe ich mir wohl was eingefangen....

Code:
Malwarebytes Anti-Malware 1.60.1.1000
www.malwarebytes.org

Datenbank Version: v2012.03.12.06

Windows 7 x86 NTFS
Internet Explorer 9.0.8112.16421
motzer :: STEEL [Administrator]

12.03.2012 21:40:32
mbam-log-2012-03-12 (21-40-32).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 642911
Laufzeit: 2 Stunde(n), 2 Minute(n), 10 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 1
C:\Windows\System32\NETw5x32.dll (RootKit.0Access.H) -> Löschen bei Neustart.

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|{91419E33-D9AC-2F4F-9DDB-0A31B337FF79} (Trojan.ZbotR.Gen) -> Daten: C:\Users\motzer\AppData\Roaming\Ihuw\ecnoni.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 3
C:\Windows\System32\NETw5x32.dll (RootKit.0Access.H) -> Löschen bei Neustart.
C:\Windows\System32\drivers\cdrom.sys (Trojan.Patched) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\motzer\AppData\Roaming\Ihuw\ecnoni.exe (Trojan.ZbotR.Gen) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
Der Rechner wird privat benutzt ich bin Student, Online Banking nutze ich täglich. Heute natürlich noch nicht, möchte jedoch wieder ruhigen gewissens das System und Onlinedienste nutzen können.

Bitte um Hilfe

Mit freundlichen Grüßen
motzer

Psychotic 13.03.2012 08:35
:hallo:

Mein Name ist Marius und ich werde dir bei deinem Problem helfen.

Eines vorneweg:

Hinweis: Wir können hier nie dafür garantieren, dass wir sämtliche Reste von Schadsoftware gefunden haben. Eine Formatierung ist meist der schnellere und immer der sicherste Weg.

Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass du clean bist.

Eine Bereinigung ist mitunter mit viel Arbeit für dich verbunden.
  • Bitte arbeite alle Schritte der Reihe nach ab.
  • Lese die Anleitungen sorgfältig. Solltest du irgendwo nicht weiterkommen, stoppe an diesem Punkt und beschreibe dein Problem hier!
  • Nur Scans durchführen, zu denen du von einem Helfer aufgefordert wirst.
  • Bitte kein Crossposting ( posten in mehreren Foren) - wenn du die anweisungen mehrere Helfer ausführst, kann das schwere Probleme nach sich ziehen!.
  • Installiere oder Deinstalliere während der Bereinigung keine Software (ausser, du wurdest dazu aufgefordert).
  • Wenn etwas unklar ist: Frage, bevor du etwas "blind" machst!
  • Poste die Logfiles direkt in deinen Thread. Nicht anhängen, außer, ich fordere dich dazu auf. Erschwert mir nämlich das Auswerten.


Vista und Win7 User
Alle Tools mit Rechtsklick "als Administrator ausführen" starten.



Schritt 1: Online-Banking sperren!


Da dein Rechner offensichtlich Schadsoftware enthält, welche Anmeldedaten abgreift:

Rufe die Sperrhotline 116 116 an und lasse das online banking sicherheitshalber sperren - sofort!





Schritt 2: FRST


Downloade dir bitte Farbar's Recovery Scan Tool und speichere diese auf einen USB Stick. Schließe den USB Stick an das infizierte System an Du musst das System nun in die System Reparatur Option booten. Über den Boot Manager
  • Starte den Rechner neu auf.
  • Während dem Hochfahren drücke mehrmals die F8 Taste
  • Wähle nun Computer reparieren.
  • Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".
Mit Windows CD/DVD
  • Lege die Windows CD in dein Laufwerk.
  • Starte den Rechner neu auf und starte von der CD
  • Wähle die Spracheinstellungen und klicke "Weiter".
  • Klicke auf Computerreparaturoptionen !!
  • Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".
Wähle in den Reparaturoptionen Eingabeaufforderung
  • Gib nun bitte notepad ein und drücke Enter.
  • Im öffnenden Textdokument --> Datei --> Speichern unter und wähle Computer Hier wird dir der Laufwerksbuchstabe deines USB Sticks angezeigt.
  • Schließe Notepad wieder
  • Gib nun bitte folgenden Befehl ein. e:\frst.exe Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks. Gegebenfalls anpassen.
  • Akzeptiere den Disclaimer mit Yes und klicke Scan
Das Tool erstellt eine FRST.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

motzerrobo 13.03.2012 22:11
Hallo Marius,

danke für die schnellen Hinweise. War etwas stressig eine Windows CD zu bekommen, hatte die Uni Version damals vom USB Stick installiert. Habe daher versuch vorhin per VPN ins Uni Netz zu gelangen hat aber nicht funktioniert auch mit verschiedenen Clients nicht, obs am Netz oder an meinem System lag weiß ich leider nicht. Habe dann letztendlich doch eine System CD bekommen.
Was mir noch aufgefallen ist die CD Laufwerke waren nicht mehr im Arbeitsplatz vorhanden, habe über den Gerätemanager nachgeschaut, Treiber sollen defekt gewesen sein. Habe sie entfernt und neu installiert - funktionierte danach um die Windows CD brennen zu können.

Lange rede kurzer Sinn hier der Log

Code:
Scan result of Farbar Recovery Scan Tool (FRST written by farbar) Version: 11-03-2012
Ran by SYSTEM at 13-03-2012 21:58:50
Running from L:\
Windows 7 Professional  Service Pack 1 (X86) OS Language: German Standard
The current controlset is ControlSet001

========================== Registry (Whitelisted) =============

HKLM\...\Run: [AVMWlanClient] C:\Program Files\avmwlanstick\wlangui.exe [2105344 2010-10-22] (AVM Berlin)
HKLM\...\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min [281768 2011-03-28] (Avira GmbH)
HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [843712 2012-01-03] (Adobe Systems Incorporated)
HKLM\...\Run: []  [x]
HKLM\...\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" [36760 2012-01-03] (Adobe Systems Incorporated)
HKLM\...\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [815512 2012-01-03] (Adobe Systems Inc.)
HKLM\...\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [98304 2009-11-18] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [BCSSync] "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices [91520 2010-03-13] (Microsoft Corporation)
HKLM\...\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" [254696 2011-06-09] (Sun Microsystems, Inc.)
HKLM\...\Run: [NI Update Service] "C:\Program Files\National Instruments\Shared\Update Service\NIUpdateService.exe" -startupTask [3002976 2011-06-07] (National Instruments)
HKLM\...\Run: [SunServer] C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunserver.exe [290816 2005-11-11] (Sunbelt Software)
HKU\motzer\...\Run: [NIRegistrationWizard] C:\Program Files\National Instruments\Shared\RegistrationWizard\Bin\RegistrationWizard.exe -autoDiscover 1 -displayIfNoneFound 0 -displayRegisterOptions 1 -sleepIfNoneFound 0 -locale 1031 [846520 2010-06-21] ()
HKU\motzer\...\Run: [{91419E33-D9AC-2F4F-9DDB-0A31B337FF79}] C:\Users\motzer\AppData\Roaming\Ihuw\ecnoni.exe [x]
Winlogon\Notify\lkapoer:
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

================================ Services (Whitelisted) ==================

2 AMD External Events Utility; C:\Windows\System32\atiesrxx.exe [172032 2009-11-18] (AMD)
2 AntiVirSchedulerService; "C:\Program Files\Avira\AntiVir Desktop\sched.exe" [136360 2011-03-28] (Avira GmbH)
2 AntiVirService; "C:\Program Files\Avira\AntiVir Desktop\avguard.exe" [269480 2011-07-04] (Avira GmbH)
2 ASDR; C:\Windows\System32\ASDR.exe [61440 2009-07-27] ()
2 ATKFUSService; C:\Windows\system32\ATKFUSService.exe [61952 2009-12-01] (ASUSTeK COMPUTER INC.)
2 AVM WLAN Connection Service; C:\Program Files\avmwlanstick\WlanNetService.exe [376832 2010-10-22] (AVM Berlin)
3 FLEXnet Licensing Service; "C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe" [1044816 2011-10-10] (Flexera Software, Inc.)
2 LkCitadelServer; C:\Windows\system32\lkcitdl.exe [695136 2010-10-27] (National Instruments, Inc.)
2 lkClassAds; C:\Windows\system32\lkads.exe [46192 2011-06-14] (National Instruments Corporation)
2 lkTimeSync; C:\Windows\system32\lktsrv.exe [56952 2011-06-14] (National Instruments Corporation)
3 Microsoft SharePoint Workspace Audit Service; "C:\Program Files\Microsoft Office\Office14\GROOVE.EXE" /auditservice [31125880 2011-06-12] (Microsoft Corporation)
2 mitsijm2012; "C:\Program Files\Autodesk\Inventor 2012\Moldflow\bin\mitsijm.exe" [580416 2011-08-03] (Autodesk, Inc.)
2 mxssvr; "C:\Program Files\National Instruments\MAX\nimxs.exe" [12696 2011-06-14] (National Instruments Corporation)
4 NetMsmqActivator; "C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe" -NetMsmqActivator [124240 2010-03-18] (Microsoft Corporation)
4 NetPipeActivator; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [124240 2010-03-18] (Microsoft Corporation)
4 NetTcpActivator; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [124240 2010-03-18] (Microsoft Corporation)
4 NetTcpPortSharing; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [124240 2010-03-18] (Microsoft Corporation)
2 NIApplicationWebServer; "C:\Program Files\National Instruments\Shared\NI WebServer\ApplicationWebServer.exe" -user [50336 2011-05-27] (National Instruments Corporation)
2 NIDomainService; "C:\Program Files\National Instruments\Shared\Security\nidmsrv.exe" [362104 2011-06-14] (National Instruments Corporation)
3 NILM License Manager; "C:\Program Files\National Instruments\Shared\License Manager\Bin\lmgrd.exe" [1427688 2010-08-02] (Macrovision Corporation)
2 nimDNSResponder; "C:\Program Files\National Instruments\Shared\mDNS Responder\nimdnsResponder.exe" [194224 2011-06-01] (National Instruments Corporation)
2 NINetworkDiscovery; "C:\Program Files\National Instruments\Shared\NI Network Discovery\niDiscSvc.exe" [121032 2011-06-10] (National Instruments Corporation)
2 niSvcLoc; "C:\Program Files\National Instruments\Shared\NI WebServer\SystemWebServer.exe" -system [50328 2011-11-17] (National Instruments Corporation)
2 NITaggerService; "C:\Program Files\National Instruments\Shared\Tagger\tagsrv.exe" [676016 2011-06-14] (National Instruments Corporation)
3 OpcEnum; C:\Windows\system32\OpcEnum.exe [98304 2009-06-03] (OPC Foundation)
3 StorSvc; C:\Windows\System32\storsvc.dll [16384 2009-07-14] (Microsoft Corporation)
2 vpnagent; "C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe" [435152 2011-03-23] (Cisco Systems, Inc.)
2 ntservice1; C:\Windows\System32\NETw5x32.dll [x]

========================== Drivers (Whitelisted) =============

3 acsock; C:\Windows\System32\DRIVERS\acsock.sys [77968 2011-03-23] (Cisco Systems, Inc.)
3 asusgsb; C:\Windows\System32\drivers\asusgsb.sys [15232 2009-02-17] (ASUSTeK Computer Inc.)
3 atikmdag; C:\Windows\System32\DRIVERS\atikmdag.sys [5140480 2009-11-18] (ATI Technologies Inc.)
3 atkdisplf; C:\Windows\System32\drivers\ATKDispLowFilter.sys [30976 2009-02-17] (ASUSTeK Computer Inc.)
2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [66616 2011-07-04] (Avira GmbH)
1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [138192 2011-07-04] (Avira GmbH)
3 avmeject; C:\Windows\System32\drivers\avmeject.sys [4352 2010-10-22] (AVM Berlin)
2 cvintdrv; C:\Windows\System32\Drivers\cvintdrv.sys [19552 2011-11-04] ()
3 CVirtA; C:\Windows\System32\DRIVERS\CVirtA.sys [5275 2007-01-18] (Cisco Systems, Inc.)
2 DgiVecp; \??\C:\Windows\system32\Drivers\DgiVecp.sys [38400 2009-03-02] (Samsung Electronics Co., Ltd.)
3 dg_ssudbus; C:\Windows\System32\DRIVERS\ssudbus.sys [77624 2011-07-20] (DEVGURU Co., LTD.(www.devguru.co.kr))
4 DNE; C:\Windows\System32\DRIVERS\dne2000.sys [131984 2008-11-16] (Deterministic Networks, Inc.)
1 EIO; C:\Windows\System32\DRIVERS\EIO.sys [14336 2011-07-27] (ASUSTeK Computer Inc.)
3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [265088 2010-10-22] (AVM GmbH)
3 fwlanusbn; C:\Windows\System32\DRIVERS\fwlanusbn.sys [586752 2010-10-22] (AVM GmbH)
3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.)
0 hotcore3; C:\Windows\System32\DRIVERS\hotcore3.sys [57112 2011-01-21] (Paragon Software Group)
3 Netaapl; C:\Windows\System32\DRIVERS\netaapl.sys [18432 2011-05-10] (Apple Inc.)
3 nipalfwedl; C:\Windows\System32\drivers\nipalfwedl.sys [11968 2011-06-29] (National Instruments Corporation)
0 NIPALK; C:\Windows\System32\drivers\nipalk.sys [584856 2011-06-29] (National Instruments Corporation)
3 nipalusbedl; C:\Windows\System32\drivers\nipalusbedl.sys [11968 2011-06-29] (National Instruments Corporation)
0 nipbcfk; C:\Windows\System32\drivers\nipbcfk.sys [15448 2010-03-24] (National Instruments Corporation)
0 PrecSim; C:\Windows\System32\DRIVERS\precsim.sys [69600 2002-05-22] (Engelmann GmbH)
3 Ser2pl; C:\Windows\System32\DRIVERS\ser2pl.sys [77824 2008-10-27] (Prolific Technology Inc.)
3 silabenm; C:\Windows\System32\DRIVERS\silabenm.sys [17920 2009-10-08] (Silicon Laboratories, Inc.)
3 silabser; C:\Windows\System32\DRIVERS\silabser.sys [63488 2009-10-08] (Silicon Laboratories)
0 sptd; C:\Windows\System32\Drivers\sptd.sys [722416 2011-08-16] (Duplex Secure Ltd.)
1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2010-06-17] (Avira GmbH)
2 SSPORT; \??\C:\Windows\system32\Drivers\SSPORT.sys [5120 2009-03-02] (Samsung Electronics)
3 ssudmdm; C:\Windows\System32\DRIVERS\ssudmdm.sys [181432 2011-07-20] (DEVGURU Co., LTD.(www.devguru.co.kr))
3 TVicPort; \??\C:\Windows\system32\DRIVERS\TVICPORT.SYS [14544 2005-03-30] (EnTech Taiwan)
1 UimBus; C:\Windows\System32\DRIVERS\UimBus.sys [40824 2011-01-21] (Windows (R) 2000 DDK provider)
1 Uim_IM; C:\Windows\System32\Drivers\Uim_IM.sys [381032 2011-01-21] (Paragon)
1 vflt; C:\Windows\System32\DRIVERS\vfilter.sys [17920 2010-09-02] (Shrew Soft Inc)
3 vnet; C:\Windows\System32\DRIVERS\virtualnet.sys [13824 2010-09-02] (Shrew Soft Inc)
3 vpnva; C:\Windows\System32\DRIVERS\vpnva.sys [19680 2011-03-23] (Cisco Systems, Inc.)
3 VSPerfDrv100; \??\C:\Program Files\Microsoft Visual Studio 10.0\Team Tools\Performance Tools\VSPerfDrv100.sys [48128 2009-12-08] (Microsoft Corporation)
3 WinDriver6; C:\Windows\System32\drivers\windrvr6.sys [195968 2010-08-31] (Jungo)

========================== NetSvcs (Whitelisted) ===========
NETSVC: rbfilter
NETSVC: SNC
NETSVC: cmuda
NETSVC: ntservice1
NETSVC: mcontrol
NETSVC: vmm

============ One Month Created Files and Folders ==============

2012-03-13 20:36 - 2012-03-13 21:31 - 2509058048 ____A C:\Users\motzer\Desktop\X17-59886.iso
2012-03-13 19:15 - 2012-03-13 20:25 - 0001594 ____A C:\Windows\VPNUnInstall.MIF
2012-03-13 19:12 - 2012-03-13 20:27 - 0000000 ____D C:\Users\motzer\AppData\Local\LogMeIn Hamachi
2012-03-13 19:12 - 2009-03-18 16:35 - 0026176 ___AH (LogMeIn, Inc.) C:\Windows\System32\hamachi.sys
2012-03-13 19:07 - 2012-03-13 20:28 - 0000000 ____D C:\Program Files\ShrewSoft
2012-03-13 19:07 - 2012-03-13 19:07 - 0000000 ____D C:\Users\motzer\Documents\Shrew Soft VPN
2012-03-13 18:30 - 2012-02-15 06:44 - 0826368 ____A (Microsoft Corporation) C:\Windows\System32\rdpcore.dll
2012-03-13 18:30 - 2012-02-15 05:22 - 0177152 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\rdpwd.sys
2012-03-13 18:30 - 2012-02-15 05:22 - 0024064 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tdtcp.sys
2012-03-13 18:30 - 2012-01-25 06:44 - 0129536 ____A (Microsoft Corporation) C:\Windows\System32\rdpcorekmts.dll
2012-03-13 18:30 - 2012-01-25 06:44 - 0057856 ____A (Microsoft Corporation) C:\Windows\System32\rdpwsx.dll
2012-03-13 18:30 - 2012-01-25 06:40 - 0008192 ____A (Microsoft Corporation) C:\Windows\System32\rdrmemptylst.exe
2012-03-13 01:12 - 2012-03-13 01:12 - 0165368 ____A C:\Windows\System32\GDIPFONTCACHEV1.DAT
2012-03-13 01:05 - 2012-03-13 01:46 - 0000000 ____D C:\Windows\System32\Shared Memory
2012-03-13 01:05 - 2012-03-13 01:05 - 0001054 ____A C:\Windows\PFRO.log
2012-03-13 01:03 - 2012-03-13 01:03 - 0003016 ____A C:\Users\motzer\Desktop\mbam-log-2012-03-13 (01-02-56).txt
2012-03-12 22:29 - 2012-03-13 21:54 - 0001400 ____A C:\Windows\setupact.log
2012-03-12 22:29 - 2012-03-12 22:29 - 0000000 ____A C:\Windows\setuperr.log
2012-03-12 22:01 - 2012-03-12 22:01 - 0001187 ____A C:\Users\motzer\Desktop\Troja.txt
2012-03-12 21:38 - 2012-03-12 21:38 - 0388608 ____A (Trend Micro Inc.) C:\Users\motzer\Desktop\HiJackThis204.exe
2012-03-12 21:33 - 2012-03-12 21:33 - 0001071 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2012-03-12 21:33 - 2012-03-12 21:33 - 0000000 ____D C:\Users\motzer\AppData\Roaming\Malwarebytes
2012-03-12 21:33 - 2012-03-12 21:33 - 0000000 ____D C:\Users\All Users\Malwarebytes
2012-03-12 21:33 - 2012-03-12 21:33 - 0000000 ____D C:\ProgramData\Malwarebytes
2012-03-12 21:33 - 2012-03-12 21:33 - 0000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2012-03-12 21:33 - 2011-12-10 15:24 - 0020464 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2012-03-12 21:28 - 2012-03-12 21:28 - 9502424 ____A (Malwarebytes Corporation                                    ) C:\Users\motzer\Desktop\mbam-setup-1.60.1.1000.exe
2012-03-12 21:19 - 2012-03-12 21:20 - 12410880 ____A C:\Users\motzer\Desktop\Ad-Aware96Install.msi
2012-03-12 21:17 - 2012-03-12 21:17 - 4435063 ____A (Swearware) C:\Users\motzer\Desktop\ComboFix.exe
2012-03-12 21:12 - 2012-03-12 21:12 - 0051570 ____A C:\Users\motzer\Documents\cc_20120312_211211.reg
2012-03-12 21:11 - 2012-03-12 21:11 - 0000000 ____D C:\Users\motzer\AppData\Local\Sunbelt Software
2012-03-12 21:10 - 2012-03-12 21:10 - 0002135 ____A C:\Users\Public\Desktop\CounterSpy.lnk
2012-03-12 21:10 - 2012-03-12 21:10 - 0000000 ____D C:\Program Files\Sunbelt Software
2012-03-12 21:07 - 2012-03-12 21:07 - 0000000 ____D C:\Windows\Downloaded Installations
2012-03-12 00:43 - 2012-03-12 00:43 - 0000000 ____D C:\Users\Public\Documents\National Instruments
2012-03-12 00:39 - 2012-03-12 20:56 - 0000000 __ASH C:\Windows\System32\dds_trash_log.cmd
2012-03-12 00:26 - 2012-03-13 01:03 - 0000000 ____D C:\Users\motzer\AppData\Roaming\Ihuw
2012-03-12 00:26 - 2012-03-12 00:45 - 0000000 ____D C:\Users\motzer\AppData\Roaming\Ygacva
2012-03-12 00:15 - 2012-03-12 00:17 - 0000000 ____D C:\Users\motzer\Documents\LabVIEW Data
2012-03-12 00:02 - 2012-03-12 00:02 - 0001039 ____A C:\Users\motzer\Desktop\National Instruments LabVIEW 2011.lnk
2012-03-12 00:01 - 2012-03-12 00:01 - 0001193 ____A C:\Users\All Users\Start Menu\Programs\Startup\NI Error Reporting.lnk
2012-03-11 23:58 - 2012-03-11 23:58 - 0000000 ____D C:\Windows\System32\cvirte
2012-03-11 23:57 - 2012-03-13 18:23 - 0000000 ____D C:\Program Files\Microsoft Silverlight
2012-03-11 23:56 - 2012-03-12 00:45 - 0000000 ____D C:\Program Files\National Instruments
2012-03-11 23:53 - 2012-03-12 20:58 - 0000000 ____D C:\Users\All Users\National Instruments
2012-03-11 23:53 - 2012-03-12 20:58 - 0000000 ____D C:\ProgramData\National Instruments
2012-03-11 23:51 - 2012-03-12 00:42 - 0000000 ____D C:\National Instruments Downloads
2012-02-26 22:31 - 2012-02-26 22:31 - 0000000 ____D C:\Program Files\Maxima-5.26.0
2012-02-24 02:32 - 2012-02-24 02:32 - 9705472 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 3695416 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat
2012-02-24 02:32 - 2012-02-24 02:32 - 2382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2012-02-24 02:32 - 2012-02-24 02:32 - 1798656 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 1792000 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 1427456 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2012-02-24 02:32 - 2012-02-24 02:32 - 12282368 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 1127424 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 1103360 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0716800 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0580608 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0434176 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0420864 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0367104 ____A (Microsoft Corporation) C:\Windows\System32\html.iec
2012-02-24 02:32 - 2012-02-24 02:32 - 0353792 ____A (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0353584 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0231936 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0227840 ____A (Microsoft Corporation) C:\Windows\System32\ieaksie.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0223232 ____A (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0203776 ____A (Microsoft Corporation) C:\Windows\System32\webcheck.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0176640 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0163840 ____A (Microsoft Corporation) C:\Windows\System32\ieakui.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0162304 ____A (Microsoft Corporation) C:\Windows\System32\msrating.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0161792 ____A (Microsoft Corporation) C:\Windows\System32\msls31.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0152064 ____A (Microsoft Corporation) C:\Windows\System32\wextract.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0150528 ____A (Microsoft Corporation) C:\Windows\System32\iexpress.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0142848 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0130560 ____A (Microsoft Corporation) C:\Windows\System32\ieakeng.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0123392 ____A (Microsoft Corporation) C:\Windows\System32\occache.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0118784 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0110592 ____A (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0101888 ____A (Microsoft Corporation) C:\Windows\System32\admparse.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0086528 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0078848 ____A (Microsoft Corporation) C:\Windows\System32\inseng.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0076800 ____A (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0074752 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0074752 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0074240 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0072822 ____A C:\Windows\System32\ieuinit.inf
2012-02-24 02:32 - 2012-02-24 02:32 - 0072704 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0066048 ____A (Microsoft Corporation) C:\Windows\System32\icardie.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0065024 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0063488 ____A (Microsoft Corporation) C:\Windows\System32\tdc.ocx
2012-02-24 02:32 - 2012-02-24 02:32 - 0054272 ____A (Microsoft Corporation) C:\Windows\System32\pngfilt.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0048640 ____A (Microsoft Corporation) C:\Windows\System32\mshtmler.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0041472 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0035840 ____A (Microsoft Corporation) C:\Windows\System32\imgutil.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0031744 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0023552 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0011776 ____A (Microsoft Corporation) C:\Windows\System32\mshta.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0010752 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
2012-02-18 01:22 - 2012-02-18 01:22 - 0002362 ____A C:\Users\motzer\Desktop\CBH Captcha Solver.exe.lnk
2012-02-18 01:22 - 2012-02-18 01:22 - 0000000 ____D C:\Program Files\Brotherhood Software
2012-02-18 01:21 - 2012-03-12 00:17 - 0000000 ____D C:\Users\motzer\AppData\Local\Captcha_Brotherhood
2012-02-16 21:25 - 2012-01-03 06:44 - 0478208 ____A (Microsoft Corporation) C:\Windows\System32\timedate.cpl
2012-02-16 21:25 - 2011-12-16 08:59 - 0690688 ____A (Microsoft Corporation) C:\Windows\System32\msvcrt.dll
2012-02-16 21:24 - 2012-01-14 04:48 - 2340864 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2012-02-16 21:24 - 2012-01-04 10:03 - 12868096 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll
2012-02-16 21:24 - 2012-01-04 10:03 - 0442880 ____A (Microsoft Corporation) C:\Windows\System32\ntshrui.dll
2012-02-12 14:45 - 2012-02-12 14:46 - 0000000 ____D C:\Program Files\iTunes
2012-02-12 14:45 - 2012-02-12 14:45 - 0000000 ____D C:\Program Files\iPod


============ 3 Months Modified Files and Folders ===============

2012-03-13 21:58 - 2012-03-13 21:58 - 0000000 ____D C:\FRST
2012-03-13 21:54 - 2012-03-12 22:29 - 0001400 ____A C:\Windows\setupact.log
2012-03-13 21:54 - 2011-05-25 12:41 - 1609175040 __ASH C:\hiberfil.sys
2012-03-13 21:54 - 2009-07-14 05:53 - 0000006 ___AH C:\Windows\Tasks\SA.DAT
2012-03-13 21:53 - 2011-05-25 12:48 - 1713040 ____A C:\Windows\WindowsUpdate.log
2012-03-13 21:31 - 2012-03-13 20:36 - 2509058048 ____A C:\Users\motzer\Desktop\X17-59886.iso
2012-03-13 20:28 - 2012-03-13 19:07 - 0000000 ____D C:\Program Files\ShrewSoft
2012-03-13 20:28 - 2009-07-14 03:37 - 0000000 ____D C:\Windows\System32\DriverStore
2012-03-13 20:27 - 2012-03-13 19:12 - 0000000 ____D C:\Users\motzer\AppData\Local\LogMeIn Hamachi
2012-03-13 20:25 - 2012-03-13 19:15 - 0001594 ____A C:\Windows\VPNUnInstall.MIF
2012-03-13 20:24 - 2011-06-24 20:33 - 0000000 ___RD C:\Users\motzer\Dropbox
2012-03-13 20:24 - 2011-06-24 20:31 - 0000000 ____D C:\Users\motzer\AppData\Roaming\Dropbox
2012-03-13 20:01 - 2009-07-14 05:34 - 0022064 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2012-03-13 20:01 - 2009-07-14 05:34 - 0022064 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2012-03-13 19:19 - 2011-06-24 17:53 - 0001594 ____A C:\Windows\VPNInstall.MIF
2012-03-13 19:07 - 2012-03-13 19:07 - 0000000 ____D C:\Users\motzer\Documents\Shrew Soft VPN
2012-03-13 18:37 - 2011-05-25 20:21 - 0000000 ____D C:\Program Files\Mozilla Firefox
2012-03-13 18:34 - 2011-05-25 12:51 - 1612484 ____A C:\Windows\System32\PerfStringBackup.INI
2012-03-13 18:23 - 2012-03-11 23:57 - 0000000 ____D C:\Program Files\Microsoft Silverlight
2012-03-13 01:46 - 2012-03-13 01:05 - 0000000 ____D C:\Windows\System32\Shared Memory
2012-03-13 01:33 - 2011-08-22 12:57 - 0000000 ____D C:\Users\motzer\AppData\Local\Samsung
2012-03-13 01:33 - 2011-08-22 12:42 - 0000000 ____D C:\Users\All Users\Samsung
2012-03-13 01:33 - 2011-08-22 12:42 - 0000000 ____D C:\ProgramData\Samsung
2012-03-13 01:33 - 2011-05-25 15:12 - 0000000 ___HD C:\Program Files\InstallShield Installation Information
2012-03-13 01:12 - 2012-03-13 01:12 - 0165368 ____A C:\Windows\System32\GDIPFONTCACHEV1.DAT
2012-03-13 01:11 - 2011-05-25 15:39 - 0008224 ____A C:\Users\motzer\AppData\Local\GDIPFONTCACHEV1.DAT
2012-03-13 01:06 - 2009-07-14 05:33 - 0544032 ____A C:\Windows\System32\FNTCACHE.DAT
2012-03-13 01:05 - 2012-03-13 01:05 - 0001054 ____A C:\Windows\PFRO.log
2012-03-13 01:05 - 2009-07-14 03:37 - 0000000 ____D C:\Windows\Branding
2012-03-13 01:03 - 2012-03-13 01:03 - 0003016 ____A C:\Users\motzer\Desktop\mbam-log-2012-03-13 (01-02-56).txt
2012-03-13 01:03 - 2012-03-12 00:26 - 0000000 ____D C:\Users\motzer\AppData\Roaming\Ihuw
2012-03-12 22:29 - 2012-03-12 22:29 - 0000000 ____A C:\Windows\setuperr.log
2012-03-12 22:01 - 2012-03-12 22:01 - 0001187 ____A C:\Users\motzer\Desktop\Troja.txt
2012-03-12 21:38 - 2012-03-12 21:38 - 0388608 ____A (Trend Micro Inc.) C:\Users\motzer\Desktop\HiJackThis204.exe
2012-03-12 21:33 - 2012-03-12 21:33 - 0001071 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2012-03-12 21:33 - 2012-03-12 21:33 - 0000000 ____D C:\Users\motzer\AppData\Roaming\Malwarebytes
2012-03-12 21:33 - 2012-03-12 21:33 - 0000000 ____D C:\Users\All Users\Malwarebytes
2012-03-12 21:33 - 2012-03-12 21:33 - 0000000 ____D C:\ProgramData\Malwarebytes
2012-03-12 21:33 - 2012-03-12 21:33 - 0000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2012-03-12 21:28 - 2012-03-12 21:28 - 9502424 ____A (Malwarebytes Corporation                                    ) C:\Users\motzer\Desktop\mbam-setup-1.60.1.1000.exe
2012-03-12 21:20 - 2012-03-12 21:19 - 12410880 ____A C:\Users\motzer\Desktop\Ad-Aware96Install.msi
2012-03-12 21:17 - 2012-03-12 21:17 - 4435063 ____A (Swearware) C:\Users\motzer\Desktop\ComboFix.exe
2012-03-12 21:12 - 2012-03-12 21:12 - 0051570 ____A C:\Users\motzer\Documents\cc_20120312_211211.reg
2012-03-12 21:11 - 2012-03-12 21:11 - 0000000 ____D C:\Users\motzer\AppData\Local\Sunbelt Software
2012-03-12 21:10 - 2012-03-12 21:10 - 0002135 ____A C:\Users\Public\Desktop\CounterSpy.lnk
2012-03-12 21:10 - 2012-03-12 21:10 - 0000000 ____D C:\Program Files\Sunbelt Software
2012-03-12 21:07 - 2012-03-12 21:07 - 0000000 ____D C:\Windows\Downloaded Installations
2012-03-12 21:07 - 2011-09-15 22:09 - 0000000 ____D C:\Users\motzer\AppData\Roaming\TS3Client
2012-03-12 21:07 - 2011-08-04 13:50 - 0000000 ____D C:\Windows\Minidump
2012-03-12 21:07 - 2011-05-26 23:10 - 0000000 ____D C:\Users\motzer\AppData\Roaming\Skype
2012-03-12 21:07 - 2011-05-25 13:40 - 0000000 ____D C:\Windows\Panther
2012-03-12 21:01 - 2011-07-28 11:31 - 0000000 ____D C:\Program Files\CCleaner
2012-03-12 20:58 - 2012-03-11 23:53 - 0000000 ____D C:\Users\All Users\National Instruments
2012-03-12 20:58 - 2012-03-11 23:53 - 0000000 ____D C:\ProgramData\National Instruments
2012-03-12 20:56 - 2012-03-12 00:39 - 0000000 __ASH C:\Windows\System32\dds_trash_log.cmd
2012-03-12 00:45 - 2012-03-12 00:26 - 0000000 ____D C:\Users\motzer\AppData\Roaming\Ygacva
2012-03-12 00:45 - 2012-03-11 23:56 - 0000000 ____D C:\Program Files\National Instruments
2012-03-12 00:44 - 2011-05-25 17:39 - 0000000 ____D C:\Program Files\Common Files\Merge Modules
2012-03-12 00:43 - 2012-03-12 00:43 - 0000000 ____D C:\Users\Public\Documents\National Instruments
2012-03-12 00:42 - 2012-03-11 23:51 - 0000000 ____D C:\National Instruments Downloads
2012-03-12 00:17 - 2012-03-12 00:15 - 0000000 ____D C:\Users\motzer\Documents\LabVIEW Data
2012-03-12 00:17 - 2012-02-18 01:21 - 0000000 ____D C:\Users\motzer\AppData\Local\Captcha_Brotherhood
2012-03-12 00:02 - 2012-03-12 00:02 - 0001039 ____A C:\Users\motzer\Desktop\National Instruments LabVIEW 2011.lnk
2012-03-12 00:01 - 2012-03-12 00:01 - 0001193 ____A C:\Users\All Users\Start Menu\Programs\Startup\NI Error Reporting.lnk
2012-03-11 23:58 - 2012-03-11 23:58 - 0000000 ____D C:\Windows\System32\cvirte
2012-03-09 23:58 - 2011-05-25 20:21 - 0000000 ____D C:\Program Files\JDownloader
2012-03-07 19:47 - 2009-07-14 03:37 - 0000000 ____D C:\Windows\Microsoft.NET
2012-03-02 21:02 - 2011-05-25 15:11 - 0000000 ____D C:\Users\motzer\AppData\Roaming\ICQ
2012-03-01 16:18 - 2011-07-15 16:07 - 0000000 ____D C:\Users\motzer\Documents\FinePrint-Dateien
2012-02-28 00:43 - 2011-06-24 20:32 - 0000997 ____A C:\Users\motzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
2012-02-26 22:31 - 2012-02-26 22:31 - 0000000 ____D C:\Program Files\Maxima-5.26.0
2012-02-25 01:32 - 2009-07-14 03:37 - 0000000 ____D C:\Windows\rescache
2012-02-24 13:16 - 2009-07-14 03:37 - 0000000 ____D C:\Windows\System32\de-DE
2012-02-24 02:32 - 2012-02-24 02:32 - 9705472 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 3695416 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat
2012-02-24 02:32 - 2012-02-24 02:32 - 2382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2012-02-24 02:32 - 2012-02-24 02:32 - 1798656 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 1792000 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 1427456 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2012-02-24 02:32 - 2012-02-24 02:32 - 12282368 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 1127424 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 1103360 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0716800 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0580608 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0434176 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0420864 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0367104 ____A (Microsoft Corporation) C:\Windows\System32\html.iec
2012-02-24 02:32 - 2012-02-24 02:32 - 0353792 ____A (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0353584 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0231936 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0227840 ____A (Microsoft Corporation) C:\Windows\System32\ieaksie.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0223232 ____A (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0203776 ____A (Microsoft Corporation) C:\Windows\System32\webcheck.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0176640 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0163840 ____A (Microsoft Corporation) C:\Windows\System32\ieakui.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0162304 ____A (Microsoft Corporation) C:\Windows\System32\msrating.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0161792 ____A (Microsoft Corporation) C:\Windows\System32\msls31.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0152064 ____A (Microsoft Corporation) C:\Windows\System32\wextract.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0150528 ____A (Microsoft Corporation) C:\Windows\System32\iexpress.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0142848 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0130560 ____A (Microsoft Corporation) C:\Windows\System32\ieakeng.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0123392 ____A (Microsoft Corporation) C:\Windows\System32\occache.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0118784 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0110592 ____A (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0101888 ____A (Microsoft Corporation) C:\Windows\System32\admparse.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0086528 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0078848 ____A (Microsoft Corporation) C:\Windows\System32\inseng.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0076800 ____A (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0074752 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0074752 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0074240 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0072822 ____A C:\Windows\System32\ieuinit.inf
2012-02-24 02:32 - 2012-02-24 02:32 - 0072704 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0066048 ____A (Microsoft Corporation) C:\Windows\System32\icardie.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0065024 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0063488 ____A (Microsoft Corporation) C:\Windows\System32\tdc.ocx
2012-02-24 02:32 - 2012-02-24 02:32 - 0054272 ____A (Microsoft Corporation) C:\Windows\System32\pngfilt.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0048640 ____A (Microsoft Corporation) C:\Windows\System32\mshtmler.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0041472 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0035840 ____A (Microsoft Corporation) C:\Windows\System32\imgutil.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0031744 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0023552 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0011776 ____A (Microsoft Corporation) C:\Windows\System32\mshta.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0010752 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
2012-02-21 19:17 - 2011-05-25 15:49 - 0414368 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2012-02-20 00:22 - 2011-06-22 19:40 - 0000692 ____A C:\Users\motzer\Desktop\Kino.txt
2012-02-20 00:05 - 2011-05-25 15:51 - 0000000 ____D C:\Program Files\Mozilla Thunderbird
2012-02-18 01:22 - 2012-02-18 01:22 - 0002362 ____A C:\Users\motzer\Desktop\CBH Captcha Solver.exe.lnk
2012-02-18 01:22 - 2012-02-18 01:22 - 0000000 ____D C:\Program Files\Brotherhood Software
2012-02-17 19:25 - 2011-05-25 12:47 - 0000174 ___SH C:\Users\motzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
2012-02-17 01:48 - 2011-10-25 13:43 - 0000000 ____D C:\Users\All Users\Microsoft Help
2012-02-17 01:48 - 2011-10-25 13:43 - 0000000 ____D C:\ProgramData\Microsoft Help
2012-02-15 06:44 - 2012-03-13 18:30 - 0826368 ____A (Microsoft Corporation) C:\Windows\System32\rdpcore.dll
2012-02-15 05:22 - 2012-03-13 18:30 - 0177152 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\rdpwd.sys
2012-02-15 05:22 - 2012-03-13 18:30 - 0024064 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tdtcp.sys
2012-02-12 15:35 - 2011-10-26 13:35 - 0000000 ____D C:\Users\motzer\AppData\Local\Deployment
2012-02-12 14:46 - 2012-02-12 14:45 - 0000000 ____D C:\Program Files\iTunes
2012-02-12 14:45 - 2012-02-12 14:45 - 0000000 ____D C:\Program Files\iPod
2012-02-12 14:45 - 2011-05-25 16:41 - 0000000 ____D C:\Program Files\Common Files\Apple
2012-02-06 18:40 - 2012-02-06 18:40 - 0000000 ____D C:\Users\motzer\Desktop\RT Vorbereitung
2012-01-27 17:22 - 2011-05-25 15:07 - 0000000 ____D C:\Program Files\Opera
2012-01-25 15:34 - 2011-05-26 23:10 - 0000000 ___RD C:\Program Files\Skype
2012-01-25 15:34 - 2011-05-26 23:09 - 0000000 ____D C:\Users\All Users\Skype
2012-01-25 15:34 - 2011-05-26 23:09 - 0000000 ____D C:\ProgramData\Skype
2012-01-25 06:44 - 2012-03-13 18:30 - 0129536 ____A (Microsoft Corporation) C:\Windows\System32\rdpcorekmts.dll
2012-01-25 06:44 - 2012-03-13 18:30 - 0057856 ____A (Microsoft Corporation) C:\Windows\System32\rdpwsx.dll
2012-01-25 06:40 - 2012-03-13 18:30 - 0008192 ____A (Microsoft Corporation) C:\Windows\System32\rdrmemptylst.exe
2012-01-23 21:26 - 2012-01-23 20:53 - 0000798 ____A C:\Windows\Ulead32.ini
2012-01-23 21:26 - 2012-01-23 20:53 - 0000000 ____D C:\Windows\ULEAD.DAT
2012-01-23 20:54 - 2012-01-23 20:54 - 0000000 ____D C:\Program Files\iPhoto Plus 4
2012-01-23 20:53 - 2012-01-23 20:53 - 0000000 _RASH C:\MSDOS.SYS
2012-01-23 20:53 - 2012-01-23 20:53 - 0000000 _RASH C:\IO.SYS
2012-01-14 04:48 - 2012-02-16 21:24 - 2340864 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2012-01-14 00:31 - 2011-07-06 11:19 - 0001106 ____A C:\Users\motzer\Desktop\Zitate.txt
2012-01-13 15:59 - 2011-05-25 16:42 - 0017408 ____A C:\Users\motzer\AppData\Local\WebpageIcons.db
2012-01-13 14:57 - 2011-10-10 23:26 - 0000000 ____D C:\Users\motzer\Documents\Inventor
2012-01-12 13:25 - 2011-10-10 20:07 - 0000000 ____D C:\Users\motzer\AppData\Roaming\toolplugin
2012-01-10 17:05 - 2011-09-20 01:50 - 0000000 ____D C:\Users\motzer\Documents\MATLAB
2012-01-09 18:18 - 2011-05-25 16:43 - 0000000 ____D C:\Users\motzer\AppData\Roaming\Apple Computer
2012-01-09 18:15 - 2012-01-09 18:13 - 0000000 ____D C:\Users\motzer\AppData\Roaming\DVDVideoSoftIEHelpers
2012-01-09 18:15 - 2012-01-09 18:13 - 0000000 ____D C:\Users\motzer\AppData\Roaming\DVDVideoSoft
2012-01-09 18:15 - 2011-05-26 19:19 - 0000000 ____D C:\Users\motzer\Documents\DVDVideoSoft
2012-01-09 18:15 - 2011-05-26 19:18 - 0000000 ____D C:\Program Files\DVDVideoSoft
2012-01-09 18:15 - 2011-05-26 19:18 - 0000000 ____D C:\Program Files\Common Files\DVDVideoSoft
2012-01-09 18:09 - 2012-01-09 18:09 - 0000000 ____D C:\Users\motzer\Documents\FILSHtray
2012-01-09 18:09 - 2012-01-09 18:09 - 0000000 ____D C:\Users\motzer\AppData\Local\FILSH_Media_GmbH
2012-01-04 10:03 - 2012-02-16 21:24 - 12868096 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll
2012-01-04 10:03 - 2012-02-16 21:24 - 0442880 ____A (Microsoft Corporation) C:\Windows\System32\ntshrui.dll
2012-01-03 06:44 - 2012-02-16 21:25 - 0478208 ____A (Microsoft Corporation) C:\Windows\System32\timedate.cpl
2011-12-20 14:11 - 2011-12-20 14:11 - 0055904 ____A (National Instruments Corporation) C:\Windows\System32\XSpyDll.dll
2011-12-20 13:16 - 2011-12-20 13:16 - 0378064 ____A (National Instruments Corporation) C:\Windows\System32\niemca2l.dll
2011-12-16 08:59 - 2012-02-16 21:25 - 0690688 ____A (Microsoft Corporation) C:\Windows\System32\msvcrt.dll

========================= Known DLLs (Whitelisted) ============


========================= Bamital & volsnap Check ============

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\System32\User32.dll
[2009-07-14 00:24] - [2009-07-14 02:16] - 0811520 ____A (Microsoft Corporation) 34B7E222E81FAFA885F0C5F2CFA56861

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

========================= Memory info ======================

Percentage of memory in use: 22%
Total physical RAM: 2046.18 MB
Available physical RAM: 1585.79 MB
Total Pagefile: 2046.18 MB
Available Pagefile: 1588.33 MB
Total Virtual: 2047.88 MB
Available Virtual: 1958.29 MB

======================= Partitions =========================

1 Drive c: () (Fixed) (Total:222.78 GB) (Free:130.55 GB) NTFS ==>[Drive with boot components (obtanied from BCD)]
2 Drive d: (DATAPART1) (Fixed) (Total:232.83 GB) (Free:54.01 GB) NTFS
3 Drive e: (Elektronik) (Fixed) (Total:10 GB) (Free:6.74 GB) NTFS
5 Drive g: (GSP1RMCPRFRER_DE_DVD) (CDROM) (Total:2.34 GB) (Free:0 GB) UDF
10 Drive l: () (Removable) (Total:0.94 GB) (Free:0.94 GB) FAT
11 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

  Datentr„ger ###  Status        Gr”áe    Frei    Dyn  GPT
  ---------------  -------------  -------  -------  ---  ---
  Datentr„ger 0    Online          232 GB      0 B       
  Datentr„ger 1    Online          232 GB      0 B       
  Datentr„ger 2    Kein Medium        0 B      0 B       
  Datentr„ger 3    Kein Medium        0 B      0 B       
  Datentr„ger 4    Kein Medium        0 B      0 B       
  Datentr„ger 5    Kein Medium        0 B      0 B       
  Datentr„ger 6    Online          965 MB      0 B       

Partitions of Disk 0:
===============

  Partition ###  Typ              Gr”áe    Offset
  -------------  ----------------  -------  -------
  Partition 1    OEM                54 MB    31 KB
  Partition 2    Prim„r              10 GB    55 MB
  Partition 3    Prim„r            222 GB    10 GB

======================================================================================================

Disk: 0
Partition 1
Typ      : DE
Versteckt: Ja
Aktiv    : Nein

  Volume ###  Bst  Bezeichnung  DS    Typ        Gr”áe    Status    Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 10                    FAT    Partition    54 MB  Fehlerfre  Versteck

======================================================================================================

Disk: 0
Partition 2
Typ      : 07
Versteckt: Nein
Aktiv    : Nein

  Volume ###  Bst  Bezeichnung  DS    Typ        Gr”áe    Status    Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 2    E  Elektronik  NTFS  Partition    10 GB  Fehlerfre         

======================================================================================================

Disk: 0
Partition 3
Typ      : 07
Versteckt: Nein
Aktiv    : Ja

  Volume ###  Bst  Bezeichnung  DS    Typ        Gr”áe    Status    Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 3    C                NTFS  Partition    222 GB  Fehlerfre         

======================================================================================================

Partitions of Disk 1:
===============

  Partition ###  Typ              Gr”áe    Offset
  -------------  ----------------  -------  -------
  Partition 1    Prim„r            232 GB  1024 KB

======================================================================================================

Disk: 1
Partition 1
Typ      : 07
Versteckt: Nein
Aktiv    : Nein

  Volume ###  Bst  Bezeichnung  DS    Typ        Gr”áe    Status    Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 4    D  DATAPART1    NTFS  Partition    232 GB  Fehlerfre         

======================================================================================================

Partitions of Disk 2:
===============

Auf diesem Datentr„ger sind keine Partitionen, die angezeigt werden k”nnen, vorhanden.

======================================================================================================

Partitions of Disk 3:
===============

Auf diesem Datentr„ger sind keine Partitionen, die angezeigt werden k”nnen, vorhanden.

======================================================================================================

Partitions of Disk 4:
===============

Auf diesem Datentr„ger sind keine Partitionen, die angezeigt werden k”nnen, vorhanden.

======================================================================================================

Partitions of Disk 5:
===============

Auf diesem Datentr„ger sind keine Partitionen, die angezeigt werden k”nnen, vorhanden.

======================================================================================================

Partitions of Disk 6:
===============

  Partition ###  Typ              Gr”áe    Offset
  -------------  ----------------  -------  -------
  Partition 1    Prim„r            962 MB  1788 KB

======================================================================================================

Disk: 6
Partition 1
Typ      : 06
Versteckt: Nein
Aktiv    : Nein

  Volume ###  Bst  Bezeichnung  DS    Typ        Gr”áe    Status    Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 9    L                FAT    Wechselmed  962 MB  Fehlerfre         

======================================================================================================

==========================================================

Last Boot: 2012-03-10 00:57

======================= End Of Log ==========================

mfg motzer

Psychotic 14.03.2012 00:02
Da hast du ja schon ganz schön rumgefroscht - insbesonder Combofix ist ein sehr mächtiges Tool, welches man niemals ausführen sollte, wenn man nicht weiß, was man tut! :twak:


Lass es mich dennoch versuchen...


Schritt 1: Fix mit FRST


Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument
Code:
HKU\motzer\...\Run: [{91419E33-D9AC-2F4F-9DDB-0A31B337FF79}] C:\Users\motzer\AppData\Roaming\Ihuw\ecnoni.exe [x]
Winlogon\Notify\lkapoer:

2012-03-12 00:26 - 2012-03-13 01:03 - 0000000 ____D C:\Users\motzer\AppData\Roaming\Ihuw
2012-03-12 00:26 - 2012-03-12 00:45 - 0000000 ____D C:\Users\motzer\AppData\Roaming\Ygacva
Speichere diese bitte als Fixlist.txt auf deinem USB Stick.
  • Starte deinen Rechner erneut in die Reparaturoptionen
  • Starte nun die FRST.exe erneut und klicke den Fix Button.
Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.




Schritt 2: ComboFix

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.
Downloade dir bitte Combofix von einem dieser Downloadspiegel

Link 1
Link 2


WICHTIG - Speichere Combofix auf deinem Desktop
  • Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.
Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.



Schritt 3: TDSS-Killer (Scan)


Lese bitte folgende Anweisungen genau. Wir wollen hier noch nichts "fixen" sondern nur einen Scan Report sehen. Downloade dir bitte TDSSKiller.exe und speichere diese Datei auf dem Desktop
  • Starte die TDSSKiller.exe
  • Drücke Start Scan
  • Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und speichere das Logfile. TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern ( Meistens C:\ ) Als Beispiel: C:\TDSSKiller.<version_date_time>log.txt
Poste den Inhalt bitte hier in deinen Thread.



Schritt 4: aswMBR



Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung) Vista und Win7 User mit Rechtsklick "als Admininstartor starten"
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. ( Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen ) Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort. Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.

motzerrobo 14.03.2012 21:29
Hallo Marius,

also vorab ich habe die Tools wie Combofix nur runtergeladen jedoch nie geöffnet, da ich hier im Forum schon gelesen hatte, dass man sie erst nach Aufforderung nutzen sollte - von daher nur halb rumgefroscht =)

So also Fix mit FRST hat geklappt.

Combofix klappt aber irgendwie nicht - ich starte und das Tool erstellt einen Wiederherstellungspunkt geht dann über zum Scan - und dann ist Ende

ich habe gestern 5h scannen lassen bis ich dachte "Die 10 Minuten sind wohl selbst bei meiner Kiste vorbei"

http://www.imgbox.de/users/motzer/th...Combofix_t.gif

das bleibt so stehen der Cursor blinkt ....

Habe dann heute als ich von der Uni kam nochmal getestet beim Hochfahren kam dann diese Meldung ich habe auf "Ja" geklickt und dann nochmal versucht mit Combofix zu scannen und jetzt sind wieder 2h vergangen und nichts passiert. Worran kann es liegen ?

http://www.imgbox.de/users/motzer/th...mbofix_2_t.gif

Ich habe Antivir deaktiviert aber er meckert trotzdem beim Start von Combofix - habe ich es vielleicht nicht komplett "ausgeschaltet" ?

Und jetzt rödelt der Rechner wie verrückt CPU Auslastung bei über 50% und der Lüfter auf volllast - selbst nach erneutem Start. Daher hier nochmal Resourcenmonitor
http://www.imgbox.de/users/motzer/th...esourcen_t.gif


bitte um weitere Anweisungen.

mfg
motzer

Psychotic 14.03.2012 22:06
Dann ist die Combofix.exe also auch schon länger am System?

Starte Windows im abgesicherten Modus mit Netzwerktreibern, lösche die vorhandene combofix.exe und lade dir eine neue von hier herunter.


Starte sie per Rechtsklick-->Als Administrator ausführen.

Poste das logfile/berichte!

motzerrobo 15.03.2012 19:24
Okay Treiber vom WLAN Stick neu installiert und Internet ist wieder da ich versuche jetzt nochmal über den abgesicherten Modus Combofix zu laden!

Edit:

Also im abgesicherten Modus funktioniert keine Internetverbindung. Ich habe Combofix dann regulär geladen und im abgesicherten Modus ausgeführt - selbes Bild wie vorher. Wiederherszellungspunkt wird erstellt danach startet der Scan, jedoch wird nichts weiter angezeigt. Was soll ich tun?

motzer

Psychotic 16.03.2012 08:11
Neues FRST-Log

Lösche die FRST.TXT (falls vorhanden) vom Stick.

Schließe den USB Stick an das infizierte System an Du musst das System nun in die System Reparatur Option booten. Über den Boot Manager
  • Starte den Rechner neu auf.
  • Während dem Hochfahren drücke mehrmals die F8 Taste
  • Wähle nun Computer reparieren.
  • Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".
Mit Windows CD/DVD
  • Lege die Windows CD in dein Laufwerk.
  • Starte den Rechner neu auf und starte von der CD
  • Wähle die Spracheinstellungen und klicke "Weiter".
  • Klicke auf Computerreparaturoptionen !!
  • Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".
Wähle in den Reparaturoptionen Eingabeaufforderung
  • Gib nun bitte notepad ein und drücke Enter.
  • Im öffnenden Textdokument --> Datei --> Speichern unter und wähle Computer Hier wird dir der Laufwerksbuchstabe deines USB Sticks angezeigt.
  • Schließe Notepad wieder
  • Gib nun bitte folgenden Befehl ein. e:\frst.exe Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks. Gegebenfalls anpassen.
  • Akzeptiere den Disclaimer mit Yes und klicke Scan
Das Tool erstellt eine FRST.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

motzerrobo 16.03.2012 22:05
Okay ausgeführt

Code:
Scan result of Farbar Recovery Scan Tool (FRST written by farbar) Version: 11-03-2012
Ran by SYSTEM at 16-03-2012 21:55:44
Running from H:\
Windows 7 Professional  Service Pack 1 (X86) OS Language: German Standard
The current controlset is ControlSet001

========================== Registry (Whitelisted) =============

HKLM\...\Run: [AVMWlanClient] C:\Program Files\avmwlanstick\wlangui.exe [2105344 2010-10-22] (AVM Berlin)
HKLM\...\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min [281768 2011-03-28] (Avira GmbH)
HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [843712 2012-01-03] (Adobe Systems Incorporated)
HKLM\...\Run: []  [x]
HKLM\...\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" [36760 2012-01-03] (Adobe Systems Incorporated)
HKLM\...\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [815512 2012-01-03] (Adobe Systems Inc.)
HKLM\...\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [98304 2009-11-18] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [BCSSync] "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices [91520 2010-03-13] (Microsoft Corporation)
HKLM\...\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" [254696 2011-06-09] (Sun Microsystems, Inc.)
HKLM\...\Run: [NI Update Service] "C:\Program Files\National Instruments\Shared\Update Service\NIUpdateService.exe" -startupTask [3002976 2011-06-07] (National Instruments)
HKLM\...\Run: [SunServer] C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunserver.exe [290816 2005-11-11] (Sunbelt Software)
HKU\motzer\...\Run: [NIRegistrationWizard] C:\Program Files\National Instruments\Shared\RegistrationWizard\Bin\RegistrationWizard.exe -autoDiscover 1 -displayIfNoneFound 0 -displayRegisterOptions 1 -sleepIfNoneFound 0 -locale 1031 [846520 2010-06-21] ()
HKU\motzer\...\Policies\system: [disableregistrytools] 0
HKU\motzer\...\Run: [NIRegistrationWizard] C:\Program Files\National Instruments\Shared\RegistrationWizard\Bin\RegistrationWizard.exe -autoDiscover 1 -displayIfNoneFound 0 -displayRegisterOptions 1 -sleepIfNoneFound 0 -locale 1031 [846520 2010-06-21] ()
HKU\motzer\...\Policies\system: [disableregistrytools] 0
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

================================ Services (Whitelisted) ==================

2 AMD External Events Utility; C:\Windows\System32\atiesrxx.exe [172032 2009-11-18] (AMD)
2 AntiVirSchedulerService; "C:\Program Files\Avira\AntiVir Desktop\sched.exe" [136360 2011-03-28] (Avira GmbH)
2 AntiVirService; "C:\Program Files\Avira\AntiVir Desktop\avguard.exe" [269480 2011-07-04] (Avira GmbH)
2 ASDR; C:\Windows\System32\ASDR.exe [61440 2009-07-27] ()
2 ATKFUSService; C:\Windows\system32\ATKFUSService.exe [61952 2009-12-01] (ASUSTeK COMPUTER INC.)
2 AVM WLAN Connection Service; C:\Program Files\avmwlanstick\WlanNetService.exe [376832 2010-10-22] (AVM Berlin)
3 FLEXnet Licensing Service; "C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe" [1044816 2011-10-10] (Flexera Software, Inc.)
2 LkCitadelServer; C:\Windows\system32\lkcitdl.exe [695136 2010-10-27] (National Instruments, Inc.)
2 lkClassAds; C:\Windows\system32\lkads.exe [46192 2011-06-14] (National Instruments Corporation)
2 lkTimeSync; C:\Windows\system32\lktsrv.exe [56952 2011-06-14] (National Instruments Corporation)
3 Microsoft SharePoint Workspace Audit Service; "C:\Program Files\Microsoft Office\Office14\GROOVE.EXE" /auditservice [31125880 2011-06-12] (Microsoft Corporation)
2 mitsijm2012; "C:\Program Files\Autodesk\Inventor 2012\Moldflow\bin\mitsijm.exe" [580416 2011-08-03] (Autodesk, Inc.)
2 mxssvr; "C:\Program Files\National Instruments\MAX\nimxs.exe" [12696 2011-06-14] (National Instruments Corporation)
4 NetMsmqActivator; "C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe" -NetMsmqActivator [124240 2010-03-18] (Microsoft Corporation)
4 NetPipeActivator; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [124240 2010-03-18] (Microsoft Corporation)
4 NetTcpActivator; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [124240 2010-03-18] (Microsoft Corporation)
4 NetTcpPortSharing; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [124240 2010-03-18] (Microsoft Corporation)
2 NIApplicationWebServer; "C:\Program Files\National Instruments\Shared\NI WebServer\ApplicationWebServer.exe" -user [50336 2011-05-27] (National Instruments Corporation)
2 NIDomainService; "C:\Program Files\National Instruments\Shared\Security\nidmsrv.exe" [362104 2011-06-14] (National Instruments Corporation)
3 NILM License Manager; "C:\Program Files\National Instruments\Shared\License Manager\Bin\lmgrd.exe" [1427688 2010-08-02] (Macrovision Corporation)
2 nimDNSResponder; "C:\Program Files\National Instruments\Shared\mDNS Responder\nimdnsResponder.exe" [194224 2011-06-01] (National Instruments Corporation)
2 NINetworkDiscovery; "C:\Program Files\National Instruments\Shared\NI Network Discovery\niDiscSvc.exe" [121032 2011-06-10] (National Instruments Corporation)
2 niSvcLoc; "C:\Program Files\National Instruments\Shared\NI WebServer\SystemWebServer.exe" -system [50328 2011-11-17] (National Instruments Corporation)
2 NITaggerService; "C:\Program Files\National Instruments\Shared\Tagger\tagsrv.exe" [676016 2011-06-14] (National Instruments Corporation)
3 OpcEnum; C:\Windows\system32\OpcEnum.exe [98304 2009-06-03] (OPC Foundation)
3 StorSvc; C:\Windows\System32\storsvc.dll [16384 2009-07-14] (Microsoft Corporation)
2 vpnagent; "C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe" [435152 2011-03-23] (Cisco Systems, Inc.)
2 ntservice1; C:\Windows\System32\NETw5x32.dll [x]

========================== Drivers (Whitelisted) =============

3 acsock; C:\Windows\System32\DRIVERS\acsock.sys [77968 2011-03-23] (Cisco Systems, Inc.)
3 asusgsb; C:\Windows\System32\drivers\asusgsb.sys [15232 2009-02-17] (ASUSTeK Computer Inc.)
3 atikmdag; C:\Windows\System32\DRIVERS\atikmdag.sys [5140480 2009-11-18] (ATI Technologies Inc.)
3 atkdisplf; C:\Windows\System32\drivers\ATKDispLowFilter.sys [30976 2009-02-17] (ASUSTeK Computer Inc.)
2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [66616 2011-07-04] (Avira GmbH)
1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [138192 2011-07-04] (Avira GmbH)
3 avmeject; C:\Windows\System32\drivers\avmeject.sys [4352 2010-10-22] (AVM Berlin)
3 BridgeMP; C:\Windows\System32\DRIVERS\bridge.sys [78336 2009-07-14] (Microsoft Corporation)
2 cvintdrv; C:\Windows\System32\Drivers\cvintdrv.sys [19552 2011-11-04] ()
3 CVirtA; C:\Windows\System32\DRIVERS\CVirtA.sys [5275 2007-01-18] (Cisco Systems, Inc.)
2 DgiVecp; \??\C:\Windows\system32\Drivers\DgiVecp.sys [38400 2009-03-02] (Samsung Electronics Co., Ltd.)
3 dg_ssudbus; C:\Windows\System32\DRIVERS\ssudbus.sys [77624 2011-07-20] (DEVGURU Co., LTD.(www.devguru.co.kr))
4 DNE; C:\Windows\System32\DRIVERS\dne2000.sys [131984 2008-11-16] (Deterministic Networks, Inc.)
1 EIO; C:\Windows\System32\DRIVERS\EIO.sys [14336 2011-07-27] (ASUSTeK Computer Inc.)
3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [265088 2010-10-22] (AVM GmbH)
3 fwlanusbn; C:\Windows\System32\DRIVERS\fwlanusbn.sys [586752 2010-10-22] (AVM GmbH)
3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.)
0 hotcore3; C:\Windows\System32\DRIVERS\hotcore3.sys [57112 2011-01-21] (Paragon Software Group)
3 Netaapl; C:\Windows\System32\DRIVERS\netaapl.sys [18432 2011-05-10] (Apple Inc.)
3 nipalfwedl; C:\Windows\System32\drivers\nipalfwedl.sys [11968 2011-06-29] (National Instruments Corporation)
0 NIPALK; C:\Windows\System32\drivers\nipalk.sys [584856 2011-06-29] (National Instruments Corporation)
3 nipalusbedl; C:\Windows\System32\drivers\nipalusbedl.sys [11968 2011-06-29] (National Instruments Corporation)
0 nipbcfk; C:\Windows\System32\drivers\nipbcfk.sys [15448 2010-03-24] (National Instruments Corporation)
0 PrecSim; C:\Windows\System32\DRIVERS\precsim.sys [69600 2002-05-22] (Engelmann GmbH)
3 Ser2pl; C:\Windows\System32\DRIVERS\ser2pl.sys [77824 2008-10-27] (Prolific Technology Inc.)
3 silabenm; C:\Windows\System32\DRIVERS\silabenm.sys [17920 2009-10-08] (Silicon Laboratories, Inc.)
3 silabser; C:\Windows\System32\DRIVERS\silabser.sys [63488 2009-10-08] (Silicon Laboratories)
0 sptd; C:\Windows\System32\Drivers\sptd.sys [722416 2011-08-16] (Duplex Secure Ltd.)
1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2010-06-17] (Avira GmbH)
2 SSPORT; \??\C:\Windows\system32\Drivers\SSPORT.sys [5120 2009-03-02] (Samsung Electronics)
3 ssudmdm; C:\Windows\System32\DRIVERS\ssudmdm.sys [181432 2011-07-20] (DEVGURU Co., LTD.(www.devguru.co.kr))
3 TVicPort; \??\C:\Windows\system32\DRIVERS\TVICPORT.SYS [14544 2005-03-30] (EnTech Taiwan)
1 UimBus; C:\Windows\System32\DRIVERS\UimBus.sys [40824 2011-01-21] (Windows (R) 2000 DDK provider)
1 Uim_IM; C:\Windows\System32\Drivers\Uim_IM.sys [381032 2011-01-21] (Paragon)
1 vflt; C:\Windows\System32\DRIVERS\vfilter.sys [17920 2010-09-02] (Shrew Soft Inc)
3 vnet; C:\Windows\System32\DRIVERS\virtualnet.sys [13824 2010-09-02] (Shrew Soft Inc)
3 vpnva; C:\Windows\System32\DRIVERS\vpnva.sys [19680 2011-03-23] (Cisco Systems, Inc.)
3 VSPerfDrv100; \??\C:\Program Files\Microsoft Visual Studio 10.0\Team Tools\Performance Tools\VSPerfDrv100.sys [48128 2009-12-08] (Microsoft Corporation)
3 WinDriver6; C:\Windows\System32\drivers\windrvr6.sys [195968 2010-08-31] (Jungo)
3 catchme; \??\C:\Users\motzer\AppData\Local\Temp\catchme.sys [x]

========================== NetSvcs (Whitelisted) ===========
NETSVC: rbfilter
NETSVC: SNC
NETSVC: cmuda
NETSVC: ntservice1
NETSVC: mcontrol
NETSVC: vmm

============ One Month Created Files and Folders ==============

2012-03-15 22:17 - 2012-03-15 22:24 - 0000000 ___SD C:\ComboFix
2012-03-15 22:17 - 2012-03-15 22:17 - 0000000 ____D C:\Qoobox
2012-03-15 22:17 - 2011-06-26 07:45 - 0256000 ____A C:\Windows\PEV.exe
2012-03-15 22:17 - 2010-11-07 18:20 - 0208896 ____A C:\Windows\MBR.exe
2012-03-15 22:17 - 2009-04-20 05:56 - 0060416 ____A (NirSoft) C:\Windows\NIRCMD.exe
2012-03-15 22:17 - 2000-08-31 01:00 - 0518144 ____A (SteelWerX) C:\Windows\SWREG.exe
2012-03-15 22:17 - 2000-08-31 01:00 - 0406528 ____A (SteelWerX) C:\Windows\SWSC.exe
2012-03-15 22:17 - 2000-08-31 01:00 - 0098816 ____A C:\Windows\sed.exe
2012-03-15 22:17 - 2000-08-31 01:00 - 0080412 ____A C:\Windows\grep.exe
2012-03-15 22:17 - 2000-08-31 01:00 - 0068096 ____A C:\Windows\zip.exe
2012-03-15 22:15 - 2012-03-15 22:15 - 4436988 ____R (Swearware) C:\Users\motzer\Desktop\ComboFix.exe
2012-03-15 22:15 - 2012-03-15 22:15 - 4436988 ____R (Swearware) C:\Documents and Settings\motzer\Desktop\ComboFix.exe
2012-03-15 20:35 - 2012-03-15 20:35 - 4731392 ____A (AVAST Software) C:\Users\motzer\Desktop\aswMBR.exe
2012-03-15 20:35 - 2012-03-15 20:35 - 4731392 ____A (AVAST Software) C:\Documents and Settings\motzer\Desktop\aswMBR.exe
2012-03-15 20:35 - 2012-03-15 20:35 - 2063920 ____A (Kaspersky Lab ZAO) C:\Users\motzer\Desktop\tdsskiller.exe
2012-03-15 20:35 - 2012-03-15 20:35 - 2063920 ____A (Kaspersky Lab ZAO) C:\Documents and Settings\motzer\Desktop\tdsskiller.exe
2012-03-15 19:40 - 2010-10-22 02:00 - 0013189 ___RA C:\Windows\instwcli.inf
2012-03-15 19:31 - 2012-03-15 19:40 - 0059618 ____A C:\Windows\avmacc.log
2012-03-15 19:31 - 2012-03-15 19:40 - 0017411 ____A C:\Windows\AVMInstall.Log
2012-03-15 19:31 - 2012-03-15 19:40 - 0009330 ____A C:\Windows\avmsetup.log
2012-03-15 19:31 - 2012-03-15 19:40 - 0002266 ____A C:\Windows\avmadd32.log
2012-03-15 19:31 - 2012-03-15 19:33 - 0009607 ____A C:\Windows\avmsetup1.log
2012-03-15 19:31 - 2012-03-15 19:33 - 0002442 ____A C:\Windows\avmadd321.log
2012-03-15 19:31 - 2012-03-15 19:31 - 0000413 ____A C:\Windows\avmacc1.log
2012-03-15 19:31 - 2010-10-22 01:01 - 0078336 ____A (AVM Berlin) C:\Windows\System32\fwusbnci.org
2012-03-15 19:31 - 2010-10-22 01:00 - 0074240 ____A (AVM Berlin) C:\Windows\System32\fwlanci.org
2012-03-15 19:26 - 2012-03-15 19:40 - 0026658 ____A C:\Windows\avmfwlanci.log
2012-03-15 19:19 - 2012-03-15 19:19 - 0019914 ____A C:\Users\motzer\Desktop\Wlan.png
2012-03-15 19:19 - 2012-03-15 19:19 - 0019914 ____A C:\Documents and Settings\motzer\Desktop\Wlan.png
2012-03-15 19:09 - 2012-03-15 20:10 - 0305120 ____A C:\Windows\ntbtlog.txt
2012-03-15 18:54 - 2012-01-25 06:32 - 0129536 ____A (Microsoft Corporation) C:\Windows\System32\rdpcorekmts.dll
2012-03-15 18:54 - 2012-01-25 06:32 - 0058880 ____A (Microsoft Corporation) C:\Windows\System32\rdpwsx.dll
2012-03-14 21:50 - 2012-03-14 21:50 - 0000000 ____D C:\Windows\System32\SPReview
2012-03-14 21:49 - 2012-03-14 21:49 - 0000000 ____D C:\Windows\System32\EventProviders
2012-03-14 21:46 - 2012-03-04 16:23 - 54215544 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2012-03-14 21:41 - 2012-03-14 21:41 - 0095045 ____A C:\Users\motzer\Desktop\Resourcen.png
2012-03-14 21:41 - 2012-03-14 21:41 - 0095045 ____A C:\Documents and Settings\motzer\Desktop\Resourcen.png
2012-03-14 21:37 - 2012-03-14 21:37 - 0019004 ____A C:\Users\motzer\Desktop\Combofix_2.png
2012-03-14 21:37 - 2012-03-14 21:37 - 0019004 ____A C:\Documents and Settings\motzer\Desktop\Combofix_2.png
2012-03-14 21:30 - 2012-03-16 00:09 - 0007601 ____A C:\Users\motzer\AppData\Local\Resmon.ResmonCfg
2012-03-14 21:30 - 2012-03-16 00:09 - 0007601 ____A C:\Documents and Settings\motzer\AppData\Local\Resmon.ResmonCfg
2012-03-14 21:27 - 2012-03-14 21:27 - 0034130 ____A C:\Users\motzer\Desktop\Combofix.png
2012-03-14 21:27 - 2012-03-14 21:27 - 0034130 ____A C:\Documents and Settings\motzer\Desktop\Combofix.png
2012-03-14 01:02 - 2012-03-15 22:17 - 0000000 ____D C:\Windows\ERDNT
2012-03-14 00:52 - 2012-03-14 00:52 - 0000334 ____A C:\Users\motzer\Desktop\Fixlist.txt
2012-03-14 00:52 - 2012-03-14 00:52 - 0000334 ____A C:\Documents and Settings\motzer\Desktop\Fixlist.txt
2012-03-13 23:14 - 2011-11-19 15:50 - 3968368 ____A (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2012-03-13 23:14 - 2011-11-19 15:50 - 3913584 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2012-03-13 21:58 - 2012-03-16 21:56 - 0000000 ____D C:\FRST
2012-03-13 20:36 - 2012-03-13 21:31 - 2509058048 ____A C:\Users\motzer\Desktop\X17-59886.iso
2012-03-13 20:36 - 2012-03-13 21:31 - 2509058048 ____A C:\Documents and Settings\motzer\Desktop\X17-59886.iso
2012-03-13 20:30 - 2012-02-10 06:38 - 1077248 ____A (Microsoft Corporation) C:\Windows\System32\DWrite.dll
2012-03-13 20:30 - 2012-02-03 04:54 - 2343424 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2012-03-13 19:15 - 2012-03-13 20:25 - 0001594 ____A C:\Windows\VPNUnInstall.MIF
2012-03-13 19:12 - 2012-03-13 20:27 - 0000000 ____D C:\Users\motzer\AppData\Local\LogMeIn Hamachi
2012-03-13 19:12 - 2012-03-13 20:27 - 0000000 ____D C:\Documents and Settings\motzer\AppData\Local\LogMeIn Hamachi
2012-03-13 19:12 - 2009-03-18 16:35 - 0026176 ___AH (LogMeIn, Inc.) C:\Windows\System32\hamachi.sys
2012-03-13 19:07 - 2012-03-13 20:28 - 0000000 ____D C:\Program Files\ShrewSoft
2012-03-13 19:07 - 2012-03-13 19:07 - 0000000 ____D C:\Users\motzer\Documents\Shrew Soft VPN
2012-03-13 19:07 - 2012-03-13 19:07 - 0000000 ____D C:\Documents and Settings\motzer\Documents\Shrew Soft VPN
2012-03-13 18:30 - 2012-02-17 06:34 - 0826880 ____A (Microsoft Corporation) C:\Windows\System32\rdpcore.dll
2012-03-13 18:30 - 2012-02-17 05:14 - 0183808 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\rdpwd.sys
2012-03-13 18:30 - 2012-02-17 05:13 - 0024576 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tdtcp.sys
2012-03-13 18:30 - 2012-01-25 06:27 - 0008192 ____A (Microsoft Corporation) C:\Windows\System32\rdrmemptylst.exe
2012-03-13 18:30 - 2010-11-20 11:21 - 0018432 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tdpipe.sys
2012-03-13 01:12 - 2012-03-13 01:12 - 0165368 ____A C:\Windows\System32\GDIPFONTCACHEV1.DAT
2012-03-13 01:05 - 2012-03-16 21:46 - 0009422 ____A C:\Windows\PFRO.log
2012-03-13 01:05 - 2012-03-13 01:46 - 0000000 ____D C:\Windows\System32\Shared Memory
2012-03-13 01:03 - 2012-03-13 01:03 - 0003016 ____A C:\Users\motzer\Desktop\mbam-log-2012-03-13 (01-02-56).txt
2012-03-13 01:03 - 2012-03-13 01:03 - 0003016 ____A C:\Documents and Settings\motzer\Desktop\mbam-log-2012-03-13 (01-02-56).txt
2012-03-12 22:29 - 2012-03-16 21:46 - 0003808 ____A C:\Windows\setupact.log
2012-03-12 22:29 - 2012-03-12 22:29 - 0000000 ____A C:\Windows\setuperr.log
2012-03-12 22:01 - 2012-03-12 22:01 - 0001187 ____A C:\Users\motzer\Desktop\Troja.txt
2012-03-12 22:01 - 2012-03-12 22:01 - 0001187 ____A C:\Documents and Settings\motzer\Desktop\Troja.txt
2012-03-12 21:38 - 2012-03-12 21:38 - 0388608 ____A (Trend Micro Inc.) C:\Users\motzer\Desktop\HiJackThis204.exe
2012-03-12 21:38 - 2012-03-12 21:38 - 0388608 ____A (Trend Micro Inc.) C:\Documents and Settings\motzer\Desktop\HiJackThis204.exe
2012-03-12 21:33 - 2012-03-12 21:33 - 0001071 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2012-03-12 21:33 - 2012-03-12 21:33 - 0001071 ____A C:\Documents and Settings\Public\Desktop\Malwarebytes Anti-Malware.lnk
2012-03-12 21:33 - 2012-03-12 21:33 - 0000000 ____D C:\Users\motzer\AppData\Roaming\Malwarebytes
2012-03-12 21:33 - 2012-03-12 21:33 - 0000000 ____D C:\Users\All Users\Malwarebytes
2012-03-12 21:33 - 2012-03-12 21:33 - 0000000 ____D C:\ProgramData\Malwarebytes
2012-03-12 21:33 - 2012-03-12 21:33 - 0000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2012-03-12 21:33 - 2012-03-12 21:33 - 0000000 ____D C:\Documents and Settings\motzer\AppData\Roaming\Malwarebytes
2012-03-12 21:33 - 2012-03-12 21:33 - 0000000 ____D C:\Documents and Settings\All Users\Malwarebytes
2012-03-12 21:33 - 2011-12-10 15:24 - 0020464 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2012-03-12 21:28 - 2012-03-12 21:28 - 9502424 ____A (Malwarebytes Corporation                                    ) C:\Users\motzer\Desktop\mbam-setup-1.60.1.1000.exe
2012-03-12 21:28 - 2012-03-12 21:28 - 9502424 ____A (Malwarebytes Corporation                                    ) C:\Documents and Settings\motzer\Desktop\mbam-setup-1.60.1.1000.exe
2012-03-12 21:19 - 2012-03-12 21:20 - 12410880 ____A C:\Users\motzer\Desktop\Ad-Aware96Install.msi
2012-03-12 21:19 - 2012-03-12 21:20 - 12410880 ____A C:\Documents and Settings\motzer\Desktop\Ad-Aware96Install.msi
2012-03-12 21:12 - 2012-03-12 21:12 - 0051570 ____A C:\Users\motzer\Documents\cc_20120312_211211.reg
2012-03-12 21:12 - 2012-03-12 21:12 - 0051570 ____A C:\Documents and Settings\motzer\Documents\cc_20120312_211211.reg
2012-03-12 21:11 - 2012-03-12 21:11 - 0000000 ____D C:\Users\motzer\AppData\Local\Sunbelt Software
2012-03-12 21:11 - 2012-03-12 21:11 - 0000000 ____D C:\Documents and Settings\motzer\AppData\Local\Sunbelt Software
2012-03-12 21:10 - 2012-03-12 21:10 - 0002135 ____A C:\Users\Public\Desktop\CounterSpy.lnk
2012-03-12 21:10 - 2012-03-12 21:10 - 0002135 ____A C:\Documents and Settings\Public\Desktop\CounterSpy.lnk
2012-03-12 21:10 - 2012-03-12 21:10 - 0000000 ____D C:\Program Files\Sunbelt Software
2012-03-12 21:07 - 2012-03-12 21:07 - 0000000 ____D C:\Windows\Downloaded Installations
2012-03-12 00:43 - 2012-03-12 00:43 - 0000000 ____D C:\Users\Public\Documents\National Instruments
2012-03-12 00:43 - 2012-03-12 00:43 - 0000000 ____D C:\Documents and Settings\Public\Documents\National Instruments
2012-03-12 00:39 - 2012-03-12 20:56 - 0000000 __ASH C:\Windows\System32\dds_trash_log.cmd
2012-03-12 00:15 - 2012-03-12 00:17 - 0000000 ____D C:\Users\motzer\Documents\LabVIEW Data
2012-03-12 00:15 - 2012-03-12 00:17 - 0000000 ____D C:\Documents and Settings\motzer\Documents\LabVIEW Data
2012-03-12 00:02 - 2012-03-12 00:02 - 0001039 ____A C:\Users\motzer\Desktop\National Instruments LabVIEW 2011.lnk
2012-03-12 00:02 - 2012-03-12 00:02 - 0001039 ____A C:\Documents and Settings\motzer\Desktop\National Instruments LabVIEW 2011.lnk
2012-03-12 00:01 - 2012-03-12 00:01 - 0001193 ____A C:\Users\All Users\Start Menu\Programs\Startup\NI Error Reporting.lnk
2012-03-12 00:01 - 2012-03-12 00:01 - 0001193 ____A C:\Documents and Settings\All Users\Start Menu\Programs\Startup\NI Error Reporting.lnk
2012-03-11 23:58 - 2012-03-11 23:58 - 0000000 ____D C:\Windows\System32\cvirte
2012-03-11 23:57 - 2012-03-13 18:23 - 0000000 ____D C:\Program Files\Microsoft Silverlight
2012-03-11 23:56 - 2012-03-12 00:45 - 0000000 ____D C:\Program Files\National Instruments
2012-03-11 23:53 - 2012-03-12 20:58 - 0000000 ____D C:\Users\All Users\National Instruments
2012-03-11 23:53 - 2012-03-12 20:58 - 0000000 ____D C:\ProgramData\National Instruments
2012-03-11 23:53 - 2012-03-12 20:58 - 0000000 ____D C:\Documents and Settings\All Users\National Instruments
2012-03-11 23:51 - 2012-03-12 00:42 - 0000000 ____D C:\National Instruments Downloads
2012-02-26 22:31 - 2012-02-26 22:31 - 0000000 ____D C:\Program Files\Maxima-5.26.0
2012-02-24 02:32 - 2012-02-24 02:32 - 9705472 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 3695416 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat
2012-02-24 02:32 - 2012-02-24 02:32 - 2382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2012-02-24 02:32 - 2012-02-24 02:32 - 1798656 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 1792000 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 1427456 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2012-02-24 02:32 - 2012-02-24 02:32 - 12282368 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 1127424 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 1103360 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0716800 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0580608 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0434176 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0420864 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0367104 ____A (Microsoft Corporation) C:\Windows\System32\html.iec
2012-02-24 02:32 - 2012-02-24 02:32 - 0353792 ____A (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0353584 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0231936 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0227840 ____A (Microsoft Corporation) C:\Windows\System32\ieaksie.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0223232 ____A (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0203776 ____A (Microsoft Corporation) C:\Windows\System32\webcheck.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0176640 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0163840 ____A (Microsoft Corporation) C:\Windows\System32\ieakui.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0162304 ____A (Microsoft Corporation) C:\Windows\System32\msrating.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0161792 ____A (Microsoft Corporation) C:\Windows\System32\msls31.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0152064 ____A (Microsoft Corporation) C:\Windows\System32\wextract.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0150528 ____A (Microsoft Corporation) C:\Windows\System32\iexpress.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0142848 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0130560 ____A (Microsoft Corporation) C:\Windows\System32\ieakeng.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0123392 ____A (Microsoft Corporation) C:\Windows\System32\occache.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0118784 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0110592 ____A (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0101888 ____A (Microsoft Corporation) C:\Windows\System32\admparse.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0086528 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0078848 ____A (Microsoft Corporation) C:\Windows\System32\inseng.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0076800 ____A (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0074752 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0074752 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0074240 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0072822 ____A C:\Windows\System32\ieuinit.inf
2012-02-24 02:32 - 2012-02-24 02:32 - 0072704 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0066048 ____A (Microsoft Corporation) C:\Windows\System32\icardie.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0065024 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0063488 ____A (Microsoft Corporation) C:\Windows\System32\tdc.ocx
2012-02-24 02:32 - 2012-02-24 02:32 - 0054272 ____A (Microsoft Corporation) C:\Windows\System32\pngfilt.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0048640 ____A (Microsoft Corporation) C:\Windows\System32\mshtmler.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0041472 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0035840 ____A (Microsoft Corporation) C:\Windows\System32\imgutil.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0031744 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0023552 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0011776 ____A (Microsoft Corporation) C:\Windows\System32\mshta.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0010752 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
2012-02-18 01:22 - 2012-02-18 01:22 - 0002362 ____A C:\Users\motzer\Desktop\CBH Captcha Solver.exe.lnk
2012-02-18 01:22 - 2012-02-18 01:22 - 0002362 ____A C:\Documents and Settings\motzer\Desktop\CBH Captcha Solver.exe.lnk
2012-02-18 01:22 - 2012-02-18 01:22 - 0000000 ____D C:\Program Files\Brotherhood Software
2012-02-18 01:21 - 2012-03-12 00:17 - 0000000 ____D C:\Users\motzer\AppData\Local\Captcha_Brotherhood
2012-02-18 01:21 - 2012-03-12 00:17 - 0000000 ____D C:\Documents and Settings\motzer\AppData\Local\Captcha_Brotherhood
2012-02-16 21:25 - 2012-01-04 09:59 - 12872704 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll
2012-02-16 21:25 - 2011-12-30 06:27 - 0478720 ____A (Microsoft Corporation) C:\Windows\System32\timedate.cpl
2012-02-16 21:25 - 2011-12-16 08:52 - 0690688 ____A (Microsoft Corporation) C:\Windows\System32\msvcrt.dll
2012-02-16 21:24 - 2012-01-04 09:58 - 0442880 ____A (Microsoft Corporation) C:\Windows\System32\ntshrui.dll


============ 3 Months Modified Files and Folders ===============

2012-03-16 21:56 - 2012-03-13 21:58 - 0000000 ____D C:\FRST
2012-03-16 21:51 - 2011-05-25 12:48 - 2004146 ____A C:\Windows\WindowsUpdate.log
2012-03-16 21:51 - 2009-07-14 05:34 - 0022064 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2012-03-16 21:51 - 2009-07-14 05:34 - 0022064 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2012-03-16 21:50 - 2011-05-25 12:51 - 1612484 ____A C:\Windows\System32\PerfStringBackup.INI
2012-03-16 21:48 - 2011-06-24 20:33 - 0000000 ___RD C:\Users\motzer\Dropbox
2012-03-16 21:48 - 2011-06-24 20:33 - 0000000 ___RD C:\Documents and Settings\motzer\Dropbox
2012-03-16 21:48 - 2011-06-24 20:31 - 0000000 ____D C:\Users\motzer\AppData\Roaming\Dropbox
2012-03-16 21:48 - 2011-06-24 20:31 - 0000000 ____D C:\Documents and Settings\motzer\AppData\Roaming\Dropbox
2012-03-16 21:47 - 2009-07-14 03:36 - 0000000 __SHD C:\$Recycle.Bin
2012-03-16 21:46 - 2012-03-13 01:05 - 0009422 ____A C:\Windows\PFRO.log
2012-03-16 21:46 - 2012-03-12 22:29 - 0003808 ____A C:\Windows\setupact.log
2012-03-16 21:46 - 2011-05-25 12:41 - 1609175040 __ASH C:\hiberfil.sys
2012-03-16 21:46 - 2009-07-14 05:53 - 0000006 ___AH C:\Windows\Tasks\SA.DAT
2012-03-16 00:09 - 2012-03-14 21:30 - 0007601 ____A C:\Users\motzer\AppData\Local\Resmon.ResmonCfg
2012-03-16 00:09 - 2012-03-14 21:30 - 0007601 ____A C:\Documents and Settings\motzer\AppData\Local\Resmon.ResmonCfg
2012-03-15 22:24 - 2012-03-15 22:17 - 0000000 ___SD C:\ComboFix
2012-03-15 22:17 - 2012-03-15 22:17 - 0000000 ____D C:\Qoobox
2012-03-15 22:17 - 2012-03-14 01:02 - 0000000 ____D C:\Windows\ERDNT
2012-03-15 22:15 - 2012-03-15 22:15 - 4436988 ____R (Swearware) C:\Users\motzer\Desktop\ComboFix.exe
2012-03-15 22:15 - 2012-03-15 22:15 - 4436988 ____R (Swearware) C:\Documents and Settings\motzer\Desktop\ComboFix.exe
2012-03-15 20:49 - 2009-07-14 03:37 - 0000000 ____D C:\Windows\Microsoft.NET
2012-03-15 20:35 - 2012-03-15 20:35 - 4731392 ____A (AVAST Software) C:\Users\motzer\Desktop\aswMBR.exe
2012-03-15 20:35 - 2012-03-15 20:35 - 4731392 ____A (AVAST Software) C:\Documents and Settings\motzer\Desktop\aswMBR.exe
2012-03-15 20:35 - 2012-03-15 20:35 - 2063920 ____A (Kaspersky Lab ZAO) C:\Users\motzer\Desktop\tdsskiller.exe
2012-03-15 20:35 - 2012-03-15 20:35 - 2063920 ____A (Kaspersky Lab ZAO) C:\Documents and Settings\motzer\Desktop\tdsskiller.exe
2012-03-15 20:10 - 2012-03-15 19:09 - 0305120 ____A C:\Windows\ntbtlog.txt
2012-03-15 19:40 - 2012-03-15 19:31 - 0059618 ____A C:\Windows\avmacc.log
2012-03-15 19:40 - 2012-03-15 19:31 - 0017411 ____A C:\Windows\AVMInstall.Log
2012-03-15 19:40 - 2012-03-15 19:31 - 0009330 ____A C:\Windows\avmsetup.log
2012-03-15 19:40 - 2012-03-15 19:31 - 0002266 ____A C:\Windows\avmadd32.log
2012-03-15 19:40 - 2012-03-15 19:26 - 0026658 ____A C:\Windows\avmfwlanci.log
2012-03-15 19:40 - 2011-05-25 15:04 - 0000000 ____D C:\Program Files\avmwlanstick
2012-03-15 19:33 - 2012-03-15 19:31 - 0009607 ____A C:\Windows\avmsetup1.log
2012-03-15 19:33 - 2012-03-15 19:31 - 0002442 ____A C:\Windows\avmadd321.log
2012-03-15 19:33 - 2009-07-14 03:37 - 0000000 ____D C:\Windows\System32\NDF
2012-03-15 19:31 - 2012-03-15 19:31 - 0000413 ____A C:\Windows\avmacc1.log
2012-03-15 19:19 - 2012-03-15 19:19 - 0019914 ____A C:\Users\motzer\Desktop\Wlan.png
2012-03-15 19:19 - 2012-03-15 19:19 - 0019914 ____A C:\Documents and Settings\motzer\Desktop\Wlan.png
2012-03-15 19:11 - 2011-06-21 14:40 - 0000000 ____D C:\Users\motzer\AppData\Local\ElevatedDiagnostics
2012-03-15 19:11 - 2011-06-21 14:40 - 0000000 ____D C:\Documents and Settings\motzer\AppData\Local\ElevatedDiagnostics
2012-03-15 18:51 - 2011-05-25 12:47 - 0000174 ___SH C:\Users\motzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
2012-03-15 18:51 - 2011-05-25 12:47 - 0000174 ___SH C:\Documents and Settings\motzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
2012-03-15 18:45 - 2009-07-14 05:33 - 0544032 ____A C:\Windows\System32\FNTCACHE.DAT
2012-03-14 22:06 - 2009-07-14 09:57 - 0000000 ____D C:\Program Files\Windows Journal
2012-03-14 22:06 - 2009-07-14 09:47 - 0000000 ____D C:\Windows\System32\Drivers\de-DE
2012-03-14 22:06 - 2009-07-14 09:47 - 0000000 ____D C:\Windows\de-DE
2012-03-14 22:06 - 2009-07-14 05:52 - 0000000 ____D C:\Program Files\Windows Sidebar
2012-03-14 22:06 - 2009-07-14 05:52 - 0000000 ____D C:\Program Files\Windows Portable Devices
2012-03-14 22:06 - 2009-07-14 05:52 - 0000000 ____D C:\Program Files\Windows Photo Viewer
2012-03-14 22:06 - 2009-07-14 05:52 - 0000000 ____D C:\Program Files\Windows Defender
2012-03-14 22:06 - 2009-07-14 05:52 - 0000000 ____D C:\Program Files\DVD Maker
2012-03-14 22:06 - 2009-07-14 03:37 - 0000000 ____D C:\Windows\System32\de-DE
2012-03-14 22:06 - 2009-07-14 03:37 - 0000000 ____D C:\Windows\System32\AdvancedInstallers
2012-03-14 22:06 - 2009-07-14 03:37 - 0000000 ____D C:\Program Files\Common Files\System
2012-03-14 22:05 - 2009-07-14 03:37 - 0000000 ____D C:\Windows\System32\DriverStore
2012-03-14 21:56 - 2009-07-14 03:05 - 0152576 ____A (Microsoft Corporation) C:\Windows\System32\msclmd.dll
2012-03-14 21:50 - 2012-03-14 21:50 - 0000000 ____D C:\Windows\System32\SPReview
2012-03-14 21:49 - 2012-03-14 21:49 - 0000000 ____D C:\Windows\System32\EventProviders
2012-03-14 21:41 - 2012-03-14 21:41 - 0095045 ____A C:\Users\motzer\Desktop\Resourcen.png
2012-03-14 21:41 - 2012-03-14 21:41 - 0095045 ____A C:\Documents and Settings\motzer\Desktop\Resourcen.png
2012-03-14 21:37 - 2012-03-14 21:37 - 0019004 ____A C:\Users\motzer\Desktop\Combofix_2.png
2012-03-14 21:37 - 2012-03-14 21:37 - 0019004 ____A C:\Documents and Settings\motzer\Desktop\Combofix_2.png
2012-03-14 21:27 - 2012-03-14 21:27 - 0034130 ____A C:\Users\motzer\Desktop\Combofix.png
2012-03-14 21:27 - 2012-03-14 21:27 - 0034130 ____A C:\Documents and Settings\motzer\Desktop\Combofix.png
2012-03-14 00:52 - 2012-03-14 00:52 - 0000334 ____A C:\Users\motzer\Desktop\Fixlist.txt
2012-03-14 00:52 - 2012-03-14 00:52 - 0000334 ____A C:\Documents and Settings\motzer\Desktop\Fixlist.txt
2012-03-13 23:22 - 2011-10-25 13:43 - 0000000 ____D C:\Users\All Users\Microsoft Help
2012-03-13 23:22 - 2011-10-25 13:43 - 0000000 ____D C:\ProgramData\Microsoft Help
2012-03-13 23:22 - 2011-10-25 13:43 - 0000000 ____D C:\Documents and Settings\All Users\Microsoft Help
2012-03-13 23:17 - 2011-05-25 15:39 - 0165368 ____A C:\Users\motzer\AppData\Local\GDIPFONTCACHEV1.DAT
2012-03-13 23:17 - 2011-05-25 15:39 - 0165368 ____A C:\Documents and Settings\motzer\AppData\Local\GDIPFONTCACHEV1.DAT
2012-03-13 21:31 - 2012-03-13 20:36 - 2509058048 ____A C:\Users\motzer\Desktop\X17-59886.iso
2012-03-13 21:31 - 2012-03-13 20:36 - 2509058048 ____A C:\Documents and Settings\motzer\Desktop\X17-59886.iso
2012-03-13 20:28 - 2012-03-13 19:07 - 0000000 ____D C:\Program Files\ShrewSoft
2012-03-13 20:27 - 2012-03-13 19:12 - 0000000 ____D C:\Users\motzer\AppData\Local\LogMeIn Hamachi
2012-03-13 20:27 - 2012-03-13 19:12 - 0000000 ____D C:\Documents and Settings\motzer\AppData\Local\LogMeIn Hamachi
2012-03-13 20:25 - 2012-03-13 19:15 - 0001594 ____A C:\Windows\VPNUnInstall.MIF
2012-03-13 19:19 - 2011-06-24 17:53 - 0001594 ____A C:\Windows\VPNInstall.MIF
2012-03-13 19:07 - 2012-03-13 19:07 - 0000000 ____D C:\Users\motzer\Documents\Shrew Soft VPN
2012-03-13 19:07 - 2012-03-13 19:07 - 0000000 ____D C:\Documents and Settings\motzer\Documents\Shrew Soft VPN
2012-03-13 18:37 - 2011-05-25 20:21 - 0000000 ____D C:\Program Files\Mozilla Firefox
2012-03-13 18:23 - 2012-03-11 23:57 - 0000000 ____D C:\Program Files\Microsoft Silverlight
2012-03-13 01:46 - 2012-03-13 01:05 - 0000000 ____D C:\Windows\System32\Shared Memory
2012-03-13 01:33 - 2011-08-22 12:57 - 0000000 ____D C:\Users\motzer\AppData\Local\Samsung
2012-03-13 01:33 - 2011-08-22 12:57 - 0000000 ____D C:\Documents and Settings\motzer\AppData\Local\Samsung
2012-03-13 01:33 - 2011-08-22 12:42 - 0000000 ____D C:\Users\All Users\Samsung
2012-03-13 01:33 - 2011-08-22 12:42 - 0000000 ____D C:\ProgramData\Samsung
2012-03-13 01:33 - 2011-08-22 12:42 - 0000000 ____D C:\Documents and Settings\All Users\Samsung
2012-03-13 01:33 - 2011-05-25 15:12 - 0000000 ___HD C:\Program Files\InstallShield Installation Information
2012-03-13 01:12 - 2012-03-13 01:12 - 0165368 ____A C:\Windows\System32\GDIPFONTCACHEV1.DAT
2012-03-13 01:05 - 2009-07-14 03:37 - 0000000 ____D C:\Windows\Branding
2012-03-13 01:03 - 2012-03-13 01:03 - 0003016 ____A C:\Users\motzer\Desktop\mbam-log-2012-03-13 (01-02-56).txt
2012-03-13 01:03 - 2012-03-13 01:03 - 0003016 ____A C:\Documents and Settings\motzer\Desktop\mbam-log-2012-03-13 (01-02-56).txt
2012-03-12 22:29 - 2012-03-12 22:29 - 0000000 ____A C:\Windows\setuperr.log
2012-03-12 22:01 - 2012-03-12 22:01 - 0001187 ____A C:\Users\motzer\Desktop\Troja.txt
2012-03-12 22:01 - 2012-03-12 22:01 - 0001187 ____A C:\Documents and Settings\motzer\Desktop\Troja.txt
2012-03-12 21:38 - 2012-03-12 21:38 - 0388608 ____A (Trend Micro Inc.) C:\Users\motzer\Desktop\HiJackThis204.exe
2012-03-12 21:38 - 2012-03-12 21:38 - 0388608 ____A (Trend Micro Inc.) C:\Documents and Settings\motzer\Desktop\HiJackThis204.exe
2012-03-12 21:33 - 2012-03-12 21:33 - 0001071 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2012-03-12 21:33 - 2012-03-12 21:33 - 0001071 ____A C:\Documents and Settings\Public\Desktop\Malwarebytes Anti-Malware.lnk
2012-03-12 21:33 - 2012-03-12 21:33 - 0000000 ____D C:\Users\motzer\AppData\Roaming\Malwarebytes
2012-03-12 21:33 - 2012-03-12 21:33 - 0000000 ____D C:\Users\All Users\Malwarebytes
2012-03-12 21:33 - 2012-03-12 21:33 - 0000000 ____D C:\ProgramData\Malwarebytes
2012-03-12 21:33 - 2012-03-12 21:33 - 0000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2012-03-12 21:33 - 2012-03-12 21:33 - 0000000 ____D C:\Documents and Settings\motzer\AppData\Roaming\Malwarebytes
2012-03-12 21:33 - 2012-03-12 21:33 - 0000000 ____D C:\Documents and Settings\All Users\Malwarebytes
2012-03-12 21:28 - 2012-03-12 21:28 - 9502424 ____A (Malwarebytes Corporation                                    ) C:\Users\motzer\Desktop\mbam-setup-1.60.1.1000.exe
2012-03-12 21:28 - 2012-03-12 21:28 - 9502424 ____A (Malwarebytes Corporation                                    ) C:\Documents and Settings\motzer\Desktop\mbam-setup-1.60.1.1000.exe
2012-03-12 21:20 - 2012-03-12 21:19 - 12410880 ____A C:\Users\motzer\Desktop\Ad-Aware96Install.msi
2012-03-12 21:20 - 2012-03-12 21:19 - 12410880 ____A C:\Documents and Settings\motzer\Desktop\Ad-Aware96Install.msi
2012-03-12 21:12 - 2012-03-12 21:12 - 0051570 ____A C:\Users\motzer\Documents\cc_20120312_211211.reg
2012-03-12 21:12 - 2012-03-12 21:12 - 0051570 ____A C:\Documents and Settings\motzer\Documents\cc_20120312_211211.reg
2012-03-12 21:11 - 2012-03-12 21:11 - 0000000 ____D C:\Users\motzer\AppData\Local\Sunbelt Software
2012-03-12 21:11 - 2012-03-12 21:11 - 0000000 ____D C:\Documents and Settings\motzer\AppData\Local\Sunbelt Software
2012-03-12 21:10 - 2012-03-12 21:10 - 0002135 ____A C:\Users\Public\Desktop\CounterSpy.lnk
2012-03-12 21:10 - 2012-03-12 21:10 - 0002135 ____A C:\Documents and Settings\Public\Desktop\CounterSpy.lnk
2012-03-12 21:10 - 2012-03-12 21:10 - 0000000 ____D C:\Program Files\Sunbelt Software
2012-03-12 21:07 - 2012-03-12 21:07 - 0000000 ____D C:\Windows\Downloaded Installations
2012-03-12 21:07 - 2011-09-15 22:09 - 0000000 ____D C:\Users\motzer\AppData\Roaming\TS3Client
2012-03-12 21:07 - 2011-09-15 22:09 - 0000000 ____D C:\Documents and Settings\motzer\AppData\Roaming\TS3Client
2012-03-12 21:07 - 2011-08-04 13:50 - 0000000 ____D C:\Windows\Minidump
2012-03-12 21:07 - 2011-05-26 23:10 - 0000000 ____D C:\Users\motzer\AppData\Roaming\Skype
2012-03-12 21:07 - 2011-05-26 23:10 - 0000000 ____D C:\Documents and Settings\motzer\AppData\Roaming\Skype
2012-03-12 21:07 - 2011-05-25 13:40 - 0000000 ____D C:\Windows\Panther
2012-03-12 21:01 - 2011-07-28 11:31 - 0000000 ____D C:\Program Files\CCleaner
2012-03-12 20:58 - 2012-03-11 23:53 - 0000000 ____D C:\Users\All Users\National Instruments
2012-03-12 20:58 - 2012-03-11 23:53 - 0000000 ____D C:\ProgramData\National Instruments
2012-03-12 20:58 - 2012-03-11 23:53 - 0000000 ____D C:\Documents and Settings\All Users\National Instruments
2012-03-12 20:56 - 2012-03-12 00:39 - 0000000 __ASH C:\Windows\System32\dds_trash_log.cmd
2012-03-12 00:45 - 2012-03-11 23:56 - 0000000 ____D C:\Program Files\National Instruments
2012-03-12 00:44 - 2011-05-25 17:39 - 0000000 ____D C:\Program Files\Common Files\Merge Modules
2012-03-12 00:43 - 2012-03-12 00:43 - 0000000 ____D C:\Users\Public\Documents\National Instruments
2012-03-12 00:43 - 2012-03-12 00:43 - 0000000 ____D C:\Documents and Settings\Public\Documents\National Instruments
2012-03-12 00:42 - 2012-03-11 23:51 - 0000000 ____D C:\National Instruments Downloads
2012-03-12 00:17 - 2012-03-12 00:15 - 0000000 ____D C:\Users\motzer\Documents\LabVIEW Data
2012-03-12 00:17 - 2012-03-12 00:15 - 0000000 ____D C:\Documents and Settings\motzer\Documents\LabVIEW Data
2012-03-12 00:17 - 2012-02-18 01:21 - 0000000 ____D C:\Users\motzer\AppData\Local\Captcha_Brotherhood
2012-03-12 00:17 - 2012-02-18 01:21 - 0000000 ____D C:\Documents and Settings\motzer\AppData\Local\Captcha_Brotherhood
2012-03-12 00:02 - 2012-03-12 00:02 - 0001039 ____A C:\Users\motzer\Desktop\National Instruments LabVIEW 2011.lnk
2012-03-12 00:02 - 2012-03-12 00:02 - 0001039 ____A C:\Documents and Settings\motzer\Desktop\National Instruments LabVIEW 2011.lnk
2012-03-12 00:01 - 2012-03-12 00:01 - 0001193 ____A C:\Users\All Users\Start Menu\Programs\Startup\NI Error Reporting.lnk
2012-03-12 00:01 - 2012-03-12 00:01 - 0001193 ____A C:\Documents and Settings\All Users\Start Menu\Programs\Startup\NI Error Reporting.lnk
2012-03-11 23:58 - 2012-03-11 23:58 - 0000000 ____D C:\Windows\System32\cvirte
2012-03-09 23:58 - 2011-05-25 20:21 - 0000000 ____D C:\Program Files\JDownloader
2012-03-04 16:23 - 2012-03-14 21:46 - 54215544 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2012-03-02 21:02 - 2011-05-25 15:11 - 0000000 ____D C:\Users\motzer\AppData\Roaming\ICQ
2012-03-02 21:02 - 2011-05-25 15:11 - 0000000 ____D C:\Documents and Settings\motzer\AppData\Roaming\ICQ
2012-03-01 16:18 - 2011-07-15 16:07 - 0000000 ____D C:\Users\motzer\Documents\FinePrint-Dateien
2012-03-01 16:18 - 2011-07-15 16:07 - 0000000 ____D C:\Documents and Settings\motzer\Documents\FinePrint-Dateien
2012-02-28 00:43 - 2011-06-24 20:32 - 0000997 ____A C:\Users\motzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
2012-02-28 00:43 - 2011-06-24 20:32 - 0000997 ____A C:\Documents and Settings\motzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
2012-02-26 22:31 - 2012-02-26 22:31 - 0000000 ____D C:\Program Files\Maxima-5.26.0
2012-02-25 01:32 - 2009-07-14 03:37 - 0000000 ____D C:\Windows\rescache
2012-02-24 02:32 - 2012-02-24 02:32 - 9705472 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 3695416 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat
2012-02-24 02:32 - 2012-02-24 02:32 - 2382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2012-02-24 02:32 - 2012-02-24 02:32 - 1798656 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 1792000 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 1427456 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2012-02-24 02:32 - 2012-02-24 02:32 - 12282368 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 1127424 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 1103360 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0716800 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0580608 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0434176 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0420864 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0367104 ____A (Microsoft Corporation) C:\Windows\System32\html.iec
2012-02-24 02:32 - 2012-02-24 02:32 - 0353792 ____A (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0353584 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0231936 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0227840 ____A (Microsoft Corporation) C:\Windows\System32\ieaksie.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0223232 ____A (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0203776 ____A (Microsoft Corporation) C:\Windows\System32\webcheck.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0176640 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0163840 ____A (Microsoft Corporation) C:\Windows\System32\ieakui.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0162304 ____A (Microsoft Corporation) C:\Windows\System32\msrating.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0161792 ____A (Microsoft Corporation) C:\Windows\System32\msls31.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0152064 ____A (Microsoft Corporation) C:\Windows\System32\wextract.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0150528 ____A (Microsoft Corporation) C:\Windows\System32\iexpress.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0142848 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0130560 ____A (Microsoft Corporation) C:\Windows\System32\ieakeng.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0123392 ____A (Microsoft Corporation) C:\Windows\System32\occache.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0118784 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0110592 ____A (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0101888 ____A (Microsoft Corporation) C:\Windows\System32\admparse.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0086528 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0078848 ____A (Microsoft Corporation) C:\Windows\System32\inseng.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0076800 ____A (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0074752 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0074752 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0074240 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0072822 ____A C:\Windows\System32\ieuinit.inf
2012-02-24 02:32 - 2012-02-24 02:32 - 0072704 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0066048 ____A (Microsoft Corporation) C:\Windows\System32\icardie.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0065024 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0063488 ____A (Microsoft Corporation) C:\Windows\System32\tdc.ocx
2012-02-24 02:32 - 2012-02-24 02:32 - 0054272 ____A (Microsoft Corporation) C:\Windows\System32\pngfilt.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0048640 ____A (Microsoft Corporation) C:\Windows\System32\mshtmler.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0041472 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0035840 ____A (Microsoft Corporation) C:\Windows\System32\imgutil.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0031744 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0023552 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2012-02-24 02:32 - 2012-02-24 02:32 - 0011776 ____A (Microsoft Corporation) C:\Windows\System32\mshta.exe
2012-02-24 02:32 - 2012-02-24 02:32 - 0010752 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
2012-02-21 19:17 - 2011-05-25 15:49 - 0414368 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2012-02-20 00:22 - 2011-06-22 19:40 - 0000692 ____A C:\Users\motzer\Desktop\Kino.txt
2012-02-20 00:22 - 2011-06-22 19:40 - 0000692 ____A C:\Documents and Settings\motzer\Desktop\Kino.txt
2012-02-20 00:05 - 2011-05-25 15:51 - 0000000 ____D C:\Program Files\Mozilla Thunderbird
2012-02-18 01:22 - 2012-02-18 01:22 - 0002362 ____A C:\Users\motzer\Desktop\CBH Captcha Solver.exe.lnk
2012-02-18 01:22 - 2012-02-18 01:22 - 0002362 ____A C:\Documents and Settings\motzer\Desktop\CBH Captcha Solver.exe.lnk
2012-02-18 01:22 - 2012-02-18 01:22 - 0000000 ____D C:\Program Files\Brotherhood Software
2012-02-17 06:34 - 2012-03-13 18:30 - 0826880 ____A (Microsoft Corporation) C:\Windows\System32\rdpcore.dll
2012-02-17 05:14 - 2012-03-13 18:30 - 0183808 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\rdpwd.sys
2012-02-17 05:13 - 2012-03-13 18:30 - 0024576 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tdtcp.sys
2012-02-12 15:35 - 2011-10-26 13:35 - 0000000 ____D C:\Users\motzer\AppData\Local\Deployment
2012-02-12 15:35 - 2011-10-26 13:35 - 0000000 ____D C:\Documents and Settings\motzer\AppData\Local\Deployment
2012-02-12 14:46 - 2012-02-12 14:45 - 0000000 ____D C:\Program Files\iTunes
2012-02-12 14:45 - 2012-02-12 14:45 - 0000000 ____D C:\Program Files\iPod
2012-02-12 14:45 - 2011-05-25 16:41 - 0000000 ____D C:\Program Files\Common Files\Apple
2012-02-10 06:38 - 2012-03-13 20:30 - 1077248 ____A (Microsoft Corporation) C:\Windows\System32\DWrite.dll
2012-02-06 18:40 - 2012-02-06 18:40 - 0000000 ____D C:\Users\motzer\Desktop\RT Vorbereitung
2012-02-06 18:40 - 2012-02-06 18:40 - 0000000 ____D C:\Documents and Settings\motzer\Desktop\RT Vorbereitung
2012-02-03 04:54 - 2012-03-13 20:30 - 2343424 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2012-01-27 17:22 - 2011-05-25 15:07 - 0000000 ____D C:\Program Files\Opera
2012-01-25 15:34 - 2011-05-26 23:10 - 0000000 ___RD C:\Program Files\Skype
2012-01-25 15:34 - 2011-05-26 23:09 - 0000000 ____D C:\Users\All Users\Skype
2012-01-25 15:34 - 2011-05-26 23:09 - 0000000 ____D C:\ProgramData\Skype
2012-01-25 15:34 - 2011-05-26 23:09 - 0000000 ____D C:\Documents and Settings\All Users\Skype
2012-01-25 06:32 - 2012-03-15 18:54 - 0129536 ____A (Microsoft Corporation) C:\Windows\System32\rdpcorekmts.dll
2012-01-25 06:32 - 2012-03-15 18:54 - 0058880 ____A (Microsoft Corporation) C:\Windows\System32\rdpwsx.dll
2012-01-25 06:27 - 2012-03-13 18:30 - 0008192 ____A (Microsoft Corporation) C:\Windows\System32\rdrmemptylst.exe
2012-01-23 21:26 - 2012-01-23 20:53 - 0000798 ____A C:\Windows\Ulead32.ini
2012-01-23 21:26 - 2012-01-23 20:53 - 0000000 ____D C:\Windows\ULEAD.DAT
2012-01-23 20:54 - 2012-01-23 20:54 - 0000000 ____D C:\Program Files\iPhoto Plus 4
2012-01-23 20:53 - 2012-01-23 20:53 - 0000000 _RASH C:\MSDOS.SYS
2012-01-23 20:53 - 2012-01-23 20:53 - 0000000 _RASH C:\IO.SYS
2012-01-14 00:31 - 2011-07-06 11:19 - 0001106 ____A C:\Users\motzer\Desktop\Zitate.txt
2012-01-14 00:31 - 2011-07-06 11:19 - 0001106 ____A C:\Documents and Settings\motzer\Desktop\Zitate.txt
2012-01-13 15:59 - 2011-05-25 16:42 - 0017408 ____A C:\Users\motzer\AppData\Local\WebpageIcons.db
2012-01-13 15:59 - 2011-05-25 16:42 - 0017408 ____A C:\Documents and Settings\motzer\AppData\Local\WebpageIcons.db
2012-01-13 14:57 - 2011-10-10 23:26 - 0000000 ____D C:\Users\motzer\Documents\Inventor
2012-01-13 14:57 - 2011-10-10 23:26 - 0000000 ____D C:\Documents and Settings\motzer\Documents\Inventor
2012-01-12 13:25 - 2011-10-10 20:07 - 0000000 ____D C:\Users\motzer\AppData\Roaming\toolplugin
2012-01-12 13:25 - 2011-10-10 20:07 - 0000000 ____D C:\Documents and Settings\motzer\AppData\Roaming\toolplugin
2012-01-10 17:05 - 2011-09-20 01:50 - 0000000 ____D C:\Users\motzer\Documents\MATLAB
2012-01-10 17:05 - 2011-09-20 01:50 - 0000000 ____D C:\Documents and Settings\motzer\Documents\MATLAB
2012-01-09 18:18 - 2011-05-25 16:43 - 0000000 ____D C:\Users\motzer\AppData\Roaming\Apple Computer
2012-01-09 18:18 - 2011-05-25 16:43 - 0000000 ____D C:\Documents and Settings\motzer\AppData\Roaming\Apple Computer
2012-01-09 18:15 - 2012-01-09 18:13 - 0000000 ____D C:\Users\motzer\AppData\Roaming\DVDVideoSoftIEHelpers
2012-01-09 18:15 - 2012-01-09 18:13 - 0000000 ____D C:\Users\motzer\AppData\Roaming\DVDVideoSoft
2012-01-09 18:15 - 2012-01-09 18:13 - 0000000 ____D C:\Documents and Settings\motzer\AppData\Roaming\DVDVideoSoftIEHelpers
2012-01-09 18:15 - 2012-01-09 18:13 - 0000000 ____D C:\Documents and Settings\motzer\AppData\Roaming\DVDVideoSoft
2012-01-09 18:15 - 2011-05-26 19:19 - 0000000 ____D C:\Users\motzer\Documents\DVDVideoSoft
2012-01-09 18:15 - 2011-05-26 19:19 - 0000000 ____D C:\Documents and Settings\motzer\Documents\DVDVideoSoft
2012-01-09 18:15 - 2011-05-26 19:18 - 0000000 ____D C:\Program Files\DVDVideoSoft
2012-01-09 18:15 - 2011-05-26 19:18 - 0000000 ____D C:\Program Files\Common Files\DVDVideoSoft
2012-01-09 18:09 - 2012-01-09 18:09 - 0000000 ____D C:\Users\motzer\Documents\FILSHtray
2012-01-09 18:09 - 2012-01-09 18:09 - 0000000 ____D C:\Users\motzer\AppData\Local\FILSH_Media_GmbH
2012-01-09 18:09 - 2012-01-09 18:09 - 0000000 ____D C:\Documents and Settings\motzer\Documents\FILSHtray
2012-01-09 18:09 - 2012-01-09 18:09 - 0000000 ____D C:\Documents and Settings\motzer\AppData\Local\FILSH_Media_GmbH
2012-01-04 09:59 - 2012-02-16 21:25 - 12872704 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll
2012-01-04 09:58 - 2012-02-16 21:24 - 0442880 ____A (Microsoft Corporation) C:\Windows\System32\ntshrui.dll
2011-12-30 06:27 - 2012-02-16 21:25 - 0478720 ____A (Microsoft Corporation) C:\Windows\System32\timedate.cpl
2011-12-20 14:11 - 2011-12-20 14:11 - 0055904 ____A (National Instruments Corporation) C:\Windows\System32\XSpyDll.dll
2011-12-20 13:16 - 2011-12-20 13:16 - 0378064 ____A (National Instruments Corporation) C:\Windows\System32\niemca2l.dll

========================= Known DLLs (Whitelisted) ============


========================= Bamital & volsnap Check ============

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

========================= Memory info ======================

Percentage of memory in use: 22%
Total physical RAM: 2046.18 MB
Available physical RAM: 1583.91 MB
Total Pagefile: 2046.18 MB
Available Pagefile: 1587.7 MB
Total Virtual: 2047.88 MB
Available Virtual: 1967.21 MB

======================= Partitions =========================

1 Drive c: () (Fixed) (Total:222.78 GB) (Free:136.83 GB) NTFS ==>[Drive with boot components (obtanied from BCD)]
2 Drive d: (DATAPART1) (Fixed) (Total:232.83 GB) (Free:45.6 GB) NTFS
3 Drive e: (Elektronik) (Fixed) (Total:10 GB) (Free:6.74 GB) NTFS
5 Drive g: (GSP1RMCPRFRER_DE_DVD) (CDROM) (Total:2.34 GB) (Free:0 GB) UDF
6 Drive h: () (Removable) (Total:0.94 GB) (Free:0.94 GB) FAT
11 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

  Datentr„ger ###  Status        Gr”áe    Frei    Dyn  GPT
  ---------------  -------------  -------  -------  ---  ---
  Datentr„ger 0    Online          232 GB      0 B       
  Datentr„ger 1    Online          232 GB      0 B       
  Datentr„ger 2    Online          965 MB      0 B       
  Datentr„ger 3    Kein Medium        0 B      0 B       
  Datentr„ger 4    Kein Medium        0 B      0 B       
  Datentr„ger 5    Kein Medium        0 B      0 B       
  Datentr„ger 6    Kein Medium        0 B      0 B       

Partitions of Disk 0:
===============

  Partition ###  Typ              Gr”áe    Offset
  -------------  ----------------  -------  -------
  Partition 1    OEM                54 MB    31 KB
  Partition 2    Prim„r              10 GB    55 MB
  Partition 3    Prim„r            222 GB    10 GB

======================================================================================================

Disk: 0
Partition 1
Typ      : DE
Versteckt: Ja
Aktiv    : Nein

  Volume ###  Bst  Bezeichnung  DS    Typ        Gr”áe    Status    Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 10                    FAT    Partition    54 MB  Fehlerfre  Versteck

======================================================================================================

Disk: 0
Partition 2
Typ      : 07
Versteckt: Nein
Aktiv    : Nein

  Volume ###  Bst  Bezeichnung  DS    Typ        Gr”áe    Status    Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 2    E  Elektronik  NTFS  Partition    10 GB  Fehlerfre         

======================================================================================================

Disk: 0
Partition 3
Typ      : 07
Versteckt: Nein
Aktiv    : Ja

  Volume ###  Bst  Bezeichnung  DS    Typ        Gr”áe    Status    Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 3    C                NTFS  Partition    222 GB  Fehlerfre         

======================================================================================================

Partitions of Disk 1:
===============

  Partition ###  Typ              Gr”áe    Offset
  -------------  ----------------  -------  -------
  Partition 1    Prim„r            232 GB  1024 KB

======================================================================================================

Disk: 1
Partition 1
Typ      : 07
Versteckt: Nein
Aktiv    : Nein

  Volume ###  Bst  Bezeichnung  DS    Typ        Gr”áe    Status    Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 4    D  DATAPART1    NTFS  Partition    232 GB  Fehlerfre         

======================================================================================================

Partitions of Disk 2:
===============

  Partition ###  Typ              Gr”áe    Offset
  -------------  ----------------  -------  -------
  Partition 1    Prim„r            962 MB  1788 KB

======================================================================================================

Disk: 2
Partition 1
Typ      : 06
Versteckt: Nein
Aktiv    : Nein

  Volume ###  Bst  Bezeichnung  DS    Typ        Gr”áe    Status    Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 5    H                FAT    Wechselmed  962 MB  Fehlerfre         

======================================================================================================

Partitions of Disk 3:
===============

Auf diesem Datentr„ger sind keine Partitionen, die angezeigt werden k”nnen, vorhanden.

======================================================================================================

Partitions of Disk 4:
===============

Auf diesem Datentr„ger sind keine Partitionen, die angezeigt werden k”nnen, vorhanden.

======================================================================================================

Partitions of Disk 5:
===============

Auf diesem Datentr„ger sind keine Partitionen, die angezeigt werden k”nnen, vorhanden.

======================================================================================================

Partitions of Disk 6:
===============

Auf diesem Datentr„ger sind keine Partitionen, die angezeigt werden k”nnen, vorhanden.

======================================================================================================

==========================================================

Last Boot: 2012-03-10 00:57

======================= End Of Log ==========================

mfg
motzer

Psychotic 17.03.2012 11:25
Schritt 1: Fix mit FRST


Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument
Code:
HKLM\...\Run: []
2 ntservice1; C:\Windows\System32\NETw5x32.dll

C:\Windows\System32\NETw5x32.dll
Speichere diese bitte als Fixlist.txt auf deinem USB Stick.
  • Starte deinen Rechner erneut in die Reparaturoptionen
  • Starte nun die FRST.exe erneut und klicke den Fix Button.
Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.


Schritt 2: Gmer


Bitte
  • alle anderen Scanner gegen Viren, Spyware, usw. deaktivieren,
  • keine bestehende Verbindung zu einem Netzwerk/Internet (WLAN nicht vergessen),
  • nichts am Rechner arbeiten,
  • nach jedem Scan der Rechner neu gestarten.
Gmer scannen lassen
  • Lade Dir Gmer von dieser Seite herunter
    (auf den Button Download EXE drücken) und das Programm auf dem Desktop speichern.
  • Alle anderen Programme sollen geschlossen sein.
  • Starte gmer.exe (Programm hat einen willkürlichen Programm-Namen).
    Vista und Win7 User mit Rechtsklick und als Administrator starten.
  • Sollte sich ein Fenster mit folgender Warnung öffnen:
    WARNING !!!
    GMER has found system modification, which might have been caused by ROOTKIT activity.
    Do you want to fully scan your system ?
    Unbedingt auf "No" klicken.
  • Entferne rechts den Haken bei:
    • IAT/EAT
    • Alle Festplatten ausser die Systemplatte (normalerweise ist nur C:\ angehackt)
    • Show all (sollte abgehackt sein)
  • Starte den Scan mit "Scan". Mache nichts am Computer während der Scan läuft.
  • Wenn der Scan fertig ist klicke auf Save und speichere die Logfile unter Gmer.txt[/B] auf deinem Desktop. Mit "Ok" wird GMER beendet.
Antiviren-Programm und sonstige Scanner wieder einschalten, bevor Du ins Netz gehst!

motzerrobo 18.03.2012 03:49
Hallo Marius,

langer Weg =) aber geschafft. Als ich heute morgen den FRST Fix machen wollte und gerade hier im Forum deine Anweisungen gelesen habe kam aus dem nichts der "GEMA" Virus und hat meinen Screen zugedeckt - mit einigen Affengriffen hab ich es geschafft das Teil zu "beenden" und habe die gema.exe aus dem versteckten Ordner gelöscht. Danach habe ich neu gestartet und den Fix durchgeführt hier die Log File:

Code:
Fix result of Farbar Recovery Tool (FRST written by farbar) Version: 11-03-2012
Ran by SYSTEM at 2012-03-17 20:40:30 R:2
Running from L:\

==============================================

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\HKLM\...\Run: [] Value not found.
ntservice1 service deleted successfully.
C:\Windows\System32\NETw5x32.dll not found.

==== End of Fixlog ====
Danach habe ich weiter deine Anweisungen befolgt und den GMER Scan mit den vorgegebenen Einstellungen und ohne Netzverbindung gemacht. Das lange warten von 6 Stunden hat sich ausgezahlt der Scan ist tatsächlich beendet worden und zwar vor 10 Minuten =) Wieso das so lange dauert und ob das üblich ist weiß ich nicht - vielleicht kannst du darauß ja noch irgendwelche Schlüsse ziehen.

hier die LogFile
Code:
GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-03-18 03:34:54
Windows 6.1.7601 Service Pack 1 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 WDC_WD2500JS-75NCB3 rev.10.02E04
Running: eu0cksk6.exe; Driver: C:\Users\motzer\AppData\Local\Temp\pxldypow.sys


---- Kernel code sections - GMER 1.0.15 ----

.text          ntkrnlpa.exe!ZwSaveKey + 13C1                                            82C563D9 1 Byte  [06]
.text          ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                    82C8FD52 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
?              System32\Drivers\spmj.sys                                                Das System kann den angegebenen Pfad nicht finden. !
.text          C:\Windows\system32\DRIVERS\atikmdag.sys                                  section is writeable [0x8EC3B000, 0x2CA9C0, 0xE8000020]
.text          USBPORT.SYS!DllUnload                                                    8E352DB9 5 Bytes  JMP 864D84E0
PAGE            spsys.sys!?SPRevision@@3PADA + 4F90                                      AF078000 290 Bytes  [8B, FF, 55, 8B, EC, 33, C0, ...]
PAGE            spsys.sys!?SPRevision@@3PADA + 50B3                                      AF078123 629 Bytes  [35, 07, AF, FE, 05, 34, 35, ...]
PAGE            spsys.sys!?SPRevision@@3PADA + 5329                                      AF078399 101 Bytes  [6A, 28, 59, A5, 5E, C6, 03, ...]
PAGE            spsys.sys!?SPRevision@@3PADA + 538F                                      AF0783FF 148 Bytes  [18, 5D, C2, 14, 00, 8B, FF, ...]
PAGE            spsys.sys!?SPRevision@@3PADA + 543B                                      AF0784AB 2228 Bytes  [8B, FF, 55, 8B, EC, FF, 75, ...]
PAGE            ...                                                                     

---- User code sections - GMER 1.0.15 ----

.text          C:\Windows\Explorer.EXE[1472] kernel32.dll!CreateProcessW                76AC204D 5 Bytes  JMP 01CB504E
.text          C:\Windows\system32\svchost.exe[2856] kernel32.dll!ExitProcess            76B1BBE2 5 Bytes  JMP 000203E8

---- Devices - GMER 1.0.15 ----

Device          \FileSystem\Ntfs \Ntfs                                                    85D3A1F8
Device          \FileSystem\fastfat \FatCdrom                                            87AE2500
Device          \FileSystem\udfs \UdfsCdRom                                              86EEF1F8
Device          \FileSystem\udfs \UdfsDisk                                                86EEF1F8
Device          \Driver\USBSTOR \Device\0000009b                                          86E3E1F8

AttachedDevice  \Driver\volsnap \Device\HarddiskVolumeShadowCopy1                        hotcore3.sys (A part of Paragon System Utilities/Paragon Software Group)
AttachedDevice  \Driver\volsnap \Device\HarddiskVolumeShadowCopy2                        hotcore3.sys (A part of Paragon System Utilities/Paragon Software Group)

Device          \Driver\usbuhci \Device\USBPDO-0                                          864A91F8
Device          \Driver\usbuhci \Device\USBPDO-1                                          864A91F8
Device          \Driver\usbuhci \Device\USBPDO-2                                          864A91F8
Device          \Driver\usbehci \Device\USBPDO-3                                          863A9500
Device          \Driver\usbuhci \Device\USBPDO-4                                          864A91F8
Device          \Driver\usbuhci \Device\USBPDO-5                                          864A91F8
Device          \Driver\usbuhci \Device\USBPDO-6                                          864A91F8
Device          \Driver\volmgr \Device\HarddiskVolume1                                    8507C1F8

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                                    fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                                    hotcore3.sys (A part of Paragon System Utilities/Paragon Software Group)

Device          \Driver\usbehci \Device\USBPDO-7                                          863A9500
Device          \Driver\volmgr \Device\HarddiskVolume2                                    8507C1F8

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2                                    fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2                                    hotcore3.sys (A part of Paragon System Utilities/Paragon Software Group)

Device          \Driver\cdrom \Device\CdRom0                                              862B21F8
Device          \Driver\cdrom \Device\CdRom0                                              85D9D96E
Device          \Driver\volmgr \Device\HarddiskVolume3                                    8507C1F8

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume3                                    fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume3                                    hotcore3.sys (A part of Paragon System Utilities/Paragon Software Group)

Device          \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-0                              8507F1F8
Device          \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-0                              85D9F02C
Device          \Driver\atapi \Device\Ide\IdePort0                                        8507F1F8
Device          \Driver\atapi \Device\Ide\IdePort0                                        85D9F02C
Device          \Driver\atapi \Device\Ide\IdeDeviceP2T0L0-4                              8507F1F8
Device          \Driver\atapi \Device\Ide\IdeDeviceP2T0L0-4                              85D9F02C
Device          \Driver\atapi \Device\Ide\IdePort1                                        8507F1F8
Device          \Driver\atapi \Device\Ide\IdePort1                                        85D9F02C
Device          \Driver\atapi \Device\Ide\IdePort2                                        8507F1F8
Device          \Driver\atapi \Device\Ide\IdePort2                                        85D9F02C
Device          \Driver\atapi \Device\Ide\IdePort3                                        8507F1F8
Device          \Driver\atapi \Device\Ide\IdePort3                                        85D9F02C
Device          \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-1                              8507F1F8
Device          \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-1                              85D9F02C
Device          \Driver\atapi \Device\Ide\IdeDeviceP3T0L0-5                              8507F1F8
Device          \Driver\atapi \Device\Ide\IdeDeviceP3T0L0-5                              85D9F02C
Device          \Driver\cdrom \Device\CdRom1                                              862B21F8
Device          \Driver\cdrom \Device\CdRom1                                              85D9D96E
Device          \Driver\volmgr \Device\HarddiskVolume4                                    8507C1F8

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume4                                    fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume4                                    hotcore3.sys (A part of Paragon System Utilities/Paragon Software Group)

Device          \Driver\cdrom \Device\CdRom2                                              862B21F8
Device          \Driver\cdrom \Device\CdRom2                                              85D9D96E
Device          \Driver\USBSTOR \Device\000000a6                                          86E3E1F8
Device          \Driver\volmgr \Device\HarddiskVolume5                                    8507C1F8

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume5                                    fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume5                                    hotcore3.sys (A part of Paragon System Utilities/Paragon Software Group)

Device          \Driver\USBSTOR \Device\000000a7                                          86E3E1F8
Device          \Driver\volmgr \Device\HarddiskVolume6                                    8507C1F8

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume6                                    fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume6                                    hotcore3.sys (A part of Paragon System Utilities/Paragon Software Group)

Device          \Driver\volmgr \Device\HarddiskVolume7                                    8507C1F8

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume7                                    fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume7                                    hotcore3.sys (A part of Paragon System Utilities/Paragon Software Group)

Device          \Driver\NetBT \Device\NetBt_Wins_Export                                  863071F8
Device          \Driver\volmgr \Device\HarddiskVolume8                                    8507C1F8

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume8                                    fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume8                                    hotcore3.sys (A part of Paragon System Utilities/Paragon Software Group)

Device          \Driver\volmgr \Device\HarddiskVolume9                                    8507C1F8

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume9                                    fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume9                                    hotcore3.sys (A part of Paragon System Utilities/Paragon Software Group)

Device          \Driver\ACPI_HAL \Device\0000005a                                        halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)
Device          \Driver\USBSTOR \Device\00000096                                          86E3E1F8
Device          \Driver\USBSTOR \Device\00000098                                          86E3E1F8
Device          \Driver\USBSTOR \Device\00000099                                          86E3E1F8
Device          \Driver\usbuhci \Device\USBFDO-0                                          864A91F8
Device          \Driver\usbuhci \Device\USBFDO-1                                          864A91F8
Device          \Driver\usbuhci \Device\USBFDO-2                                          864A91F8
Device          \Driver\usbehci \Device\USBFDO-3                                          863A9500
Device          \Driver\NetBT \Device\NetBT_Tcpip_{CC86D29B-4AE9-4769-94EF-8CBBD26D5AC1}  863071F8
Device          \Driver\usbuhci \Device\USBFDO-4                                          864A91F8
Device          \Driver\usbuhci \Device\USBFDO-5                                          864A91F8
Device          \Driver\usbuhci \Device\USBFDO-6                                          864A91F8
Device          \Driver\usbehci \Device\USBFDO-7                                          863A9500
Device          \Driver\PrecSim \Device\Scsi\PrecSim1Port0Path0Target0Lun0                8507E1F8
Device          \Driver\PrecSim \Device\Scsi\PrecSim1Port0Path0Target0Lun0                85D9F00C
Device          \Driver\PrecSim \Device\Scsi\PrecSim1                                    8507E1F8
Device          \Driver\PrecSim \Device\Scsi\PrecSim1                                    85D9F00C
Device          \Driver\USBSTOR \Device\0000009a                                          86E3E1F8
Device          \FileSystem\fastfat \Fat                                                  87AE2500

AttachedDevice  \FileSystem\fastfat \Fat                                                  fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg            HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s1                        771343423
Reg            HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s2                        285507792

---- Files - GMER 1.0.15 ----

File            C:\Windows\$NtUninstallKB40230$\1042759890                                0 bytes
File            C:\Windows\$NtUninstallKB40230$\3762978156                                0 bytes
File            C:\Windows\$NtUninstallKB40230$\3762978156\@                              2048 bytes
File            C:\Windows\$NtUninstallKB40230$\3762978156\cfg.ini                        316 bytes
File            C:\Windows\$NtUninstallKB40230$\3762978156\Desktop.ini                    4608 bytes
File            C:\Windows\$NtUninstallKB40230$\3762978156\L                              0 bytes
File            C:\Windows\$NtUninstallKB40230$\3762978156\L\xadqgnnk                    108544 bytes
File            C:\Windows\$NtUninstallKB40230$\3762978156\oemid                          229 bytes
File            C:\Windows\$NtUninstallKB40230$\3762978156\U                              0 bytes
File            C:\Windows\$NtUninstallKB40230$\3762978156\U\00000001.@                  2048 bytes
File            C:\Windows\$NtUninstallKB40230$\3762978156\U\00000002.@                  224768 bytes
File            C:\Windows\$NtUninstallKB40230$\3762978156\U\00000004.@                  1024 bytes
File            C:\Windows\$NtUninstallKB40230$\3762978156\U\80000000.@                  66560 bytes
File            C:\Windows\$NtUninstallKB40230$\3762978156\U\80000004.@                  12800 bytes
File            C:\Windows\$NtUninstallKB40230$\3762978156\U\80000032.@                  96256 bytes
File            C:\Windows\$NtUninstallKB40230$\3762978156\version                        851 bytes

---- EOF - GMER 1.0.15 ----
Ich hatte noch nie Probleme mit Viren Würmen Trojanern oder sonstigem Ungeziefer in den letzten 2 Jahrzehnten und jetzt scheint eine wahre Bombe auf mich einzuprasseln, dabei habe ich nichts an meinen Gewohnheiten geändert, schon erschreckend....

ich hoffe auf weitere Hilfe

mfg
motzer

Psychotic 18.03.2012 11:56
Schritt 1: Fix mit FRST


Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument
Code:
C:\Windows\$NtUninstallKB40230$\3762978156\U
C:\Windows\$NtUninstallKB40230$\3762978156\L
Speichere diese bitte als Fixlist.txt auf deinem USB Stick.
  • Starte deinen Rechner erneut in die Reparaturoptionen
  • Starte nun die FRST.exe erneut und klicke den Fix Button.
Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.




Schritt 2: ComboFix

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.
Downloade dir bitte Combofix von einem dieser Downloadspiegel

Link 1
Link 2


WICHTIG - Speichere Combofix auf deinem Desktop
  • Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.
Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

starte den Rechner einfach neu. Dies sollte das Problem beheben.

motzerrobo 18.03.2012 22:43
Hallo Marius,

also heute starte ich meinen Rechner und Gema.exe startet wieder diesmal aus dem system32 Ordner. Ich habe die Datei wieder gelöscht um am Rechner arbeiten zu können. Dann hat Antivir direkt alarm geschlagen

"TR/Spy.Banker.Gen2" ich klicke auf entfernen und nach einigen Minuten den gleichen Trojaner nochmal und einige Minuten wieder. Das alles während ich hier deine Anweisungen gelesen habe.

Ich habe den FRST Fix ausgeführt hier die Logfile

Code:
Fix result of Farbar Recovery Tool (FRST written by farbar) Version: 11-03-2012
Ran by SYSTEM at 2012-03-18 21:08:40 R:3
Running from H:\

==============================================

C:\Windows\$NtUninstallKB40230$\3762978156\U not found.
C:\Windows\$NtUninstallKB40230$\3762978156\L not found.

==== End of Fixlog ====
bei Combofix bietet sich das gleiche Bild wie vorher es startet stellt den Wiederherstellungspunkt her und beginnt scheinbar den Scan, dann passiert aber nichts weiter. Liegt es vielleicht daran, dass der Rechner so heftig ausgelastet ist und nur wenig scannt pro Zeit. Nach dem CombofixScan Versuch war die Internetverbindung wieder zerschossen und ich musste mit der FritzboxWLan Stick CD die Software dafür neu installieren. Klappt wieder!

Die CPU Auslastung ist aber weiterhin sehr hoch - immer noch um die 70% dauerhaft ohne irgendeine Aktion am Rechner services.exe und svchost.exe (netsvcs) nehmen davon fast alles ein.


Wenn ich heute Abend noch neue Anweisungen bekommen sollte befolge ich diese natürliche, ansonsten werde ich morgen bevor ich in die Uni gehe den Rechner anschalten und einen Combofix Scan starten und den ganzen Tag laufen lassen - keine Ahnung ob das was bringt, jedoch nervt der laute Lüfter durch die hohe CPU Auslastung und ich kann das Teil nachts nicht durchlaufen lassen.

mfg
motzer

Psychotic 18.03.2012 23:19
Schritt 1: Scan mit TDSS-Killer


Lese bitte folgende Anweisungen genau. Wir wollen hier noch nichts "fixen" sondern nur einen Scan Report sehen. Downloade dir bitte TDSSKiller.exe und speichere diese Datei auf dem Desktop
  • Starte die TDSSKiller.exe
  • Drücke Start Scan
  • Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und speichere das Logfile. TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern ( Meistens C:\ ) Als Beispiel: C:\TDSSKiller.<version_date_time>log.txt
Poste den Inhalt bitte hier in deinen Thread.



Schritt 2: OTL (Custom Scan)


Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
/md5start
explorer.exe
regedit.exe
winlogon.exe
wininit.exe
userinit.exe
/md5stop
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
CREATERESTOREPOINT
  • Schliesse bitte nun alle Programme. (Wichtig)
  • Klicke nun bitte auf den Quick Scan Button.
  • Kopiere nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread



Schritt 3: Datei suchen


Check mal, ob die Datei C:\Qoobox\ComboFix-quarantined-files.txt existiert und lade sie in dem Fall hoch!

motzerrobo 19.03.2012 00:00
Okay

TDSSKiller File
Code:
23:30:12.0175 9384        TDSS rootkit removing tool 2.7.20.0 Mar  9 2012 17:10:43
23:30:12.0953 9384        ============================================================
23:30:12.0953 9384        Current date / time: 2012/03/18 23:30:12.0953
23:30:12.0953 9384        SystemInfo:
23:30:12.0953 9384       
23:30:12.0953 9384        OS Version: 6.1.7601 ServicePack: 1.0
23:30:12.0953 9384        Product type: Workstation
23:30:12.0953 9384        ComputerName: STEEL
23:30:12.0953 9384        UserName: motzer
23:30:12.0953 9384        Windows directory: C:\Windows
23:30:12.0953 9384        System windows directory: C:\Windows
23:30:12.0953 9384        Processor architecture: Intel x86
23:30:12.0953 9384        Number of processors: 2
23:30:12.0953 9384        Page size: 0x1000
23:30:12.0953 9384        Boot type: Normal boot
23:30:12.0953 9384        ============================================================
23:30:14.0076 9384        Drive \Device\Harddisk0\DR0 - Size: 0x3A35294400 (232.83 Gb), SectorSize: 0x200, Cylinders: 0x76BA, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
23:30:14.0094 9384        Drive \Device\Harddisk1\DR1 - Size: 0x3A35294400 (232.83 Gb), SectorSize: 0x200, Cylinders: 0x76BA, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
23:30:14.0165 9384        Drive \Device\Harddisk6\DR7 - Size: 0x774488000 (29.82 Gb), SectorSize: 0x200, Cylinders: 0xF34, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
23:30:14.0185 9384        \Device\Harddisk0\DR0:
23:30:14.0185 9384        MBR used
23:30:14.0185 9384        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x1B800, BlocksNum 0x1400000
23:30:14.0185 9384        \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x141B800, BlocksNum 0x1BD8D000
23:30:14.0185 9384        \Device\Harddisk1\DR1:
23:30:14.0185 9384        MBR used
23:30:14.0185 9384        \Device\Harddisk1\DR1\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x1D1A8000
23:30:14.0185 9384        \Device\Harddisk6\DR7:
23:30:14.0204 9384        MBR used
23:30:14.0204 9384        \Device\Harddisk6\DR7\Partition0: MBR, Type 0xC, StartLBA 0x20, BlocksNum 0x3BA2420
23:30:14.0317 9384        Initialize success
23:30:14.0317 9384        ============================================================
23:31:57.0248 7008        ============================================================
23:31:57.0248 7008        Scan started
23:31:57.0248 7008        Mode: Manual;
23:31:57.0248 7008        ============================================================
23:31:59.0422 7008        1394ohci        (1b133875b8aa8ac48969bd3458afe9f5) C:\Windows\system32\drivers\1394ohci.sys
23:31:59.0424 7008        1394ohci - ok
23:31:59.0506 7008        ACPI            (cea80c80bed809aa0da6febc04733349) C:\Windows\system32\drivers\ACPI.sys
23:31:59.0509 7008        ACPI - ok
23:31:59.0570 7008        AcpiPmi        (1efbc664abff416d1d07db115dcb264f) C:\Windows\system32\drivers\acpipmi.sys
23:31:59.0571 7008        AcpiPmi - ok
23:31:59.0636 7008        acsock          (ae954c42547605408cddf03bb13845b8) C:\Windows\system32\DRIVERS\acsock.sys
23:31:59.0638 7008        acsock - ok
23:31:59.0712 7008        adp94xx        (21e785ebd7dc90a06391141aac7892fb) C:\Windows\system32\DRIVERS\adp94xx.sys
23:31:59.0729 7008        adp94xx - ok
23:31:59.0753 7008        adpahci        (0c676bc278d5b59ff5abd57bbe9123f2) C:\Windows\system32\DRIVERS\adpahci.sys
23:31:59.0757 7008        adpahci - ok
23:31:59.0775 7008        adpu320        (7c7b5ee4b7b822ec85321fe23a27db33) C:\Windows\system32\DRIVERS\adpu320.sys
23:31:59.0777 7008        adpu320 - ok
23:31:59.0840 7008        AFD            (9ebbba55060f786f0fcaa3893bfa2806) C:\Windows\system32\drivers\afd.sys
23:31:59.0846 7008        AFD - ok
23:31:59.0933 7008        agp440          (507812c3054c21cef746b6ee3d04dd6e) C:\Windows\system32\drivers\agp440.sys
23:31:59.0934 7008        agp440 - ok
23:31:59.0990 7008        aic78xx        (8b30250d573a8f6b4bd23195160d8707) C:\Windows\system32\DRIVERS\djsvs.sys
23:31:59.0991 7008        aic78xx - ok
23:32:00.0051 7008        aliide          (0d40bcf52ea90fc7df2aeab6503dea44) C:\Windows\system32\drivers\aliide.sys
23:32:00.0052 7008        aliide - ok
23:32:00.0122 7008        amdagp          (3c6600a0696e90a463771c7422e23ab5) C:\Windows\system32\drivers\amdagp.sys
23:32:00.0123 7008        amdagp - ok
23:32:00.0144 7008        amdide          (cd5914170297126b6266860198d1d4f0) C:\Windows\system32\drivers\amdide.sys
23:32:00.0145 7008        amdide - ok
23:32:00.0172 7008        AmdK8          (00dda200d71bac534bf56a9db5dfd666) C:\Windows\system32\DRIVERS\amdk8.sys
23:32:00.0173 7008        AmdK8 - ok
23:32:00.0191 7008        AmdPPM          (3cbf30f5370fda40dd3e87df38ea53b6) C:\Windows\system32\DRIVERS\amdppm.sys
23:32:00.0192 7008        AmdPPM - ok
23:32:00.0262 7008        amdsata        (d320bf87125326f996d4904fe24300fc) C:\Windows\system32\drivers\amdsata.sys
23:32:00.0263 7008        amdsata - ok
23:32:00.0304 7008        amdsbs          (ea43af0c423ff267355f74e7a53bdaba) C:\Windows\system32\DRIVERS\amdsbs.sys
23:32:00.0338 7008        amdsbs - ok
23:32:00.0434 7008        amdxata        (46387fb17b086d16dea267d5be23a2f2) C:\Windows\system32\drivers\amdxata.sys
23:32:00.0434 7008        amdxata - ok
23:32:00.0509 7008        AppID          (aea177f783e20150ace5383ee368da19) C:\Windows\system32\drivers\appid.sys
23:32:00.0510 7008        AppID - ok
23:32:00.0592 7008        arc            (2932004f49677bd84dbc72edb754ffb3) C:\Windows\system32\DRIVERS\arc.sys
23:32:00.0594 7008        arc - ok
23:32:00.0611 7008        arcsas          (5d6f36c46fd283ae1b57bd2e9feb0bc7) C:\Windows\system32\DRIVERS\arcsas.sys
23:32:00.0613 7008        arcsas - ok
23:32:00.0675 7008        asusgsb        (b6e6b264e9c4d0ad0e97af8434c8754d) C:\Windows\system32\drivers\asusgsb.sys
23:32:00.0676 7008        asusgsb - ok
23:32:00.0705 7008        AsyncMac        (add2ade1c2b285ab8378d2daaf991481) C:\Windows\system32\DRIVERS\asyncmac.sys
23:32:00.0706 7008        AsyncMac - ok
23:32:00.0755 7008        atapi          (338c86357871c167a96ab976519bf59e) C:\Windows\system32\drivers\atapi.sys
23:32:00.0756 7008        atapi - ok
23:32:00.0934 7008        atikmdag        (b9290cf76263838ed609f3bdb6ad07ec) C:\Windows\system32\DRIVERS\atikmdag.sys
23:32:01.0049 7008        atikmdag - ok
23:32:01.0102 7008        atkdisplf      (409aafbd2642813f2c1bb446c816e354) C:\Windows\system32\drivers\ATKDispLowFilter.sys
23:32:01.0103 7008        atkdisplf - ok
23:32:01.0176 7008        avgntflt        (1e4114685de1ffa9675e09c6a1fb3f4b) C:\Windows\system32\DRIVERS\avgntflt.sys
23:32:01.0178 7008        avgntflt - ok
23:32:01.0199 7008        avipbb          (0f78d3dae6dedd99ae54c9491c62adf2) C:\Windows\system32\DRIVERS\avipbb.sys
23:32:01.0202 7008        avipbb - ok
23:32:01.0272 7008        avmeject        (263cf9d248fd5e020a1333ed4f7eaa88) C:\Windows\system32\drivers\avmeject.sys
23:32:01.0273 7008        avmeject - ok
23:32:01.0377 7008        b06bdrv        (1a231abec60fd316ec54c66715543cec) C:\Windows\system32\DRIVERS\bxvbdx.sys
23:32:01.0392 7008        b06bdrv - ok
23:32:01.0437 7008        b57nd60x        (bd8869eb9cde6bbe4508d869929869ee) C:\Windows\system32\DRIVERS\b57nd60x.sys
23:32:01.0440 7008        b57nd60x - ok
23:32:01.0486 7008        Beep            (505506526a9d467307b3c393dedaf858) C:\Windows\system32\drivers\Beep.sys
23:32:01.0487 7008        Beep - ok
23:32:01.0524 7008        blbdrive        (2287078ed48fcfc477b05b20cf38f36f) C:\Windows\system32\DRIVERS\blbdrive.sys
23:32:01.0525 7008        blbdrive - ok
23:32:01.0602 7008        bowser          (8f2da3028d5fcbd1a060a3de64cd6506) C:\Windows\system32\DRIVERS\bowser.sys
23:32:01.0603 7008        bowser - ok
23:32:01.0622 7008        BrFiltLo        (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\DRIVERS\BrFiltLo.sys
23:32:01.0622 7008        BrFiltLo - ok
23:32:01.0636 7008        BrFiltUp        (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\DRIVERS\BrFiltUp.sys
23:32:01.0637 7008        BrFiltUp - ok
23:32:01.0691 7008        BridgeMP        (77361d72a04f18809d0efb6cceb74d4b) C:\Windows\system32\DRIVERS\bridge.sys
23:32:01.0692 7008        BridgeMP - ok
23:32:01.0739 7008        Brserid        (845b8ce732e67f3b4133164868c666ea) C:\Windows\System32\Drivers\Brserid.sys
23:32:01.0742 7008        Brserid - ok
23:32:01.0755 7008        BrSerWdm        (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\System32\Drivers\BrSerWdm.sys
23:32:01.0757 7008        BrSerWdm - ok
23:32:01.0816 7008        BrUsbMdm        (bd456606156ba17e60a04e18016ae54b) C:\Windows\System32\Drivers\BrUsbMdm.sys
23:32:01.0816 7008        BrUsbMdm - ok
23:32:01.0846 7008        BrUsbSer        (af72ed54503f717a43268b3cc5faec2e) C:\Windows\System32\Drivers\BrUsbSer.sys
23:32:01.0863 7008        BrUsbSer - ok
23:32:01.0886 7008        BTHMODEM        (ed3df7c56ce0084eb2034432fc56565a) C:\Windows\system32\DRIVERS\bthmodem.sys
23:32:01.0887 7008        BTHMODEM - ok
23:32:01.0976 7008        catchme - ok
23:32:02.0023 7008        cdfs            (77ea11b065e0a8ab902d78145ca51e10) C:\Windows\system32\DRIVERS\cdfs.sys
23:32:02.0025 7008        cdfs - ok
23:32:02.0082 7008        cdrom          (be167ed0fdb9c1fa1133953c18d5a6c9) C:\Windows\system32\drivers\cdrom.sys
23:32:02.0084 7008        cdrom - ok
23:32:02.0115 7008        circlass        (3fe3fe94a34df6fb06e6418d0f6a0060) C:\Windows\system32\DRIVERS\circlass.sys
23:32:02.0115 7008        circlass - ok
23:32:02.0147 7008        CLFS            (635181e0e9bbf16871bf5380d71db02d) C:\Windows\system32\CLFS.sys
23:32:02.0150 7008        CLFS - ok
23:32:02.0184 7008        CmBatt          (dea805815e587dad1dd2c502220b5616) C:\Windows\system32\DRIVERS\CmBatt.sys
23:32:02.0185 7008        CmBatt - ok
23:32:02.0235 7008        cmdide          (c537b1db64d495b9b4717b4d6d9edbf2) C:\Windows\system32\drivers\cmdide.sys
23:32:02.0236 7008        cmdide - ok
23:32:02.0326 7008        CNG            (6427525d76f61d0c519b008d3680e8e7) C:\Windows\system32\Drivers\cng.sys
23:32:02.0340 7008        CNG - ok
23:32:02.0379 7008        Compbatt        (a6023d3823c37043986713f118a89bee) C:\Windows\system32\DRIVERS\compbatt.sys
23:32:02.0380 7008        Compbatt - ok
23:32:02.0442 7008        CompositeBus    (cbe8c58a8579cfe5fccf809e6f114e89) C:\Windows\system32\drivers\CompositeBus.sys
23:32:02.0444 7008        CompositeBus - ok
23:32:02.0475 7008        crcdisk        (2c4ebcfc84a9b44f209dff6c6e6c61d1) C:\Windows\system32\DRIVERS\crcdisk.sys
23:32:02.0476 7008        crcdisk - ok
23:32:02.0560 7008        CSC            (3c2177a897b4ca2788c6fb0c3fd81d4b) C:\Windows\system32\drivers\csc.sys
23:32:02.0575 7008        CSC - ok
23:32:02.0661 7008        cvintdrv        (cab213d4681fcfac9bf4e6d3b1ee4bfc) C:\Windows\system32\drivers\cvintdrv.sys
23:32:02.0662 7008        cvintdrv - ok
23:32:02.0724 7008        CVirtA          (b5ecadf7708960f1818c7fa015f4c239) C:\Windows\system32\DRIVERS\CVirtA.sys
23:32:02.0739 7008        CVirtA - ok
23:32:02.0819 7008        DfsC            (f024449c97ec1e464aaffda18593db88) C:\Windows\system32\Drivers\dfsc.sys
23:32:02.0820 7008        DfsC - ok
23:32:02.0921 7008        DgiVecp        (7f19dba1a467b838ccb23124a2c55568) C:\Windows\system32\Drivers\DgiVecp.sys
23:32:02.0922 7008        DgiVecp - ok
23:32:02.0995 7008        dg_ssudbus      (c9f9cafafbffaf7e380efc353ccc940c) C:\Windows\system32\DRIVERS\ssudbus.sys
23:32:02.0997 7008        dg_ssudbus - ok
23:32:03.0058 7008        discache        (1a050b0274bfb3890703d490f330c0da) C:\Windows\system32\drivers\discache.sys
23:32:03.0059 7008        discache - ok
23:32:03.0090 7008        Disk            (565003f326f99802e68ca78f2a68e9ff) C:\Windows\system32\DRIVERS\disk.sys
23:32:03.0091 7008        Disk - ok
23:32:03.0152 7008        DNE            (b5aa5aa5ac327bd7c1aec0c58f0c1144) C:\Windows\system32\DRIVERS\dne2000.sys
23:32:03.0154 7008        DNE - ok
23:32:03.0206 7008        drmkaud        (b918e7c5f9bf77202f89e1a9539f2eb4) C:\Windows\system32\drivers\drmkaud.sys
23:32:03.0207 7008        drmkaud - ok
23:32:03.0263 7008        DXGKrnl        (23f5d28378a160352ba8f817bd8c71cb) C:\Windows\System32\drivers\dxgkrnl.sys
23:32:03.0287 7008        DXGKrnl - ok
23:32:03.0368 7008        e1express      (cf0a6015f437161698c5b2a0a12cf052) C:\Windows\system32\DRIVERS\e1e6032.sys
23:32:03.0370 7008        e1express - ok
23:32:03.0479 7008        ebdrv          (024e1b5cac09731e4d868e64dbfb4ab0) C:\Windows\system32\DRIVERS\evbdx.sys
23:32:03.0547 7008        ebdrv - ok
23:32:03.0633 7008        EIO            (42584ec72495f4da1704123a20ac1012) C:\Windows\system32\DRIVERS\EIO.sys
23:32:03.0634 7008        EIO - ok
23:32:03.0669 7008        elxstor        (0ed67910c8c326796faa00b2bf6d9d3c) C:\Windows\system32\DRIVERS\elxstor.sys
23:32:03.0686 7008        elxstor - ok
23:32:03.0742 7008        ErrDev          (8fc3208352dd3912c94367a206ab3f11) C:\Windows\system32\drivers\errdev.sys
23:32:03.0742 7008        ErrDev - ok
23:32:03.0771 7008        exfat          (2dc9108d74081149cc8b651d3a26207f) C:\Windows\system32\drivers\exfat.sys
23:32:03.0773 7008        exfat - ok
23:32:03.0805 7008        fastfat        (7e0ab74553476622fb6ae36f73d97d35) C:\Windows\system32\drivers\fastfat.sys
23:32:03.0807 7008        fastfat - ok
23:32:03.0834 7008        fdc            (e817a017f82df2a1f8cfdbda29388b29) C:\Windows\system32\DRIVERS\fdc.sys
23:32:03.0835 7008        fdc - ok
23:32:03.0857 7008        FileInfo        (6cf00369c97f3cf563be99be983d13d8) C:\Windows\system32\drivers\fileinfo.sys
23:32:03.0859 7008        FileInfo - ok
23:32:03.0878 7008        Filetrace      (42c51dc94c91da21cb9196eb64c45db9) C:\Windows\system32\drivers\filetrace.sys
23:32:03.0879 7008        Filetrace - ok
23:32:03.0959 7008        flpydisk        (87907aa70cb3c56600f1c2fb8841579b) C:\Windows\system32\DRIVERS\flpydisk.sys
23:32:03.0960 7008        flpydisk - ok
23:32:03.0987 7008        FltMgr          (7520ec808e0c35e0ee6f841294316653) C:\Windows\system32\drivers\fltmgr.sys
23:32:03.0990 7008        FltMgr - ok
23:32:04.0016 7008        FsDepends      (1a16b57943853e598cff37fe2b8cbf1d) C:\Windows\system32\drivers\FsDepends.sys
23:32:04.0017 7008        FsDepends - ok
23:32:04.0037 7008        Fs_Rec          (a574b4360e438977038aae4bf60d79a2) C:\Windows\system32\drivers\Fs_Rec.sys
23:32:04.0037 7008        Fs_Rec - ok
23:32:04.0094 7008        fvevol          (8a73e79089b282100b9393b644cb853b) C:\Windows\system32\DRIVERS\fvevol.sys
23:32:04.0097 7008        fvevol - ok
23:32:04.0156 7008        FWLANUSB        (ff12fa487265da2ac7de4be53f72ff1a) C:\Windows\system32\DRIVERS\fwlanusb.sys
23:32:04.0159 7008        FWLANUSB - ok
23:32:04.0239 7008        fwlanusbn      (34403847d2e224a96b94a123b9ae55a0) C:\Windows\system32\DRIVERS\fwlanusbn.sys
23:32:04.0256 7008        fwlanusbn - ok
23:32:04.0309 7008        gagp30kx        (65ee0c7a58b65e74ae05637418153938) C:\Windows\system32\DRIVERS\gagp30kx.sys
23:32:04.0310 7008        gagp30kx - ok
23:32:04.0358 7008        GEARAspiWDM    (8182ff89c65e4d38b2de4bb0fb18564e) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
23:32:04.0359 7008        GEARAspiWDM - ok
23:32:04.0417 7008        hamachi        (833051c6c6c42117191935f734cfbd97) C:\Windows\system32\DRIVERS\hamachi.sys
23:32:04.0418 7008        hamachi - ok
23:32:04.0479 7008        hcw85cir        (c44e3c2bab6837db337ddee7544736db) C:\Windows\system32\drivers\hcw85cir.sys
23:32:04.0480 7008        hcw85cir - ok
23:32:04.0551 7008        HdAudAddService (a5ef29d5315111c80a5c1abad14c8972) C:\Windows\system32\drivers\HdAudio.sys
23:32:04.0558 7008        HdAudAddService - ok
23:32:04.0620 7008        HDAudBus        (9036377b8a6c15dc2eec53e489d159b5) C:\Windows\system32\drivers\HDAudBus.sys
23:32:04.0622 7008        HDAudBus - ok
23:32:04.0651 7008        HidBatt        (1d58a7f3e11a9731d0eaaaa8405acc36) C:\Windows\system32\DRIVERS\HidBatt.sys
23:32:04.0652 7008        HidBatt - ok
23:32:04.0681 7008        HidBth          (89448f40e6df260c206a193a4683ba78) C:\Windows\system32\DRIVERS\hidbth.sys
23:32:04.0682 7008        HidBth - ok
23:32:04.0700 7008        HidIr          (cf50b4cf4a4f229b9f3c08351f99ca5e) C:\Windows\system32\DRIVERS\hidir.sys
23:32:04.0701 7008        HidIr - ok
23:32:04.0780 7008        HidUsb          (10c19f8290891af023eaec0832e1eb4d) C:\Windows\system32\drivers\hidusb.sys
23:32:04.0781 7008        HidUsb - ok
23:32:04.0852 7008        hotcore3        (8be9369d385dc0fdf86a59f70d90ae79) C:\Windows\system32\DRIVERS\hotcore3.sys
23:32:04.0853 7008        hotcore3 - ok
23:32:04.0885 7008        HpSAMD          (295fdc419039090eb8b49ffdbb374549) C:\Windows\system32\drivers\HpSAMD.sys
23:32:04.0886 7008        HpSAMD - ok
23:32:04.0962 7008        HTTP            (871917b07a141bff43d76d8844d48106) C:\Windows\system32\drivers\HTTP.sys
23:32:04.0980 7008        HTTP - ok
23:32:05.0021 7008        hwpolicy        (0c4e035c7f105f1299258c90886c64c5) C:\Windows\system32\drivers\hwpolicy.sys
23:32:05.0022 7008        hwpolicy - ok
23:32:05.0107 7008        i8042prt        (f151f0bdc47f4a28b1b20a0818ea36d6) C:\Windows\system32\drivers\i8042prt.sys
23:32:05.0116 7008        i8042prt - ok
23:32:05.0156 7008        iaStorV        (5cd5f9a5444e6cdcb0ac89bd62d8b76e) C:\Windows\system32\drivers\iaStorV.sys
23:32:05.0171 7008        iaStorV - ok
23:32:05.0345 7008        igfx            (ad626f6964f4d364d226c39e06872dd3) C:\Windows\system32\DRIVERS\igdkmd32.sys
23:32:05.0448 7008        igfx - ok
23:32:05.0491 7008        iirsp          (4173ff5708f3236cf25195fecd742915) C:\Windows\system32\DRIVERS\iirsp.sys
23:32:05.0492 7008        iirsp - ok
23:32:05.0533 7008        intelide        (a0f12f2c9ba6c72f3987ce780e77c130) C:\Windows\system32\drivers\intelide.sys
23:32:05.0534 7008        intelide - ok
23:32:05.0569 7008        intelppm        (3b514d27bfc4accb4037bc6685f766e0) C:\Windows\system32\DRIVERS\intelppm.sys
23:32:05.0570 7008        intelppm - ok
23:32:05.0599 7008        IpFilterDriver  (709d1761d3b19a932ff0238ea6d50200) C:\Windows\system32\DRIVERS\ipfltdrv.sys
23:32:05.0601 7008        IpFilterDriver - ok
23:32:05.0696 7008        IPMIDRV        (4bd7134618c1d2a27466a099062547bf) C:\Windows\system32\drivers\IPMIDrv.sys
23:32:05.0697 7008        IPMIDRV - ok
23:32:05.0721 7008        IPNAT          (a5fa468d67abcdaa36264e463a7bb0cd) C:\Windows\system32\drivers\ipnat.sys
23:32:05.0722 7008        IPNAT - ok
23:32:05.0820 7008        IRENUM          (42996cff20a3084a56017b7902307e9f) C:\Windows\system32\drivers\irenum.sys
23:32:05.0820 7008        IRENUM - ok
23:32:05.0871 7008        isapnp          (1f32bb6b38f62f7df1a7ab7292638a35) C:\Windows\system32\drivers\isapnp.sys
23:32:05.0872 7008        isapnp - ok
23:32:05.0930 7008        iScsiPrt        (cb7a9abb12b8415bce5d74994c7ba3ae) C:\Windows\system32\drivers\msiscsi.sys
23:32:05.0933 7008        iScsiPrt - ok
23:32:05.0979 7008        kbdclass        (adef52ca1aeae82b50df86b56413107e) C:\Windows\system32\drivers\kbdclass.sys
23:32:05.0980 7008        kbdclass - ok
23:32:06.0052 7008        kbdhid          (9e3ced91863e6ee98c24794d05e27a71) C:\Windows\system32\drivers\kbdhid.sys
23:32:06.0053 7008        kbdhid - ok
23:32:06.0115 7008        KSecDD          (f4647bb23db9038a7536cf6b68f4207f) C:\Windows\system32\Drivers\ksecdd.sys
23:32:06.0116 7008        KSecDD - ok
23:32:06.0144 7008        KSecPkg        (e73cae53bbb72ba26918492c6b4c229d) C:\Windows\system32\Drivers\ksecpkg.sys
23:32:06.0146 7008        KSecPkg - ok
23:32:06.0219 7008        lltdio          (f7611ec07349979da9b0ae1f18ccc7a6) C:\Windows\system32\DRIVERS\lltdio.sys
23:32:06.0220 7008        lltdio - ok
23:32:06.0256 7008        LSI_FC          (eb119a53ccf2acc000ac71b065b78fef) C:\Windows\system32\DRIVERS\lsi_fc.sys
23:32:06.0257 7008        LSI_FC - ok
23:32:06.0275 7008        LSI_SAS        (8ade1c877256a22e49b75d1cc9161f9c) C:\Windows\system32\DRIVERS\lsi_sas.sys
23:32:06.0277 7008        LSI_SAS - ok
23:32:06.0299 7008        LSI_SAS2        (dc9dc3d3daa0e276fd2ec262e38b11e9) C:\Windows\system32\DRIVERS\lsi_sas2.sys
23:32:06.0300 7008        LSI_SAS2 - ok
23:32:06.0318 7008        LSI_SCSI        (0a036c7d7cab643a7f07135ac47e0524) C:\Windows\system32\DRIVERS\lsi_scsi.sys
23:32:06.0320 7008        LSI_SCSI - ok
23:32:06.0507 7008        luafv          (6703e366cc18d3b6e534f5cf7df39cee) C:\Windows\system32\drivers\luafv.sys
23:32:06.0526 7008        luafv - ok
23:32:06.0745 7008        megasas        (0fff5b045293002ab38eb1fd1fc2fb74) C:\Windows\system32\DRIVERS\megasas.sys
23:32:06.0946 7008        megasas - ok
23:32:07.0273 7008        MegaSR          (dcbab2920c75f390caf1d29f675d03d6) C:\Windows\system32\DRIVERS\MegaSR.sys
23:32:07.0295 7008        MegaSR - ok
23:32:07.0436 7008        Modem          (f001861e5700ee84e2d4e52c712f4964) C:\Windows\system32\drivers\modem.sys
23:32:07.0437 7008        Modem - ok
23:32:07.0515 7008        monitor        (79d10964de86b292320e9dfe02282a23) C:\Windows\system32\DRIVERS\monitor.sys
23:32:07.0516 7008        monitor - ok
23:32:07.0577 7008        mouclass        (fb18cc1d4c2e716b6b903b0ac0cc0609) C:\Windows\system32\drivers\mouclass.sys
23:32:07.0578 7008        mouclass - ok
23:32:07.0617 7008        mouhid          (2c388d2cd01c9042596cf3c8f3c7b24d) C:\Windows\system32\DRIVERS\mouhid.sys
23:32:07.0618 7008        mouhid - ok
23:32:07.0689 7008        mountmgr        (fc8771f45ecccfd89684e38842539b9b) C:\Windows\system32\drivers\mountmgr.sys
23:32:07.0691 7008        mountmgr - ok
23:32:07.0754 7008        mpio            (2d699fb6e89ce0d8da14ecc03b3edfe0) C:\Windows\system32\drivers\mpio.sys
23:32:07.0756 7008        mpio - ok
23:32:07.0985 7008        mpsdrv          (ad2723a7b53dd1aacae6ad8c0bfbf4d0) C:\Windows\system32\drivers\mpsdrv.sys
23:32:07.0987 7008        mpsdrv - ok
23:32:08.0053 7008        MRxDAV          (ceb46ab7c01c9f825f8cc6babc18166a) C:\Windows\system32\drivers\mrxdav.sys
23:32:08.0055 7008        MRxDAV - ok
23:32:08.0100 7008        mrxsmb          (5d16c921e3671636c0eba3bbaac5fd25) C:\Windows\system32\DRIVERS\mrxsmb.sys
23:32:08.0102 7008        mrxsmb - ok
23:32:08.0140 7008        mrxsmb10        (6d17a4791aca19328c685d256349fefc) C:\Windows\system32\DRIVERS\mrxsmb10.sys
23:32:08.0143 7008        mrxsmb10 - ok
23:32:08.0196 7008        mrxsmb20        (b81f204d146000be76651a50670a5e9e) C:\Windows\system32\DRIVERS\mrxsmb20.sys
23:32:08.0198 7008        mrxsmb20 - ok
23:32:08.0229 7008        msahci          (012c5f4e9349e711e11e0f19a8589f0a) C:\Windows\system32\drivers\msahci.sys
23:32:08.0230 7008        msahci - ok
23:32:08.0249 7008        msdsm          (55055f8ad8be27a64c831322a780a228) C:\Windows\system32\drivers\msdsm.sys
23:32:08.0253 7008        msdsm - ok
23:32:08.0298 7008        Msfs            (daefb28e3af5a76abcc2c3078c07327f) C:\Windows\system32\drivers\Msfs.sys
23:32:08.0299 7008        Msfs - ok
23:32:08.0360 7008        mshidkmdf      (3e1e5767043c5af9367f0056295e9f84) C:\Windows\System32\drivers\mshidkmdf.sys
23:32:08.0361 7008        mshidkmdf - ok
23:32:08.0409 7008        msisadrv        (0a4e5757ae09fa9622e3158cc1aef114) C:\Windows\system32\drivers\msisadrv.sys
23:32:08.0410 7008        msisadrv - ok
23:32:08.0459 7008        MSKSSRV        (8c0860d6366aaffb6c5bb9df9448e631) C:\Windows\system32\drivers\MSKSSRV.sys
23:32:08.0460 7008        MSKSSRV - ok
23:32:08.0482 7008        MSPCLOCK        (3ea8b949f963562cedbb549eac0c11ce) C:\Windows\system32\drivers\MSPCLOCK.sys
23:32:08.0483 7008        MSPCLOCK - ok
23:32:08.0503 7008        MSPQM          (f456e973590d663b1073e9c463b40932) C:\Windows\system32\drivers\MSPQM.sys
23:32:08.0504 7008        MSPQM - ok
23:32:08.0533 7008        MsRPC          (0e008fc4819d238c51d7c93e7b41e560) C:\Windows\system32\drivers\MsRPC.sys
23:32:08.0535 7008        MsRPC - ok
23:32:08.0597 7008        mssmbios        (fc6b9ff600cc585ea38b12589bd4e246) C:\Windows\system32\drivers\mssmbios.sys
23:32:08.0598 7008        mssmbios - ok
23:32:08.0645 7008        MSTEE          (b42c6b921f61a6e55159b8be6cd54a36) C:\Windows\system32\drivers\MSTEE.sys
23:32:08.0646 7008        MSTEE - ok
23:32:08.0671 7008        MTConfig        (33599130f44e1f34631cea241de8ac84) C:\Windows\system32\DRIVERS\MTConfig.sys
23:32:08.0672 7008        MTConfig - ok
23:32:08.0696 7008        Mup            (159fad02f64e6381758c990f753bcc80) C:\Windows\system32\Drivers\mup.sys
23:32:08.0698 7008        Mup - ok
23:32:08.0753 7008        NativeWifiP    (26384429fcd85d83746f63e798ab1480) C:\Windows\system32\DRIVERS\nwifi.sys
23:32:08.0776 7008        NativeWifiP - ok
23:32:08.0835 7008        NDIS            (e7c54812a2aaf43316eb6930c1ffa108) C:\Windows\system32\drivers\ndis.sys
23:32:08.0852 7008        NDIS - ok
23:32:08.0907 7008        NdisCap        (0e1787aa6c9191d3d319e8bafe86f80c) C:\Windows\system32\DRIVERS\ndiscap.sys
23:32:08.0908 7008        NdisCap - ok
23:32:08.0949 7008        NdisTapi        (e4a8aec125a2e43a9e32afeea7c9c888) C:\Windows\system32\DRIVERS\ndistapi.sys
23:32:08.0950 7008        NdisTapi - ok
23:32:09.0008 7008        Ndisuio        (d8a65dafb3eb41cbb622745676fcd072) C:\Windows\system32\DRIVERS\ndisuio.sys
23:32:09.0009 7008        Ndisuio - ok
23:32:09.0059 7008        NdisWan        (38fbe267e7e6983311179230facb1017) C:\Windows\system32\DRIVERS\ndiswan.sys
23:32:09.0061 7008        NdisWan - ok
23:32:09.0112 7008        NDProxy        (a4bdc541e69674fbff1a8ff00be913f2) C:\Windows\system32\drivers\NDProxy.sys
23:32:09.0113 7008        NDProxy - ok
23:32:09.0227 7008        Netaapl        (1352e1648213551923a0a822e441553c) C:\Windows\system32\DRIVERS\netaapl.sys
23:32:09.0227 7008        Netaapl - ok
23:32:09.0252 7008        NetBIOS        (80b275b1ce3b0e79909db7b39af74d51) C:\Windows\system32\DRIVERS\netbios.sys
23:32:09.0253 7008        NetBIOS - ok
23:32:09.0308 7008        NetBT          (280122ddcf04b378edd1ad54d71c1e54) C:\Windows\system32\DRIVERS\netbt.sys
23:32:09.0311 7008        NetBT - ok
23:32:09.0384 7008        nfrd960        (1d85c4b390b0ee09c7a46b91efb2c097) C:\Windows\system32\DRIVERS\nfrd960.sys
23:32:09.0385 7008        nfrd960 - ok
23:32:09.0469 7008        nipalfwedl      (198ca937f7b20bca38294922109ac8e4) C:\Windows\system32\drivers\nipalfwedl.sys
23:32:09.0470 7008        nipalfwedl - ok
23:32:09.0545 7008        NIPALK          (4413132b1f64efc9571fa47854f188d7) C:\Windows\system32\drivers\nipalk.sys
23:32:09.0562 7008        NIPALK - ok
23:32:09.0603 7008        nipalusbedl    (464baaaba44abe885df42e2394f2b4c5) C:\Windows\system32\drivers\nipalusbedl.sys
23:32:09.0604 7008        nipalusbedl - ok
23:32:09.0644 7008        nipbcfk        (96c846ab33c383583282b0375b34e9d2) C:\Windows\system32\drivers\nipbcfk.sys
23:32:09.0644 7008        nipbcfk - ok
23:32:09.0704 7008        Npfs            (1db262a9f8c087e8153d89bef3d2235f) C:\Windows\system32\drivers\Npfs.sys
23:32:09.0705 7008        Npfs - ok
23:32:09.0722 7008        nsiproxy        (e9a0a4d07e53d8fea2bb8387a3293c58) C:\Windows\system32\drivers\nsiproxy.sys
23:32:09.0723 7008        nsiproxy - ok
23:32:09.0804 7008        Ntfs            (81189c3d7763838e55c397759d49007a) C:\Windows\system32\drivers\Ntfs.sys
23:32:09.0838 7008        Ntfs - ok
23:32:09.0905 7008        Null            (f9756a98d69098dca8945d62858a812c) C:\Windows\system32\drivers\Null.sys
23:32:09.0905 7008        Null - ok
23:32:10.0149 7008        nvlddmkm        (b0881dda5a8160422561ffab7f0008b1) C:\Windows\system32\DRIVERS\nvlddmkm.sys
23:32:10.0352 7008        nvlddmkm - ok
23:32:10.0421 7008        nvraid          (b3e25ee28883877076e0e1ff877d02e0) C:\Windows\system32\drivers\nvraid.sys
23:32:10.0423 7008        nvraid - ok
23:32:10.0492 7008        nvstor          (4380e59a170d88c4f1022eff6719a8a4) C:\Windows\system32\drivers\nvstor.sys
23:32:10.0494 7008        nvstor - ok
23:32:10.0519 7008        nv_agp          (5a0983915f02bae73267cc2a041f717d) C:\Windows\system32\drivers\nv_agp.sys
23:32:10.0521 7008        nv_agp - ok
23:32:10.0575 7008        ohci1394        (08a70a1f2cdde9bb49b885cb817a66eb) C:\Windows\system32\drivers\ohci1394.sys
23:32:10.0577 7008        ohci1394 - ok
23:32:10.0670 7008        Parport        (2ea877ed5dd9713c5ac74e8ea7348d14) C:\Windows\system32\DRIVERS\parport.sys
23:32:10.0672 7008        Parport - ok
23:32:10.0726 7008        partmgr        (bf8f6af06da75b336f07e23aef97d93b) C:\Windows\system32\drivers\partmgr.sys
23:32:10.0728 7008        partmgr - ok
23:32:10.0800 7008        Parvdm          (eb0a59f29c19b86479d36b35983daadc) C:\Windows\system32\DRIVERS\parvdm.sys
23:32:10.0800 7008        Parvdm - ok
23:32:10.0830 7008        pci            (673e55c3498eb970088e812ea820aa8f) C:\Windows\system32\drivers\pci.sys
23:32:10.0832 7008        pci - ok
23:32:10.0863 7008        pciide          (afe86f419014db4e5593f69ffe26ce0a) C:\Windows\system32\drivers\pciide.sys
23:32:10.0864 7008        pciide - ok
23:32:10.0892 7008        pcmcia          (f396431b31693e71e8a80687ef523506) C:\Windows\system32\DRIVERS\pcmcia.sys
23:32:10.0894 7008        pcmcia - ok
23:32:10.0921 7008        pcw            (250f6b43d2b613172035c6747aeeb19f) C:\Windows\system32\drivers\pcw.sys
23:32:10.0923 7008        pcw - ok
23:32:10.0955 7008        PEAUTH          (9e0104ba49f4e6973749a02bf41344ed) C:\Windows\system32\drivers\peauth.sys
23:32:11.0005 7008        PEAUTH - ok
23:32:11.0358 7008        PptpMiniport    (631e3e205ad6d86f2aed6a4a8e69f2db) C:\Windows\system32\DRIVERS\raspptp.sys
23:32:11.0371 7008        PptpMiniport - ok
23:32:11.0708 7008        PrecSim        (c3127bfdab6200769b5a0184fab48573) C:\Windows\system32\DRIVERS\precsim.sys
23:32:11.0748 7008        PrecSim - ok
23:32:11.0960 7008        Processor      (85b1e3a0c7585bc4aae6899ec6fcf011) C:\Windows\system32\DRIVERS\processr.sys
23:32:11.0976 7008        Processor - ok
23:32:12.0071 7008        Psched          (6270ccae2a86de6d146529fe55b3246a) C:\Windows\system32\DRIVERS\pacer.sys
23:32:12.0073 7008        Psched - ok
23:32:12.0229 7008        ql2300          (ab95ecf1f6659a60ddc166d8315b0751) C:\Windows\system32\DRIVERS\ql2300.sys
23:32:12.0257 7008        ql2300 - ok
23:32:12.0456 7008        ql40xx          (b4dd51dd25182244b86737dc51af2270) C:\Windows\system32\DRIVERS\ql40xx.sys
23:32:12.0473 7008        ql40xx - ok
23:32:12.0688 7008        QWAVEdrv        (584078ca1b95ca72df2a27c336f9719d) C:\Windows\system32\drivers\qwavedrv.sys
23:32:12.0707 7008        QWAVEdrv - ok
23:32:12.0799 7008        RasAcd          (30a81b53c766d0133bb86d234e5556ab) C:\Windows\system32\DRIVERS\rasacd.sys
23:32:12.0799 7008        RasAcd - ok
23:32:12.0857 7008        RasAgileVpn    (57ec4aef73660166074d8f7f31c0d4fd) C:\Windows\system32\DRIVERS\AgileVpn.sys
23:32:12.0872 7008        RasAgileVpn - ok
23:32:12.0916 7008        Rasl2tp        (d9f91eafec2815365cbe6d167e4e332a) C:\Windows\system32\DRIVERS\rasl2tp.sys
23:32:12.0917 7008        Rasl2tp - ok
23:32:12.0953 7008        RasPppoe        (0fe8b15916307a6ac12bfb6a63e45507) C:\Windows\system32\DRIVERS\raspppoe.sys
23:32:12.0955 7008        RasPppoe - ok
23:32:12.0982 7008        RasSstp        (44101f495a83ea6401d886e7fd70096b) C:\Windows\system32\DRIVERS\rassstp.sys
23:32:12.0984 7008        RasSstp - ok
23:32:13.0063 7008        rdbss          (d528bc58a489409ba40334ebf96a311b) C:\Windows\system32\DRIVERS\rdbss.sys
23:32:13.0077 7008        rdbss - ok
23:32:13.0134 7008        rdpbus          (0d8f05481cb76e70e1da06ee9f0da9df) C:\Windows\system32\DRIVERS\rdpbus.sys
23:32:13.0135 7008        rdpbus - ok
23:32:13.0220 7008        RDPCDD          (23dae03f29d253ae74c44f99e515f9a1) C:\Windows\system32\DRIVERS\RDPCDD.sys
23:32:13.0221 7008        RDPCDD - ok
23:32:13.0288 7008        RDPDR          (b973fcfc50dc1434e1970a146f7e3885) C:\Windows\system32\drivers\rdpdr.sys
23:32:13.0290 7008        RDPDR - ok
23:32:13.0378 7008        RDPENCDD        (5a53ca1598dd4156d44196d200c94b8a) C:\Windows\system32\drivers\rdpencdd.sys
23:32:13.0398 7008        RDPENCDD - ok
23:32:14.0014 7008        RDPREFMP        (44b0a53cd4f27d50ed461dae0c0b4e1f) C:\Windows\system32\drivers\rdprefmp.sys
23:32:14.0042 7008        RDPREFMP - ok
23:32:14.0755 7008        RDPWD          (244c83332f44589ae98fc347f11b2693) C:\Windows\system32\drivers\RDPWD.sys
23:32:14.0857 7008        RDPWD - ok
23:32:15.0609 7008        rdyboost        (518395321dc96fe2c9f0e96ac743b656) C:\Windows\system32\drivers\rdyboost.sys
23:32:15.0645 7008        rdyboost - ok
23:32:15.0992 7008        rspndr          (032b0d36ad92b582d869879f5af5b928) C:\Windows\system32\DRIVERS\rspndr.sys
23:32:16.0016 7008        rspndr - ok
23:32:16.0317 7008        s3cap          (7fa7f2e249a5dcbb7970630e15e1f482) C:\Windows\system32\drivers\vms3cap.sys
23:32:16.0334 7008        s3cap - ok
23:32:16.0561 7008        sbp2port        (05d860da1040f111503ac416ccef2bca) C:\Windows\system32\drivers\sbp2port.sys
23:32:16.0583 7008        sbp2port - ok
23:32:17.0081 7008        SCDEmu          (9feb2026a460916d1a1198b460632630) C:\Windows\system32\drivers\SCDEmu.sys
23:32:17.0103 7008        SCDEmu - ok
23:32:17.0503 7008        scfilter        (0693b5ec673e34dc147e195779a4dcf6) C:\Windows\system32\DRIVERS\scfilter.sys
23:32:17.0535 7008        scfilter - ok
23:32:17.0821 7008        secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
23:32:17.0842 7008        secdrv - ok
23:32:18.0030 7008        Ser2pl          (c3179f6f180a435dfc485fdeaef12af6) C:\Windows\system32\DRIVERS\ser2pl.sys
23:32:18.0052 7008        Ser2pl - ok
23:32:18.0335 7008        Serenum        (9ad8b8b515e3df6acd4212ef465de2d1) C:\Windows\system32\DRIVERS\serenum.sys
23:32:18.0350 7008        Serenum - ok
23:32:18.0573 7008        Serial          (5fb7fcea0490d821f26f39cc5ea3d1e2) C:\Windows\system32\DRIVERS\serial.sys
23:32:18.0592 7008        Serial - ok
23:32:18.0662 7008        sermouse        (79bffb520327ff916a582dfea17aa813) C:\Windows\system32\DRIVERS\sermouse.sys
23:32:18.0663 7008        sermouse - ok
23:32:18.0728 7008        sffdisk        (9f976e1eb233df46fce808d9dea3eb9c) C:\Windows\system32\drivers\sffdisk.sys
23:32:18.0729 7008        sffdisk - ok
23:32:18.0747 7008        sffp_mmc        (932a68ee27833cfd57c1639d375f2731) C:\Windows\system32\drivers\sffp_mmc.sys
23:32:18.0747 7008        sffp_mmc - ok
23:32:18.0800 7008        sffp_sd        (6d4ccaedc018f1cf52866bbbaa235982) C:\Windows\system32\drivers\sffp_sd.sys
23:32:18.0800 7008        sffp_sd - ok
23:32:18.0833 7008        sfloppy        (db96666cc8312ebc45032f30b007a547) C:\Windows\system32\DRIVERS\sfloppy.sys
23:32:18.0834 7008        sfloppy - ok
23:32:18.0902 7008        silabenm        (c16173316918a1360dc22947c4ff6352) C:\Windows\system32\DRIVERS\silabenm.sys
23:32:18.0903 7008        silabenm - ok
23:32:18.0947 7008        silabser        (182f483ec274015d2b2110eda84e59d0) C:\Windows\system32\DRIVERS\silabser.sys
23:32:18.0949 7008        silabser - ok
23:32:19.0111 7008        sisagp          (2565cac0dc9fe0371bdce60832582b2e) C:\Windows\system32\drivers\sisagp.sys
23:32:19.0112 7008        sisagp - ok
23:32:19.0145 7008        SiSRaid2        (a9f0486851becb6dda1d89d381e71055) C:\Windows\system32\DRIVERS\SiSRaid2.sys
23:32:19.0146 7008        SiSRaid2 - ok
23:32:19.0165 7008        SiSRaid4        (3727097b55738e2f554972c3be5bc1aa) C:\Windows\system32\DRIVERS\sisraid4.sys
23:32:19.0167 7008        SiSRaid4 - ok
23:32:19.0203 7008        Smb            (3e21c083b8a01cb70ba1f09303010fce) C:\Windows\system32\DRIVERS\smb.sys
23:32:19.0205 7008        Smb - ok
23:32:19.0251 7008        spldr          (95cf1ae7527fb70f7816563cbc09d942) C:\Windows\system32\drivers\spldr.sys
23:32:19.0252 7008        spldr - ok
23:32:19.0352 7008        sptd            (a80cd850d69d996c832bea37e3a6aa1e) C:\Windows\system32\Drivers\sptd.sys
23:32:19.0352 7008        Suspicious file (NoAccess): C:\Windows\system32\Drivers\sptd.sys. md5: a80cd850d69d996c832bea37e3a6aa1e
23:32:19.0354 7008        sptd ( LockedFile.Multi.Generic ) - warning
23:32:19.0354 7008        sptd - detected LockedFile.Multi.Generic (1)
23:32:19.0402 7008        srv            (e4c2764065d66ea1d2d3ebc28fe99c46) C:\Windows\system32\DRIVERS\srv.sys
23:32:19.0408 7008        srv - ok
23:32:19.0477 7008        srv2            (03f0545bd8d4c77fa0ae1ceedfcc71ab) C:\Windows\system32\DRIVERS\srv2.sys
23:32:19.0499 7008        srv2 - ok
23:32:19.0553 7008        srvnet          (be6bd660caa6f291ae06a718a4fa8abc) C:\Windows\system32\DRIVERS\srvnet.sys
23:32:19.0555 7008        srvnet - ok
23:32:19.0622 7008        ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\Windows\system32\DRIVERS\ssmdrv.sys
23:32:19.0623 7008        ssmdrv - ok
23:32:19.0785 7008        SSPORT          (ef3458337d7341a05169cefc73709264) C:\Windows\system32\Drivers\SSPORT.sys
23:32:19.0786 7008        SSPORT - ok
23:32:19.0944 7008        ssudmdm        (91970cc4a3a30a01c1573184a62f5143) C:\Windows\system32\DRIVERS\ssudmdm.sys
23:32:19.0947 7008        ssudmdm - ok
23:32:20.0098 7008        stexstor        (db32d325c192b801df274bfd12a7e72b) C:\Windows\system32\DRIVERS\stexstor.sys
23:32:20.0099 7008        stexstor - ok
23:32:20.0207 7008        storflt        (472af0311073dceceaa8fa18ba2bdf89) C:\Windows\system32\drivers\vmstorfl.sys
23:32:20.0222 7008        storflt - ok
23:32:20.0622 7008        storvsc        (dcaffd62259e0bdb433dd67b5bb37619) C:\Windows\system32\drivers\storvsc.sys
23:32:20.0641 7008        storvsc - ok
23:32:20.0733 7008        swenum          (e58c78a848add9610a4db6d214af5224) C:\Windows\system32\drivers\swenum.sys
23:32:20.0763 7008        swenum - ok
23:32:20.0862 7008        Tcpip          (65d10b191c59c5501a1263fc33f6894b) C:\Windows\system32\drivers\tcpip.sys
23:32:20.0896 7008        Tcpip - ok
23:32:20.0983 7008        TCPIP6          (65d10b191c59c5501a1263fc33f6894b) C:\Windows\system32\DRIVERS\tcpip.sys
23:32:20.0989 7008        TCPIP6 - ok
23:32:21.0054 7008        tcpipreg        (cca24162e055c3714ce5a88b100c64ed) C:\Windows\system32\drivers\tcpipreg.sys
23:32:21.0055 7008        tcpipreg - ok
23:32:21.0109 7008        TDPIPE          (1cb91b2bd8f6dd367dfc2ef26fd751b2) C:\Windows\system32\drivers\tdpipe.sys
23:32:21.0110 7008        TDPIPE - ok
23:32:21.0146 7008        TDTCP          (2c2c5afe7ee4f620d69c23c0617651a8) C:\Windows\system32\drivers\tdtcp.sys
23:32:21.0147 7008        TDTCP - ok
23:32:21.0205 7008        tdx            (b459575348c20e8121d6039da063c704) C:\Windows\system32\DRIVERS\tdx.sys
23:32:21.0206 7008        tdx - ok
23:32:21.0286 7008        TermDD          (04dbf4b01ea4bf25a9a3e84affac9b20) C:\Windows\system32\drivers\termdd.sys
23:32:21.0287 7008        TermDD - ok
23:32:21.0383 7008        tssecsrv        (254bb140eee3c59d6114c1a86b636877) C:\Windows\system32\DRIVERS\tssecsrv.sys
23:32:21.0384 7008        tssecsrv - ok
23:32:21.0481 7008        TsUsbFlt        (fd1d6c73e6333be727cbcc6054247654) C:\Windows\system32\drivers\tsusbflt.sys
23:32:21.0483 7008        TsUsbFlt - ok
23:32:21.0564 7008        tunnel          (b2fa25d9b17a68bb93d58b0556e8c90d) C:\Windows\system32\DRIVERS\tunnel.sys
23:32:21.0581 7008        tunnel - ok
23:32:21.0799 7008        TVicPort        (97dd70feca64fb4f63de7bb7e66a80b1) C:\Windows\system32\DRIVERS\TVICPORT.SYS
23:32:21.0865 7008        TVicPort - ok
23:32:22.0206 7008        uagp35          (750fbcb269f4d7dd2e420c56b795db6d) C:\Windows\system32\DRIVERS\uagp35.sys
23:32:22.0207 7008        uagp35 - ok
23:32:22.0255 7008        udfs            (ee43346c7e4b5e63e54f927babbb32ff) C:\Windows\system32\DRIVERS\udfs.sys
23:32:22.0259 7008        udfs - ok
23:32:22.0436 7008        UimBus          (16264d4a7f052a7cc516b23e00b14213) C:\Windows\system32\DRIVERS\UimBus.sys
23:32:22.0451 7008        UimBus - ok
23:32:22.0657 7008        Uim_IM          (811e4296913821ce402b9e6629740350) C:\Windows\system32\Drivers\Uim_IM.sys
23:32:22.0663 7008        Uim_IM - ok
23:32:22.0726 7008        uliagpkx        (44e8048ace47befbfdc2e9be4cbc8880) C:\Windows\system32\drivers\uliagpkx.sys
23:32:22.0727 7008        uliagpkx - ok
23:32:22.0818 7008        umbus          (d295bed4b898f0fd999fcfa9b32b071b) C:\Windows\system32\drivers\umbus.sys
23:32:22.0837 7008        umbus - ok
23:32:22.0866 7008        UmPass          (7550ad0c6998ba1cb4843e920ee0feac) C:\Windows\system32\DRIVERS\umpass.sys
23:32:22.0867 7008        UmPass - ok
23:32:22.0914 7008        USBAAPL        (83cafcb53201bbac04d822f32438e244) C:\Windows\system32\Drivers\usbaapl.sys
23:32:22.0915 7008        USBAAPL - ok
23:32:22.0977 7008        usbaudio        (1d9f2bd026e8e2d45033a4df3f16b78c) C:\Windows\system32\drivers\usbaudio.sys
23:32:22.0979 7008        usbaudio - ok
23:32:23.0016 7008        usbccgp        (bd9c55d7023c5de374507acc7a14e2ac) C:\Windows\system32\DRIVERS\usbccgp.sys
23:32:23.0026 7008        usbccgp - ok
23:32:23.0236 7008        usbcir          (04ec7cec62ec3b6d9354eee93327fc82) C:\Windows\system32\drivers\usbcir.sys
23:32:23.0244 7008        usbcir - ok
23:32:23.0422 7008        usbehci        (f92de757e4b7ce9c07c5e65423f3ae3b) C:\Windows\system32\DRIVERS\usbehci.sys
23:32:23.0452 7008        usbehci - ok
23:32:23.0789 7008        usbhub          (8dc94aec6a7e644a06135ae7506dc2e9) C:\Windows\system32\DRIVERS\usbhub.sys
23:32:23.0807 7008        usbhub - ok
23:32:23.0897 7008        usbohci        (e185d44fac515a18d9deddc23c2cdf44) C:\Windows\system32\drivers\usbohci.sys
23:32:23.0898 7008        usbohci - ok
23:32:23.0947 7008        usbprint        (797d862fe0875e75c7cc4c1ad7b30252) C:\Windows\system32\DRIVERS\usbprint.sys
23:32:23.0947 7008        usbprint - ok
23:32:23.0989 7008        USBSTOR        (f991ab9cc6b908db552166768176896a) C:\Windows\system32\drivers\USBSTOR.SYS
23:32:23.0990 7008        USBSTOR - ok
23:32:24.0048 7008        usbuhci        (68df884cf41cdada664beb01daf67e3d) C:\Windows\system32\DRIVERS\usbuhci.sys
23:32:24.0049 7008        usbuhci - ok
23:32:24.0124 7008        usbvideo        (45f4e7bf43db40a6c6b4d92c76cbc3f2) C:\Windows\System32\Drivers\usbvideo.sys
23:32:24.0126 7008        usbvideo - ok
23:32:24.0196 7008        vdrvroot        (a059c4c3edb09e07d21a8e5c0aabd3cb) C:\Windows\system32\drivers\vdrvroot.sys
23:32:24.0198 7008        vdrvroot - ok
23:32:24.0263 7008        vflt            (b149fc750a51d272a25e0adc7f52dbfd) C:\Windows\system32\DRIVERS\vfilter.sys
23:32:24.0264 7008        vflt - ok
23:32:24.0301 7008        vga            (17c408214ea61696cec9c66e388b14f3) C:\Windows\system32\DRIVERS\vgapnp.sys
23:32:24.0302 7008        vga - ok
23:32:24.0326 7008        VgaSave        (8e38096ad5c8570a6f1570a61e251561) C:\Windows\System32\drivers\vga.sys
23:32:24.0327 7008        VgaSave - ok
23:32:24.0380 7008        vhdmp          (5461686cca2fda57b024547733ab42e3) C:\Windows\system32\drivers\vhdmp.sys
23:32:24.0383 7008        vhdmp - ok
23:32:24.0420 7008        viaagp          (c829317a37b4bea8f39735d4b076e923) C:\Windows\system32\drivers\viaagp.sys
23:32:24.0422 7008        viaagp - ok
23:32:24.0486 7008        ViaC7          (e02f079a6aa107f06b16549c6e5c7b74) C:\Windows\system32\DRIVERS\viac7.sys
23:32:24.0488 7008        ViaC7 - ok
23:32:24.0517 7008        viaide          (e43574f6a56a0ee11809b48c09e4fd3c) C:\Windows\system32\drivers\viaide.sys
23:32:24.0519 7008        viaide - ok
23:32:24.0561 7008        vmbus          (c2f2911156fdc7817c52829c86da494e) C:\Windows\system32\drivers\vmbus.sys
23:32:24.0564 7008        vmbus - ok
23:32:24.0602 7008        VMBusHID        (d4d77455211e204f370d08f4963063ce) C:\Windows\system32\drivers\VMBusHID.sys
23:32:24.0603 7008        VMBusHID - ok
23:32:24.0686 7008        vnet            (1b13a6a5253e7f046728980ccb59c0b7) C:\Windows\system32\DRIVERS\virtualnet.sys
23:32:24.0687 7008        vnet - ok
23:32:24.0738 7008        volmgr          (4c63e00f2f4b5f86ab48a58cd990f212) C:\Windows\system32\drivers\volmgr.sys
23:32:24.0739 7008        volmgr - ok
23:32:24.0790 7008        volmgrx        (b5bb72067ddddbbfb04b2f89ff8c3c87) C:\Windows\system32\drivers\volmgrx.sys
23:32:24.0796 7008        volmgrx - ok
23:32:24.0859 7008        volsnap        (f497f67932c6fa693d7de2780631cfe7) C:\Windows\system32\drivers\volsnap.sys
23:32:24.0862 7008        volsnap - ok
23:32:24.0950 7008        vpnva          (1b7c80c66742dafaa31f98af4c3a5bc2) C:\Windows\system32\DRIVERS\vpnva.sys
23:32:24.0951 7008        vpnva - ok
23:32:25.0014 7008        vsmraid        (9dfa0cc2f8855a04816729651175b631) C:\Windows\system32\DRIVERS\vsmraid.sys
23:32:25.0016 7008        vsmraid - ok
23:32:25.0203 7008        VSPerfDrv100    (5a2ddc5411a092bedb1a07755e087784) C:\Program Files\Microsoft Visual Studio 10.0\Team Tools\Performance Tools\VSPerfDrv100.sys
23:32:25.0205 7008        VSPerfDrv100 - ok
23:32:25.0272 7008        vwifibus        (90567b1e658001e79d7c8bbd3dde5aa6) C:\Windows\System32\drivers\vwifibus.sys
23:32:25.0273 7008        vwifibus - ok
23:32:25.0364 7008        WacomPen        (de3721e89c653aa281428c8a69745d90) C:\Windows\system32\DRIVERS\wacompen.sys
23:32:25.0365 7008        WacomPen - ok
23:32:25.0435 7008        WANARP          (3c3c78515f5ab448b022bdf5b8ffdd2e) C:\Windows\system32\DRIVERS\wanarp.sys
23:32:25.0437 7008        WANARP - ok
23:32:25.0442 7008        Wanarpv6        (3c3c78515f5ab448b022bdf5b8ffdd2e) C:\Windows\system32\DRIVERS\wanarp.sys
23:32:25.0443 7008        Wanarpv6 - ok
23:32:25.0480 7008        Wd              (1112a9badacb47b7c0bb0392e3158dff) C:\Windows\system32\DRIVERS\wd.sys
23:32:25.0481 7008        Wd - ok
23:32:25.0531 7008        Wdf01000        (9950e3d0f08141c7e89e64456ae7dc73) C:\Windows\system32\drivers\Wdf01000.sys
23:32:25.0547 7008        Wdf01000 - ok
23:32:25.0663 7008        WfpLwf          (8b9a943f3b53861f2bfaf6c186168f79) C:\Windows\system32\DRIVERS\wfplwf.sys
23:32:25.0664 7008        WfpLwf - ok
23:32:25.0677 7008        WIMMount        (5cf95b35e59e2a38023836fff31be64c) C:\Windows\system32\drivers\wimmount.sys
23:32:25.0678 7008        WIMMount - ok
23:32:25.0775 7008        WinDriver6      (0a597f84bc8af4229b529f655bb2ba14) C:\Windows\system32\drivers\windrvr6.sys
23:32:25.0778 7008        WinDriver6 - ok
23:32:25.0880 7008        WinUsb          (a67e5f9a400f3bd1be3d80613b45f708) C:\Windows\system32\drivers\WinUsb.sys
23:32:25.0881 7008        WinUsb - ok
23:32:25.0896 7008        WmiAcpi        (0217679b8fca58714c3bf2726d2ca84e) C:\Windows\system32\drivers\wmiacpi.sys
23:32:25.0897 7008        WmiAcpi - ok
23:32:25.0932 7008        ws2ifsl        (6db3276587b853bf886b69528fdb048c) C:\Windows\system32\drivers\ws2ifsl.sys
23:32:25.0933 7008        ws2ifsl - ok
23:32:26.0010 7008        WudfPf          (e714a1c0354636837e20ccbf00888ee7) C:\Windows\system32\drivers\WudfPf.sys
23:32:26.0011 7008        WudfPf - ok
23:32:26.0071 7008        WUDFRd          (1023ee888c9b47178c5293ed5336ab69) C:\Windows\system32\drivers\WUDFRd.sys
23:32:26.0073 7008        WUDFRd - ok
23:32:26.0125 7008        MBR (0x1B8)    (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
23:32:26.0188 7008        \Device\Harddisk0\DR0 - ok
23:32:26.0217 7008        MBR (0x1B8)    (5c616939100b85e558da92b899a0fc36) \Device\Harddisk1\DR1
23:32:26.0219 7008        \Device\Harddisk1\DR1 - ok
23:32:26.0238 7008        Boot (0x1200)  (958f049b4fc9865f18340fe04b262f8d) \Device\Harddisk0\DR0\Partition0
23:32:26.0238 7008        \Device\Harddisk0\DR0\Partition0 - ok
23:32:26.0241 7008        Boot (0x1200)  (1773edc80c05221eab85cb73e9530c54) \Device\Harddisk0\DR0\Partition1
23:32:26.0241 7008        \Device\Harddisk0\DR0\Partition1 - ok
23:32:26.0249 7008        Boot (0x1200)  (5158e063f8c8cf3a77efa0a854813797) \Device\Harddisk1\DR1\Partition0
23:32:26.0250 7008        \Device\Harddisk1\DR1\Partition0 - ok
23:32:26.0254 7008        ============================================================
23:32:26.0254 7008        Scan finished
23:32:26.0254 7008        ============================================================
23:32:26.0264 9368        Detected object count: 1
23:32:26.0264 9368        Actual detected object count: 1
23:33:05.0712 9368        sptd ( LockedFile.Multi.Generic ) - skipped by user
23:33:05.0712 9368        sptd ( LockedFile.Multi.Generic ) - User select action: Skip
23:33:43.0564 8020        Deinitialize success

motzerrobo 19.03.2012 00:01
OLT File

OTL Logfile:
Code:
OTL logfile created on: 18.03.2012 23:35:35 - Run 1
OTL by OldTimer - Version 3.2.39.1    Folder = C:\Users\motzer\Desktop
 Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,29 Gb Available Physical Memory | 64,46% Memory free
4,00 Gb Paging File | 2,81 Gb Available in Paging File | 70,29% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 222,78 Gb Total Space | 137,04 Gb Free Space | 61,51% Space Free | Partition Type: NTFS
Drive D: | 232,83 Gb Total Space | 41,77 Gb Free Space | 17,94% Space Free | Partition Type: NTFS
Drive E: | 10,00 Gb Total Space | 6,74 Gb Free Space | 67,37% Space Free | Partition Type: NTFS
Drive F: | 47,14 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive M: | 2,34 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
 
Computer Name: STEEL | User Name: motzer | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.03.18 23:34:36 | 000,594,432 | ---- | M] (OldTimer Tools) -- C:\Users\motzer\Desktop\OTL.exe
PRC - [2012.01.03 14:10:50 | 000,815,512 | ---- | M] (Adobe Systems Inc.) -- C:\Programme\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
PRC - [2012.01.03 14:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011.11.17 08:25:00 | 000,050,328 | ---- | M] (National Instruments Corporation) -- C:\Programme\National Instruments\Shared\NI WebServer\SystemWebServer.exe
PRC - [2011.08.30 17:18:30 | 002,358,656 | ---- | M] (TeamViewer GmbH) -- C:\Programme\TeamViewer\Version6\TeamViewer_Service.exe
PRC - [2011.08.03 04:20:34 | 000,580,416 | ---- | M] (Autodesk, Inc.) -- C:\Programme\Autodesk\Inventor 2012\Moldflow\bin\mitsijm.exe
PRC - [2011.07.28 21:55:14 | 001,082,368 | ---- | M] () -- C:\Programme\Air Mouse\Air Mouse\Air Mouse.exe
PRC - [2011.07.06 10:41:30 | 000,039,080 | ---- | M] (RPA Technology) -- C:\Programme\Air Mouse\Air Mouse\Mobile Mouse Service.exe
PRC - [2011.07.04 15:35:01 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.06.24 05:22:20 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
PRC - [2011.06.19 08:29:04 | 000,619,672 | ---- | M] (National Instruments Corporation) -- C:\Programme\National Instruments\Shared\NI Error Reporting\nierserver.exe
PRC - [2011.06.14 17:57:10 | 000,012,696 | ---- | M] (National Instruments Corporation) -- C:\Programme\National Instruments\MAX\nimxs.exe
PRC - [2011.06.10 14:11:20 | 000,121,032 | ---- | M] (National Instruments Corporation) -- C:\Programme\National Instruments\Shared\NI Network Discovery\niDiscSvc.exe
PRC - [2011.06.01 16:32:14 | 000,194,224 | ---- | M] (National Instruments Corporation) -- C:\Programme\National Instruments\Shared\mDNS Responder\nimdnsResponder.exe
PRC - [2011.05.27 13:43:48 | 000,050,336 | ---- | M] (National Instruments Corporation) -- C:\Programme\National Instruments\Shared\NI WebServer\ApplicationWebServer.exe
PRC - [2011.03.28 15:15:17 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2011.03.28 15:15:04 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2011.03.28 15:14:56 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2011.03.23 23:34:18 | 000,435,152 | ---- | M] (Cisco Systems, Inc.) -- C:\Programme\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
PRC - [2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010.11.20 13:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2010.11.20 13:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2010.11.20 13:17:41 | 001,174,016 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe
PRC - [2010.10.22 02:00:00 | 002,105,344 | R--- | M] (AVM Berlin) -- C:\Programme\avmwlanstick\WLanGUI.exe
PRC - [2010.10.22 02:00:00 | 000,376,832 | R--- | M] (AVM Berlin) -- C:\Programme\avmwlanstick\WLanNetService.exe
PRC - [2009.12.01 13:22:54 | 000,061,952 | ---- | M] (ASUSTeK COMPUTER INC.) -- C:\Windows\System32\ATKFUSService.exe
PRC - [2009.11.30 14:17:00 | 000,417,792 | ---- | M] () -- C:\Programme\ASUS\GamerOSD\ATKFastUserSwitching.exe
PRC - [2009.11.18 06:45:56 | 000,368,640 | ---- | M] (AMD) -- C:\Windows\System32\atieclxx.exe
PRC - [2009.11.18 06:45:26 | 000,172,032 | ---- | M] (AMD) -- C:\Windows\System32\atiesrxx.exe
PRC - [2009.07.27 10:13:28 | 000,061,440 | ---- | M] () -- C:\Windows\System32\ASDR.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.03.16 22:04:31 | 000,177,560 | ---- | M] () -- C:\Users\motzer\AppData\Roaming\07016\components\AcroFF.dll
MOD - [2012.03.16 22:04:24 | 000,005,624 | ---- | M] () -- C:\Users\motzer\AppData\Roaming\BAcroIEHelpe.dll
MOD - [2012.03.15 20:44:12 | 001,670,144 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\08d608378aa405adc844f3cf36974b8c\Microsoft.VisualBasic.ni.dll
MOD - [2012.03.15 18:51:12 | 012,432,896 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
MOD - [2012.03.15 18:50:43 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\5cae93d923c8378370758489e5535820\System.Runtime.Remoting.ni.dll
MOD - [2012.03.15 18:50:33 | 011,819,520 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\da5da08245467818759aa44c4eb948e1\System.Web.ni.dll
MOD - [2012.03.15 18:50:24 | 001,587,200 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
MOD - [2012.03.15 18:49:56 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\461d3b6b3f43e6fbe6c897d5936e17e4\System.Xml.ni.dll
MOD - [2012.03.15 18:49:51 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\bc09ad2d49d8535371845cd7532f9271\System.Configuration.ni.dll
MOD - [2012.03.15 18:49:49 | 007,963,136 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
MOD - [2012.03.15 18:48:34 | 011,490,304 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
MOD - [2012.03.14 01:04:27 | 000,053,248 | ---- | M] () -- C:\Users\motzer\AppData\Local\Temp\catchme.dll
MOD - [2012.01.03 14:10:54 | 000,019,968 | ---- | M] () -- C:\Programme\Adobe\Acrobat 10.0\Acrobat\Locale\de_DE\AcroTray.DEU
MOD - [2011.09.29 08:09:51 | 001,833,944 | ---- | M] () -- C:\Programme\Mozilla Firefox\mozjs.dll
MOD - [2011.07.28 21:55:14 | 001,082,368 | ---- | M] () -- C:\Programme\Air Mouse\Air Mouse\Air Mouse.exe
MOD - [2011.07.27 13:53:51 | 001,703,936 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager2.Graphics.Wizard\2.0.3609.23390__90ba9c70f846762e\CLI.Aspect.DisplaysManager2.Graphics.Wizard.dll
MOD - [2011.07.27 13:53:51 | 000,491,520 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Wizard\2.0.3609.23357__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Wizard.dll
MOD - [2011.07.27 13:53:51 | 000,372,736 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime\2.0.3609.23260__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.dll
MOD - [2011.07.27 13:53:51 | 000,204,800 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Wizard\2.0.3609.23281__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Wizard.dll
MOD - [2011.07.27 13:53:51 | 000,077,824 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Runtime\2.0.3609.23336__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Runtime.dll
MOD - [2011.07.27 13:53:51 | 000,073,728 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard\2.0.3609.23269__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.dll
MOD - [2011.07.27 13:53:51 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Runtime\2.0.3609.23316__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Runtime.dll
MOD - [2011.07.27 13:53:51 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Runtime\2.0.3609.23306__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Runtime.dll
MOD - [2011.07.27 13:53:51 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard\2.0.3609.23275__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.dll
MOD - [2011.07.27 13:53:51 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Runtime\2.0.3609.23270__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Runtime.dll
MOD - [2011.07.27 13:53:50 | 000,643,072 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.OverDrive5.Graphics.Dashboard\2.0.3609.23369__90ba9c70f846762e\CLI.Aspect.OverDrive5.Graphics.Dashboard.dll
MOD - [2011.07.27 13:53:50 | 000,409,600 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Wizard\2.0.3609.23331__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Wizard.dll
MOD - [2011.07.27 13:53:50 | 000,356,352 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Dashboard\2.0.3609.23322__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Dashboard.dll
MOD - [2011.07.27 13:53:50 | 000,094,208 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Wizard\2.0.3609.23322__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Wizard.dll
MOD - [2011.07.27 13:53:50 | 000,077,824 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.OverDrive5.Graphics.Runtime\2.0.3609.23368__90ba9c70f846762e\CLI.Aspect.OverDrive5.Graphics.Runtime.dll
MOD - [2011.07.27 13:53:50 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Welcome.Graphics.Dashboard\2.0.3609.23358__90ba9c70f846762e\CLI.Aspect.Welcome.Graphics.Dashboard.dll
MOD - [2011.07.27 13:53:50 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Runtime\2.0.3609.23321__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Runtime.dll
MOD - [2011.07.27 13:53:50 | 000,013,312 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Welcome.Graphics.Runtime\2.0.3609.23390__90ba9c70f846762e\CLI.Aspect.Welcome.Graphics.Runtime.dll
MOD - [2011.07.27 13:53:49 | 001,142,784 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager2.Graphics.Dashboard\2.0.3609.23385__90ba9c70f846762e\CLI.Aspect.DisplaysManager2.Graphics.Dashboard.dll
MOD - [2011.07.27 13:53:49 | 000,827,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Dashboard\2.0.3609.23308__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Dashboard.dll
MOD - [2011.07.27 13:53:49 | 000,573,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Dashboard\2.0.3609.23282__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Dashboard.dll
MOD - [2011.07.27 13:53:49 | 000,393,216 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Dashboard\2.0.3609.23307__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Dashboard.dll
MOD - [2011.07.27 13:53:49 | 000,372,736 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Dashboard\2.0.3609.23302__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Dashboard.dll
MOD - [2011.07.27 13:53:49 | 000,344,064 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Dashboard.Shared\2.0.3609.23298__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Dashboard.Shared.dll
MOD - [2011.07.27 13:53:49 | 000,270,336 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
MOD - [2011.07.27 13:53:49 | 000,196,608 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Dashboard\2.0.3609.23282__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Dashboard.dll
MOD - [2011.07.27 13:53:49 | 000,098,304 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Runtime\2.0.3609.23308__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Runtime.dll
MOD - [2011.07.27 13:53:49 | 000,094,208 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Dashboard\2.0.3609.23313__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Dashboard.dll
MOD - [2011.07.27 13:53:49 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Runtime\2.0.3609.23306__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Runtime.dll
MOD - [2011.07.27 13:53:49 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Runtime\2.0.3609.23313__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Runtime.dll
MOD - [2011.07.27 13:53:49 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Runtime\2.0.3609.23286__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Runtime.dll
MOD - [2011.07.27 13:53:49 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Runtime\2.0.3609.23307__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Runtime.dll
MOD - [2011.07.27 13:53:49 | 000,036,864 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Runtime\2.0.3609.23315__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Runtime.dll
MOD - [2011.07.27 13:53:49 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.Hotkeys.Shared\2.0.3589.25834__90ba9c70f846762e\AEM.Plugin.Hotkeys.Shared.dll
MOD - [2011.07.27 13:53:49 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Actions.CCAA.Shared\2.0.3589.25817__90ba9c70f846762e\AEM.Actions.CCAA.Shared.dll
MOD - [2011.07.27 13:53:49 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.WinMessages.Shared\2.0.3589.25847__90ba9c70f846762e\AEM.Plugin.WinMessages.Shared.dll
MOD - [2011.07.27 13:53:49 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.EEU.Shared\2.0.3589.25854__90ba9c70f846762e\AEM.Plugin.EEU.Shared.dll
MOD - [2011.07.27 13:53:48 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation\2.0.3589.25791__90ba9c70f846762e\LOG.Foundation.dll
MOD - [2011.07.27 13:53:48 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\NEWAEM.Foundation\2.0.3589.25794__90ba9c70f846762e\NEWAEM.Foundation.dll
MOD - [2011.07.27 13:53:48 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0703\2.0.2651.18802__90ba9c70f846762e\DEM.Graphics.I0703.dll
MOD - [2011.07.27 13:53:48 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\MOM.Foundation\2.0.3589.25837__90ba9c70f846762e\MOM.Foundation.dll
MOD - [2011.07.27 13:53:48 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0706\2.0.2743.23304__90ba9c70f846762e\DEM.Graphics.I0706.dll
MOD - [2011.07.27 13:53:48 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.REG.Shared\2.0.3589.25951__90ba9c70f846762e\AEM.Plugin.REG.Shared.dll
MOD - [2011.07.27 13:53:48 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.GD.Shared\2.0.3589.25922__90ba9c70f846762e\AEM.Plugin.GD.Shared.dll
MOD - [2011.07.27 13:53:48 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.DPPE.Shared\2.0.3589.25916__90ba9c70f846762e\AEM.Plugin.DPPE.Shared.dll
MOD - [2011.07.27 13:53:48 | 000,007,168 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\atixclib\1.0.0.0__90ba9c70f846762e\atixclib.dll
MOD - [2011.07.27 13:53:47 | 000,151,552 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Shared\2.0.3589.25814__90ba9c70f846762e\CLI.Caste.Graphics.Shared.dll
MOD - [2011.07.27 13:53:47 | 000,098,304 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Foundation\2.0.3589.25796__90ba9c70f846762e\CLI.Foundation.dll
MOD - [2011.07.27 13:53:47 | 000,061,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.OverDrive5.Graphics.Shared\2.0.3589.25948__90ba9c70f846762e\CLI.Aspect.OverDrive5.Graphics.Shared.dll
MOD - [2011.07.27 13:53:47 | 000,061,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Shared\2.0.3589.25848__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Shared.dll
MOD - [2011.07.27 13:53:47 | 000,057,344 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Shared\2.0.3589.25945__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Shared.dll
MOD - [2011.07.27 13:53:47 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0601\2.0.2573.17685__90ba9c70f846762e\DEM.Graphics.I0601.dll
MOD - [2011.07.27 13:53:47 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Shared\2.0.3589.25905__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Shared.dll
MOD - [2011.07.27 13:53:47 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Foundation.XManifest\2.0.3589.26042__90ba9c70f846762e\CLI.Foundation.XManifest.dll
MOD - [2011.07.27 13:53:47 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MultiVPU4.Graphics.Shared\2.0.3589.25921__90ba9c70f846762e\CLI.Aspect.MultiVPU4.Graphics.Shared.dll
MOD - [2011.07.27 13:53:47 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared\2.0.3589.25822__90ba9c70f846762e\CLI.Component.Dashboard.Shared.dll
MOD - [2011.07.27 13:53:47 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.PowerXpress.Graphics.Shared\2.0.3589.25946__90ba9c70f846762e\CLI.Aspect.PowerXpress.Graphics.Shared.dll
MOD - [2011.07.27 13:53:47 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared\2.0.3589.25829__90ba9c70f846762e\CLI.Component.Wizard.Shared.dll
MOD - [2011.07.27 13:53:47 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Client.Shared\2.0.3589.25810__90ba9c70f846762e\CLI.Component.Client.Shared.dll
MOD - [2011.07.27 13:53:47 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Welcome.Graphics.Shared\2.0.3589.25907__90ba9c70f846762e\CLI.Aspect.Welcome.Graphics.Shared.dll
MOD - [2011.07.27 13:53:47 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Shared\2.0.3589.25838__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Shared.dll
MOD - [2011.07.27 13:53:47 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics\2.0.3589.25917__90ba9c70f846762e\DEM.Graphics.dll
MOD - [2011.07.27 13:53:47 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Foundation\2.0.2573.17684__90ba9c70f846762e\DEM.Foundation.dll
MOD - [2011.07.27 13:53:47 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared\2.0.3589.25832__90ba9c70f846762e\CLI.Component.Runtime.Shared.dll
MOD - [2011.07.27 13:53:47 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard.Shared\2.0.3589.25896__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.Shared.dll
MOD - [2011.07.27 13:53:47 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard.Shared\2.0.3589.25844__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.Shared.dll
MOD - [2011.07.27 13:53:46 | 000,741,376 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\ResourceManagement.Foundation.Implementation\2.0.3609.23384__90ba9c70f846762e\ResourceManagement.Foundation.Implementation.dll
MOD - [2011.07.27 13:53:46 | 000,106,496 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\MOM.Implementation\2.0.3609.23351__90ba9c70f846762e\MOM.Implementation.dll
MOD - [2011.07.27 13:53:46 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation\2.0.3609.23350__90ba9c70f846762e\LOG.Foundation.Implementation.dll
MOD - [2011.07.27 13:53:46 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Shared\2.0.3589.25859__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Shared.dll
MOD - [2011.07.27 13:53:46 | 000,053,248 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Shared\2.0.3589.25846__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Shared.dll
MOD - [2011.07.27 13:53:46 | 000,053,248 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Shared\2.0.3589.25888__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Shared.dll
MOD - [2011.07.27 13:53:46 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.Source.Kit.Server\2.0.3609.23363__90ba9c70f846762e\AEM.Plugin.Source.Kit.Server.dll
MOD - [2011.07.27 13:53:46 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Foundation.Private\2.0.3589.25806__90ba9c70f846762e\CLI.Foundation.Private.dll
MOD - [2011.07.27 13:53:46 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Shared\2.0.3589.25831__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Shared.dll
MOD - [2011.07.27 13:53:46 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Shared\2.0.3589.25857__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Shared.dll
MOD - [2011.07.27 13:53:46 | 000,036,864 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Private\2.0.3589.25801__90ba9c70f846762e\LOG.Foundation.Private.dll
MOD - [2011.07.27 13:53:46 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Shared\2.0.3589.25893__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Shared.dll
MOD - [2011.07.27 13:53:46 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Shared\2.0.3589.25912__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Shared.dll
MOD - [2011.07.27 13:53:46 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CustomFormats.Graphics.Shared\2.0.3589.25825__90ba9c70f846762e\CLI.Aspect.CustomFormats.Graphics.Shared.dll
MOD - [2011.07.27 13:53:46 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.ALICrossfire.Graphics.Shared\2.0.3589.25863__90ba9c70f846762e\CLI.Aspect.ALICrossfire.Graphics.Shared.dll
MOD - [2011.07.27 13:53:46 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared.Private\2.0.3589.25839__90ba9c70f846762e\CLI.Component.Wizard.Shared.Private.dll
MOD - [2011.07.27 13:53:46 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Shared\2.0.3589.25862__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Shared.dll
MOD - [2011.07.27 13:53:46 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\ResourceManagement.Foundation.Private\2.0.3589.25819__90ba9c70f846762e\ResourceManagement.Foundation.Private.dll
MOD - [2011.07.27 13:53:46 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation.Private\2.0.3589.25856__90ba9c70f846762e\LOG.Foundation.Implementation.Private.dll
MOD - [2011.07.27 13:53:46 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\APM.Foundation\2.0.3589.25858__90ba9c70f846762e\APM.Foundation.dll
MOD - [2011.07.27 13:53:46 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Server.Shared\2.0.3589.25836__90ba9c70f846762e\AEM.Server.Shared.dll
MOD - [2011.07.27 13:53:46 | 000,007,168 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Extension.EEU\2.0.3609.23257__90ba9c70f846762e\CLI.Component.Runtime.Extension.EEU.dll
MOD - [2011.07.27 13:53:45 | 001,220,608 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard\2.0.3609.23265__90ba9c70f846762e\CLI.Component.Dashboard.dll
MOD - [2011.07.27 13:53:45 | 000,565,248 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Systemtray\2.0.3609.23345__90ba9c70f846762e\CLI.Component.Systemtray.dll
MOD - [2011.07.27 13:53:45 | 000,405,504 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard\2.0.3609.23275__90ba9c70f846762e\CLI.Component.Wizard.dll
MOD - [2011.07.27 13:53:45 | 000,061,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime\2.0.3609.23257__90ba9c70f846762e\CLI.Component.Runtime.dll
MOD - [2011.07.27 13:53:45 | 000,057,344 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.SkinFactory\2.0.3609.23259__90ba9c70f846762e\CLI.Component.SkinFactory.dll
MOD - [2011.07.27 13:53:45 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared.Private\2.0.3589.25849__90ba9c70f846762e\CLI.Component.Runtime.Shared.Private.dll
MOD - [2011.07.27 13:53:45 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared.Private\2.0.3589.25851__90ba9c70f846762e\CLI.Component.Dashboard.Shared.Private.dll
MOD - [2011.07.27 13:53:44 | 000,061,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\APM.Server\2.0.3609.23255__90ba9c70f846762e\APM.Server.dll
MOD - [2011.07.27 13:53:44 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Server\2.0.3609.23256__90ba9c70f846762e\AEM.Server.dll
MOD - [2011.07.27 13:53:44 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Client.Shared.Private\2.0.3589.25826__90ba9c70f846762e\CLI.Component.Client.Shared.Private.dll
MOD - [2011.07.27 13:53:44 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\ATICCCom\2.0.0.0__90ba9c70f846762e\ATICCCom.dll
MOD - [2011.07.27 13:53:44 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime.Shared.Private\2.0.3589.25865__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.Shared.Private.dll
MOD - [2011.07.27 13:53:44 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CustomFormatSelection.Graphics.Dashboard.Shared.Private\2.0.3589.25903__90ba9c70f846762e\CLI.Aspect.CustomFormatSelection.Graphics.Dashboard.Shared.Private.dll
MOD - [2011.07.27 13:53:44 | 000,019,456 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CCC.Implementation\2.0.3609.23351__90ba9c70f846762e\CCC.Implementation.dll
MOD - [2011.06.19 08:29:06 | 001,967,104 | ---- | M] () -- C:\Programme\National Instruments\Shared\NI Error Reporting\niwsrp.dll
MOD - [2011.06.14 13:19:58 | 000,025,600 | ---- | M] () -- C:\Programme\Air Mouse\Air Mouse\BonjourService.dll
MOD - [2011.03.16 23:11:16 | 004,297,568 | ---- | M] () -- C:\Programme\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
MOD - [2011.03.02 11:40:51 | 000,140,288 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll
MOD - [2010.11.05 02:59:41 | 000,212,992 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.resources\2.0.0.0_de_b77a5c561934e089\System.resources.dll
MOD - [2009.11.30 14:17:00 | 000,417,792 | ---- | M] () -- C:\Programme\ASUS\GamerOSD\ATKFastUserSwitching.exe
MOD - [2009.07.14 09:47:13 | 000,434,176 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll
MOD - [2009.07.14 09:47:12 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2008.12.10 10:19:08 | 000,430,080 | ---- | M] () -- C:\Programme\ATI Technologies\ATI.ACE\Branding\Branding.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2012.01.03 14:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.11.17 08:25:00 | 000,050,328 | ---- | M] (National Instruments Corporation) [Auto | Running] -- C:\Programme\National Instruments\Shared\NI WebServer\SystemWebServer.exe -- (niSvcLoc)
SRV - [2011.10.10 23:27:16 | 001,044,816 | ---- | M] (Flexera Software, Inc.) [On_Demand | Stopped] -- C:\Programme\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2011.10.04 20:49:27 | 000,419,624 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2011.08.30 17:18:30 | 002,358,656 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Programme\TeamViewer\Version6\TeamViewer_Service.exe -- (TeamViewer6)
SRV - [2011.08.03 04:20:34 | 000,580,416 | ---- | M] (Autodesk, Inc.) [Auto | Running] -- C:\Programme\Autodesk\Inventor 2012\Moldflow\bin\mitsijm.exe -- (mitsijm2012)
SRV - [2011.07.04 15:35:01 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.06.14 17:57:10 | 000,012,696 | ---- | M] (National Instruments Corporation) [Auto | Running] -- C:\Programme\National Instruments\MAX\nimxs.exe -- (mxssvr)
SRV - [2011.06.14 11:54:08 | 000,676,016 | ---- | M] (National Instruments Corporation) [Auto | Stopped] -- C:\Programme\National Instruments\Shared\Tagger\tagsrv.exe -- (NITaggerService)
SRV - [2011.06.14 09:11:10 | 000,362,104 | ---- | M] (National Instruments Corporation) [Auto | Stopped] -- C:\Programme\National Instruments\Shared\Security\nidmsrv.exe -- (NIDomainService)
SRV - [2011.06.14 09:08:24 | 000,056,952 | ---- | M] (National Instruments Corporation) [Auto | Stopped] -- C:\Windows\System32\lktsrv.exe -- (lkTimeSync)
SRV - [2011.06.14 09:00:10 | 000,046,192 | ---- | M] (National Instruments Corporation) [Auto | Stopped] -- C:\Windows\System32\lkads.exe -- (lkClassAds)
SRV - [2011.06.12 10:15:00 | 031,125,880 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft Office\Office14\GROOVE.EXE -- (Microsoft SharePoint Workspace Audit Service)
SRV - [2011.06.10 14:11:20 | 000,121,032 | ---- | M] (National Instruments Corporation) [Auto | Running] -- C:\Programme\National Instruments\Shared\NI Network Discovery\niDiscSvc.exe -- (NINetworkDiscovery)
SRV - [2011.06.01 16:32:14 | 000,194,224 | ---- | M] (National Instruments Corporation) [Auto | Running] -- C:\Programme\National Instruments\Shared\mDNS Responder\nimdnsResponder.exe -- (nimDNSResponder)
SRV - [2011.05.27 13:43:48 | 000,050,336 | ---- | M] (National Instruments Corporation) [Auto | Running] -- C:\Programme\National Instruments\Shared\NI WebServer\ApplicationWebServer.exe -- (NIApplicationWebServer)
SRV - [2011.03.28 15:15:04 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011.03.23 23:34:18 | 000,435,152 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Programme\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe -- (vpnagent)
SRV - [2010.11.20 13:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2010.10.27 09:43:38 | 000,695,136 | ---- | M] (National Instruments, Inc.) [Auto | Stopped] -- C:\Windows\System32\lkcitdl.exe -- (LkCitadelServer)
SRV - [2010.10.22 02:00:00 | 000,376,832 | R--- | M] (AVM Berlin) [Auto | Running] -- C:\Programme\avmwlanstick\WLanNetService.exe -- (AVM WLAN Connection Service)
SRV - [2010.08.02 10:00:00 | 001,427,688 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Programme\National Instruments\Shared\License Manager\Bin\lmgrd.exe -- (NILM License Manager)
SRV - [2010.01.09 20:37:50 | 004,640,000 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
SRV - [2010.01.09 20:18:00 | 000,149,352 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)
SRV - [2009.12.01 13:22:54 | 000,061,952 | ---- | M] (ASUSTeK COMPUTER INC.) [Auto | Running] -- C:\Windows\System32\ATKFUSService.exe -- (ATKFUSService)
SRV - [2009.11.18 06:45:26 | 000,172,032 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2009.07.27 10:13:28 | 000,061,440 | ---- | M] () [Auto | Running] -- C:\Windows\System32\ASDR.exe -- (ASDR)
SRV - [2009.07.14 02:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc)
SRV - [2009.07.14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 02:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009.07.14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009.06.03 10:26:34 | 000,098,304 | ---- | M] (OPC Foundation) [On_Demand | Stopped] -- C:\Windows\System32\Opcenum.exe -- (OpcEnum)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Running] -- C:\Users\motzer\AppData\Local\Temp\catchme.sys -- (catchme)
DRV - [2011.11.04 20:34:56 | 000,019,552 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\cvintdrv.sys -- (cvintdrv)
DRV - [2011.08.16 15:25:01 | 000,722,416 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\drivers\sptd.sys -- (sptd)
DRV - [2011.07.27 13:54:55 | 000,014,336 | ---- | M] (ASUSTeK Computer Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\EIO.sys -- (EIO)
DRV - [2011.07.20 08:46:04 | 000,181,432 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssudmdm.sys -- (ssudmdm) SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.)
DRV - [2011.07.20 08:46:04 | 000,077,624 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssudbus.sys -- (dg_ssudbus) SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.)
DRV - [2011.07.04 15:35:01 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2011.07.04 15:35:01 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011.06.29 13:49:48 | 000,011,968 | ---- | M] (National Instruments Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nipalfwedl.sys -- (nipalfwedl)
DRV - [2011.06.29 13:48:18 | 000,011,968 | ---- | M] (National Instruments Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nipalusbedl.sys -- (nipalusbedl)
DRV - [2011.06.29 13:41:00 | 000,584,856 | ---- | M] (National Instruments Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\nipalk.sys -- (NIPALK)
DRV - [2011.06.15 09:23:56 | 000,060,156 | ---- | M] (PowerISO Computing, Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\scdemu.sys -- (SCDEmu)
DRV - [2011.05.10 07:06:14 | 000,018,432 | ---- | M] (Apple Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\netaapl.sys -- (Netaapl)
DRV - [2011.03.23 23:25:38 | 000,019,680 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vpnva.sys -- (vpnva)
DRV - [2011.03.23 23:25:14 | 000,077,968 | R--- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\acsock.sys -- (acsock)
DRV - [2011.01.21 13:52:18 | 000,381,032 | ---- | M] (Paragon) [Kernel | System | Running] -- C:\Windows\System32\drivers\Uim_IM.sys -- (Uim_IM)
DRV - [2011.01.21 13:52:18 | 000,057,112 | ---- | M] (Paragon Software Group) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\hotcore3.sys -- (hotcore3)
DRV - [2011.01.21 13:52:18 | 000,040,824 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | System | Running] -- C:\Windows\System32\drivers\UimBus.sys -- (UimBus)
DRV - [2010.11.20 13:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2010.11.20 13:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010.11.20 13:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)
DRV - [2010.11.20 11:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010.11.20 10:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010.11.20 10:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010.11.20 10:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)
DRV - [2010.10.22 01:01:00 | 000,586,752 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\fwlanusbn.sys -- (fwlanusbn)
DRV - [2010.10.22 01:01:00 | 000,004,352 | ---- | M] (AVM Berlin) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\avmeject.sys -- (avmeject)
DRV - [2010.10.22 01:00:00 | 000,265,088 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\fwlanusb.sys -- (FWLANUSB)
DRV - [2010.09.02 08:18:48 | 000,017,920 | ---- | M] (Shrew Soft Inc) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\vfilter.sys -- (vflt)
DRV - [2010.09.02 08:18:48 | 000,013,824 | ---- | M] (Shrew Soft Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\virtualnet.sys -- (vnet)
DRV - [2010.08.31 11:43:36 | 000,195,968 | ---- | M] (Jungo) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\windrvr6.sys -- (WinDriver6)
DRV - [2010.06.17 14:27:02 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2010.03.24 12:27:44 | 000,015,448 | ---- | M] (National Instruments Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\nipbcfk.sys -- (nipbcfk)
DRV - [2009.12.08 20:24:26 | 000,048,128 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Programme\Microsoft Visual Studio 10.0\Team Tools\Performance Tools\VSPerfDrv100.sys -- (VSPerfDrv100)
DRV - [2009.11.18 07:20:34 | 005,140,480 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2009.10.08 12:41:46 | 000,063,488 | ---- | M] (Silicon Laboratories) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\silabser.sys -- (silabser)
DRV - [2009.10.08 12:41:46 | 000,017,920 | ---- | M] (Silicon Laboratories, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\silabenm.sys -- (silabenm)
DRV - [2009.07.13 23:02:50 | 000,211,456 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express) Intel(R)
DRV - [2009.06.10 22:19:48 | 009,853,248 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2009.03.18 17:35:40 | 000,026,176 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\hamachi.sys -- (hamachi)
DRV - [2009.03.02 13:12:10 | 000,038,400 | ---- | M] (Samsung Electronics Co., Ltd.) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\DGIVECP.SYS -- (DgiVecp)
DRV - [2009.03.02 13:12:10 | 000,005,120 | ---- | M] (Samsung Electronics) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\SSPORT.SYS -- (SSPORT)
DRV - [2009.02.17 17:22:14 | 000,030,976 | ---- | M] (ASUSTeK Computer Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ATKDispLowFilter.sys -- (atkdisplf)
DRV - [2009.02.17 17:22:14 | 000,015,232 | ---- | M] (ASUSTeK Computer Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\asusgsb.sys -- (asusgsb)
DRV - [2008.11.16 17:39:44 | 000,131,984 | ---- | M] (Deterministic Networks, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\dne2000.sys -- (DNE)
DRV - [2008.10.27 13:57:28 | 000,077,824 | ---- | M] (Prolific Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ser2pl.sys -- (Ser2pl)
DRV - [2007.01.18 19:28:02 | 000,005,275 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\CVirtA.sys -- (CVirtA)
DRV - [2005.03.30 10:12:38 | 000,014,544 | ---- | M] (EnTech Taiwan) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TVicPort.sys -- (TVicPort)
DRV - [2002.05.22 00:00:00 | 000,069,600 | ---- | M] (Engelmann GmbH) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\precsim.sys -- (PrecSim)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 8C AA F3 5C 76 A0 CC 01  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = fritz.box;*.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Search the web"
FF - prefs.js..browser.search.order.1: "Search the web"
FF - prefs.js..browser.search.selectedEngine: "Search the web"
FF - prefs.js..keyword.URL: "hxxp://www.browsersafesearch.com?client=mozilla-firefox&cd=UTF-8&search=1&q="
 
FF - user.js..browser.search.selectedEngine: "Search the web"
FF - user.js..browser.search.order.1: "Search the web"
FF - user.js..browser.search.defaultenginename: "Search the web"
FF - user.js..keyword.URL: "hxxp://www.browsersafesearch.com?client=mozilla-firefox&cd=UTF-8&search=1&q="
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Acrobat: C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\web2pdfextension@web2pdf.adobedotcom: C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2012.02.02 14:46:30 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{184AA5E6-741D-464a-820E-94B3ABC2F3B4}: C:\Users\motzer\AppData\Roaming\07016 [2012.03.16 22:04:34 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.10.05 13:21:56 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.03.12 00:44:29 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 10.0.2\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2011.08.17 19:31:51 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 10.0.2\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\extensions\\{184AA5E6-741D-464a-820E-94B3ABC2F3B4}: C:\Users\motzer\AppData\Roaming\07016 [2012.03.16 22:04:34 | 000,000,000 | ---D | M]
 
[2011.05.25 15:51:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\motzer\AppData\Roaming\mozilla\Extensions
[2011.05.25 15:51:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\motzer\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012.01.09 18:13:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\motzer\AppData\Roaming\mozilla\Firefox\Profiles\vcob6byz.default\extensions
[2012.01.09 18:13:19 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\motzer\AppData\Roaming\mozilla\Firefox\Profiles\vcob6byz.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2012.01.25 15:34:29 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.01.25 15:34:29 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2011.11.07 14:32:02 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}
[2012.02.02 14:46:30 | 000,000,000 | ---D | M] (Adobe Acrobat - Create PDF) -- C:\PROGRAM FILES\ADOBE\ACROBAT 10.0\ACROBAT\BROWSER\WCFIREFOXEXTN
[2012.01.25 15:34:29 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2011.09.29 08:09:51 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011.06.22 11:43:54 | 000,026,112 | ---- | M] (National Instruments) -- C:\Program Files\mozilla firefox\plugins\nplv2011win32.dll
[2011.05.12 10:00:46 | 000,025,088 | ---- | M] (National Instruments) -- C:\Program Files\mozilla firefox\plugins\nplv90win32.dll
[2011.09.29 02:24:37 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.09.29 02:16:42 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011.09.29 02:24:37 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011.09.29 02:24:37 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.10.10 20:07:03 | 000,000,158 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\Search the web.src
[2011.09.29 02:24:37 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.09.29 02:24:37 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
Hosts file not found
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Microsoft-Webtestaufzeichnung 10.0-Hilfsprogramm) - {DDA57003-0068-4ed2-9D32-4D1EC707D94D} - C:\Programme\Microsoft Visual Studio 10.0\Common7\IDE\PrivateAssemblies\Microsoft.VisualStudio.QualityTools.RecorderBarBHO100.dll (Microsoft Corporation)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (no name) - {DFEFCDEE-CF1A-4FC8-89AF-189327213627} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [AVMWlanClient] C:\Programme\avmwlanstick\WLanGUI.exe (AVM Berlin)
O4 - HKLM..\Run: [BCSSync] C:\Program Files\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)
O4 - HKLM..\Run: [gema] C:\Windows\System32\gema.exe ()
O4 - HKLM..\Run: [gema.] C:\ProgramData\gema\gema.exe File not found
O4 - HKLM..\Run: [NI Update Service] C:\Program Files\National Instruments\Shared\Update Service\NIUpdateService.exe (National Instruments)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [SunServer] C:\Programme\Sunbelt Software\CounterSpy\Consumer\SunServer.exe (Sunbelt Software)
O4 - HKCU..\Run: [gema] C:\Users\motzer\AppData\Roaming\gema\gema.exe ()
O4 - HKCU..\Run: [NIRegistrationWizard] C:\Program Files\National Instruments\Shared\RegistrationWizard\Bin\RegistrationWizard.exe ()
O4 - Startup: C:\Users\motzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\motzer\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 91 00 00 00  [binary data]
O8 - Extra context menu item: An OneNote s&enden - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Free YouTube Download - C:\Users\motzer\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\motzer\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Programme\ICQ7.6\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Programme\ICQ7.6\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Programme\National Instruments\Shared\mDNS Responder\nimdnsNSP.dll (National Instruments Corporation)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: fritz.box ([]* in Lokales Intranet)
O15 - HKCU\..Trusted Ranges: Range1 ([*] in Lokales Intranet)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{56B65BB0-AA21-4A1A-AB7C-8CB9593B7B3A}: DhcpNameServer = 212.23.97.3 212.23.97.2
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B1290DBB-9D3F-427B-97EB-CCA008AD719C}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\ProgramData\gema\gema.exe) -  File not found
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\gema.exe) - C:\Windows\System32\gema.exe ()
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Users\motzer\AppData\Roaming\appconf32.exe) - C:\Users\motzer\AppData\Roaming\appconf32.exe ()
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011.10.25 22:23:56 | 000,000,000 | ---D | M] - C:\Autodesk -- [ NTFS ]
O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2011.04.12 03:37:58 | 000,000,043 | R--- | M] () - M:\autorun.inf -- [ UDF ]
O33 - MountPoints2\{afa1bf46-cd7a-11e0-bae4-001aa091f7a6}\Shell - "" = AutoRun
O33 - MountPoints2\{afa1bf46-cd7a-11e0-bae4-001aa091f7a6}\Shell\AutoRun\command - "" = L:\pushinst.exe
O33 - MountPoints2\{dff9a773-86c3-11e0-99af-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{dff9a773-86c3-11e0-99af-806e6f6e6963}\Shell\AutoRun\command - "" = M:\setup.exe -- [2011.04.12 03:37:58 | 000,112,400 | R--- | M] (Microsoft Corporation)
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {31FC3F49-B603-2BBB-4B72-952B41E98BF5} - .NET Framework
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4A714DA3-0F91-9CB5-4DC4-734E0F9FEEAA} - Java (Sun)
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5EA97B4D-0579-EC62-737C-AA2958CBE6F2} - .NET Framework
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {8B1EC444-50ED-44BB-FA40-18FE57D31FAD} - Browser Customizations
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {9605F371-7183-4BD8-B48E-E1B099CA0DB3} - Microsoft Windows Media Player
ActiveX: {A017B03A-758D-6277-904B-8ED91E5E4F84} - Browser Customizations
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: rbfilter -  File not found
NetSvcs: SNC -  File not found
NetSvcs: cmuda -  File not found
NetSvcs: ntservice1 -  File not found
NetSvcs: mcontrol -  File not found
NetSvcs: vmm -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.03.18 23:34:36 | 000,594,432 | ---- | C] (OldTimer Tools) -- C:\Users\motzer\Desktop\OTL.exe
[2012.03.18 21:22:53 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2012.03.18 21:22:53 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2012.03.18 21:22:53 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012.03.18 21:22:23 | 000,000,000 | --SD | C] -- C:\ComboFix
[2012.03.18 21:21:57 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012.03.18 21:21:07 | 000,000,000 | --SD | C] -- C:\32788R22FWJFW
[2012.03.18 21:20:33 | 004,438,697 | R--- | C] (Swearware) -- C:\Users\motzer\Desktop\ComboFix.exe
[2012.03.17 20:34:37 | 000,000,000 | ---D | C] -- C:\Users\motzer\AppData\Roaming\gema
[2012.03.17 20:34:37 | 000,000,000 | ---D | C] -- C:\ProgramData\gema
[2012.03.16 22:04:31 | 000,000,000 | ---D | C] -- C:\Users\motzer\AppData\Roaming\07016
[2012.03.16 22:04:09 | 000,000,000 | ---D | C] -- C:\Users\motzer\AppData\Roaming\xmldm
[2012.03.16 22:04:09 | 000,000,000 | ---D | C] -- C:\Users\motzer\AppData\Roaming\kock
[2012.03.15 20:35:42 | 004,731,392 | ---- | C] (AVAST Software) -- C:\Users\motzer\Desktop\aswMBR.exe
[2012.03.15 20:35:31 | 002,063,920 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\motzer\Desktop\tdsskiller.exe
[2012.03.15 19:31:09 | 000,078,336 | ---- | C] (AVM Berlin) -- C:\Windows\System32\fwusbnci.org
[2012.03.15 19:31:09 | 000,074,240 | ---- | C] (AVM Berlin) -- C:\Windows\System32\fwlanci.org
[2012.03.14 21:50:19 | 000,000,000 | ---D | C] -- C:\Windows\System32\SPReview
[2012.03.14 21:49:12 | 000,000,000 | ---D | C] -- C:\Windows\System32\EventProviders
[2012.03.14 01:02:16 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2012.03.13 21:58:43 | 000,000,000 | ---D | C] -- C:\FRST
[2012.03.13 19:12:58 | 000,026,176 | -H-- | C] (LogMeIn, Inc.) -- C:\Windows\System32\hamachi.sys
[2012.03.13 19:12:47 | 000,000,000 | ---D | C] -- C:\Users\motzer\AppData\Local\LogMeIn Hamachi
[2012.03.13 19:07:34 | 000,000,000 | ---D | C] -- C:\Users\motzer\Documents\Shrew Soft VPN
[2012.03.13 19:07:33 | 000,000,000 | ---D | C] -- C:\Program Files\ShrewSoft
[2012.03.13 01:05:18 | 000,000,000 | ---D | C] -- C:\Windows\System32\Shared Memory
[2012.03.12 21:38:34 | 000,388,608 | ---- | C] (Trend Micro Inc.) -- C:\Users\motzer\Desktop\HiJackThis204.exe
[2012.03.12 21:33:54 | 000,000,000 | ---D | C] -- C:\Users\motzer\AppData\Roaming\Malwarebytes
[2012.03.12 21:33:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.03.12 21:33:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.03.12 21:33:34 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.03.12 21:33:34 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.03.12 21:28:02 | 009,502,424 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\motzer\Desktop\mbam-setup-1.60.1.1000.exe
[2012.03.12 21:11:18 | 000,000,000 | ---D | C] -- C:\Users\motzer\AppData\Local\Sunbelt Software
[2012.03.12 21:10:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sunbelt Software
[2012.03.12 21:10:34 | 000,000,000 | ---D | C] -- C:\Program Files\Sunbelt Software
[2012.03.12 21:07:36 | 000,000,000 | ---D | C] -- C:\Windows\Downloaded Installations
[2012.03.12 00:43:25 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\National Instruments
[2012.03.12 00:15:23 | 000,000,000 | ---D | C] -- C:\Users\motzer\Documents\LabVIEW Data
[2012.03.11 23:59:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\National Instruments
[2012.03.11 23:58:41 | 000,000,000 | ---D | C] -- C:\Windows\System32\cvirte
[2012.03.11 23:58:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
[2012.03.11 23:57:44 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight
[2012.03.11 23:56:21 | 000,000,000 | ---D | C] -- C:\Program Files\National Instruments
[2012.03.11 23:53:49 | 000,000,000 | ---D | C] -- C:\ProgramData\National Instruments
[2012.03.11 23:51:01 | 000,000,000 | ---D | C] -- C:\National Instruments Downloads
[2012.02.26 22:31:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maxima-5.26.0
[2012.02.26 22:31:24 | 000,000,000 | ---D | C] -- C:\Program Files\Maxima-5.26.0
[2012.02.18 01:22:36 | 000,000,000 | ---D | C] -- C:\Program Files\Brotherhood Software
[2012.02.18 01:21:33 | 000,000,000 | ---D | C] -- C:\Users\motzer\AppData\Local\Captcha_Brotherhood
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\motzer\AppData\Roaming\*.tmp files -> C:\Users\motzer\AppData\Roaming\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.03.18 23:34:36 | 000,594,432 | ---- | M] (OldTimer Tools) -- C:\Users\motzer\Desktop\OTL.exe
[2012.03.18 22:48:48 | 000,007,595 | ---- | M] () -- C:\Users\motzer\AppData\Local\Resmon.ResmonCfg
[2012.03.18 21:20:36 | 004,438,697 | R--- | M] (Swearware) -- C:\Users\motzer\Desktop\ComboFix.exe
[2012.03.18 21:20:27 | 000,022,064 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.03.18 21:20:27 | 000,022,064 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.03.18 21:17:36 | 000,000,016 | ---- | M] () -- C:\Users\motzer\AppData\Roaming\blckdom.res
[2012.03.18 21:09:37 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.03.18 21:09:31 | 1609,175,040 | -HS- | M] () -- C:\hiberfil.sys
[2012.03.17 20:45:49 | 000,302,592 | ---- | M] () -- C:\Users\motzer\Desktop\eu0cksk6.exe
[2012.03.17 20:34:27 | 000,249,929 | ---- | M] () -- C:\Windows\System32\gema.exe
[2012.03.16 22:13:02 | 000,000,272 | ---- | M] () -- C:\Users\motzer\AppData\Roaming\.backup.dm
[2012.03.16 22:04:24 | 000,390,648 | ---- | M] () -- C:\Users\motzer\AppData\Roaming\AcroIEHelpe.dll
[2012.03.16 22:04:24 | 000,005,624 | ---- | M] () -- C:\Users\motzer\AppData\Roaming\BAcroIEHelpe.dll
[2012.03.16 22:03:31 | 000,696,620 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.03.16 22:03:31 | 000,651,938 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.03.16 22:03:31 | 000,147,916 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.03.16 22:03:31 | 000,120,870 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.03.15 20:35:52 | 004,731,392 | ---- | M] (AVAST Software) -- C:\Users\motzer\Desktop\aswMBR.exe
[2012.03.15 20:35:33 | 002,063,920 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\motzer\Desktop\tdsskiller.exe
[2012.03.15 19:19:00 | 000,019,914 | ---- | M] () -- C:\Users\motzer\Desktop\Wlan.png
[2012.03.15 18:45:04 | 000,544,032 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.03.14 21:41:45 | 000,095,045 | ---- | M] () -- C:\Users\motzer\Desktop\Resourcen.png
[2012.03.14 21:37:36 | 000,019,004 | ---- | M] () -- C:\Users\motzer\Desktop\Combofix_2.png
[2012.03.14 21:27:05 | 000,034,130 | ---- | M] () -- C:\Users\motzer\Desktop\Combofix.png
[2012.03.13 21:31:59 | 2509,058,048 | ---- | M] () -- C:\Users\motzer\Desktop\X17-59886.iso
[2012.03.13 20:25:48 | 000,001,594 | ---- | M] () -- C:\Windows\VPNUnInstall.MIF
[2012.03.13 19:19:03 | 000,001,594 | ---- | M] () -- C:\Windows\VPNInstall.MIF
[2012.03.12 21:38:35 | 000,388,608 | ---- | M] (Trend Micro Inc.) -- C:\Users\motzer\Desktop\HiJackThis204.exe
[2012.03.12 21:33:40 | 000,001,071 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.03.12 21:28:07 | 009,502,424 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\motzer\Desktop\mbam-setup-1.60.1.1000.exe
[2012.03.12 21:20:32 | 012,410,880 | ---- | M] () -- C:\Users\motzer\Desktop\Ad-Aware96Install.msi
[2012.03.12 21:12:27 | 000,051,570 | ---- | M] () -- C:\Users\motzer\Documents\cc_20120312_211211.reg
[2012.03.12 21:10:37 | 000,002,135 | ---- | M] () -- C:\Users\Public\Desktop\CounterSpy.lnk
[2012.03.12 20:56:42 | 000,000,000 | -HS- | M] () -- C:\Windows\System32\dds_trash_log.cmd
[2012.03.12 00:02:59 | 000,001,039 | ---- | M] () -- C:\Users\motzer\Desktop\National Instruments LabVIEW 2011.lnk
[2012.03.12 00:01:21 | 000,001,193 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\NI Error Reporting.lnk
[2012.02.28 00:43:39 | 000,000,997 | ---- | M] () -- C:\Users\motzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2012.02.24 02:32:51 | 000,072,822 | ---- | M] () -- C:\Windows\System32\ieuinit.inf
[2012.02.18 01:22:40 | 000,002,362 | ---- | M] () -- C:\Users\motzer\Desktop\CBH Captcha Solver.exe.lnk
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\motzer\AppData\Roaming\*.tmp files -> C:\Users\motzer\AppData\Roaming\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.03.18 21:22:53 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012.03.18 21:22:53 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012.03.18 21:22:53 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012.03.18 21:22:53 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012.03.18 21:22:53 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012.03.18 21:16:50 | 000,013,189 | R--- | C] () -- C:\Windows\instwcli.inf
[2012.03.18 21:10:05 | 000,249,929 | ---- | C] () -- C:\Windows\System32\gema.exe
[2012.03.17 20:45:49 | 000,302,592 | ---- | C] () -- C:\Users\motzer\Desktop\eu0cksk6.exe
[2012.03.16 22:13:02 | 000,000,272 | ---- | C] () -- C:\Users\motzer\AppData\Roaming\.backup.dm
[2012.03.16 22:04:24 | 000,390,648 | ---- | C] () -- C:\Users\motzer\AppData\Roaming\AcroIEHelpe.dll
[2012.03.16 22:04:24 | 000,005,624 | ---- | C] () -- C:\Users\motzer\AppData\Roaming\BAcroIEHelpe.dll
[2012.03.16 22:04:20 | 000,000,016 | ---- | C] () -- C:\Users\motzer\AppData\Roaming\blckdom.res
[2012.03.15 19:19:00 | 000,019,914 | ---- | C] () -- C:\Users\motzer\Desktop\Wlan.png
[2012.03.14 21:41:45 | 000,095,045 | ---- | C] () -- C:\Users\motzer\Desktop\Resourcen.png
[2012.03.14 21:37:36 | 000,019,004 | ---- | C] () -- C:\Users\motzer\Desktop\Combofix_2.png
[2012.03.14 21:30:41 | 000,007,595 | ---- | C] () -- C:\Users\motzer\AppData\Local\Resmon.ResmonCfg
[2012.03.14 21:27:05 | 000,034,130 | ---- | C] () -- C:\Users\motzer\Desktop\Combofix.png
[2012.03.13 20:36:17 | 2509,058,048 | ---- | C] () -- C:\Users\motzer\Desktop\X17-59886.iso
[2012.03.13 19:15:06 | 000,001,594 | ---- | C] () -- C:\Windows\VPNUnInstall.MIF
[2012.03.12 21:33:40 | 000,001,071 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.03.12 21:19:57 | 012,410,880 | ---- | C] () -- C:\Users\motzer\Desktop\Ad-Aware96Install.msi
[2012.03.12 21:12:17 | 000,051,570 | ---- | C] () -- C:\Users\motzer\Documents\cc_20120312_211211.reg
[2012.03.12 21:10:37 | 000,002,135 | ---- | C] () -- C:\Users\Public\Desktop\CounterSpy.lnk
[2012.03.12 00:39:58 | 000,000,000 | -HS- | C] () -- C:\Windows\System32\dds_trash_log.cmd
[2012.03.12 00:02:59 | 000,001,039 | ---- | C] () -- C:\Users\motzer\Desktop\National Instruments LabVIEW 2011.lnk
[2012.03.12 00:01:21 | 000,001,193 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\NI Error Reporting.lnk
[2012.02.24 02:32:51 | 000,072,822 | ---- | C] () -- C:\Windows\System32\ieuinit.inf
[2012.02.18 01:22:40 | 000,002,362 | ---- | C] () -- C:\Users\motzer\Desktop\CBH Captcha Solver.exe.lnk
[2012.01.23 20:53:52 | 000,000,798 | ---- | C] () -- C:\Windows\Ulead32.ini
[2012.01.23 20:53:38 | 000,284,160 | ---- | C] () -- C:\Windows\unin0407.exe
[2011.11.04 20:34:56 | 000,019,552 | ---- | C] () -- C:\Windows\System32\drivers\cvintdrv.sys
[2011.10.27 13:25:41 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2011.10.18 12:54:48 | 000,034,308 | ---- | C] () -- C:\Windows\System32\bassmod.dll
[2011.08.23 12:32:09 | 000,015,565 | ---- | C] () -- C:\Windows\System32\drivers\fwlanusbn.bin
[2011.07.28 01:21:19 | 000,004,608 | ---- | C] () -- C:\Users\motzer\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.07.28 01:16:54 | 000,237,568 | ---- | C] () -- C:\Windows\System32\lame_enc.dll
[2011.07.27 13:56:11 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2011.07.27 13:54:39 | 000,053,248 | ---- | C] () -- C:\Windows\System32\asrussian.dll
[2011.07.27 13:54:39 | 000,053,248 | ---- | C] () -- C:\Windows\System32\askorean.dll
[2011.07.27 13:54:39 | 000,053,248 | ---- | C] () -- C:\Windows\System32\asjapan.dll
[2011.07.27 13:54:39 | 000,053,248 | ---- | C] () -- C:\Windows\System32\asgerman.dll
[2011.07.27 13:54:39 | 000,053,248 | ---- | C] () -- C:\Windows\System32\asfrench.dll
[2011.07.27 13:54:39 | 000,053,248 | ---- | C] () -- C:\Windows\System32\aseng.dll
[2011.07.27 13:54:39 | 000,053,248 | ---- | C] () -- C:\Windows\System32\ASCHT.dll
[2011.07.27 13:54:39 | 000,053,248 | ---- | C] () -- C:\Windows\System32\aschs.dll
[2011.07.27 13:54:38 | 000,761,856 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2011.07.27 13:54:38 | 000,180,224 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2011.07.26 16:26:46 | 000,974,848 | ---- | C] () -- C:\Windows\System32\cis-2.4.dll
[2011.07.26 16:26:46 | 000,081,920 | ---- | C] () -- C:\Windows\System32\issacapi_bs-2.3.dll
[2011.07.26 16:26:46 | 000,065,536 | ---- | C] () -- C:\Windows\System32\issacapi_pe-2.3.dll
[2011.07.26 16:26:46 | 000,057,344 | ---- | C] () -- C:\Windows\System32\issacapi_se-2.3.dll
[2011.06.30 13:00:08 | 000,022,723 | ---- | C] () -- C:\Windows\System32\SUGG1l3.DLL
[2011.06.10 13:52:52 | 000,000,244 | ---- | C] () -- C:\Windows\System32\nirpc.ini
[2011.05.26 23:10:55 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat
[2011.05.25 17:55:20 | 000,000,303 | ---- | C] () -- C:\Users\motzer\AppData\Roaming\myAVR_WorkpadPLUS_Demo.cfg
[2011.05.25 17:55:20 | 000,000,000 | ---- | C] () -- C:\ProgramData\myAVR_WorkpadPLUS_Demo.cfg
[2011.05.25 17:49:50 | 000,000,431 | ---- | C] () -- C:\Users\motzer\AppData\Roaming\myAVR_ProgTool.cfg
[2011.05.25 16:42:25 | 000,017,408 | ---- | C] () -- C:\Users\motzer\AppData\Local\WebpageIcons.db
[2011.05.25 15:51:29 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2010.10.22 01:00:00 | 000,097,360 | ---- | C] () -- C:\Windows\System32\drivers\Fwusb1b.bin
 
========== LOP Check ==========
 
[2012.03.16 22:04:34 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\07016
[2011.06.21 12:23:23 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\Amazon
[2011.05.25 17:43:53 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\Atmel
[2011.11.29 20:37:45 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\Autodesk
[2011.10.27 17:32:20 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\CADClick
[2011.09.12 18:34:11 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\Das Fussball Studio
[2012.03.18 21:17:18 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\Dropbox
[2012.01.09 18:15:58 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\DVDVideoSoft
[2012.01.09 18:15:53 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.03.17 20:34:37 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\gema
[2011.06.21 10:51:15 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\go
[2012.03.02 21:02:37 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\ICQ
[2011.09.22 00:15:44 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\ImgBurn
[2011.09.15 16:23:07 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\IrfanView
[2012.03.16 22:04:09 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\kock
[2011.09.15 16:13:04 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\MAGIX
[2011.05.25 20:07:34 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\MCS Electronics
[2011.07.05 23:24:23 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\mkvtoolnix
[2011.06.23 14:51:05 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\OpenOffice.org
[2011.05.25 15:07:10 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\Opera
[2011.08.22 12:42:48 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\Samsung
[2011.07.07 18:44:23 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\TeamViewer
[2011.05.25 15:51:29 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\Thunderbird
[2012.01.12 13:25:07 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\toolplugin
[2012.03.12 21:07:41 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\TS3Client
[2011.08.16 22:20:40 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\Unified Remote
[2011.05.25 21:02:49 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\VisualAssist
[2011.06.24 17:54:31 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\X-Chat 2
[2012.03.16 22:04:09 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\xmldm
[2011.11.14 15:36:33 | 000,032,630 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %SYSTEMDRIVE%\*. >
[2012.03.18 23:12:23 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin
[2012.03.18 21:22:27 | 000,000,000 | --SD | M] -- C:\32788R22FWJFW
[2011.07.25 13:22:33 | 000,000,000 | ---D | M] -- C:\AdobeAcrobat
[2011.10.25 22:23:56 | 000,000,000 | ---D | M] -- C:\Autodesk
[2012.03.15 18:50:02 | 000,000,000 | -HSD | M] -- C:\Boot
[2012.03.18 21:32:37 | 000,000,000 | --SD | M] -- C:\ComboFix
[2009.07.14 05:53:55 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2011.05.25 12:47:22 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2012.03.16 21:57:02 | 000,000,000 | ---D | M] -- C:\FRST
[2011.10.24 15:32:32 | 000,000,000 | ---D | M] -- C:\Inventor
[2011.10.10 23:22:42 | 000,000,000 | ---D | M] -- C:\MITSI 2012 Temporary Files
[2011.10.25 13:43:05 | 000,000,000 | RH-D | M] -- C:\MSOCache
[2012.03.12 00:42:15 | 000,000,000 | ---D | M] -- C:\National Instruments Downloads
[2009.07.14 03:37:05 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2012.03.13 20:27:31 | 000,000,000 | R--D | M] -- C:\Program Files
[2012.03.17 20:34:37 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2011.05.25 12:47:22 | 000,000,000 | -HSD | M] -- C:\Programme
[2011.11.21 18:16:00 | 000,000,000 | ---D | M] -- C:\Python24
[2012.03.18 21:22:33 | 000,000,000 | ---D | M] -- C:\Qoobox
[2011.05.25 12:47:23 | 000,000,000 | -HSD | M] -- C:\Recovery
[2011.05.25 21:00:45 | 000,000,000 | ---D | M] -- C:\SiLabs
[2011.07.06 21:41:49 | 000,000,000 | ---D | M] -- C:\stick
[2012.03.18 23:40:27 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2011.06.30 12:59:54 | 000,000,000 | ---D | M] -- C:\Temp
[2011.05.25 12:47:32 | 000,000,000 | R--D | M] -- C:\Users
[2012.03.18 21:24:40 | 000,000,000 | ---D | M] -- C:\Windows
 
< %PROGRAMFILES%\*.exe >
 
< %LOCALAPPDATA%\*.exe >
 
< %systemroot%\*. /mp /s >
 
< MD5 for: EXPLORER.EXE  >
[2011.02.26 06:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_54149f9ef14031fc\explorer.exe
[2009.07.14 02:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_518afd35db100430\explorer.exe
[2011.02.26 06:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_525b5180f3f95373\explorer.exe
[2009.10.31 06:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_51a66d6ddafc2ed1\explorer.exe
[2011.02.26 06:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_51a3a583dafd0cef\explorer.exe
[2010.11.20 13:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_53bc10fdd7fe87ca\explorer.exe
[2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\explorer.exe
[2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_5389023fd8245f84\explorer.exe
[2009.08.03 06:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_526619d4f3f142e6\explorer.exe
[2009.08.03 06:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_51e07e31dad00878\explorer.exe
[2009.10.31 07:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_52283b2af41f3691\explorer.exe
 
< MD5 for: REGEDIT.EXE  >
[2009.07.14 02:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\regedit.exe
[2009.07.14 02:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\winsxs\x86_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_f4050b883d2c3c08\regedit.exe
 
< MD5 for: USERINIT.EXE  >
[2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\System32\userinit.exe
[2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\System32\wininit.exe
[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.10.28 07:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe
[2009.10.28 06:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe
[2012.01.13 14:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2010.11.20 13:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\System32\winlogon.exe
[2010.11.20 13:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe
[2009.07.14 02:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe
 
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2012-03-16 01:35:06
 
<          >
 
========== Hard Links - Junction Points - Mount Points - Symbolic Links ==========
[C:\Windows\$NtUninstallKB40230$] ->  -> Unknown point type

< End of report >
--- --- ---

motzerrobo 19.03.2012 00:04
EXTRA File
OTL EXTRAS Logfile:
Code:
OTL Extras logfile created on: 18.03.2012 23:35:35 - Run 1
OTL by OldTimer - Version 3.2.39.1    Folder = C:\Users\motzer\Desktop
 Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,29 Gb Available Physical Memory | 64,46% Memory free
4,00 Gb Paging File | 2,81 Gb Available in Paging File | 70,29% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 222,78 Gb Total Space | 137,04 Gb Free Space | 61,51% Space Free | Partition Type: NTFS
Drive D: | 232,83 Gb Total Space | 41,77 Gb Free Space | 17,94% Space Free | Partition Type: NTFS
Drive E: | 10,00 Gb Total Space | 6,74 Gb Free Space | 67,37% Space Free | Partition Type: NTFS
Drive F: | 47,14 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive M: | 2,34 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
 
Computer Name: STEEL | User Name: motzer | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = Opera.HTML] -- C:\Program Files\Opera\Opera.exe (Opera Software)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files\Opera\Opera.exe" "%1" (Opera Software)
https [open] -- "C:\Program Files\Opera\Opera.exe" "%1" (Opera Software)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Browse with &IrfanView] -- "C:\Program Files\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{010A2C18-0830-45A0-BE2B-DD37A2D8A2FE}" = NI LabVIEW Run-Time Engine Interop 2011
"{0125D081-30D0-4A97-82A8-C28D444B6256}" = Microsoft SQL Server Compact 3.5 SP2 DEU
"{01415FEA-D7D9-40CF-9370-AF74ABC1AE39}" = NI System API Web-Servce 32-bit 5.0.0
"{01AC4D6A-05F0-4158-95E7-FC299961B50A}" = NI Math Kernel Libraries
"{033F0FD6-07E0-414A-8367-51EB862EFE12}" = Runtime für den NI-Systemkonfigurator 5.0.0
"{035400A4-29BD-3723-BEED-E2718A68CDE0}" = Microsoft Visual Studio 2010 Office Developer Tools (x86)
"{03A4C6A1-26E9-4DDB-81D9-B332E5BB10AD}" = Microsoft Sync Framework SDK v1.0 SP1 de
"{043955AD-7E11-4B6D-A317-B72F7BB87736}" = NI Assistant Framework LabVIEW 2011 Support
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{05617B99-0727-4FFB-AC8E-8F6427799C8F}" = NI-DAQmx/LabVIEW shared documentation 1.9.5
"{05C030B8-DC4F-489D-B86B-FC6B7DB3F607}" = NI SSL LabVIEW 2011 Support
"{066F687E-1CA0-4D94-A2C9-F8E6E817F4CB}" = NI LabVIEW Run-Time Engine 2011
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0AD5AD99-6172-4385-8765-385FBE3A1013}" = Sunbelt CounterSpy
"{0FD812C9-3BBE-4CC5-A43C-B7304E3EC581}" = NI Web Pipeline 2.0.1
"{10779616-12F8-4D9C-A02B-5394C2868188}" = Silicon Laboratories CP210x VCP Drivers for Windows 2000/XP/2003 Server/Vista
"{123700E7-CAC7-48BB-B309-48FAFAC4FA2F}" = BOcncV2
"{126A258A-DF8C-4EF2-9780-0EEA4C76CE6D}" = NI Logos LabVIEW 2011 Support
"{1570DE88-A78A-37FD-8A05-92620D160CCA}" = Microsoft Visual Studio 2010 Office Developer Tools (x86) Language Pack - DEU
"{15F02176-0D12-4FAF-B2CD-2767C7781427}" = Google SketchUp 8
"{16AE16D2-8895-4E4A-A6D5-7EB9055B6517}" = NI I/O Trace API LV2011
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319
"{1A609A84-71AF-4D96-962B-E060D34FD4AB}" = NI MetaSuite Installer
"{1B5ABB51-8AAB-4FBA-8987-9A8820756E2B}" = NI USI 1.9.0
"{1D328E11-3B0C-388C-835D-C9C20E8C7734}" = Microsoft Help Viewer 1.0 Language Pack - DEU
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{207780D5-A515-4E79-B7C2-E4D32F8A6CA1}" = Eco Materials Adviser
"{22923F17-B592-4A7F-84A8-18F3BFC13B94}" = NI Microsoft Silverlight Wrapper
"{24FF088D-CDCF-480C-8A4B-98F14A54CAA8}" = Autodesk Material Library Low Resolution Image Library 2012
"{266597A9-1632-0000-0100-DCBF2B69166B}" = Autodesk Vault 2012 (Client) German Language Pack
"{268B0789-E2BF-4836-BF05-A6140B4983CA}" = NI MAX Remote Configuration Installer 5.0
"{26A24AE4-039D-4CA4-87B4-2F83216022F0}" = Java(TM) 6 Update 22
"{26A24AE4-039D-4CA4-87B4-2F83216025FF}" = Java(TM) 6 Update 29
"{27111B7A-97FE-46BD-81F9-4E87737DF803}" = NI LabVIEW 2011 MeasAppChm File
"{292382C0-61F7-458A-9008-55F272A4DD9C}" = NI Logos 5.3.0
"{2ADC660A-77C9-4A6C-9D4B-5E48A27BCA10}" = NI Help Assistant
"{2B1D39F8-477A-4B40-B062-F5E0C4D42B9B}" = NI LabWindows/CVI 2010 SP1 Low-Level Driver (Original)
"{2DCD52EE-1AE1-4128-9819-A79F7D09B6B3}" = MAGIX Foto Designer 7
"{3070A9C6-D670-439A-21ED-ED0CB66B15FC}" = Catalyst Control Center Graphics Full Existing
"{3174B721-5400-4259-900D-C804356B0010}" = NI LabVIEW Run-Time Engine 2009 SP1
"{338AD4E5-9332-A678-5062-7A07ED70D6D4}" = ccc-core-static
"{33AAA123-A24A-46A7-8CD6-F03C5B375033}" = NI TDM Excel Add-In 3.3
"{343666E2-A059-48AC-AD67-230BF74E2DB2}" = Apple Application Support
"{36FDBDC7-C572-4A85-A104-28AD48207448}" = Mobile Mouse Server
"{39D5C483-196E-4A75-A7E9-FEF0FA8314EC}" = Unified Remote
"{3AC01660-F640-4AFB-A25E-082B260C025C}" = WIF Core Dependencies Windows 5.0.0
"{3AE9153C-1E52-4B6B-9405-FE403342A3C8}" = NI-Update-Dienst 2.0
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3CF95105-5857-4852-BF20-764B69C1881D}" = NI LabVIEW 2011
"{3D1F6E51-C98C-4C01-8170-D2DBF2837F13}" = NI LabVIEW Merge Utility 11.0.0
"{4135C790-0387-36D7-9C2A-1B09A5900460}" = Microsoft Visual Studio 2010 Ultimate - DEU
"{415780C0-4A19-4567-AAAE-10CCB9832B13}" = NI-RPC 4.2.2f0 for Phar Lap ETS
"{4159DD60-49C1-4323-A1A5-FB060CBA35C5}" = NI Measurement Studio Recipe Processor
"{416B50BB-64CE-46C5-81A6-7F842CC35CDC}" = NI LabVIEW MAX XML
"{41A01180-D9FD-3428-9FD6-749F4C637CBF}" = Microsoft Visual Studio 2010 Tools for Office Runtime (x86)
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{43CB1196-79D0-18F6-B66D-BD94E8910883}" = ATI Catalyst Install Manager
"{451F962A-92A1-407C-AFA0-A29C0349A76F}" = NI MDF Support
"{45C5DE6E-85AB-466E-9A6F-8BAB11EE0EDD}" = NI Web Interface Framework 2.0
"{46BF7707-A511-47E7-B118-0E53DCA1A0EA}" = NI Remote PXI Provider for MAX 5.0.0
"{47C39E4A-28F2-33B1-B9B7-97F24E52D917}" = Microsoft Help Viewer 1.0
"{47F94730-ABD2-47F6-920E-EA8CDB6DD0C6}_is1" = BASCOM-AVR
"{4967DB4F-07FC-4443-8287-C9C1B0D1C8FA}" = NI Variable Engine LabVIEW 2011 Support
"{49F05354-04F7-4AE4-8434-9E7B5462C727}" = NI DN 2.0 SP1 installer
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4BDAF6F8-8C28-49FD-8FA7-CEE3E9E9BAD4}" = NI LabVIEW 2011 Simulation
"{4BEFB7C6-F103-42FB-9482-861C6D9690A0}" = NI LabVIEW Compare Utility 11.0.0
"{4E1A54A9-FFB3-4BE6-B59B-3CC94C3B31D2}" = Autodesk Inventor Fusion for Inventor 2012 Zusatzmodul Language Pack
"{4E3B47F2-21EB-4F20-87C8-5A0E4D5F3858}" = Autodesk Inventor Fusion for Inventor 2012 Zusatzmodul
"{50F728C0-9A37-4868-B9E1-42565C228B12}" = Reset NI Config 5.0.0
"{52252F5C-58CD-48ED-8C88-9AAD6FE887B4}" = NI Trace Engine
"{523B5D39-C209-41C8-9075-F6C14C2394D2}" = NI LabVIEW 2011 Search
"{5242B252-01BB-4F2E-BBF4-5C01BC3B6619}" = Microsoft SQL Server 2008 R2 Data-Tier Application Project
"{5545EEE1-FA36-4F76-B6BE-5696E7F4E2D6}" = VBA (2627.01)
"{5545EEE4-FA36-4F76-B6BE-5696E7F4E2D6}" = VBA (2701.01)
"{555B2ADE-B3CB-4C95-A789-8A7C03A004B7}" = NI LabVIEW 2011 Deployment Framework
"{561A25E6-C332-45E0-94A1-9BA22CD2C4A5}" = NI-PAL 2.7.0f0 for Phar Lap ETS
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5783F2D7-A028-0409-0000-0060B0CE6BBA}" = DWG TrueView 2012
"{578A6214-6CC6-4043-A9A8-C045DDAE2B39}" = NI Remote Provider for MAX 5.0.0
"{5866AEFB-0037-49DA-8F2C-ED7E7E21636E}" = NI LabVIEW 2011
"{5A08C9D1-37AD-4A8D-90D3-33F92C578AA5}" = Microsoft SQL Server System CLR Types
"{5B1F04DA-0F27-45B7-96F2-37190D5E11AE}" = Cisco AnyConnect Secure Mobility Client
"{5C0BBD9F-2D3F-4093-AD7B-3F7377E0EDCA}" = NI LabVIEW Real-Time NBFifo
"{5F123C21-A5E2-4CFB-A6A7-034C9087099F}" = NI Logos XT Support
"{60315A8A-5FCA-47CE-A856-681F3A9CDB5B}" = AVR Studio 5.0
"{616C6F39-4CE1-3434-A665-2F6A04C09A7F}" = Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools
"{63BB51BB-C078-4960-B624-087651E8D526}" = NI LabVIEW 2011
"{65420DC9-306E-4371-905F-F4DC3B418E52}" = Autodesk Material Library Base Resolution Image Library 2012
"{660787DD-68B3-4E67-9073-4A66DD7AD193}" = ASUS VGA Driver
"{67DEC296-C8CC-A5BE-0378-A25C760B78B4}" = Catalyst Control Center Graphics Full New
"{68DE7BF6-AFA9-4609-9C96-8C15E46E2093}" = NI Example Finder 11.0
"{6A86554B-8928-30E4-A53C-D7337689134D}" = Microsoft Visual C++ 2010  x86 Runtime - 10.0.30319
"{6CDEAD7E-F8D8-37F7-AB6F-1E22716E30F3}" = Microsoft Visual Studio Macro Tools
"{6E542012-DD29-0000-B703-2376D4CC9C8F}" = Autodesk Inventor Publisher 2012
"{6E542012-DD29-0001-B703-2376D4CC9C8F}" = Autodesk Inventor Publisher 2012 Language Pack
"{70BA7761-629A-4118-BFE0-02753B9019C8}" = NI MXS 5.0.0
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{712723FB-BF99-4406-8F91-A2DB766AB2C9}" = NI VC2008MSMs x86
"{73854BF9-E78E-4D6F-B8C2-A7A3CD855124}" = NI LabVIEW 2011 Help File
"{74DBB98D-B4A7-4DD9-9E13-C51FDB1105D0}" = NI LabWindows/CVI 2010 SP1 Low-Level Driver (Updated)
"{75E71ADD-042C-4F30-BFAC-A9EC42351313}" = Python 2.4.3
"{7644E42D-B096-457F-8B5B-901238FC81AE}" = ICQ7.6
"{76560C00-0CFB-00F0-31AD-3DDA280032B6}" = Catalyst Control Center InstallProxy
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{774F2CE3-C9C9-BC80-1231-E9432F2756C3}" = ccc-utility
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7A29AA0C-202A-467E-9257-DE2E8DBC60B3}" = NI LabVIEW 2011 License
"{7C62B54A-E524-4F3D-83E7-0F2ABAFC978A}" = NI Xalan Delay Load 1.10.1
"{7C6869BF-6CBE-4CB0-8869-2743B419343C}" = NI LabVIEW 2011 Real-Time NBFifo
"{7D64A463-C3C9-40B6-BC46-4DD7D0DE2BFD}" = NI Unterstützung für nicht englische Versionen der Runtime-Engine von LabVIEW 2011.
"{7D89ECEB-7E27-4898-812E-80862E91AB94}" = NI Portable Configuration 5.0.0
"{7EAC91E4-AFC3-8A6F-B802-218548D21873}" = Catalyst Control Center Core Implementation
"{7F4DD591-1632-0409-0000-7107D70F3DB4}" = Autodesk Inventor Professional 2012
"{7F4DD591-1632-0409-0001-7107D70F3DB4}" = Autodesk Inventor Professional 2012 Language Pack - Deutsch
"{7F88C9E5-12BD-404F-AC6A-108BAAC9B708}" = ASUS Gamer OSD
"{809D7E6D-915D-4EAD-821F-E13D93F37161}" = ASUS Smart Doctor
"{80C792E1-78BC-4F4A-839E-BCD107770938}" = NI System API Windows 32-bit 5.0.0
"{8153ED9A-C94A-426E-9880-5E6775C08B62}" = Apple Mobile Device Support
"{8283E8AC-3CF9-4712-B56D-FFE9D47F88E1}" = NI LabVIEW 2011
"{86EADBA6-CE62-46D1-B594-4267CB11FC66}" = NI BCI 2.0.2
"{886C3E95-4032-45C8-92F6-57861871635A}" = NI Software Provider for MAX 5.0.0
"{89089F33-94D7-4E9C-918F-75CC933FC88F}" = NI DataSocket 4.9
"{8923D179-24D1-475D-A381-0B8C1AF1A206}" = NI LabVIEW 2011 Web Server
"{896849EE-EEE6-4E45-B20B-9F4DDCF805DA}" = NI Assistant Framework
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8B88204E-6446-4F7F-9379-F1A982C9D07C}" = NI LabVIEW 2011
"{8D9F6EFD-6EAF-4327-AD59-92DEA050BDAF}" = NI Instrument IO Assistant for LabVIEW 2011 32-bit
"{8EAA9D70-C912-3708-92DD-0CCC26F386E1}" = Microsoft Visual Studio 2010 Performance Collection Tools - DEU
"{8F0837C2-EE09-4903-88F3-1976FE7FFF4E}" = Autodesk Material Library 2012
"{8F1B9FE1-5777-4118-B982-B50B030101FF}" = NI LabVIEW 2011
"{90140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0015-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}_Office14.PROPLUS_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUS_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUS_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0410-0000-0000000FF1CE}_Office14.PROPLUS_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-002C-0407-0000-0000000FF1CE}_Office14.PROPLUS_{4275FB46-ABDF-4456-876C-17CF64294D9A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2010
"{90140000-0044-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}_Office14.PROPLUS_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010
"{90140000-00BA-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-1105-0000-0000-0000000FF1CE}" = Microsoft Office 2010 Primary Interop Assemblies
"{92443D78-4C75-4320-BFC6-47D75122625F}" = Captcha Brotherhood
"{929F5BFC-60F0-34EC-A50B-2001AAC03D56}" = Microsoft Team Foundation Server 2010 Object Model - DEU
"{92C5C058-E941-47C3-B7E8-38A79C605969}" = Microsoft SQL Server 2008 R2 Transact-SQL Language Service
"{9492A5F3-FDA5-4CE9-9B96-AB5881046CB6}" = NI LabVIEW 2011 Help
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{962F04A4-130E-F725-BFC3-F46E33889D0E}" = ATI AVIVO Codecs
"{98F4DC3F-958E-4DE5-BE1D-DBD72B05A204}" = NI Search Shared
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A87DA58-1C1C-4305-BD69-231886F03191}" = NI Uninstaller
"{9B2B0EAD-2CC7-4589-B3AA-D23BAB724065}" = CDRWIN 5
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9BF9F0A2-2CF9-4165-9A36-639381F54BE3}" = NI IO Trace 3.0.0
"{9C2113B6-30DC-4827-9166-E6F4889D7594}" = NI LabVIEW 2011 Deployable License
"{9C3B8582-A72A-4835-8903-877A834407BB}" = Microsoft SQL Server 2008 R2-Datenebenenanwendungs-Framework
"{9FD901EF-E9E0-42AD-B957-C691E020DD6A}" = NI Authentication 2011 SP1
"{A059FB87-5DC3-0883-7D65-F68603CACDF1}" = Catalyst Control Center Graphics Previews Vista
"{A0A20C35-FA6C-471D-ADA6-FFB1604157BD}" = NI-PAL 2.7.0f0
"{A106D33E-6B43-42C0-9BFC-D03303261FA7}" = Microsoft SQL Server 2008 R2 Management Objects
"{A11A542A-37BF-4943-9810-3F1DC0AD4A1C}" = NI LabWindows/CVI 2010 Code Generator
"{A1B35B59-B8B4-47C8-B4D6-3F90FB1997CC}" = NI LabVIEW 2011
"{A363C314-2242-4BBE-9ADE-B427AF646EFF}" = NI mDNS Responder 1.6.0
"{A49BDCBE-590E-43A6-AB77-7C40E499B7C1}" = Autodesk Design Review 2012
"{A7B1ABA8-E2A2-4565-A8AF-F01657FF5CEA}" = NI LabVIEW Web Services Runtime
"{A9111573-EF12-4D80-A5B9-55F620D5BCA1}" = PL-2303 USB-to-Serial
"{A961C6FD-C583-45F6-A0A4-5E4376C29E41}" = Catalyst Control Center - Branding
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AB972FD3-1B17-4592-9C47-4C732A018B48}" = NI System Web Server 11.5
"{AB9BBC2E-83F6-47A9-9FA3-08D3774F8E45}" = NI-RPC 4.2.2f0
"{ABD79E99-F9E3-413B-8D18-11070754355F}" = NI Math Kernel Libraries
"{AC41D924-8C68-4BD5-A7A1-0AE4176C31A6}" = Crystal Reports for Visual Studio
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.2) - Deutsch
"{ACE28263-76A4-4BF5-B6F4-8BD719595969}" = Microsoft SQL Server Database Publishing Wizard 1.4
"{AE593237-3C8E-44F2-A9AA-2DDE0A472CDE}" = NI LabVIEW Web Server for Run-Time Engine
"{B1DCBBC7-8ECE-497F-926F-02FE4E42216B}" = NI-DSM 2011
"{B1EE55C1-F98B-40AB-AF0C-422ECCC88454}" = NI Measurement & Automation Explorer 5.0.0
"{B2BDA3BC-29BE-49C1-A30E-15DA8D041601}" = NI License Manager
"{B46DECD1-1632-4EF1-0000-22D71E81877C}" = Autodesk Inventor Content Center Libraries 2012 (Desktop Content)
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{B7E38540-E355-3503-AFD7-635B2F2F76E1}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4974
"{BB3EBB9E-1CA1-4B7F-9E67-09540CCE9F45}" = NI Assistant Framework LabVIEW Code Generator 2011
"{BEBCBC05-4B39-4935-8B7C-B06E9FF1EA2A}" = NI EulaDepot
"{C0DE25AE-B0E5-4D4B-96CE-EE757066D0BA}" = NI Network Discovery 5.0
"{C1457A9E-3745-4026-BF81-4332AA695644}" = NI System Web Server Base 11.5
"{C268B5E1-A5DA-11DF-A289-005056C00008}" = Paragon Backup & Recovery™ 2011 (Advanced) Free
"{C3B91040-953D-4A51-8D69-D660AE9003D0}" = FreeMILL
"{C6E8484F-F9C1-4657-B03B-9CD1FE4CB812}" = NI ECU Measurement and Calibration Toolkit 2.2.0
"{C911A0C2-2236-3164-AA47-F2566C01AE5E}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{CC17CE69-4AB6-4434-ADB4-27DB49D36080}" = NI Curl 1.1
"{CE9BAD6E-60FC-46CC-82A2-5B0F2B1A0E36}" = Dotfuscator Software Services - Community Edition - DEU
"{CF30E2B5-A7A7-47AD-8B03-22A27D4E9971}" = NI LabVIEW 2011 Real-Time Error Dialog
"{CF526A26-1632-0000-0000-02E95019B628}" = Autodesk Vault 2012 (Client)
"{CFCB8616-A5D1-4281-80E8-389F685BFAE2}" = Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 DEU
"{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}" = Microsoft .NET Framework 4 Multi-Targeting Pack
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{D25FF5C1-1632-469A-9794-69309387C193}" = Schnell-Deinstallations-Tool für Autodesk Inventor 2012
"{D361B9E5-E918-48CB-BEC3-8E44A5F6E624}" = NI LabVIEW 2009 SP1 Run-Time Engine Web Services
"{D5BB7AAE-62F4-4C4F-B272-F27AEE16BA7F}" = NI TDMS
"{D64B6984-242F-32BC-B008-752806E5FC44}" = Microsoft Visual Studio 2010 Shell (Isolated) - ENU
"{D6A6CFAD-CD86-482B-90D1-6FCC4E252ACD}" = Microsoft Sync Services for ADO.NET v2.0 SP1 (x86) de
"{D7AF16E7-5938-4369-BA54-B1ABD541BC32}" = Utility
"{D7CC49D5-FC42-4082-8F2D-CCAAF9390E7F}" = NI LabVIEW 2011
"{DB0AF767-7CC7-4E4D-B6BE-A200F20A2FB1}" = Microsoft Sync Framework Runtime v1.0 SP1 (x86) de
"{DB2C5648-700D-4AEF-83E1-70C72F0C34FA}" = NI Math Kernel Libraries
"{DBE8431C-CF9A-38C3-B42D-28B6FCE1EA3B}" = Microsoft Visual Studio 2010 Tools for Office Runtime (x86) Language Pack - DEU
"{DEC25D81-2317-47F6-8B26-D54A939DA1EE}" = NI LabVIEW C Interface
"{E0D8CD4E-4771-4848-A09D-60A31D883883}" = NI VC2005MSMs x86
"{E1D60C68-016C-4951-8C1F-52E24DFE7836}" = NI CodeSignAPI
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E5102348-951B-4375-A582-2E0675180517}" = NI LabVIEW 2011
"{E6068691-1FBC-4EF0-87E8-609CDB32038A}" = NI Xerces Delay Load 2.7.3
"{E69A31C9-F24F-4A1A-BEAD-B1AA255760C1}" = NI Registration Wizard
"{E7BDC0BC-583B-4193-9460-BDF51D131695}" = NI LabVIEW 2011
"{E8550330-7EAF-46CC-AE68-25A3AC6B1AE4}" = NI LabVIEW 2011 Manuals
"{E8F8861D-98E0-43FF-9E48-AC236CC3BE4E}" = AVR Jungo USB
"{E9030CD3-1707-4149-B3CA-794582116E23}" = NI SSL Support
"{EA37AB72-EC8C-432C-A1C6-186850FB0559}" = NI System State Publisher
"{EAF7B35C-DCBE-4032-9ABF-C35C43D07124}" = Microsoft Sync Framework Services v1.0 SP1 (x86) de
"{EB8D0A82-E02A-437C-A7C4-90516F1CFB39}" = NI Web Application Server 2.0
"{EC2F2B8A-8C35-D5CE-0011-C97BCD807D05}" = CCC Help German
"{EC66418E-DAA2-36D5-809E-40BEC94E622A}" = Microsoft Visual Studio Macro Tools - DEU Language Pack
"{ED7CED5A-26BF-DFD3-08AC-771E72D43F74}" = Catalyst Control Center Localization All
"{EF1B1A68-988E-4A68-8504-774373A4651C}" = NI OPC Support
"{F04A89CB-A185-4263-85ED-4BAD766F7DAE}" = NI Error Reporting 2011
"{F055B0A4-8F75-4F85-B6FF-1C5BE10A72DC}" = NI LabWindows/CVI 9.0 Run-Time Engine
"{F37CC885-1E37-4F2A-93F3-7F1E1EEBBEBB}" = NI LabVIEW Broker
"{F3AB0933-B7D6-4C47-5523-922B49B37AE3}" = Catalyst Control Center Graphics Light
"{F45CE5E8-4A60-4292-8FD5-1807DFEBE221}" = NI LabWindows/CVI 2010 LabVIEW DLL Builder
"{F57F2FCF-A66D-4F6F-A2CF-321B8DB4D385}" = AVR QTouch Studio
"{F6C682B6-7714-41CC-80B6-3288364910AF}" = NI GMP Windows 32-bit Installer 11.0.0
"{F6D6B258-E3CA-4AAC-965A-68D3E3140A8C}" = iTunes
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F804CEB4-747E-46D5-B8AB-C56E3BAF27D9}_is1" = Das Fussball Studio 8.3.1
"{F9A74F70-7597-47B8-B04C-044824C23B15}" = NI LabVIEW 2011 VIPM Helper
"{F9E0880D-B263-48F9-B8E5-BAFCAE9BE150}" = NI System API Client for WIF 5.0.0
"{FDED748C-432B-4B44-BB33-3BB8550A2AD2}" = NI Variable Engine 2.5.0
"{FE24BCDF-9231-450D-AA08-D3550B81EE41}" = NI LabVIEW Web Server for Run-Time Engine
"{FF82AEC3-C821-4716-BD9C-10434178EA39}" = NI LabVIEW Run-Time Engine Interop 2009
"{FFF5619F-6669-4EC5-A85E-9994F70A9E5D}" = Autodesk Inventor Fusion 2012
"{FFF7F80F-929E-497F-A112-B070DE816128}" = Autodesk Inventor Fusion 2012 Language Pack
"1489-3350-5074-6281" = JDownloader 0.9
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Amazon MP3-Downloader" = Amazon MP3-Downloader 1.0.9
"Apex RM RMVB Converter_is1" = Apex RM RMVB Converter 6.57
"Autodesk Design Review 2012" = Autodesk Design Review 2012
"Autodesk Inventor Fusion 2012" = Autodesk Inventor Fusion 2012
"Autodesk Inventor Fusion for Inventor 2012 Zusatzmodul" = Autodesk Inventor Fusion for Inventor 2012 Add-in
"Autodesk Inventor Professional 2012" = Autodesk Inventor Professional 2012 Deutsch
"Autodesk Inventor Professional 2012 SP1" = Autodesk Inventor Professional 2012 SP1
"Autodesk Inventor Publisher 2012" = Autodesk Inventor Publisher 2012
"Autodesk Vault 2012 (Client)" = Autodesk Vault 2012 (Client)
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"AVMWLANCLI" = AVM FRITZ!WLAN
"CCleaner" = CCleaner
"Cisco AnyConnect Secure Mobility Client" = Cisco AnyConnect Secure Mobility Client
"DWG TrueView 2012" = DWG TrueView 2012
"FinePrint" = FinePrint
"Free Video Flip and Rotate_is1" = Free Video Flip and Rotate version 1.8.11.426
"Free YouTube Download_is1" = Free YouTube Download version 3.0.20.1228
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.10.15.1228
"ImgBurn" = ImgBurn
"InstallShield_{809D7E6D-915D-4EAD-821F-E13D93F37161}" = ASUS Smart Doctor
"iPhoto Plus 4" = iPhoto Plus 4
"IrfanView" = IrfanView (remove only)
"IsoBuster_is1" = IsoBuster 2.8.5
"MAGIX_MSI_FotoDesigner7_silver" = MAGIX Foto Designer 7
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.60.1.1000
"MatlabR2011a" = MATLAB R2011a
"Maxima-5.26.0_is1" = Maxima 5.26.0
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"Microsoft Help Viewer 1.0" = Microsoft Help Viewer 1.0
"Microsoft Help Viewer 1.0 Language Pack - DEU" = Microsoft Help Viewer 1.0 Language Pack - DEU
"Microsoft Team Foundation Server 2010 Object Model - DEU" = Microsoft Team Foundation Server 2010-Objektmodell - DEU
"Microsoft Visual Studio 2010 Tools for Office Runtime (x86)" = Microsoft Visual Studio 2010 Tools for Office Runtime (x86)
"Microsoft Visual Studio 2010 Tools for Office Runtime (x86) Language Pack - DEU" = Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x86) Language Pack - DEU
"Microsoft Visual Studio 2010 Ultimate - DEU" = Microsoft Visual Studio 2010 Ultimate - DEU
"Microsoft Visual Studio Macro Tools" = Microsoft Visual Studio Macro Tools
"Microsoft Visual Studio Macro Tools - DEU Language Pack" = Microsoft Visual Studio Macro Tools - DEU Language Pack
"MKVtoolnix" = MKVtoolnix 4.9.1
"Mozilla Firefox 7.0.1 (x86 de)" = Mozilla Firefox 7.0.1 (x86 de)
"Mozilla Thunderbird 10.0.2 (x86 de)" = Mozilla Thunderbird 10.0.2 (x86 de)
"myAVR Workpad PLUS Demo" = myAVR Workpad PLUS Demo
"NAVIGON Fresh" = NAVIGON Fresh 3.3.2
"NI Uninstaller" = National Instruments - Software
"Office14.PROPLUS" = Microsoft Office Professional Plus 2010
"OpenAL" = OpenAL
"Opera 11.61.1250" = Opera 11.61
"PDFTK Builder_is1" = PDFTK Builder 3.5.3
"PowerISO" = PowerISO
"Samsung CLP-300 Series" = Samsung CLP-300 Series
"SLABCOMM&10C4&EA60" = Silicon Laboratories CP210x USB to UART Bridge (Driver Removal)
"SopCast" = SopCast 3.4.0
"Steam App 10" = Counter-Strike
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"TeamViewer 6" = TeamViewer 6
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VLC media player 1.1.9
"WinRAR archiver" = WinRAR 4.00 (32-Bit)
"X-Chat 2_is1" = X-Chat 2.8.6-2
"xvid" = XviD MPEG-4 Video Codec
"Zattoo4" = Zattoo4 4.0.5
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"8C1A28F014D5B1E4398987CA544BE8A2009D0228" = Autodesk Inventor Publisher 2012 Word Add-in
"Dropbox" = Dropbox
"Game Organizer" = EasyBits GO
 
========== Last 10 Event Log Errors ==========
 
[ Cisco AnyConnect Secure Mobility Client Events ]
Error - 18.03.2012 18:33:49 | Computer Name = STEEL | Source = acvpnagent | ID = 67108866
Description = Function: CNetEnvironment::testNetwork File: .\NetEnvironment.cpp Line:
 648 Invoked Function: CHostConfigMgr::DeterminePublicInterface Return Code: -33095647
 (0xFE070021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED
 
Error - 18.03.2012 18:33:54 | Computer Name = STEEL | Source = acvpnagent | ID = 67108866
Description = Function: CIPv4ChangeRouteHelper::FindBestRoute File: .\IPv4ChangeRouteHelper.cpp
Line:
 2600 Invoked Function: CIPv4RouteTable::FindMatchingRoute Return Code: -33095647
(0xFE070021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED
 
Error - 18.03.2012 18:33:54 | Computer Name = STEEL | Source = acvpnagent | ID = 67108866
Description = Function: CRouteMgr::UpdatePublicAddress File: .\RouteMgr.cpp Line:
2182 Invoked Function: CChangeRouteTable::FindBestRouteInterface Return Code: -33095647
 (0xFE070021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED
 
Error - 18.03.2012 18:33:54 | Computer Name = STEEL | Source = acvpnagent | ID = 67108866
Description = Function: CNetEnvironment::testNetwork File: .\NetEnvironment.cpp Line:
 648 Invoked Function: CHostConfigMgr::DeterminePublicInterface Return Code: -33095647
 (0xFE070021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED
 
Error - 18.03.2012 18:33:59 | Computer Name = STEEL | Source = acvpnagent | ID = 67108866
Description = Function: CIPv4ChangeRouteHelper::FindBestRoute File: .\IPv4ChangeRouteHelper.cpp
Line:
 2600 Invoked Function: CIPv4RouteTable::FindMatchingRoute Return Code: -33095647
(0xFE070021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED
 
Error - 18.03.2012 18:33:59 | Computer Name = STEEL | Source = acvpnagent | ID = 67108866
Description = Function: CRouteMgr::UpdatePublicAddress File: .\RouteMgr.cpp Line:
2182 Invoked Function: CChangeRouteTable::FindBestRouteInterface Return Code: -33095647
 (0xFE070021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED
 
Error - 18.03.2012 18:33:59 | Computer Name = STEEL | Source = acvpnagent | ID = 67108866
Description = Function: CNetEnvironment::testNetwork File: .\NetEnvironment.cpp Line:
 648 Invoked Function: CHostConfigMgr::DeterminePublicInterface Return Code: -33095647
 (0xFE070021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED
 
Error - 18.03.2012 18:34:04 | Computer Name = STEEL | Source = acvpnagent | ID = 67108866
Description = Function: CIPv4ChangeRouteHelper::FindBestRoute File: .\IPv4ChangeRouteHelper.cpp
Line:
 2600 Invoked Function: CIPv4RouteTable::FindMatchingRoute Return Code: -33095647
(0xFE070021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED
 
Error - 18.03.2012 18:34:04 | Computer Name = STEEL | Source = acvpnagent | ID = 67108866
Description = Function: CRouteMgr::UpdatePublicAddress File: .\RouteMgr.cpp Line:
2182 Invoked Function: CChangeRouteTable::FindBestRouteInterface Return Code: -33095647
 (0xFE070021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED
 
Error - 18.03.2012 18:34:04 | Computer Name = STEEL | Source = acvpnagent | ID = 67108866
Description = Function: CNetEnvironment::testNetwork File: .\NetEnvironment.cpp Line:
 648 Invoked Function: CHostConfigMgr::DeterminePublicInterface Return Code: -33095647
 (0xFE070021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED
 
[ System Events ]
Error - 18.03.2012 17:35:05 | Computer Name = Steel | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = Fehler beim Lesen der Datei für lokale Hosts.
 
Error - 18.03.2012 17:35:09 | Computer Name = Steel | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = Fehler beim Lesen der Datei für lokale Hosts.
 
Error - 18.03.2012 18:32:13 | Computer Name = Steel | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = Fehler beim Lesen der Datei für lokale Hosts.
 
Error - 18.03.2012 18:32:23 | Computer Name = Steel | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = Fehler beim Lesen der Datei für lokale Hosts.
 
Error - 18.03.2012 18:34:08 | Computer Name = Steel | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = Fehler beim Lesen der Datei für lokale Hosts.
 
Error - 18.03.2012 18:34:08 | Computer Name = Steel | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = Fehler beim Lesen der Datei für lokale Hosts.
 
Error - 18.03.2012 18:34:15 | Computer Name = Steel | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = Fehler beim Lesen der Datei für lokale Hosts.
 
Error - 18.03.2012 18:34:20 | Computer Name = Steel | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = Fehler beim Lesen der Datei für lokale Hosts.
 
Error - 18.03.2012 18:34:20 | Computer Name = Steel | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = Fehler beim Lesen der Datei für lokale Hosts.
 
Error - 18.03.2012 18:34:23 | Computer Name = Steel | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = Fehler beim Lesen der Datei für lokale Hosts.
 
 
< End of report >
--- --- ---


Sorry musste Splitten und du wolltest ja das alles hier reingepostet wird ohne Anhang.

In dem Qoobox Ordner sind nur andere Ordner die Textdatei ist nicht vorhanden.

mfg
motzer

Psychotic 19.03.2012 00:13
Alles klar, melde mich morgen früh! warte ab und führe keine anderen Tools aus!

motzerrobo 19.03.2012 00:16
Perfekt - Danke Dir schonmal !

mfg
motzer

Psychotic 19.03.2012 15:22
Schritt 1: OTL-Fix

Code:

:otl
O4 - HKLM..\Run: [gema] C:\Windows\System32\gema.exe ()
O4 - HKLM..\Run: [gema.] C:\ProgramData\gema
O4 - HKCU..\Run: [gema] C:\Users\motzer\AppData\Roaming\gema
O20 - HKLM Winlogon: UserInit - (C:\ProgramData\gema\gema.exe) -  File not found
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\gema.exe) - C:\Windows\System32\gema.exe ()
O20 - HKLM Winlogon: UserInit - (C:\Users\motzer\AppData\Roaming\appconf32.exe) - C:\Users\motzer\AppData\Roaming\appconf32.exe ()
[2012.03.16 22:04:31 | 000,000,000 | ---D | C] -- C:\Users\motzer\AppData\Roaming\07016
[2012.03.16 22:04:09 | 000,000,000 | ---D | C] -- C:\Users\motzer\AppData\Roaming\xmldm
[2012.03.16 22:04:09 | 000,000,000 | ---D | C] -- C:\Users\motzer\AppData\Roaming\kock
[2012.03.18 21:16:50 | 000,013,189 | R--- | C] () -- C:\Windows\instwcli.inf
:files
C:\Windows\$NtUninstallKB40230$
fsuitl reparesepoint delete C:\Windows\$NtUninstallKB40230$ /c
:commands
[emptytemp]
[resethosts]
  • Schliesse bitte nun alle Programme.
  • Klicke nun bitte auf den Fix Button.
  • OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
  • Nach dem Neustart findest Du ein Textdokument auf deinem Desktop.
    ( Auch zu finden unter C:\_OTL\MovedFiles\<time_date>.txt)
    Kopiere nun den Inhalt hier in Deinen Thread
.


Schritt 2: Combofix


Wichtig: Gehe nach dem Neustart NICHT ins Internet, sondern führe combofix über die Kommandozeile aus, indem du folgendes tust:

Stelle sicher, dass Combofix auf deinem Desktop liegt!
Drücke die Windows- und dieR-Taste gleichzeitig.
Schreibe in das Feld: Combofix /nombr, klicke OK.

Poste die von OTL und die von Combofix erstellte Textdatei hier in deinen Thread! :)

(Du findest sie unter C:\_OTL\<Datum><Zeit>.txt (OTL) bzw. unter C:\combofix.txt)

motzerrobo 19.03.2012 20:30
It finally worked:

Code:
All processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\gema deleted successfully.
C:\Windows\System32\gema.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\gema. deleted successfully.
C:\ProgramData\gema folder moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\gema deleted successfully.
C:\Users\motzer\AppData\Roaming\gema folder moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UserInit:C:\ProgramData\gema\gema.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UserInit:C:\Windows\system32\gema.exe deleted successfully.
File C:\Windows\System32\gema.exe not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UserInit:C:\Users\motzer\AppData\Roaming\appconf32.exe deleted successfully.
File move failed. C:\Users\motzer\AppData\Roaming\appconf32.exe scheduled to be moved on reboot.
C:\Users\motzer\AppData\Roaming\07016\components folder moved successfully.
C:\Users\motzer\AppData\Roaming\07016 folder moved successfully.
C:\Users\motzer\AppData\Roaming\xmldm folder moved successfully.
C:\Users\motzer\AppData\Roaming\kock folder moved successfully.
C:\Windows\instwcli.inf moved successfully.
========== FILES ==========
Folder move failed. C:\Windows\$NtUninstallKB40230$\TxR scheduled to be moved on reboot.
C:\Windows\$NtUninstallKB40230$\systemprofile\Vorlagen folder moved successfully.
C:\Windows\$NtUninstallKB40230$\systemprofile\Videos folder moved successfully.
C:\Windows\$NtUninstallKB40230$\systemprofile\Startmenü folder moved successfully.
C:\Windows\$NtUninstallKB40230$\systemprofile\SendTo folder moved successfully.
C:\Windows\$NtUninstallKB40230$\systemprofile\Searches folder moved successfully.
C:\Windows\$NtUninstallKB40230$\systemprofile\Saved Games folder moved successfully.
C:\Windows\$NtUninstallKB40230$\systemprofile\Recent folder moved successfully.
C:\Windows\$NtUninstallKB40230$\systemprofile\Pictures\Slide Shows folder moved successfully.
C:\Windows\$NtUninstallKB40230$\systemprofile\Pictures folder moved successfully.
C:\Windows\$NtUninstallKB40230$\systemprofile\Netzwerkumgebung folder moved successfully.
C:\Windows\$NtUninstallKB40230$\systemprofile\Music\Playlists folder moved successfully.
C:\Windows\$NtUninstallKB40230$\systemprofile\Music folder moved successfully.
C:\Windows\$NtUninstallKB40230$\systemprofile\Lokale Einstellungen folder moved successfully.
C:\Windows\$NtUninstallKB40230$\systemprofile\Links folder moved successfully.
C:\Windows\$NtUninstallKB40230$\systemprofile\Favorites folder moved successfully.
C:\Windows\$NtUninstallKB40230$\systemprofile\Eigene Dateien folder moved successfully.
C:\Windows\$NtUninstallKB40230$\systemprofile\Druckumgebung folder moved successfully.
C:\Windows\$NtUninstallKB40230$\systemprofile\Downloads folder moved successfully.
C:\Windows\$NtUninstallKB40230$\systemprofile\Documents\LabVIEW Data\WebServices\Standalone folder moved successfully.
C:\Windows\$NtUninstallKB40230$\systemprofile\Documents\LabVIEW Data\WebServices folder moved successfully.
C:\Windows\$NtUninstallKB40230$\systemprofile\Documents\LabVIEW Data folder moved successfully.
C:\Windows\$NtUninstallKB40230$\systemprofile\Documents\Eigene Videos folder moved successfully.
C:\Windows\$NtUninstallKB40230$\systemprofile\Documents\Eigene Musik folder moved successfully.
C:\Windows\$NtUninstallKB40230$\systemprofile\Documents\Eigene Bilder folder moved successfully.
C:\Windows\$NtUninstallKB40230$\systemprofile\Documents folder moved successfully.
C:\Windows\$NtUninstallKB40230$\systemprofile\Desktop folder moved successfully.
C:\Windows\$NtUninstallKB40230$\systemprofile\Cookies folder moved successfully.
C:\Windows\$NtUninstallKB40230$\systemprofile\Contacts folder moved successfully.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Roaming scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\LocalLow scheduled to be moved on reboot.
C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Verlauf folder moved successfully.
C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Temporary Internet Files folder moved successfully.
C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Programs\Common folder moved successfully.
C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Programs folder moved successfully.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Microsoft scheduled to be moved on reboot.
C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\LogMeIn Hamachi folder moved successfully.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Verlauf scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Temporary Internet Files scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Programs\Common scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Programs scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Microsoft scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\LogMeIn Hamachi scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Verlauf scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Temporary Internet Files scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Programs\Common scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Programs scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Microsoft scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\LogMeIn Hamachi scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Verlauf scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Temporary Internet Files scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Programs\Common scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Programs scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Microsoft scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\LogMeIn Hamachi scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Verlauf scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Temporary Internet Files scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Programs\Common scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Programs scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Microsoft scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\LogMeIn Hamachi scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Verlauf scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Temporary Internet Files scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Programs\Common scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Programs scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Microsoft scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\LogMeIn Hamachi scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Verlauf scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Temporary Internet Files scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Programs\Common scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Programs scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Microsoft scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\LogMeIn Hamachi scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Verlauf scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Temporary Internet Files scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Programs\Common scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Programs scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Microsoft scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\LogMeIn Hamachi scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Verlauf scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Temporary Internet Files scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Programs\Common scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Programs scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Microsoft scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\LogMeIn Hamachi scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Verlauf scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Temporary Internet Files scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Programs\Common scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Programs scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Microsoft scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\LogMeIn Hamachi scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Verlauf scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Temporary Internet Files scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Programs\Common scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Programs scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Microsoft scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\LogMeIn Hamachi scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Verlauf scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Temporary Internet Files scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Programs\Common scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Programs scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Microsoft scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\LogMeIn Hamachi scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Verlauf scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Temporary Internet Files scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Programs scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Microsoft scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\LogMeIn Hamachi scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten scheduled to be moved on reboot.
C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten folder moved successfully.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData scheduled to be moved on reboot.
C:\Windows\$NtUninstallKB40230$\systemprofile\Anwendungsdaten folder moved successfully.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\RegBack scheduled to be moved on reboot.
C:\Windows\$NtUninstallKB40230$\Journal folder moved successfully.
Folder move failed. C:\Windows\$NtUninstallKB40230$ scheduled to be moved on reboot.
< fsuitl reparesepoint delete C:\Windows\$NtUninstallKB40230$ /c >
C:\Users\motzer\Desktop\cmd.bat deleted successfully.
C:\Users\motzer\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: motzer
->Temp folder emptied: 16634181 bytes
->Temporary Internet Files folder emptied: 7343517 bytes
->Java cache emptied: 3106485 bytes
->FireFox cache emptied: 37125657 bytes
->Opera cache emptied: 13146261 bytes
->Flash cache emptied: 2173 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 3066788 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 35219024 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 110,00 mb
 
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.39.1 log created on 03192012_192551

Files\Folders moved on Reboot...
C:\Users\motzer\AppData\Roaming\appconf32.exe moved successfully.
Folder move failed. C:\Windows\$NtUninstallKB40230$\TxR scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Roaming scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\LocalLow scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Microsoft scheduled to be moved on reboot.
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Verlauf not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Temporary Internet Files not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Programs\Common not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Programs not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Microsoft not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\LogMeIn Hamachi not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Verlauf not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Temporary Internet Files not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Programs\Common not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Programs not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Microsoft not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\LogMeIn Hamachi not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Verlauf not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Temporary Internet Files not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Programs\Common not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Programs not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Microsoft not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\LogMeIn Hamachi not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Verlauf not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Temporary Internet Files not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Programs\Common not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Programs not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Microsoft not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\LogMeIn Hamachi not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Verlauf not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Temporary Internet Files not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Programs\Common not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Programs not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Microsoft not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\LogMeIn Hamachi not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Verlauf not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Temporary Internet Files not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Programs\Common not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Programs not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Microsoft not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\LogMeIn Hamachi not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Verlauf not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Temporary Internet Files not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Programs\Common not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Programs not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Microsoft not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\LogMeIn Hamachi not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Verlauf not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Temporary Internet Files not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Programs\Common not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Programs not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Microsoft not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\LogMeIn Hamachi not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Verlauf not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Temporary Internet Files not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Programs\Common not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Programs not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Microsoft not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\LogMeIn Hamachi not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Verlauf not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Temporary Internet Files not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Programs\Common not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Programs not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Microsoft not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\LogMeIn Hamachi not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Verlauf not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Temporary Internet Files not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Programs\Common not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Programs not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Microsoft not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\LogMeIn Hamachi not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Verlauf not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Temporary Internet Files not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Programs not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Microsoft not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\LogMeIn Hamachi not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten\Anwendungsdaten not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten\Anwendungsdaten not found!
File\Folder C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Anwendungsdaten not found!
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Microsoft scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Roaming scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\LocalLow scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Microsoft scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData scheduled to be moved on reboot.
C:\Windows\$NtUninstallKB40230$\systemprofile\Documents\LabVIEW Data\WebServices\Standalone folder moved successfully.
C:\Windows\$NtUninstallKB40230$\systemprofile\Documents\LabVIEW Data\WebServices folder moved successfully.
C:\Windows\$NtUninstallKB40230$\systemprofile\Documents\LabVIEW Data folder moved successfully.
C:\Windows\$NtUninstallKB40230$\systemprofile\Documents folder moved successfully.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Roaming scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\LocalLow scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Microsoft scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\RegBack scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\TxR scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Roaming scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\LocalLow scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local\Microsoft scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData\Local scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile\AppData scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\systemprofile scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$\RegBack scheduled to be moved on reboot.
Folder move failed. C:\Windows\$NtUninstallKB40230$ scheduled to be moved on reboot.

Registry entries deleted on Reboot...

Und Combofix
Code:
Combofix Logfile:

       
Code:

       
ComboFix 12-03-17.01 - motzer 19.03.2012  19:46:39.1.2 - x86
Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.2046.1344 [GMT 1:00]
ausgeführt von:: c:\users\motzer\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: /nombr
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\motzer\AppData\Local\assembly\tmp
c:\users\motzer\AppData\Roaming\AcroIEHelpe.dll
c:\users\motzer\AppData\Roaming\AcroIEHelpe.txt
c:\users\motzer\AppData\Roaming\srvblck2.tmp
c:\windows\$NtUninstallKB40230$
c:\windows\$NtUninstallKB40230$\1042759890
c:\windows\$NtUninstallKB40230$\3762978156\@
c:\windows\$NtUninstallKB40230$\3762978156\cfg.ini
c:\windows\$NtUninstallKB40230$\3762978156\Desktop.ini
c:\windows\$NtUninstallKB40230$\3762978156\L\xadqgnnk
c:\windows\$NtUninstallKB40230$\3762978156\oemid
c:\windows\$NtUninstallKB40230$\3762978156\U\00000001.@
c:\windows\$NtUninstallKB40230$\3762978156\U\00000002.@
c:\windows\$NtUninstallKB40230$\3762978156\U\00000004.@
c:\windows\$NtUninstallKB40230$\3762978156\U\80000000.@
c:\windows\$NtUninstallKB40230$\3762978156\U\80000004.@
c:\windows\$NtUninstallKB40230$\3762978156\U\80000032.@
c:\windows\$NtUninstallKB40230$\3762978156\version
c:\windows\Downloaded Program Files\IDropPTB.dll
c:\windows\system32\dds_trash_log.cmd
c:\windows\system32\muzapp.exe
c:\windows\unin0407.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2012-02-19 bis 2012-03-19  ))))))))))))))))))))))))))))))
.
.
2012-03-19 19:12 . 2012-03-19 19:14        --------        d-----w-        c:\users\motzer\AppData\Local\temp
2012-03-19 19:12 . 2012-03-19 19:12        --------        d-----w-        c:\users\Default\AppData\Local\temp
2012-03-19 18:25 . 2012-03-19 18:25        --------        d-----w-        C:\_OTL
2012-03-15 18:31 . 2010-10-22 00:01        78336        ----a-w-        c:\windows\system32\fwusbnci.org
2012-03-15 18:31 . 2010-10-22 00:00        74240        ----a-w-        c:\windows\system32\fwlanci.org
2012-03-14 20:49 . 2012-03-14 20:49        --------        d-----w-        c:\windows\system32\EventProviders
2012-03-13 20:58 . 2012-03-16 20:57        --------        d-----w-        C:\FRST
2012-03-13 19:30 . 2012-02-10 05:38        1077248        ----a-w-        c:\windows\system32\DWrite.dll
2012-03-13 18:12 . 2009-03-18 15:35        26176        ---ha-w-        c:\windows\system32\hamachi.sys
2012-03-13 18:12 . 2012-03-13 19:27        --------        d-----w-        c:\users\motzer\AppData\Local\LogMeIn Hamachi
2012-03-13 18:07 . 2012-03-13 19:28        --------        d-----w-        c:\program files\ShrewSoft
2012-03-13 17:30 . 2012-02-17 04:14        183808        ----a-w-        c:\windows\system32\drivers\rdpwd.sys
2012-03-13 17:30 . 2012-02-17 04:13        24576        ----a-w-        c:\windows\system32\drivers\tdtcp.sys
2012-03-13 17:30 . 2010-11-20 10:21        18432        ----a-w-        c:\windows\system32\drivers\tdpipe.sys
2012-03-12 20:33 . 2012-03-12 20:33        --------        d-----w-        c:\users\motzer\AppData\Roaming\Malwarebytes
2012-03-12 20:33 . 2012-03-12 20:33        --------        d-----w-        c:\programdata\Malwarebytes
2012-03-12 20:33 . 2012-03-12 20:33        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware
2012-03-12 20:33 . 2011-12-10 14:24        20464        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-03-12 20:11 . 2012-03-12 20:11        --------        d-----w-        c:\users\motzer\AppData\Local\Sunbelt Software
2012-03-12 20:10 . 2012-03-12 20:10        --------        d-----w-        c:\program files\Sunbelt Software
2012-03-12 20:07 . 2012-03-12 20:07        --------        d-----w-        c:\windows\Downloaded Installations
2012-03-11 22:58 . 2012-03-11 22:58        --------        d-----w-        c:\windows\system32\cvirte
2012-03-11 22:57 . 2012-03-13 17:23        --------        d-----w-        c:\program files\Microsoft Silverlight
2012-03-11 22:56 . 2012-03-11 23:45        --------        d-----w-        c:\program files\National Instruments
2012-03-11 22:53 . 2012-03-12 19:58        --------        d-----w-        c:\programdata\National Instruments
2012-03-11 22:51 . 2012-03-11 23:42        --------        d-----w-        C:\National Instruments Downloads
2012-02-26 21:31 . 2012-02-26 21:31        --------        d-----w-        c:\program files\Maxima-5.26.0
2012-02-24 12:16 . 2012-02-24 12:16        --------        d-----w-        c:\windows\system32\wbem\en-US
2012-02-22 23:20 . 2012-02-22 23:20        327432        ----a-w-        c:\program files\Common Files\Microsoft Shared\VSA\9.0\VsaEnv\vsaenv.exe
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-03-14 20:56 . 2009-07-14 02:05        152576        ----a-w-        c:\windows\system32\msclmd.dll
2012-03-13 22:21 . 2011-05-25 16:40        1844384        ----a-w-        c:\programdata\Microsoft\VisualStudio\10.0\1033\ResourceCache.dll
2012-03-13 22:21 . 2011-05-25 17:14        1912512        ----a-w-        c:\programdata\Microsoft\VisualStudio\10.0\1031\ResourceCache.dll
2012-02-24 01:32 . 2012-02-24 01:32        76800        ----a-w-        c:\windows\system32\SetIEInstalledDate.exe
2012-02-24 01:32 . 2012-02-24 01:32        74752        ----a-w-        c:\windows\system32\RegisterIEPKEYs.exe
2012-02-24 01:32 . 2012-02-24 01:32        63488        ----a-w-        c:\windows\system32\tdc.ocx
2012-02-24 01:32 . 2012-02-24 01:32        152064        ----a-w-        c:\windows\system32\wextract.exe
2012-02-24 01:32 . 2012-02-24 01:32        1127424        ----a-w-        c:\windows\system32\wininet.dll
2012-02-24 01:32 . 2012-02-24 01:32        420864        ----a-w-        c:\windows\system32\vbscript.dll
2012-02-21 18:17 . 2011-05-25 14:49        414368        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2012-02-17 05:34 . 2012-03-13 17:30        826880        ----a-w-        c:\windows\system32\rdpcore.dll
2012-02-03 03:54 . 2012-03-13 19:30        2343424        ----a-w-        c:\windows\system32\win32k.sys
2012-01-25 05:32 . 2012-03-15 17:54        58880        ----a-w-        c:\windows\system32\rdpwsx.dll
2012-01-25 05:32 . 2012-03-15 17:54        129536        ----a-w-        c:\windows\system32\rdpcorekmts.dll
2012-01-25 05:27 . 2012-03-13 17:30        8192        ----a-w-        c:\windows\system32\rdrmemptylst.exe
2012-01-04 08:58 . 2012-02-16 20:24        442880        ----a-w-        c:\windows\system32\ntshrui.dll
2011-12-30 05:27 . 2012-02-16 20:25        478720        ----a-w-        c:\windows\system32\timedate.cpl
2011-06-22 10:44 . 2011-06-22 10:44        158720        ----a-w-        c:\program files\internet explorer\plugins\LV2011ActiveXControl.dll
2011-05-12 09:01 . 2011-05-12 09:01        158720        ----a-w-        c:\program files\internet explorer\plugins\LV90ActiveXControl.dll
2011-09-29 07:09 . 2011-10-05 12:21        134104        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12        94208        ----a-w-        c:\users\motzer\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12        94208        ----a-w-        c:\users\motzer\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12        94208        ----a-w-        c:\users\motzer\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12        94208        ----a-w-        c:\users\motzer\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
"NIRegistrationWizard"="c:\program files\National Instruments\Shared\RegistrationWizard\Bin\RegistrationWizard.exe" [2010-06-21 846520]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVMWlanClient"="c:\program files\avmwlanstick\wlangui.exe" [2010-10-22 2105344]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-03-28 281768]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" [2012-01-03 36760]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [2012-01-03 815512]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-11-18 98304]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"NI Update Service"="c:\program files\National Instruments\Shared\Update Service\NIUpdateService.exe" [2011-06-07 3002976]
"SunServer"="c:\program files\Sunbelt Software\CounterSpy\Consumer\sunserver.exe" [2005-11-11 290816]
.
c:\users\motzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\motzer\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-2-15 24246216]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Air Mouse.lnk - c:\program files\Air Mouse\Air Mouse\Air Mouse.exe [2011-7-28 1082368]
NI Error Reporting.lnk - c:\program files\National Instruments\Shared\NI Error Reporting\nierserver.exe [2011-6-19 619672]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
R1 vflt;Shrew Soft Lightweight Filter;c:\windows\system32\DRIVERS\vfilter.sys [2010-09-02 17920]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 acsock;acsock;c:\windows\system32\DRIVERS\acsock.sys [2011-03-23 77968]
R3 avmeject;AVM Eject;c:\windows\system32\drivers\avmeject.sys [2010-10-22 4352]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [2011-07-20 77624]
R3 FWLANUSB;AVM FRITZ!WLAN;c:\windows\system32\DRIVERS\fwlanusb.sys [2010-10-22 265088]
R3 fwlanusbn;FRITZ!WLAN N;c:\windows\system32\DRIVERS\fwlanusbn.sys [2010-10-22 586752]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 31125880]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl.sys [2011-05-10 18432]
R3 nipalfwedl;nipalfwedl;c:\windows\system32\drivers\nipalfwedl.sys [2011-06-29 11968]
R3 nipalusbedl;nipalusbedl;c:\windows\system32\drivers\nipalusbedl.sys [2011-06-29 11968]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
R3 silabenm;Silicon Labs CP210x USB to UART Bridge Serial Port Enumerator Driver;c:\windows\system32\DRIVERS\silabenm.sys [2009-10-08 17920]
R3 silabser;Silicon Labs CP210x USB to UART Bridge Driver;c:\windows\system32\DRIVERS\silabser.sys [2009-10-08 63488]
R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [2011-07-20 181432]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 vnet;Shrew Soft Virtual Adapter;c:\windows\system32\DRIVERS\virtualnet.sys [2010-09-02 13824]
R3 VSPerfDrv100;Performance Tools Driver 10.0;c:\program files\Microsoft Visual Studio 10.0\Team Tools\Performance Tools\VSPerfDrv100.sys [2009-12-08 48128]
S0 hotcore3;hc3ServiceName;c:\windows\system32\DRIVERS\hotcore3.sys [2011-01-21 57112]
S0 nipbcfk;National Instruments Class Upper Filter Driver;c:\windows\System32\drivers\nipbcfk.sys [2010-03-24 15448]
S0 PrecSim;PrecSim;c:\windows\system32\DRIVERS\precsim.sys [2002-05-21 69600]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2011-08-16 722416]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-11-18 172032]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-03-28 136360]
S2 mitsijm2012;Autodesk Moldflow Inventor Tool Suite Integration 2012 Job-Manager;c:\program files\Autodesk\Inventor 2012\Moldflow\bin\mitsijm.exe [2011-08-03 580416]
S2 NIApplicationWebServer;NI Application Web Server;c:\program files\National Instruments\Shared\NI WebServer\ApplicationWebServer.exe [2011-05-27 50336]
S2 nimDNSResponder;National Instruments mDNS Responder Service;c:\program files\National Instruments\Shared\mDNS Responder\nimdnsResponder.exe [2011-06-01 194224]
S2 NINetworkDiscovery;NI Network Discovery;c:\program files\National Instruments\Shared\NI Network Discovery\niDiscSvc.exe [2011-06-10 121032]
S2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys [2009-03-02 5120]
S2 TeamViewer6;TeamViewer 6;c:\program files\TeamViewer\Version6\TeamViewer_Service.exe [2011-08-30 2358656]
S2 vpnagent;Cisco AnyConnect Secure Mobility Agent;c:\program files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe [2011-03-23 435152]
.
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
rbfilter
SNC
cmuda
ntservice1
mcontrol
vmm
.
.
------- Zusätzlicher Suchlauf -------
.
uInternet Settings,ProxyOverride = fritz.box;*.local
IE: An OneNote s&enden - c:\progra~1\MIF5BA~1\Office14\ONBttnIE.dll/105
IE: An vorhandene PDF-Datei anfügen - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Free YouTube Download - c:\users\motzer\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Free YouTube to MP3 Converter - c:\users\motzer\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: In Adobe PDF konvertieren - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Linkziel an vorhandene PDF-Datei anhängen - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Linkziel in Adobe PDF konvertieren - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MIF5BA~1\Office14\EXCEL.EXE/3000
IE: {{7644E42D-B096-457F-8B5B-901238FC81AE} - c:\program files\ICQ7.6\ICQ.exe
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\motzer\AppData\Roaming\Mozilla\Firefox\Profiles\vcob6byz.default\
FF - prefs.js: browser.search.selectedEngine - Search the web
FF - prefs.js: keyword.URL - hxxp://www.browsersafesearch.com?client=mozilla-firefox&cd=UTF-8&search=1&q=
FF - user.js: browser.search.selectedEngine - Search the web
FF - user.js: browser.search.order.1 - Search the web
FF - user.js: browser.search.defaultenginename - Search the web
FF - user.js: keyword.URL - hxxp://www.browsersafesearch.com?client=mozilla-firefox&cd=UTF-8&search=1&q=
FF - user.js: privacy.item.cookies - false
FF - user.js: privacy.sanitize.promptOnSanitize - false
.
.
------- Dateityp-Verknüpfung -------
.
.scr=DWGTrueViewScriptFile
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
AddRemove-iPhoto Plus 4 - c:\windows\unin0407.exe
AddRemove-SLABCOMM&10C4&EA60 - c:\windows\system32\Silabs\DriverUninstaller.exe VCP CP210x Cardinal\SLABCOMM&10C4&EA60
AddRemove-01_Simmental - c:\program files\Samsung\USB Drivers\01_Simmental\Uninstall.exe
AddRemove-02_Siberian - c:\program files\Samsung\USB Drivers\02_Siberian\Uninstall.exe
AddRemove-03_Swallowtail - c:\program files\Samsung\USB Drivers\03_Swallowtail\Uninstall.exe
AddRemove-04_semseyite - c:\program files\Samsung\USB Drivers\04_semseyite\Uninstall.exe
AddRemove-05_Sloan - c:\program files\Samsung\USB Drivers\05_Sloan\Uninstall.exe
AddRemove-06_Spencer - c:\program files\Samsung\USB Drivers\06_Spencer\Uninstall.exe
AddRemove-07_Schorl - c:\program files\Samsung\USB Drivers\07_Schorl\Uninstall.exe
AddRemove-08_EMPChipset - c:\program files\Samsung\USB Drivers\08_EMPChipset\Uninstall.exe
AddRemove-09_Hsp - c:\program files\Samsung\USB Drivers\09_Hsp\Uninstall.exe
AddRemove-11_HSP_Plus_Default - c:\program files\Samsung\USB Drivers\11_HSP_Plus_Default\Uninstall.exe
AddRemove-16_Shrewsbury - c:\program files\Samsung\USB Drivers\16_Shrewsbury\Uninstall.exe
AddRemove-17_EMP_Chipset2 - c:\program files\Samsung\USB Drivers\17_EMP_Chipset2\Uninstall.exe
AddRemove-18_Zinia_Serial_Driver - c:\program files\Samsung\USB Drivers\18_Zinia_Serial_Driver\Uninstall.exe
AddRemove-19_VIA_driver - c:\program files\Samsung\USB Drivers\19_VIA_driver\Uninstall.exe
AddRemove-20_NXP_Driver - c:\program files\Samsung\USB Drivers\20_NXP_Driver\Uninstall.exe
AddRemove-21_Searsburg - c:\program files\Samsung\USB Drivers\21_Searsburg\Uninstall.exe
AddRemove-22_WiBro_WiMAX - c:\program files\Samsung\USB Drivers\22_WiBro_WiMAX\Uninstall.exe
AddRemove-24_flashusbdriver - c:\program files\Samsung\USB Drivers\24_flashusbdriver\Uninstall.exe
AddRemove-25_escape - c:\program files\Samsung\USB Drivers\25_escape\Uninstall.exe
AddRemove-26_VIA_driver2 - c:\program files\Samsung\USB Drivers\26_VIA_driver2\Uninstall.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'Explorer.exe'(6140)
c:\users\motzer\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\ATKFUSService.exe
c:\windows\system32\atieclxx.exe
c:\windows\system32\taskhost.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\ASUS\GamerOSD\ATKFastUserSwitching.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\windows\system32\conhost.exe
c:\windows\System32\ASDR.exe
c:\program files\avmwlanstick\WlanNetService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\lkads.exe
c:\program files\National Instruments\MAX\nimxs.exe
c:\program files\National Instruments\Shared\Security\nidmsrv.exe
c:\windows\system32\conhost.exe
c:\program files\ASUS\SmartDoctor\SmartDoctor.exe
c:\program files\National Instruments\Shared\NI WebServer\SystemWebServer.exe
c:\program files\National Instruments\Shared\Tagger\tagsrv.exe
c:\windows\system32\lkcitdl.exe
c:\windows\system32\lktsrv.exe
c:\program files\Air Mouse\Air Mouse\Mobile Mouse Service.exe
c:\windows\system32\WUDFHost.exe
c:\windows\system32\sppsvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-03-19  20:23:30 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-03-19 19:23
.
Vor Suchlauf: 16 Verzeichnis(se), 146.924.564.480 Bytes frei
Nach Suchlauf: 21 Verzeichnis(se), 146.630.221.824 Bytes frei
.
- - End Of File - - AC43627F598EFEF6EC6DD7C46FFD9A84

--- --- ---

mfg motzer

Psychotic 20.03.2012 09:30
OTL (Custom Scan)


Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
/md5start
explorer.exe
regedit.exe
winlogon.exe
wininit.exe
userinit.exe
/md5stop
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
CREATERESTOREPOINT
  • Schliesse bitte nun alle Programme. (Wichtig)
  • Klicke nun bitte auf den Quick Scan Button.
  • Kopiere nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

motzerrobo 20.03.2012 17:36
Jop

OLT.txt

Code:
OTL logfile created on: 20.03.2012 16:50:25 - Run 2
OTL by OldTimer - Version 3.2.39.1    Folder = C:\Users\motzer\Desktop
 Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,16 Gb Available Physical Memory | 58,17% Memory free
4,00 Gb Paging File | 2,87 Gb Available in Paging File | 71,88% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 222,78 Gb Total Space | 136,28 Gb Free Space | 61,17% Space Free | Partition Type: NTFS
Drive D: | 232,83 Gb Total Space | 41,48 Gb Free Space | 17,82% Space Free | Partition Type: NTFS
Drive E: | 10,00 Gb Total Space | 6,74 Gb Free Space | 67,37% Space Free | Partition Type: NTFS
Drive F: | 47,14 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive M: | 2,34 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
 
Computer Name: STEEL | User Name: motzer | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.03.18 23:34:36 | 000,594,432 | ---- | M] (OldTimer Tools) -- C:\Users\motzer\Desktop\OTL.exe
PRC - [2012.01.03 14:10:50 | 000,815,512 | ---- | M] (Adobe Systems Inc.) -- C:\Programme\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
PRC - [2012.01.03 14:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011.11.17 08:25:00 | 000,050,328 | ---- | M] (National Instruments Corporation) -- C:\Programme\National Instruments\Shared\NI WebServer\SystemWebServer.exe
PRC - [2011.08.30 17:18:30 | 002,358,656 | ---- | M] (TeamViewer GmbH) -- C:\Programme\TeamViewer\Version6\TeamViewer_Service.exe
PRC - [2011.08.03 04:20:34 | 000,580,416 | ---- | M] (Autodesk, Inc.) -- C:\Programme\Autodesk\Inventor 2012\Moldflow\bin\mitsijm.exe
PRC - [2011.07.28 21:55:14 | 001,082,368 | ---- | M] () -- C:\Programme\Air Mouse\Air Mouse\Air Mouse.exe
PRC - [2011.07.06 10:41:30 | 000,039,080 | ---- | M] (RPA Technology) -- C:\Programme\Air Mouse\Air Mouse\Mobile Mouse Service.exe
PRC - [2011.07.04 15:35:01 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.06.24 05:22:20 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
PRC - [2011.06.19 08:29:04 | 000,619,672 | ---- | M] (National Instruments Corporation) -- C:\Programme\National Instruments\Shared\NI Error Reporting\nierserver.exe
PRC - [2011.06.14 17:57:10 | 000,012,696 | ---- | M] (National Instruments Corporation) -- C:\Programme\National Instruments\MAX\nimxs.exe
PRC - [2011.06.14 11:54:08 | 000,676,016 | ---- | M] (National Instruments Corporation) -- C:\Programme\National Instruments\Shared\Tagger\tagsrv.exe
PRC - [2011.06.14 09:11:10 | 000,362,104 | ---- | M] (National Instruments Corporation) -- C:\Programme\National Instruments\Shared\Security\nidmsrv.exe
PRC - [2011.06.14 09:08:24 | 000,056,952 | ---- | M] (National Instruments Corporation) -- C:\Windows\System32\lktsrv.exe
PRC - [2011.06.14 09:00:10 | 000,046,192 | ---- | M] (National Instruments Corporation) -- C:\Windows\System32\lkads.exe
PRC - [2011.06.10 14:11:20 | 000,121,032 | ---- | M] (National Instruments Corporation) -- C:\Programme\National Instruments\Shared\NI Network Discovery\niDiscSvc.exe
PRC - [2011.06.01 16:32:14 | 000,194,224 | ---- | M] (National Instruments Corporation) -- C:\Programme\National Instruments\Shared\mDNS Responder\nimdnsResponder.exe
PRC - [2011.05.27 13:43:48 | 000,050,336 | ---- | M] (National Instruments Corporation) -- C:\Programme\National Instruments\Shared\NI WebServer\ApplicationWebServer.exe
PRC - [2011.03.28 15:15:17 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2011.03.28 15:15:04 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2011.03.28 15:14:56 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2011.03.23 23:34:18 | 000,435,152 | ---- | M] (Cisco Systems, Inc.) -- C:\Programme\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
PRC - [2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010.11.20 13:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2010.11.20 13:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2010.11.20 13:17:41 | 001,174,016 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe
PRC - [2010.10.27 09:43:38 | 000,695,136 | ---- | M] (National Instruments, Inc.) -- C:\Windows\System32\lkcitdl.exe
PRC - [2010.10.22 02:00:00 | 002,105,344 | R--- | M] (AVM Berlin) -- C:\Programme\avmwlanstick\WLanGUI.exe
PRC - [2010.10.22 02:00:00 | 000,376,832 | R--- | M] (AVM Berlin) -- C:\Programme\avmwlanstick\WLanNetService.exe
PRC - [2009.12.21 23:42:18 | 001,204,224 | ---- | M] (ASUSTeK Inc.) -- C:\Programme\ASUS\SmartDoctor\SmartDoctor.exe
PRC - [2009.12.01 13:22:54 | 000,061,952 | ---- | M] (ASUSTeK COMPUTER INC.) -- C:\Windows\System32\ATKFUSService.exe
PRC - [2009.11.30 14:17:00 | 000,417,792 | ---- | M] () -- C:\Programme\ASUS\GamerOSD\ATKFastUserSwitching.exe
PRC - [2009.11.18 06:45:56 | 000,368,640 | ---- | M] (AMD) -- C:\Windows\System32\atieclxx.exe
PRC - [2009.11.18 06:45:26 | 000,172,032 | ---- | M] (AMD) -- C:\Windows\System32\atiesrxx.exe
PRC - [2009.07.27 10:13:28 | 000,061,440 | ---- | M] () -- C:\Windows\System32\ASDR.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.03.15 20:44:12 | 001,670,144 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\08d608378aa405adc844f3cf36974b8c\Microsoft.VisualBasic.ni.dll
MOD - [2012.03.15 18:51:12 | 012,432,896 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
MOD - [2012.03.15 18:50:43 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\5cae93d923c8378370758489e5535820\System.Runtime.Remoting.ni.dll
MOD - [2012.03.15 18:50:33 | 011,819,520 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\da5da08245467818759aa44c4eb948e1\System.Web.ni.dll
MOD - [2012.03.15 18:50:24 | 001,587,200 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
MOD - [2012.03.15 18:49:56 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\461d3b6b3f43e6fbe6c897d5936e17e4\System.Xml.ni.dll
MOD - [2012.03.15 18:49:51 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\bc09ad2d49d8535371845cd7532f9271\System.Configuration.ni.dll
MOD - [2012.03.15 18:49:49 | 007,963,136 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
MOD - [2012.03.15 18:48:34 | 011,490,304 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
MOD - [2012.01.03 14:10:54 | 000,019,968 | ---- | M] () -- C:\Programme\Adobe\Acrobat 10.0\Acrobat\Locale\de_DE\AcroTray.DEU
MOD - [2011.07.28 21:55:14 | 001,082,368 | ---- | M] () -- C:\Programme\Air Mouse\Air Mouse\Air Mouse.exe
MOD - [2011.07.27 13:53:51 | 001,703,936 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager2.Graphics.Wizard\2.0.3609.23390__90ba9c70f846762e\CLI.Aspect.DisplaysManager2.Graphics.Wizard.dll
MOD - [2011.07.27 13:53:51 | 000,491,520 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Wizard\2.0.3609.23357__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Wizard.dll
MOD - [2011.07.27 13:53:51 | 000,372,736 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime\2.0.3609.23260__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.dll
MOD - [2011.07.27 13:53:51 | 000,204,800 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Wizard\2.0.3609.23281__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Wizard.dll
MOD - [2011.07.27 13:53:51 | 000,077,824 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Runtime\2.0.3609.23336__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Runtime.dll
MOD - [2011.07.27 13:53:51 | 000,073,728 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard\2.0.3609.23269__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.dll
MOD - [2011.07.27 13:53:51 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Runtime\2.0.3609.23316__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Runtime.dll
MOD - [2011.07.27 13:53:51 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Runtime\2.0.3609.23306__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Runtime.dll
MOD - [2011.07.27 13:53:51 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard\2.0.3609.23275__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.dll
MOD - [2011.07.27 13:53:51 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Runtime\2.0.3609.23270__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Runtime.dll
MOD - [2011.07.27 13:53:50 | 000,643,072 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.OverDrive5.Graphics.Dashboard\2.0.3609.23369__90ba9c70f846762e\CLI.Aspect.OverDrive5.Graphics.Dashboard.dll
MOD - [2011.07.27 13:53:50 | 000,409,600 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Wizard\2.0.3609.23331__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Wizard.dll
MOD - [2011.07.27 13:53:50 | 000,356,352 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Dashboard\2.0.3609.23322__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Dashboard.dll
MOD - [2011.07.27 13:53:50 | 000,094,208 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Wizard\2.0.3609.23322__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Wizard.dll
MOD - [2011.07.27 13:53:50 | 000,077,824 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.OverDrive5.Graphics.Runtime\2.0.3609.23368__90ba9c70f846762e\CLI.Aspect.OverDrive5.Graphics.Runtime.dll
MOD - [2011.07.27 13:53:50 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Welcome.Graphics.Dashboard\2.0.3609.23358__90ba9c70f846762e\CLI.Aspect.Welcome.Graphics.Dashboard.dll
MOD - [2011.07.27 13:53:50 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Runtime\2.0.3609.23321__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Runtime.dll
MOD - [2011.07.27 13:53:50 | 000,013,312 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Welcome.Graphics.Runtime\2.0.3609.23390__90ba9c70f846762e\CLI.Aspect.Welcome.Graphics.Runtime.dll
MOD - [2011.07.27 13:53:49 | 001,142,784 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager2.Graphics.Dashboard\2.0.3609.23385__90ba9c70f846762e\CLI.Aspect.DisplaysManager2.Graphics.Dashboard.dll
MOD - [2011.07.27 13:53:49 | 000,827,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Dashboard\2.0.3609.23308__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Dashboard.dll
MOD - [2011.07.27 13:53:49 | 000,573,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Dashboard\2.0.3609.23282__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Dashboard.dll
MOD - [2011.07.27 13:53:49 | 000,393,216 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Dashboard\2.0.3609.23307__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Dashboard.dll
MOD - [2011.07.27 13:53:49 | 000,372,736 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Dashboard\2.0.3609.23302__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Dashboard.dll
MOD - [2011.07.27 13:53:49 | 000,270,336 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
MOD - [2011.07.27 13:53:49 | 000,196,608 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Dashboard\2.0.3609.23282__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Dashboard.dll
MOD - [2011.07.27 13:53:49 | 000,098,304 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Runtime\2.0.3609.23308__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Runtime.dll
MOD - [2011.07.27 13:53:49 | 000,094,208 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Dashboard\2.0.3609.23313__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Dashboard.dll
MOD - [2011.07.27 13:53:49 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Runtime\2.0.3609.23306__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Runtime.dll
MOD - [2011.07.27 13:53:49 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Runtime\2.0.3609.23313__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Runtime.dll
MOD - [2011.07.27 13:53:49 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Runtime\2.0.3609.23286__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Runtime.dll
MOD - [2011.07.27 13:53:49 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Runtime\2.0.3609.23307__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Runtime.dll
MOD - [2011.07.27 13:53:49 | 000,036,864 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Runtime\2.0.3609.23315__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Runtime.dll
MOD - [2011.07.27 13:53:49 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.Hotkeys.Shared\2.0.3589.25834__90ba9c70f846762e\AEM.Plugin.Hotkeys.Shared.dll
MOD - [2011.07.27 13:53:49 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Actions.CCAA.Shared\2.0.3589.25817__90ba9c70f846762e\AEM.Actions.CCAA.Shared.dll
MOD - [2011.07.27 13:53:49 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.WinMessages.Shared\2.0.3589.25847__90ba9c70f846762e\AEM.Plugin.WinMessages.Shared.dll
MOD - [2011.07.27 13:53:49 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.EEU.Shared\2.0.3589.25854__90ba9c70f846762e\AEM.Plugin.EEU.Shared.dll
MOD - [2011.07.27 13:53:48 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation\2.0.3589.25791__90ba9c70f846762e\LOG.Foundation.dll
MOD - [2011.07.27 13:53:48 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\NEWAEM.Foundation\2.0.3589.25794__90ba9c70f846762e\NEWAEM.Foundation.dll
MOD - [2011.07.27 13:53:48 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0703\2.0.2651.18802__90ba9c70f846762e\DEM.Graphics.I0703.dll
MOD - [2011.07.27 13:53:48 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\MOM.Foundation\2.0.3589.25837__90ba9c70f846762e\MOM.Foundation.dll
MOD - [2011.07.27 13:53:48 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0706\2.0.2743.23304__90ba9c70f846762e\DEM.Graphics.I0706.dll
MOD - [2011.07.27 13:53:48 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.REG.Shared\2.0.3589.25951__90ba9c70f846762e\AEM.Plugin.REG.Shared.dll
MOD - [2011.07.27 13:53:48 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.GD.Shared\2.0.3589.25922__90ba9c70f846762e\AEM.Plugin.GD.Shared.dll
MOD - [2011.07.27 13:53:48 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.DPPE.Shared\2.0.3589.25916__90ba9c70f846762e\AEM.Plugin.DPPE.Shared.dll
MOD - [2011.07.27 13:53:48 | 000,007,168 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\atixclib\1.0.0.0__90ba9c70f846762e\atixclib.dll
MOD - [2011.07.27 13:53:47 | 000,151,552 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Shared\2.0.3589.25814__90ba9c70f846762e\CLI.Caste.Graphics.Shared.dll
MOD - [2011.07.27 13:53:47 | 000,098,304 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Foundation\2.0.3589.25796__90ba9c70f846762e\CLI.Foundation.dll
MOD - [2011.07.27 13:53:47 | 000,061,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.OverDrive5.Graphics.Shared\2.0.3589.25948__90ba9c70f846762e\CLI.Aspect.OverDrive5.Graphics.Shared.dll
MOD - [2011.07.27 13:53:47 | 000,061,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Shared\2.0.3589.25848__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Shared.dll
MOD - [2011.07.27 13:53:47 | 000,057,344 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Shared\2.0.3589.25945__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Shared.dll
MOD - [2011.07.27 13:53:47 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0601\2.0.2573.17685__90ba9c70f846762e\DEM.Graphics.I0601.dll
MOD - [2011.07.27 13:53:47 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Shared\2.0.3589.25905__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Shared.dll
MOD - [2011.07.27 13:53:47 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Foundation.XManifest\2.0.3589.26042__90ba9c70f846762e\CLI.Foundation.XManifest.dll
MOD - [2011.07.27 13:53:47 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared\2.0.3589.25822__90ba9c70f846762e\CLI.Component.Dashboard.Shared.dll
MOD - [2011.07.27 13:53:47 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared\2.0.3589.25829__90ba9c70f846762e\CLI.Component.Wizard.Shared.dll
MOD - [2011.07.27 13:53:47 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Client.Shared\2.0.3589.25810__90ba9c70f846762e\CLI.Component.Client.Shared.dll
MOD - [2011.07.27 13:53:47 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Welcome.Graphics.Shared\2.0.3589.25907__90ba9c70f846762e\CLI.Aspect.Welcome.Graphics.Shared.dll
MOD - [2011.07.27 13:53:47 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Shared\2.0.3589.25838__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Shared.dll
MOD - [2011.07.27 13:53:47 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics\2.0.3589.25917__90ba9c70f846762e\DEM.Graphics.dll
MOD - [2011.07.27 13:53:47 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Foundation\2.0.2573.17684__90ba9c70f846762e\DEM.Foundation.dll
MOD - [2011.07.27 13:53:47 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared\2.0.3589.25832__90ba9c70f846762e\CLI.Component.Runtime.Shared.dll
MOD - [2011.07.27 13:53:47 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard.Shared\2.0.3589.25896__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.Shared.dll
MOD - [2011.07.27 13:53:47 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard.Shared\2.0.3589.25844__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.Shared.dll
MOD - [2011.07.27 13:53:46 | 000,741,376 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\ResourceManagement.Foundation.Implementation\2.0.3609.23384__90ba9c70f846762e\ResourceManagement.Foundation.Implementation.dll
MOD - [2011.07.27 13:53:46 | 000,106,496 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\MOM.Implementation\2.0.3609.23351__90ba9c70f846762e\MOM.Implementation.dll
MOD - [2011.07.27 13:53:46 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation\2.0.3609.23350__90ba9c70f846762e\LOG.Foundation.Implementation.dll
MOD - [2011.07.27 13:53:46 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Shared\2.0.3589.25859__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Shared.dll
MOD - [2011.07.27 13:53:46 | 000,053,248 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Shared\2.0.3589.25846__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Shared.dll
MOD - [2011.07.27 13:53:46 | 000,053,248 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Shared\2.0.3589.25888__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Shared.dll
MOD - [2011.07.27 13:53:46 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.Source.Kit.Server\2.0.3609.23363__90ba9c70f846762e\AEM.Plugin.Source.Kit.Server.dll
MOD - [2011.07.27 13:53:46 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Foundation.Private\2.0.3589.25806__90ba9c70f846762e\CLI.Foundation.Private.dll
MOD - [2011.07.27 13:53:46 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Shared\2.0.3589.25831__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Shared.dll
MOD - [2011.07.27 13:53:46 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Shared\2.0.3589.25857__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Shared.dll
MOD - [2011.07.27 13:53:46 | 000,036,864 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Private\2.0.3589.25801__90ba9c70f846762e\LOG.Foundation.Private.dll
MOD - [2011.07.27 13:53:46 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Shared\2.0.3589.25893__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Shared.dll
MOD - [2011.07.27 13:53:46 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Shared\2.0.3589.25912__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Shared.dll
MOD - [2011.07.27 13:53:46 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CustomFormats.Graphics.Shared\2.0.3589.25825__90ba9c70f846762e\CLI.Aspect.CustomFormats.Graphics.Shared.dll
MOD - [2011.07.27 13:53:46 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared.Private\2.0.3589.25839__90ba9c70f846762e\CLI.Component.Wizard.Shared.Private.dll
MOD - [2011.07.27 13:53:46 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Shared\2.0.3589.25862__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Shared.dll
MOD - [2011.07.27 13:53:46 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\ResourceManagement.Foundation.Private\2.0.3589.25819__90ba9c70f846762e\ResourceManagement.Foundation.Private.dll
MOD - [2011.07.27 13:53:46 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation.Private\2.0.3589.25856__90ba9c70f846762e\LOG.Foundation.Implementation.Private.dll
MOD - [2011.07.27 13:53:46 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\APM.Foundation\2.0.3589.25858__90ba9c70f846762e\APM.Foundation.dll
MOD - [2011.07.27 13:53:46 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Server.Shared\2.0.3589.25836__90ba9c70f846762e\AEM.Server.Shared.dll
MOD - [2011.07.27 13:53:46 | 000,007,168 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Extension.EEU\2.0.3609.23257__90ba9c70f846762e\CLI.Component.Runtime.Extension.EEU.dll
MOD - [2011.07.27 13:53:45 | 001,220,608 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard\2.0.3609.23265__90ba9c70f846762e\CLI.Component.Dashboard.dll
MOD - [2011.07.27 13:53:45 | 000,565,248 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Systemtray\2.0.3609.23345__90ba9c70f846762e\CLI.Component.Systemtray.dll
MOD - [2011.07.27 13:53:45 | 000,405,504 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard\2.0.3609.23275__90ba9c70f846762e\CLI.Component.Wizard.dll
MOD - [2011.07.27 13:53:45 | 000,061,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime\2.0.3609.23257__90ba9c70f846762e\CLI.Component.Runtime.dll
MOD - [2011.07.27 13:53:45 | 000,057,344 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.SkinFactory\2.0.3609.23259__90ba9c70f846762e\CLI.Component.SkinFactory.dll
MOD - [2011.07.27 13:53:45 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared.Private\2.0.3589.25849__90ba9c70f846762e\CLI.Component.Runtime.Shared.Private.dll
MOD - [2011.07.27 13:53:45 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared.Private\2.0.3589.25851__90ba9c70f846762e\CLI.Component.Dashboard.Shared.Private.dll
MOD - [2011.07.27 13:53:44 | 000,061,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\APM.Server\2.0.3609.23255__90ba9c70f846762e\APM.Server.dll
MOD - [2011.07.27 13:53:44 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Server\2.0.3609.23256__90ba9c70f846762e\AEM.Server.dll
MOD - [2011.07.27 13:53:44 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Client.Shared.Private\2.0.3589.25826__90ba9c70f846762e\CLI.Component.Client.Shared.Private.dll
MOD - [2011.07.27 13:53:44 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\ATICCCom\2.0.0.0__90ba9c70f846762e\ATICCCom.dll
MOD - [2011.07.27 13:53:44 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime.Shared.Private\2.0.3589.25865__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.Shared.Private.dll
MOD - [2011.07.27 13:53:44 | 000,019,456 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CCC.Implementation\2.0.3609.23351__90ba9c70f846762e\CCC.Implementation.dll
MOD - [2011.06.19 08:29:06 | 001,967,104 | ---- | M] () -- C:\Programme\National Instruments\Shared\NI Error Reporting\niwsrp.dll
MOD - [2011.06.14 13:19:58 | 000,025,600 | ---- | M] () -- C:\Programme\Air Mouse\Air Mouse\BonjourService.dll
MOD - [2011.03.16 23:11:16 | 004,297,568 | ---- | M] () -- C:\Programme\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
MOD - [2009.11.30 14:17:00 | 000,417,792 | ---- | M] () -- C:\Programme\ASUS\GamerOSD\ATKFastUserSwitching.exe
MOD - [2009.07.14 09:47:13 | 000,434,176 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll
MOD - [2009.07.14 09:47:12 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2008.12.10 10:19:08 | 000,430,080 | ---- | M] () -- C:\Programme\ATI Technologies\ATI.ACE\Branding\Branding.dll
MOD - [2007.03.13 15:46:50 | 000,007,168 | ---- | M] () -- C:\Programme\ASUS\SmartDoctor\VOV32.dll
MOD - [2007.02.28 17:34:04 | 000,643,142 | ---- | M] () -- C:\Programme\ASUS\SmartDoctor\aticlocklib.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2012.01.03 14:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.11.17 08:25:00 | 000,050,328 | ---- | M] (National Instruments Corporation) [Auto | Running] -- C:\Programme\National Instruments\Shared\NI WebServer\SystemWebServer.exe -- (niSvcLoc)
SRV - [2011.10.10 23:27:16 | 001,044,816 | ---- | M] (Flexera Software, Inc.) [On_Demand | Stopped] -- C:\Programme\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2011.10.04 20:49:27 | 000,419,624 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2011.08.30 17:18:30 | 002,358,656 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Programme\TeamViewer\Version6\TeamViewer_Service.exe -- (TeamViewer6)
SRV - [2011.08.03 04:20:34 | 000,580,416 | ---- | M] (Autodesk, Inc.) [Auto | Running] -- C:\Programme\Autodesk\Inventor 2012\Moldflow\bin\mitsijm.exe -- (mitsijm2012)
SRV - [2011.07.04 15:35:01 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.06.14 17:57:10 | 000,012,696 | ---- | M] (National Instruments Corporation) [Auto | Running] -- C:\Programme\National Instruments\MAX\nimxs.exe -- (mxssvr)
SRV - [2011.06.14 11:54:08 | 000,676,016 | ---- | M] (National Instruments Corporation) [Auto | Running] -- C:\Programme\National Instruments\Shared\Tagger\tagsrv.exe -- (NITaggerService)
SRV - [2011.06.14 09:11:10 | 000,362,104 | ---- | M] (National Instruments Corporation) [Auto | Running] -- C:\Programme\National Instruments\Shared\Security\nidmsrv.exe -- (NIDomainService)
SRV - [2011.06.14 09:08:24 | 000,056,952 | ---- | M] (National Instruments Corporation) [Auto | Running] -- C:\Windows\System32\lktsrv.exe -- (lkTimeSync)
SRV - [2011.06.14 09:00:10 | 000,046,192 | ---- | M] (National Instruments Corporation) [Auto | Running] -- C:\Windows\System32\lkads.exe -- (lkClassAds)
SRV - [2011.06.12 10:15:00 | 031,125,880 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft Office\Office14\GROOVE.EXE -- (Microsoft SharePoint Workspace Audit Service)
SRV - [2011.06.10 14:11:20 | 000,121,032 | ---- | M] (National Instruments Corporation) [Auto | Running] -- C:\Programme\National Instruments\Shared\NI Network Discovery\niDiscSvc.exe -- (NINetworkDiscovery)
SRV - [2011.06.01 16:32:14 | 000,194,224 | ---- | M] (National Instruments Corporation) [Auto | Running] -- C:\Programme\National Instruments\Shared\mDNS Responder\nimdnsResponder.exe -- (nimDNSResponder)
SRV - [2011.05.27 13:43:48 | 000,050,336 | ---- | M] (National Instruments Corporation) [Auto | Running] -- C:\Programme\National Instruments\Shared\NI WebServer\ApplicationWebServer.exe -- (NIApplicationWebServer)
SRV - [2011.03.28 15:15:04 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011.03.23 23:34:18 | 000,435,152 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Programme\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe -- (vpnagent)
SRV - [2010.11.20 13:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2010.10.27 09:43:38 | 000,695,136 | ---- | M] (National Instruments, Inc.) [Auto | Running] -- C:\Windows\System32\lkcitdl.exe -- (LkCitadelServer)
SRV - [2010.10.22 02:00:00 | 000,376,832 | R--- | M] (AVM Berlin) [Auto | Running] -- C:\Programme\avmwlanstick\WLanNetService.exe -- (AVM WLAN Connection Service)
SRV - [2010.08.02 10:00:00 | 001,427,688 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Programme\National Instruments\Shared\License Manager\Bin\lmgrd.exe -- (NILM License Manager)
SRV - [2010.01.09 20:37:50 | 004,640,000 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
SRV - [2010.01.09 20:18:00 | 000,149,352 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)
SRV - [2009.12.01 13:22:54 | 000,061,952 | ---- | M] (ASUSTeK COMPUTER INC.) [Auto | Running] -- C:\Windows\System32\ATKFUSService.exe -- (ATKFUSService)
SRV - [2009.11.18 06:45:26 | 000,172,032 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2009.07.27 10:13:28 | 000,061,440 | ---- | M] () [Auto | Running] -- C:\Windows\System32\ASDR.exe -- (ASDR)
SRV - [2009.07.14 02:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc)
SRV - [2009.07.14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 02:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009.07.14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009.06.03 10:26:34 | 000,098,304 | ---- | M] (OPC Foundation) [On_Demand | Stopped] -- C:\Windows\System32\Opcenum.exe -- (OpcEnum)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\motzer\AppData\Local\Temp\catchme.sys -- (catchme)
DRV - [2011.11.04 20:34:56 | 000,019,552 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\cvintdrv.sys -- (cvintdrv)
DRV - [2011.08.16 15:25:01 | 000,722,416 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\drivers\sptd.sys -- (sptd)
DRV - [2011.07.27 13:54:55 | 000,014,336 | ---- | M] (ASUSTeK Computer Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\EIO.sys -- (EIO)
DRV - [2011.07.20 08:46:04 | 000,181,432 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssudmdm.sys -- (ssudmdm) SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.)
DRV - [2011.07.20 08:46:04 | 000,077,624 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssudbus.sys -- (dg_ssudbus) SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.)
DRV - [2011.07.04 15:35:01 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2011.07.04 15:35:01 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011.06.29 13:49:48 | 000,011,968 | ---- | M] (National Instruments Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nipalfwedl.sys -- (nipalfwedl)
DRV - [2011.06.29 13:48:18 | 000,011,968 | ---- | M] (National Instruments Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nipalusbedl.sys -- (nipalusbedl)
DRV - [2011.06.29 13:41:00 | 000,584,856 | ---- | M] (National Instruments Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\nipalk.sys -- (NIPALK)
DRV - [2011.06.15 09:23:56 | 000,060,156 | ---- | M] (PowerISO Computing, Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\scdemu.sys -- (SCDEmu)
DRV - [2011.05.10 07:06:14 | 000,018,432 | ---- | M] (Apple Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\netaapl.sys -- (Netaapl)
DRV - [2011.03.23 23:25:38 | 000,019,680 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vpnva.sys -- (vpnva)
DRV - [2011.03.23 23:25:14 | 000,077,968 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\acsock.sys -- (acsock)
DRV - [2011.01.21 13:52:18 | 000,381,032 | ---- | M] (Paragon) [Kernel | System | Running] -- C:\Windows\System32\drivers\Uim_IM.sys -- (Uim_IM)
DRV - [2011.01.21 13:52:18 | 000,057,112 | ---- | M] (Paragon Software Group) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\hotcore3.sys -- (hotcore3)
DRV - [2011.01.21 13:52:18 | 000,040,824 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | System | Running] -- C:\Windows\System32\drivers\UimBus.sys -- (UimBus)
DRV - [2010.11.20 13:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2010.11.20 13:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010.11.20 13:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)
DRV - [2010.11.20 11:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010.11.20 10:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010.11.20 10:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010.11.20 10:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)
DRV - [2010.10.22 01:01:00 | 000,586,752 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\fwlanusbn.sys -- (fwlanusbn)
DRV - [2010.10.22 01:01:00 | 000,004,352 | ---- | M] (AVM Berlin) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\avmeject.sys -- (avmeject)
DRV - [2010.10.22 01:00:00 | 000,265,088 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\fwlanusb.sys -- (FWLANUSB)
DRV - [2010.09.02 08:18:48 | 000,017,920 | ---- | M] (Shrew Soft Inc) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\vfilter.sys -- (vflt)
DRV - [2010.09.02 08:18:48 | 000,013,824 | ---- | M] (Shrew Soft Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\virtualnet.sys -- (vnet)
DRV - [2010.08.31 11:43:36 | 000,195,968 | ---- | M] (Jungo) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\windrvr6.sys -- (WinDriver6)
DRV - [2010.06.17 14:27:02 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2010.03.24 12:27:44 | 000,015,448 | ---- | M] (National Instruments Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\nipbcfk.sys -- (nipbcfk)
DRV - [2009.12.08 20:24:26 | 000,048,128 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Programme\Microsoft Visual Studio 10.0\Team Tools\Performance Tools\VSPerfDrv100.sys -- (VSPerfDrv100)
DRV - [2009.11.18 07:20:34 | 005,140,480 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2009.10.08 12:41:46 | 000,063,488 | ---- | M] (Silicon Laboratories) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\silabser.sys -- (silabser)
DRV - [2009.10.08 12:41:46 | 000,017,920 | ---- | M] (Silicon Laboratories, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\silabenm.sys -- (silabenm)
DRV - [2009.07.14 00:45:33 | 000,083,456 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\serial.sys -- (Serial)
DRV - [2009.07.13 23:02:50 | 000,211,456 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express) Intel(R)
DRV - [2009.06.10 22:19:48 | 009,853,248 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2009.03.18 17:35:40 | 000,026,176 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\hamachi.sys -- (hamachi)
DRV - [2009.03.02 13:12:10 | 000,038,400 | ---- | M] (Samsung Electronics Co., Ltd.) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\DGIVECP.SYS -- (DgiVecp)
DRV - [2009.03.02 13:12:10 | 000,005,120 | ---- | M] (Samsung Electronics) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\SSPORT.SYS -- (SSPORT)
DRV - [2009.02.17 17:22:14 | 000,030,976 | ---- | M] (ASUSTeK Computer Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ATKDispLowFilter.sys -- (atkdisplf)
DRV - [2009.02.17 17:22:14 | 000,015,232 | ---- | M] (ASUSTeK Computer Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\asusgsb.sys -- (asusgsb)
DRV - [2008.11.16 17:39:44 | 000,131,984 | ---- | M] (Deterministic Networks, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\dne2000.sys -- (DNE)
DRV - [2008.10.27 13:57:28 | 000,077,824 | ---- | M] (Prolific Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ser2pl.sys -- (Ser2pl)
DRV - [2007.01.18 19:28:02 | 000,005,275 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\CVirtA.sys -- (CVirtA)
DRV - [2005.03.30 10:12:38 | 000,014,544 | ---- | M] (EnTech Taiwan) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TVicPort.sys -- (TVicPort)
DRV - [2002.05.22 00:00:00 | 000,069,600 | ---- | M] (Engelmann GmbH) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\precsim.sys -- (PrecSim)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 8C AA F3 5C 76 A0 CC 01  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = fritz.box;*.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Search the web"
FF - prefs.js..browser.search.order.1: "Search the web"
FF - prefs.js..browser.search.selectedEngine: "Search the web"
FF - prefs.js..keyword.URL: "hxxp://www.browsersafesearch.com?client=mozilla-firefox&cd=UTF-8&search=1&q="
 
FF - user.js..browser.search.selectedEngine: "Search the web"
FF - user.js..browser.search.order.1: "Search the web"
FF - user.js..browser.search.defaultenginename: "Search the web"
FF - user.js..keyword.URL: "hxxp://www.browsersafesearch.com?client=mozilla-firefox&cd=UTF-8&search=1&q="
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Acrobat: C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\web2pdfextension@web2pdf.adobedotcom: C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2012.02.02 14:46:30 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{184AA5E6-741D-464a-820E-94B3ABC2F3B4}: C:\Users\motzer\AppData\Roaming\07016
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.10.05 13:21:56 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.03.12 00:44:29 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 10.0.2\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2011.08.17 19:31:51 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 10.0.2\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\extensions\\{184AA5E6-741D-464a-820E-94B3ABC2F3B4}: C:\Users\motzer\AppData\Roaming\07016
 
[2011.05.25 15:51:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\motzer\AppData\Roaming\mozilla\Extensions
[2011.05.25 15:51:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\motzer\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012.01.09 18:13:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\motzer\AppData\Roaming\mozilla\Firefox\Profiles\vcob6byz.default\extensions
[2012.01.09 18:13:19 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\motzer\AppData\Roaming\mozilla\Firefox\Profiles\vcob6byz.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2012.01.25 15:34:29 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.01.25 15:34:29 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2011.11.07 14:32:02 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}
[2012.02.02 14:46:30 | 000,000,000 | ---D | M] (Adobe Acrobat - Create PDF) -- C:\PROGRAM FILES\ADOBE\ACROBAT 10.0\ACROBAT\BROWSER\WCFIREFOXEXTN
[2012.01.25 15:34:29 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2011.09.29 08:09:51 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011.06.22 11:43:54 | 000,026,112 | ---- | M] (National Instruments) -- C:\Program Files\mozilla firefox\plugins\nplv2011win32.dll
[2011.05.12 10:00:46 | 000,025,088 | ---- | M] (National Instruments) -- C:\Program Files\mozilla firefox\plugins\nplv90win32.dll
[2011.09.29 02:24:37 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.09.29 02:16:42 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011.09.29 02:24:37 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011.09.29 02:24:37 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.10.10 20:07:03 | 000,000,158 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\Search the web.src
[2011.09.29 02:24:37 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.09.29 02:24:37 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2012.03.19 20:13:41 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Microsoft-Webtestaufzeichnung 10.0-Hilfsprogramm) - {DDA57003-0068-4ed2-9D32-4D1EC707D94D} - C:\Programme\Microsoft Visual Studio 10.0\Common7\IDE\PrivateAssemblies\Microsoft.VisualStudio.QualityTools.RecorderBarBHO100.dll (Microsoft Corporation)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [AVMWlanClient] C:\Programme\avmwlanstick\WLanGUI.exe (AVM Berlin)
O4 - HKLM..\Run: [BCSSync] C:\Program Files\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NI Update Service] C:\Program Files\National Instruments\Shared\Update Service\NIUpdateService.exe (National Instruments)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [SunServer] C:\Programme\Sunbelt Software\CounterSpy\Consumer\SunServer.exe (Sunbelt Software)
O4 - HKCU..\Run: [NIRegistrationWizard] C:\Program Files\National Instruments\Shared\RegistrationWizard\Bin\RegistrationWizard.exe ()
O4 - Startup: C:\Users\motzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\motzer\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 91 00 00 00  [binary data]
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: An OneNote s&enden - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Free YouTube Download - C:\Users\motzer\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\motzer\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Programme\ICQ7.6\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Programme\ICQ7.6\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Programme\National Instruments\Shared\mDNS Responder\nimdnsNSP.dll (National Instruments Corporation)
O15 - HKCU\..Trusted Domains: fritz.box ([]* in Lokales Intranet)
O15 - HKCU\..Trusted Ranges: Range1 ([*] in Lokales Intranet)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{56B65BB0-AA21-4A1A-AB7C-8CB9593B7B3A}: DhcpNameServer = 212.23.97.3 212.23.97.2
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B1290DBB-9D3F-427B-97EB-CCA008AD719C}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011.10.25 22:23:56 | 000,000,000 | ---D | M] - C:\Autodesk -- [ NTFS ]
O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2011.04.12 03:37:58 | 000,000,043 | R--- | M] () - M:\autorun.inf -- [ UDF ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {31FC3F49-B603-2BBB-4B72-952B41E98BF5} - .NET Framework
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4A714DA3-0F91-9CB5-4DC4-734E0F9FEEAA} - Java (Sun)
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5EA97B4D-0579-EC62-737C-AA2958CBE6F2} - .NET Framework
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {8B1EC444-50ED-44BB-FA40-18FE57D31FAD} - Browser Customizations
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {9605F371-7183-4BD8-B48E-E1B099CA0DB3} - Microsoft Windows Media Player
ActiveX: {A017B03A-758D-6277-904B-8ED91E5E4F84} - Browser Customizations
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: rbfilter -  File not found
NetSvcs: SNC -  File not found
NetSvcs: cmuda -  File not found
NetSvcs: ntservice1 -  File not found
NetSvcs: mcontrol -  File not found
NetSvcs: vmm -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.03.19 20:23:32 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2012.03.19 20:14:05 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2012.03.19 20:12:17 | 000,000,000 | ---D | C] -- C:\Users\motzer\AppData\Local\temp
[2012.03.19 19:31:32 | 000,000,000 | ---D | C] -- C:\ComboFix
[2012.03.19 19:25:51 | 000,000,000 | ---D | C] -- C:\_OTL
[2012.03.18 23:34:36 | 000,594,432 | ---- | C] (OldTimer Tools) -- C:\Users\motzer\Desktop\OTL.exe
[2012.03.18 21:22:53 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2012.03.18 21:22:53 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2012.03.18 21:22:53 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012.03.18 21:21:57 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012.03.18 21:20:33 | 004,438,697 | R--- | C] (Swearware) -- C:\Users\motzer\Desktop\ComboFix.exe
[2012.03.15 20:35:42 | 004,731,392 | ---- | C] (AVAST Software) -- C:\Users\motzer\Desktop\aswMBR.exe
[2012.03.15 20:35:31 | 002,063,920 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\motzer\Desktop\tdsskiller.exe
[2012.03.15 19:31:09 | 000,078,336 | ---- | C] (AVM Berlin) -- C:\Windows\System32\fwusbnci.org
[2012.03.15 19:31:09 | 000,074,240 | ---- | C] (AVM Berlin) -- C:\Windows\System32\fwlanci.org
[2012.03.14 21:50:19 | 000,000,000 | ---D | C] -- C:\Windows\System32\SPReview
[2012.03.14 21:49:12 | 000,000,000 | ---D | C] -- C:\Windows\System32\EventProviders
[2012.03.14 01:02:16 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2012.03.13 21:58:43 | 000,000,000 | ---D | C] -- C:\FRST
[2012.03.13 19:12:58 | 000,026,176 | -H-- | C] (LogMeIn, Inc.) -- C:\Windows\System32\hamachi.sys
[2012.03.13 19:12:47 | 000,000,000 | ---D | C] -- C:\Users\motzer\AppData\Local\LogMeIn Hamachi
[2012.03.13 19:07:34 | 000,000,000 | ---D | C] -- C:\Users\motzer\Documents\Shrew Soft VPN
[2012.03.13 19:07:33 | 000,000,000 | ---D | C] -- C:\Program Files\ShrewSoft
[2012.03.13 01:05:18 | 000,000,000 | ---D | C] -- C:\Windows\System32\Shared Memory
[2012.03.12 21:38:34 | 000,388,608 | ---- | C] (Trend Micro Inc.) -- C:\Users\motzer\Desktop\HiJackThis204.exe
[2012.03.12 21:33:54 | 000,000,000 | ---D | C] -- C:\Users\motzer\AppData\Roaming\Malwarebytes
[2012.03.12 21:33:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.03.12 21:33:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.03.12 21:33:34 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.03.12 21:33:34 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.03.12 21:28:02 | 009,502,424 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\motzer\Desktop\mbam-setup-1.60.1.1000.exe
[2012.03.12 21:11:18 | 000,000,000 | ---D | C] -- C:\Users\motzer\AppData\Local\Sunbelt Software
[2012.03.12 21:10:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sunbelt Software
[2012.03.12 21:10:34 | 000,000,000 | ---D | C] -- C:\Program Files\Sunbelt Software
[2012.03.12 21:07:36 | 000,000,000 | ---D | C] -- C:\Windows\Downloaded Installations
[2012.03.12 00:43:25 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\National Instruments
[2012.03.12 00:15:23 | 000,000,000 | ---D | C] -- C:\Users\motzer\Documents\LabVIEW Data
[2012.03.11 23:59:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\National Instruments
[2012.03.11 23:58:41 | 000,000,000 | ---D | C] -- C:\Windows\System32\cvirte
[2012.03.11 23:58:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
[2012.03.11 23:57:44 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight
[2012.03.11 23:56:21 | 000,000,000 | ---D | C] -- C:\Program Files\National Instruments
[2012.03.11 23:53:49 | 000,000,000 | ---D | C] -- C:\ProgramData\National Instruments
[2012.03.11 23:51:01 | 000,000,000 | ---D | C] -- C:\National Instruments Downloads
[2012.02.26 22:31:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maxima-5.26.0
[2012.02.26 22:31:24 | 000,000,000 | ---D | C] -- C:\Program Files\Maxima-5.26.0
 
========== Files - Modified Within 30 Days ==========
 
[2012.03.20 16:35:03 | 000,022,064 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.03.20 16:35:03 | 000,022,064 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.03.20 16:25:55 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.03.20 16:25:48 | 1609,175,040 | -HS- | M] () -- C:\hiberfil.sys
[2012.03.19 20:13:41 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2012.03.19 19:38:51 | 000,222,126 | ---- | M] () -- C:\Users\motzer\Desktop\fixi.png
[2012.03.19 19:25:20 | 000,261,943 | ---- | M] () -- C:\Users\motzer\Desktop\anweisung.png
[2012.03.19 19:20:00 | 000,000,016 | ---- | M] () -- C:\Users\motzer\AppData\Roaming\blckdom.res
[2012.03.18 23:34:36 | 000,594,432 | ---- | M] (OldTimer Tools) -- C:\Users\motzer\Desktop\OTL.exe
[2012.03.18 22:48:48 | 000,007,595 | ---- | M] () -- C:\Users\motzer\AppData\Local\Resmon.ResmonCfg
[2012.03.18 21:20:36 | 004,438,697 | R--- | M] (Swearware) -- C:\Users\motzer\Desktop\ComboFix.exe
[2012.03.17 20:45:49 | 000,302,592 | ---- | M] () -- C:\Users\motzer\Desktop\eu0cksk6.exe
[2012.03.16 22:13:02 | 000,000,272 | ---- | M] () -- C:\Users\motzer\AppData\Roaming\.backup.dm
[2012.03.16 22:03:31 | 000,696,620 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.03.16 22:03:31 | 000,651,938 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.03.16 22:03:31 | 000,147,916 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.03.16 22:03:31 | 000,120,870 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.03.15 20:35:52 | 004,731,392 | ---- | M] (AVAST Software) -- C:\Users\motzer\Desktop\aswMBR.exe
[2012.03.15 20:35:33 | 002,063,920 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\motzer\Desktop\tdsskiller.exe
[2012.03.15 19:19:00 | 000,019,914 | ---- | M] () -- C:\Users\motzer\Desktop\Wlan.png
[2012.03.15 18:45:04 | 000,544,032 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.03.14 21:41:45 | 000,095,045 | ---- | M] () -- C:\Users\motzer\Desktop\Resourcen.png
[2012.03.14 21:37:36 | 000,019,004 | ---- | M] () -- C:\Users\motzer\Desktop\Combofix_2.png
[2012.03.14 21:27:05 | 000,034,130 | ---- | M] () -- C:\Users\motzer\Desktop\Combofix.png
[2012.03.13 21:31:59 | 2509,058,048 | ---- | M] () -- C:\Users\motzer\Desktop\X17-59886.iso
[2012.03.13 20:25:48 | 000,001,594 | ---- | M] () -- C:\Windows\VPNUnInstall.MIF
[2012.03.13 19:19:03 | 000,001,594 | ---- | M] () -- C:\Windows\VPNInstall.MIF
[2012.03.12 21:38:35 | 000,388,608 | ---- | M] (Trend Micro Inc.) -- C:\Users\motzer\Desktop\HiJackThis204.exe
[2012.03.12 21:33:40 | 000,001,071 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.03.12 21:28:07 | 009,502,424 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\motzer\Desktop\mbam-setup-1.60.1.1000.exe
[2012.03.12 21:20:32 | 012,410,880 | ---- | M] () -- C:\Users\motzer\Desktop\Ad-Aware96Install.msi
[2012.03.12 21:12:27 | 000,051,570 | ---- | M] () -- C:\Users\motzer\Documents\cc_20120312_211211.reg
[2012.03.12 21:10:37 | 000,002,135 | ---- | M] () -- C:\Users\Public\Desktop\CounterSpy.lnk
[2012.03.12 00:02:59 | 000,001,039 | ---- | M] () -- C:\Users\motzer\Desktop\National Instruments LabVIEW 2011.lnk
[2012.03.12 00:01:21 | 000,001,193 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\NI Error Reporting.lnk
[2012.02.28 00:43:39 | 000,000,997 | ---- | M] () -- C:\Users\motzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2012.02.24 02:32:51 | 000,072,822 | ---- | M] () -- C:\Windows\System32\ieuinit.inf
 
========== Files Created - No Company Name ==========
 
[2012.03.19 19:38:50 | 000,222,126 | ---- | C] () -- C:\Users\motzer\Desktop\fixi.png
[2012.03.19 19:25:19 | 000,261,943 | ---- | C] () -- C:\Users\motzer\Desktop\anweisung.png
[2012.03.18 21:22:53 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012.03.18 21:22:53 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012.03.18 21:22:53 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012.03.18 21:22:53 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012.03.18 21:22:53 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012.03.17 20:45:49 | 000,302,592 | ---- | C] () -- C:\Users\motzer\Desktop\eu0cksk6.exe
[2012.03.16 22:13:02 | 000,000,272 | ---- | C] () -- C:\Users\motzer\AppData\Roaming\.backup.dm
[2012.03.16 22:04:20 | 000,000,016 | ---- | C] () -- C:\Users\motzer\AppData\Roaming\blckdom.res
[2012.03.15 19:19:00 | 000,019,914 | ---- | C] () -- C:\Users\motzer\Desktop\Wlan.png
[2012.03.14 21:41:45 | 000,095,045 | ---- | C] () -- C:\Users\motzer\Desktop\Resourcen.png
[2012.03.14 21:37:36 | 000,019,004 | ---- | C] () -- C:\Users\motzer\Desktop\Combofix_2.png
[2012.03.14 21:30:41 | 000,007,595 | ---- | C] () -- C:\Users\motzer\AppData\Local\Resmon.ResmonCfg
[2012.03.14 21:27:05 | 000,034,130 | ---- | C] () -- C:\Users\motzer\Desktop\Combofix.png
[2012.03.13 20:36:17 | 2509,058,048 | ---- | C] () -- C:\Users\motzer\Desktop\X17-59886.iso
[2012.03.13 19:15:06 | 000,001,594 | ---- | C] () -- C:\Windows\VPNUnInstall.MIF
[2012.03.12 21:33:40 | 000,001,071 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.03.12 21:19:57 | 012,410,880 | ---- | C] () -- C:\Users\motzer\Desktop\Ad-Aware96Install.msi
[2012.03.12 21:12:17 | 000,051,570 | ---- | C] () -- C:\Users\motzer\Documents\cc_20120312_211211.reg
[2012.03.12 21:10:37 | 000,002,135 | ---- | C] () -- C:\Users\Public\Desktop\CounterSpy.lnk
[2012.03.12 00:02:59 | 000,001,039 | ---- | C] () -- C:\Users\motzer\Desktop\National Instruments LabVIEW 2011.lnk
[2012.03.12 00:01:21 | 000,001,193 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\NI Error Reporting.lnk
[2012.02.24 02:32:51 | 000,072,822 | ---- | C] () -- C:\Windows\System32\ieuinit.inf
[2012.01.23 20:53:52 | 000,000,798 | ---- | C] () -- C:\Windows\Ulead32.ini
[2011.11.04 20:34:56 | 000,019,552 | ---- | C] () -- C:\Windows\System32\drivers\cvintdrv.sys
[2011.10.27 13:25:41 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2011.10.18 12:54:48 | 000,034,308 | ---- | C] () -- C:\Windows\System32\bassmod.dll
[2011.08.23 12:32:09 | 000,015,565 | ---- | C] () -- C:\Windows\System32\drivers\fwlanusbn.bin
[2011.07.28 01:21:19 | 000,004,608 | ---- | C] () -- C:\Users\motzer\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.07.28 01:16:54 | 000,237,568 | ---- | C] () -- C:\Windows\System32\lame_enc.dll
[2011.07.27 13:56:11 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2011.07.27 13:54:39 | 000,053,248 | ---- | C] () -- C:\Windows\System32\asrussian.dll
[2011.07.27 13:54:39 | 000,053,248 | ---- | C] () -- C:\Windows\System32\askorean.dll
[2011.07.27 13:54:39 | 000,053,248 | ---- | C] () -- C:\Windows\System32\asjapan.dll
[2011.07.27 13:54:39 | 000,053,248 | ---- | C] () -- C:\Windows\System32\asgerman.dll
[2011.07.27 13:54:39 | 000,053,248 | ---- | C] () -- C:\Windows\System32\asfrench.dll
[2011.07.27 13:54:39 | 000,053,248 | ---- | C] () -- C:\Windows\System32\aseng.dll
[2011.07.27 13:54:39 | 000,053,248 | ---- | C] () -- C:\Windows\System32\ASCHT.dll
[2011.07.27 13:54:39 | 000,053,248 | ---- | C] () -- C:\Windows\System32\aschs.dll
[2011.07.27 13:54:38 | 000,761,856 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2011.07.27 13:54:38 | 000,180,224 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2011.07.26 16:26:46 | 000,974,848 | ---- | C] () -- C:\Windows\System32\cis-2.4.dll
[2011.07.26 16:26:46 | 000,081,920 | ---- | C] () -- C:\Windows\System32\issacapi_bs-2.3.dll
[2011.07.26 16:26:46 | 000,065,536 | ---- | C] () -- C:\Windows\System32\issacapi_pe-2.3.dll
[2011.07.26 16:26:46 | 000,057,344 | ---- | C] () -- C:\Windows\System32\issacapi_se-2.3.dll
[2011.06.30 13:00:08 | 000,022,723 | ---- | C] () -- C:\Windows\System32\SUGG1l3.DLL
[2011.06.10 13:52:52 | 000,000,244 | ---- | C] () -- C:\Windows\System32\nirpc.ini
[2011.05.26 23:10:55 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat
[2011.05.25 17:55:20 | 000,000,303 | ---- | C] () -- C:\Users\motzer\AppData\Roaming\myAVR_WorkpadPLUS_Demo.cfg
[2011.05.25 17:55:20 | 000,000,000 | ---- | C] () -- C:\ProgramData\myAVR_WorkpadPLUS_Demo.cfg
[2011.05.25 17:49:50 | 000,000,431 | ---- | C] () -- C:\Users\motzer\AppData\Roaming\myAVR_ProgTool.cfg
[2011.05.25 16:42:25 | 000,017,408 | ---- | C] () -- C:\Users\motzer\AppData\Local\WebpageIcons.db
[2011.05.25 15:51:29 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2010.10.22 01:00:00 | 000,097,360 | ---- | C] () -- C:\Windows\System32\drivers\Fwusb1b.bin
 
========== LOP Check ==========
 
[2011.06.21 12:23:23 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\Amazon
[2011.05.25 17:43:53 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\Atmel
[2011.11.29 20:37:45 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\Autodesk
[2011.10.27 17:32:20 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\CADClick
[2011.09.12 18:34:11 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\Das Fussball Studio
[2012.03.20 16:27:56 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\Dropbox
[2012.01.09 18:15:58 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\DVDVideoSoft
[2012.01.09 18:15:53 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\DVDVideoSoftIEHelpers
[2011.06.21 10:51:15 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\go
[2012.03.02 21:02:37 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\ICQ
[2011.09.22 00:15:44 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\ImgBurn
[2011.09.15 16:23:07 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\IrfanView
[2011.09.15 16:13:04 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\MAGIX
[2011.05.25 20:07:34 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\MCS Electronics
[2011.07.05 23:24:23 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\mkvtoolnix
[2011.06.23 14:51:05 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\OpenOffice.org
[2011.05.25 15:07:10 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\Opera
[2011.08.22 12:42:48 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\Samsung
[2011.07.07 18:44:23 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\TeamViewer
[2011.05.25 15:51:29 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\Thunderbird
[2012.01.12 13:25:07 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\toolplugin
[2012.03.12 21:07:41 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\TS3Client
[2011.08.16 22:20:40 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\Unified Remote
[2011.05.25 21:02:49 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\VisualAssist
[2011.06.24 17:54:31 | 000,000,000 | ---D | M] -- C:\Users\motzer\AppData\Roaming\X-Chat 2
[2011.11.14 15:36:33 | 000,032,630 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %SYSTEMDRIVE%\*. >
[2012.03.19 20:14:05 | 000,000,000 | -HSD | M] -- C:\$RECYCLE.BIN
[2011.07.25 13:22:33 | 000,000,000 | ---D | M] -- C:\AdobeAcrobat
[2011.10.25 22:23:56 | 000,000,000 | ---D | M] -- C:\Autodesk
[2012.03.15 18:50:02 | 000,000,000 | ---D | M] -- C:\Boot
[2012.03.19 20:23:32 | 000,000,000 | ---D | M] -- C:\ComboFix
[2009.07.14 05:53:55 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2011.05.25 12:47:22 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2012.03.16 21:57:02 | 000,000,000 | ---D | M] -- C:\FRST
[2011.10.24 15:32:32 | 000,000,000 | ---D | M] -- C:\Inventor
[2011.10.10 23:22:42 | 000,000,000 | ---D | M] -- C:\MITSI 2012 Temporary Files
[2011.10.25 13:43:05 | 000,000,000 | R--D | M] -- C:\MSOCache
[2012.03.12 00:42:15 | 000,000,000 | ---D | M] -- C:\National Instruments Downloads
[2009.07.14 03:37:05 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2012.03.13 20:27:31 | 000,000,000 | R--D | M] -- C:\Program Files
[2012.03.19 19:25:52 | 000,000,000 | ---D | M] -- C:\ProgramData
[2011.05.25 12:47:22 | 000,000,000 | -HSD | M] -- C:\Programme
[2011.11.21 18:16:00 | 000,000,000 | ---D | M] -- C:\Python24
[2012.03.19 20:23:31 | 000,000,000 | ---D | M] -- C:\Qoobox
[2011.05.25 12:47:23 | 000,000,000 | ---D | M] -- C:\Recovery
[2011.05.25 21:00:45 | 000,000,000 | ---D | M] -- C:\SiLabs
[2011.07.06 21:41:49 | 000,000,000 | ---D | M] -- C:\stick
[2012.03.20 16:53:21 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2011.06.30 12:59:54 | 000,000,000 | ---D | M] -- C:\Temp
[2011.05.25 12:47:32 | 000,000,000 | R--D | M] -- C:\Users
[2012.03.19 20:23:32 | 000,000,000 | ---D | M] -- C:\Windows
[2012.03.19 19:25:51 | 000,000,000 | ---D | M] -- C:\_OTL
 
< %PROGRAMFILES%\*.exe >
 
< %LOCALAPPDATA%\*.exe >
 
< %systemroot%\*. /mp /s >
 
< MD5 for: EXPLORER.EXE  >
[2011.02.26 06:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_54149f9ef14031fc\explorer.exe
[2009.07.14 02:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_518afd35db100430\explorer.exe
[2011.02.26 06:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_525b5180f3f95373\explorer.exe
[2009.10.31 06:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_51a66d6ddafc2ed1\explorer.exe
[2011.02.26 06:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_51a3a583dafd0cef\explorer.exe
[2010.11.20 13:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_53bc10fdd7fe87ca\explorer.exe
[2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\ERDNT\cache\explorer.exe
[2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\explorer.exe
[2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_5389023fd8245f84\explorer.exe
[2009.08.03 06:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_526619d4f3f142e6\explorer.exe
[2009.08.03 06:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_51e07e31dad00878\explorer.exe
[2009.10.31 07:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_52283b2af41f3691\explorer.exe
 
< MD5 for: REGEDIT.EXE  >
[2009.07.14 02:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\ERDNT\cache\regedit.exe
[2009.07.14 02:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\regedit.exe
[2009.07.14 02:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\winsxs\x86_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_f4050b883d2c3c08\regedit.exe
 
< MD5 for: USERINIT.EXE  >
[2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\ERDNT\cache\userinit.exe
[2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\System32\userinit.exe
[2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\ERDNT\cache\wininit.exe
[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\System32\wininit.exe
[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.10.28 07:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe
[2009.10.28 06:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe
[2012.01.13 14:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2010.11.20 13:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\ERDNT\cache\winlogon.exe
[2010.11.20 13:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\System32\winlogon.exe
[2010.11.20 13:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe
[2009.07.14 02:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe
 
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2012-03-16 01:35:06
 
<          >

< End of report >
Extra.txt wurde diesmal nicht erstellt oder ich finde sie nicht.

mfg
motzer

Psychotic 21.03.2012 23:57
Schritt 1: Fix mit OTL

Code:
:OTL
FF - prefs.js..browser.search.defaultenginename: "Search the web"
FF - prefs.js..browser.search.order.1: "Search the web"
FF - prefs.js..browser.search.selectedEngine: "Search the web"
FF - prefs.js..keyword.URL: "hxxp://www.browsersafesearch.com?client=mozilla-firefox&cd=UTF-8&search=1&q="
FF - user.js..browser.search.selectedEngine: "Search the web"
FF - user.js..browser.search.order.1: "Search the web"
FF - user.js..browser.search.defaultenginename: "Search the web"
FF - user.js..keyword.URL: "hxxp://www.browsersafesearch.com?client=mozilla-firefox&cd=UTF-8&search=1&q="
[2011.10.10 20:07:03 | 000,000,158 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\Search the web.src
NetSvcs: rbfilter -  File not found
NetSvcs: SNC -  File not found
NetSvcs: cmuda -  File not found
NetSvcs: ntservice1 -  File not found
NetSvcs: mcontrol -  File not found
NetSvcs: vmm -  File not found
[2012.03.19 19:20:00 | 000,000,016 | ---- | M] () -- C:\Users\motzer\AppData\Roaming\blckdom.res
:COMMANDS
[emptytemp]
  • Schliesse bitte nun alle Programme.
  • Klicke nun bitte auf den Fix Button.
  • OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
  • Nach dem Neustart findest Du ein Textdokument auf deinem Desktop.
    ( Auch zu finden unter C:\_OTL\MovedFiles\<time_date>.txt)
    Kopiere nun den Inhalt hier in Deinen Thread


Schritt 2: MBAM vollständig



Downloade Dir bitte Malwarebytes
  • Installiere das Programm in den vorgegebenen Pfad.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Starte Malwarebytes, klicke auf Aktualisierung --> Suche nach Aktualisierung
  • Wenn das Update beendet wurde, aktiviere Vollständigen Scan durchführen und drücke auf Scannen.(Hinweis: Alle Festplatten anhaken!
  • Wenn der Scan beendet ist, klicke auf Ergebnisse anzeigen.
  • Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
  • Poste das Logfile, welches sich in Notepad öffnet, hier in den Thread.
  • Nachträglich kannst du den Bericht unter "Log Dateien" finden.

motzerrobo 23.03.2012 21:13
OTL File

Code:
All processes killed
========== OTL ==========
Prefs.js: "Search the web" removed from browser.search.defaultenginename
Prefs.js: "Search the web" removed from browser.search.order.1
Prefs.js: "Search the web" removed from browser.search.selectedEngine
Prefs.js: "hxxp://www.browsersafesearch.com?client=mozilla-firefox&cd=UTF-8&search=1&q=" removed from keyword.URL
C:\Users\motzer\AppData\Roaming\Mozilla\FireFox\Profiles\vcob6byz.default\user.js moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\Search the web.src moved successfully.
rbfilter removed from NetSvcs value successfully!
SNC removed from NetSvcs value successfully!
cmuda removed from NetSvcs value successfully!
ntservice1 removed from NetSvcs value successfully!
mcontrol removed from NetSvcs value successfully!
vmm removed from NetSvcs value successfully!
C:\Users\motzer\AppData\Roaming\blckdom.res moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: motzer
->Temp folder emptied: 216889 bytes
->Temporary Internet Files folder emptied: 263072 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Opera cache emptied: 21350763 bytes
->Flash cache emptied: 1182 bytes
 
User: Public
->Temp folder emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 2432 bytes
RecycleBin emptied: 3710096265 bytes
 
Total Files Cleaned = 3.559,00 mb
 
 
OTL by OldTimer - Version 3.2.39.1 log created on 03222012_000129

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

Malware
Code:
Malwarebytes Anti-Malware 1.60.1.1000
www.malwarebytes.org

Datenbank Version: v2012.03.20.07

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
motzer :: STEEL [Administrator]

23.03.2012 19:01:08
mbam-log-2012-03-23 (21-06-15).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 647468
Laufzeit: 2 Stunde(n), 4 Minute(n), 33 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{975670D0-7EFB-4fa8-90FA-3AE575B9FB77} (Trojan.Banker) -> Keine Aktion durchgeführt.

Infizierte Registrierungswerte: 4
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|gema. (Trojan.Ransom.ICL) -> Daten: C:\ProgramData\gema\gema.exe -> Keine Aktion durchgeführt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|gema (Trojan.Ransom.ICL) -> Daten: C:\Users\motzer\AppData\Roaming\gema\gema.exe -> Keine Aktion durchgeführt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|gema (Trojan.Ransom) -> Daten: C:\Windows\system32\gema.exe -> Keine Aktion durchgeführt.
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon|shell (Trojan.Ransom.ICL) -> Daten: C:\Users\motzer\AppData\Roaming\gema\gema.exe,Explorer.exe, -> Keine Aktion durchgeführt.

Infizierte Dateiobjekte der Registrierung: 3
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon|Userinit (Trojan.Ransom.ICL) -> Bösartig: (C:\ProgramData\gema\gema.exe) Gut: () -> Keine Aktion durchgeführt.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon|Userinit (Trojan.Ransom) -> Bösartig: (C:\Windows\system32\gema.exe) Gut: () -> Keine Aktion durchgeführt.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon|Userinit (Hijack.UserInit) -> Bösartig: (C:\ProgramData\gema\gema.exe,C:\Windows\system32\gema.exe,C:\Windows\system32\userinit.exe,) Gut: (userinit.exe) -> Keine Aktion durchgeführt.

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 7
C:\Qoobox\Quarantine\C\Users\motzer\AppData\Roaming\AcroIEHelpe.dll.vir (Trojan.Banker.H) -> Keine Aktion durchgeführt.
C:\_OTL\MovedFiles\03192012_192551\C_ProgramData\gema\gema.exe (Trojan.Agent.H) -> Keine Aktion durchgeführt.
C:\_OTL\MovedFiles\03192012_192551\C_Users\motzer\AppData\Roaming\gema\gema.exe (Trojan.Agent.H) -> Keine Aktion durchgeführt.
C:\_OTL\MovedFiles\03192012_192551\C_Windows\System32\gema.exe (Trojan.Agent.H) -> Keine Aktion durchgeführt.
C:\ProgramData\gema\gema.exe (Trojan.Ransom.ICL) -> Keine Aktion durchgeführt.
C:\Users\motzer\AppData\Roaming\gema\gema.exe (Trojan.Ransom.ICL) -> Keine Aktion durchgeführt.
C:\Windows\System32\gema.exe (Trojan.Ransom) -> Keine Aktion durchgeführt.

(Ende)

mfg motzer

Psychotic 25.03.2012 10:04
Schritt 1: MBAM-Funde entfernen


Die Funde von MBAM müssen entfernt werden! Scanne erneut vollständig und klicke nach Abschluß auf "Entferne Auswahl".



Schritt 2: ESET



ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset



Hallo, benötigst Du noch weiterhin Hilfe ? Sollte ich innerhalb der nächsten 24 Stunden keine Antwort von dir erhalten, werde ich dein Thema aus meinen Abos nehmen und bekomme dadurch keine Nachricht über neue Antworten. Das Verschwinden der Symptome bedeutet nicht, dass dein System schon sauber ist

motzerrobo 26.03.2012 00:26
Hey Marius tut mir leid war das Wochenede nicht zu Hause.

Also Malware scan erneut durchgeführt und alles entfernt und hier die ESET File

[code]
C:\Documents and Settings\motzer\AppData\Local\temp\mor.exe Win32/Injector.PKD trojan
C:\Users\motzer\AppData\Local\temp\mor.exe Win32/Injector.PKD trojan
C:\_OTL\MovedFiles\03192012_192551\C_Users\motzer\AppData\Roaming\appconf32.exe a variant of Win32/Kryptik.ACVS trojan
C:\_OTL\MovedFiles\03192012_192551\C_Users\motzer\AppData\Roaming\07016\components\AcroFF.dll probably a variant of Win32/Spy.Banker.WZJ trojan
[/code}

mfg motzer

Psychotic 26.03.2012 08:13
Schritt 1: Adobe Flash Player update


Dein Flash-Player ist veraltet. Da gerade diese Software gerne von Schädlingen als Sprungbrett ins System genutzt wird, muss sie immer aktuell gehalten werden.
Um den Flash Player zu aktualisieren, gehe bitte wie folgt vor:
  • Lade dir den aktuellen Adobe Flash Player von hier herunter. Wichtig: Entferne den Haken für optionale Software (z.B. Google Chrome), der auf der Seite angezeigt wird, bevor du auf "Jetzt herunterladen" klickst.
  • Starte das Setup und folge den Anweisungen auf dem Bildschirm.
  • Melde dich umgehend, falls Schwierigkeiten auftreten.



Schritt 2: Java update


Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.
  • Downloade dir bitte die neueste Java-Version von hier
  • Speichere die jxpiinstall.exe
  • Schließe alle laufenden Programme. Speziell deinen Browser.
  • Starte die jxpiinstall.exe. Diese wird den Installer für die neueste Java Version ( Java 6 Update 30 ) herunter laden.
  • Wenn die installation beendet wurde
    Start --> Systemsteuerung --> Programme und deinstalliere alle älteren Java Versionen.
  • Starte deinen Rechner neu sobald alle älteren Versionen deinstalliert wurden.
Nach dem Neustart
  • Öffne erneut die Systemsteuerung --> Programme und klicke auf das Java Symbol.
  • Im Reiter Allgemein, klicke unter Temporäre Internetdateien auf Einstellungen.
  • Klicke auf Dateien löschen....
  • Gehe sicher das überall ein Hacken gesetzt ist und klicke OK.
  • Klicke erneut OK.



Schritt 3: Mozilla Firefox update

Dein Firefox-Browser ist veraltet. Gehe wie folgt vor, um ihn zu aktualisieren:
  • Lade dir den aktuellen Firefox von hier herunter.
  • Starte das Setup und folge den Anweisungen auf dem Bildschirm.
  • Drücke die Windows- und die R-Taste, gib im folgenden Fenster appwiz.cpl ein und klicke auf OK.
  • Entferne alle älteren Firefox-Versionen.
  • Melde dich umgehend, falls Schwierigkeiten auftreten.



Schritt 4: VLC-Player update


Dein VLC-Player ist veraltet. Um ihn zu aktualisieren, gehe bitte wie folgt vor:
  • Lade dir den aktuellen Player von hier]VLC media player - Browse Files at SourceForge.net herunter.
  • Starte das Setup und folge den Anweisungen auf dem Bildschrim. Setup wird die alte Version des Players erkennen und dich fragen, ob vor der Installation die alte Version entfernt werden soll. Bestätige dies mit Ja.
  • Nachdem die alte Version des Programms entfernt wurde, startet die Neuinstallation. Belasse alles bei den vorgegebenen Werten - es sei denn, du willst daran etwas ändern (z.B. die Dateizuordnung o.ä.).
  • Melde dich umgehend, falls Schwierigkeiten auftreten.


Schritt 5: TFC


Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop.
Schließe nun alle offenen Programme und trenne Dich von dem Internet.
Doppelklick auf die TFC.exe
Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen.



Macht der Rechner noch Probleme?

motzerrobo 27.03.2012 18:42
Okay alles erledigt.

Rechner scheint keine Mucken mehr zu machen.

Ich danke Dir vielmals für die lange ausdauernde kompetente Hilfe !


mfg motzer

Psychotic 27.03.2012 19:20
Mach noch ein letztes ESET! :)

ESET



ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Psychotic 02.04.2012 13:53
Fehlende Rückmeldung
Dieses Thema wurde aus den Abos gelöscht. Somit bekomm ich keine Benachrichtigung über neue Antworten.
PM an mich falls Du denoch weiter machen willst.

Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass Dein Rechner schon sauber ist.

Jeder andere bitte hier klicken und einen eigenen Thread erstellen


Alle Zeitangaben in WEZ +1. Es ist jetzt 06:52 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131