Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   PC versendet SPAM mails im hintergrund (https://www.trojaner-board.de/118670-pc-versendet-spam-mails-hintergrund.html)

nicom028 06.07.2012 08:57
PC versendet SPAM mails im hintergrund
 
Hallo,

Mein PC versendet Spam mails im hintergrund.
Habe dies festgestellt da im verzeignis:
c:\inetpub\mailroot\queue immer wieder neue mails erscheinen und in
c:\inetpub\mailroot\badmail tausende von nicht versendete mails sind.

Ich verwende Norton Internet Security, aber der findet nichts :-(

Unterstehend mein Hijackthis logfile, jeder hilfe werde ich dankend entgegen nehmen !!!!!!!!!
HiJackthis Logfile:
Code:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:55:48, on 06.07.2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe
C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\CNAB5RPK.EXE
C:\Programme\LogMeIn\x86\LMIGuardianSvc.exe
C:\WINDOWS\system32\mgabg.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Norton Internet Security\Norton Internet Security\Engine\19.7.1.5\ccSvcHst.exe
C:\WINDOWS\System32\svchost.exe
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Skype\Toolbars\Skype C2C Service\c2c_service.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Programme\HP\HP Software Update\HPWuSchd2.exe
C:\Programme\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtProc.exe
C:\Programme\VirtualCloneDrive\VCDDaemon.exe
C:\Programme\Norton Internet Security\Norton Internet Security\Engine\19.7.1.5\ccSvcHst.exe
C:\Programme\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe
C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\FLEXnet\Connect\11\ISUSPM.exe
C:\Programme\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\CNAB5LAK.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Programme\Microsoft Office\Office10\WINWORD.EXE
C:\WINDOWS\system32\dllhost.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Programme\Mozilla Firefox\plugin-container.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Programme\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\mmc.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.xxxxxxxxxxxx.at/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Programme\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: SuggestMeYesBHO - {0FB6A909-6086-458F-BD92-1F8EE10042A0} - C:\Programme\AutocompletePro\AutocompletePro.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Programme\Norton Internet Security\Norton Internet Security\Engine\19.7.1.5\coIEPlg.dll
O2 - BHO: DIALux 3.1 ULDBrowserHelper Class - {69AB812A-8CE4-4BF3-B49B-3B60A9F31FB2} - C:\Programme\DIALux\DLXShellExtension.dll
O2 - BHO: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Programme\Norton Internet Security\Norton Internet Security\Engine\19.7.1.5\IPS\IPSBHO.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.7.7018.1622\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Programme\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Programme\Norton Internet Security\Norton Internet Security\Engine\19.7.1.5\coIEPlg.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Programme\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SetRefresh] C:\Programme\COMPAQ\SetRefresh\\SetRefresh.exe
O4 - HKLM\..\Run: [LayoutM] KLayMgr.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Programme\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [OpwareSE4] "C:\Programme\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
O4 - HKLM\..\Run: [WrtMon.exe] C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe
O4 - HKLM\..\Run: [Nuance PDF Reader-reminder] "C:\Programme\Nuance\PDF Reader\Ereg\Ereg.exe" -r "C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Nuance\PDF Reader\Ereg\Ereg.ini"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Programme\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Programme\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Programme\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Programme\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [FileZilla Server Interface] "C:\Programme\FileZilla Server\FileZilla Server Interface.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ISUSPM] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\FLEXnet\Connect\11\ISUSPM.exe -scheduler
O4 - HKCU\..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-18 Startup: Adobe Gamma.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe (User 'SYSTEM')
O4 - S-1-5-18 Startup: Verknüpfung mit Mail Postgasse -Hxxxxxxxxx.lnk = ? (User 'SYSTEM')
O4 - S-1-5-18 Startup: VPN Drucker-Internet.lnk = ? (User 'SYSTEM')
O4 - .DEFAULT Startup: Adobe Gamma.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe (User 'Default user')
O4 - .DEFAULT Startup: Verknüpfung mit Mail Postgasse -Höpflergasse.lnk = ? (User 'Default user')
O4 - .DEFAULT Startup: VPN Drucker-Internet.lnk = ? (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Verknüpfung mit Mail Postgasse -Höpflergasse.lnk = ?
O4 - Startup: VPN Drucker-Internet.lnk = ?
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Canon LBP3300 Statusfenster.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\CNAB5LAK.EXE
O4 - Global Startup: VPN Drucker-Internet.lnk = ?
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - res://C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: In Adobe PDF konvertieren - res://C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - res://C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - res://C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: HP Smart Web Printing ein- oder ausblenden - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Programme\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - hxxp://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - hxxp://www.cult3d.com/download/cult.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - hxxp://a1540.g.akamai.net/7/1540/52/20021126/qtinstall.info.apple.com/dribnif/de/win/QuickTimeInstaller.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - hxxp://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1158794628677
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} - hxxp://toolbar.google.com/data/de/big/1.1.62-big/GoogleNav.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O17 - HKLM\System\CCS\Services\Tcpip\..\{656C01D1-A252-4CD2-953F-B3CD44F56750}: NameServer = 193.186.161.35,193.186.161.66
O17 - HKLM\System\CCS\Services\Tcpip\..\{75BA237D-CD34-49E3-8345-D9EC827F3B6E}: NameServer = 193.186.161.66 193.186.161.35
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Programme\Canon\CAL\CALMAIN.exe
O23 - Service: DIAL Communication Service (DialComService) - Unknown owner - C:\Programme\DIAL GmbH\DIAL Communication Framework\DialComService.exe
O23 - Service: FileZilla Server FTP server (FileZilla Server) - FileZilla Project - C:\Programme\FileZilla Server\FileZilla Server.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate1c9dd17746cffd0) (gupdate1c9dd17746cffd0) - Google Inc. - C:\Programme\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update-Dienst (gupdatem) (gupdatem) - Google Inc. - C:\Programme\Google\Update\GoogleUpdate.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle Corporation - C:\Programme\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
O23 - Service: LMIGuardianSvc - LogMeIn, Inc. - C:\Programme\LogMeIn\x86\LMIGuardianSvc.exe
O23 - Service: MGABGEXE - Matrox Graphics Inc. - C:\WINDOWS\system32\mgabg.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: Norton Internet Security (NIS) - Symantec Corporation - C:\Programme\Norton Internet Security\Norton Internet Security\Engine\19.7.1.5\ccSvcHst.exe
O23 - Service: NMIndexingService - Nero AG - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe
O23 - Service: ReaConverter scheduler service (rcp_service) - ReaSoft - C:\Programme\ReaConverter 5.5 Pro\rcp_scheduler.exe
O23 - Service: ServiceLayer - Nokia - C:\Programme\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Skype C2C Service - Skype Technologies S.A. - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Skype\Toolbars\Skype C2C Service\c2c_service.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Programme\Skype\Updater\Updater.exe

--
End of file - 16072 bytes
--- --- ---

markusg 06.07.2012 10:02
hi
hjt logs wollen wir nicht mehr sehen :-)
Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%USERPROFILE%\*.*
%USERPROFILE%\Local Settings\Temp\*.exe
%USERPROFILE%\Local Settings\Temp\*.dll
%USERPROFILE%\Application Data\*.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs
CREATERESTOREPOINT
  • Schliesse bitte nun alle Programme. (Wichtig)
  • Klicke nun bitte auf den Quick Scan Button.
  • Kopiere
    nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

nicom028 06.07.2012 10:25
Bin gerade drauf gekommen das wenn ich inetinfo.exe (in dienste) beende, kein weitere spam mails mehr verschickt werden.

OTL Logfile:
Code:
OTL logfile created on: 06.07.2012 11:33:48 - Run 1
OTL by OldTimer - Version 3.2.53.1    Folder = C:\Dokumente und Einstellungen\thomas\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000C07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy
 
1,99 Gb Total Physical Memory | 1,24 Gb Available Physical Memory | 62,35% Memory free
3,32 Gb Paging File | 2,50 Gb Available in Paging File | 75,16% Paging File free
Paging file location(s): C:\pagefile.sys 1520 2500 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 148,87 Gb Total Space | 68,93 Gb Free Space | 46,30% Space Free | Partition Type: NTFS
Drive D: | 180,41 Mb Total Space | 106,84 Mb Free Space | 59,22% Space Free | Partition Type: NTFS
Drive H: | 931,51 Gb Total Space | 778,77 Gb Free Space | 83,60% Space Free | Partition Type: NTFS
 
Computer Name: THOMASRECHNER | User Name: thomas | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.07.06 11:28:41 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\thomas\Desktop\OTL.exe
PRC - [2012.05.30 13:56:52 | 003,048,136 | ---- | M] (Skype Technologies S.A.) -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Skype\Toolbars\Skype C2C Service\c2c_service.exe
PRC - [2012.05.04 19:29:46 | 000,161,664 | ---- | M] (Oracle Corporation) -- C:\Programme\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe
PRC - [2012.03.28 01:14:06 | 000,138,232 | R--- | M] (Symantec Corporation) -- C:\Programme\Norton Internet Security\Norton Internet Security\Engine\19.7.1.5\ccSvcHst.exe
PRC - [2012.01.17 12:07:54 | 000,252,296 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
PRC - [2011.10.07 08:54:11 | 000,374,152 | ---- | M] (LogMeIn, Inc.) -- C:\Programme\LogMeIn\x86\LMIGuardianSvc.exe
PRC - [2011.03.07 15:33:08 | 000,089,456 | ---- | M] (Elaborate Bytes AG) -- C:\Programme\VirtualCloneDrive\VCDDaemon.exe
PRC - [2009.05.05 16:06:06 | 000,222,496 | ---- | M] (Acresso Corporation) -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\FLEXnet\Connect\11\ISUSPM.exe
PRC - [2008.06.11 22:43:26 | 000,640,376 | ---- | M] (Adobe Systems Inc.) -- C:\Programme\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
PRC - [2008.04.14 07:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007.04.17 14:03:52 | 000,063,048 | ---- | M] (LogMeIn, Inc.) -- C:\Programme\LogMeIn\x86\LogMeInSystray.exe
PRC - [2007.03.06 08:10:22 | 000,050,848 | ---- | M] (CANON INC.) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\CNAB5LAK.EXE
PRC - [2007.01.15 02:53:24 | 000,063,168 | ---- | M] (CANON INC.) -- C:\WINDOWS\system32\CNAB5RPK.EXE
PRC - [2006.12.23 19:05:20 | 000,143,360 | ---- | M] (Nero AG) -- C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe
PRC - [2006.12.23 19:04:42 | 000,905,216 | ---- | M] (Nero AG) -- C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexStoreSvr.exe
PRC - [2006.12.23 18:54:04 | 000,262,144 | ---- | M] (Nero AG) -- C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe
PRC - [2006.12.14 18:49:10 | 000,061,440 | ---- | M] (Hewlett-Packard Company) -- C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
PRC - [2006.10.11 12:45:12 | 000,075,304 | ---- | M] (ScanSoft, Inc.) -- C:\Programme\ScanSoft\OmniPageSE4.0\OpWareSE4.exe
PRC - [2006.09.20 08:35:26 | 000,020,480 | ---- | M] () -- C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe
PRC - [2006.09.19 16:05:32 | 000,024,576 | ---- | M] () -- C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtProc.exe
PRC - [2005.09.30 20:22:50 | 000,096,341 | ---- | M] (Canon Inc.) -- C:\Programme\Canon\CAL\CALMAIN.exe
PRC - [2005.06.07 00:46:24 | 000,057,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
PRC - [2002.01.16 15:15:14 | 000,081,920 | ---- | M] (Matrox Graphics Inc.) -- C:\WINDOWS\system32\mgabg.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.01.08 15:41:12 | 000,093,696 | ---- | M] () -- C:\Programme\FileZilla FTP Client\fzshellext.dll
MOD - [2006.09.20 08:35:26 | 000,020,480 | ---- | M] () -- C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe
MOD - [2006.09.19 16:05:32 | 000,024,576 | ---- | M] () -- C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtProc.exe
MOD - [2000.12.22 08:51:00 | 000,028,672 | ---- | M] () -- C:\WINDOWS\system32\NavLogon.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Auto | Stopped] -- %SystemRoot%\System32\hidserv.dll -- (HidServ)
SRV - [2012.06.23 15:29:55 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.06.19 10:33:00 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.05.30 13:56:52 | 003,048,136 | ---- | M] (Skype Technologies S.A.) [Auto | Running] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)
SRV - [2012.05.04 19:29:46 | 000,161,664 | ---- | M] (Oracle Corporation) [Auto | Running] -- C:\Programme\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe -- (JavaQuickStarterService)
SRV - [2012.03.28 01:14:06 | 000,138,232 | R--- | M] (Symantec Corporation) [Auto | Running] -- C:\Programme\Norton Internet Security\Norton Internet Security\Engine\19.7.1.5\ccSvcHst.exe -- (NIS)
SRV - [2012.02.26 16:42:28 | 000,632,320 | ---- | M] (FileZilla Project) [On_Demand | Stopped] -- C:\Programme\FileZilla Server\FileZilla server.exe -- (FileZilla Server)
SRV - [2012.02.15 13:30:18 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2011.10.07 08:54:24 | 000,136,584 | ---- | M] (LogMeIn, Inc.) [Disabled | Stopped] -- C:\Programme\LogMeIn\x86\ramaint.exe -- (LMIMaint)
SRV - [2011.10.07 08:54:11 | 000,374,152 | ---- | M] (LogMeIn, Inc.) [Auto | Running] -- C:\Programme\LogMeIn\x86\LMIGuardianSvc.exe -- (LMIGuardianSvc)
SRV - [2011.08.29 08:54:17 | 000,390,528 | ---- | M] (LogMeIn, Inc.) [Disabled | Stopped] -- C:\Programme\LogMeIn\x86\LogMeIn.exe -- (LogMeIn)
SRV - [2011.05.15 22:59:35 | 001,639,216 | ---- | M] () [On_Demand | Stopped] -- C:\Programme\DIAL GmbH\DIAL Communication Framework\DialComService.exe -- (DialComService)
SRV - [2011.03.17 12:35:59 | 000,651,720 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2010.06.14 16:07:14 | 000,615,936 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2008.08.27 16:32:45 | 000,072,704 | ---- | M] (Adobe Systems) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe -- (Adobe LM Service)
SRV - [2008.04.14 07:52:50 | 000,015,872 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\WINDOWS\system32\inetsrv\inetinfo.exe -- (W3SVC)
SRV - [2008.04.14 07:52:50 | 000,015,872 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\WINDOWS\system32\inetsrv\inetinfo.exe -- (SMTPSVC) Simple Mail Transfer Protocol (SMTP)
SRV - [2008.04.14 07:52:50 | 000,015,872 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\inetsrv\inetinfo.exe -- (IISADMIN)
SRV - [2007.11.30 13:27:22 | 000,558,592 | ---- | M] (ReaSoft) [On_Demand | Stopped] -- C:\Programme\ReaConverter 5.5 Pro\rcp_scheduler.exe -- (rcp_service)
SRV - [2006.12.23 18:54:04 | 000,262,144 | ---- | M] (Nero AG) [On_Demand | Running] -- C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe -- (NMIndexingService)
SRV - [2006.12.14 18:49:10 | 000,061,440 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe -- (LightScribeService)
SRV - [2005.09.30 20:22:50 | 000,096,341 | ---- | M] (Canon Inc.) [Auto | Running] -- C:\Programme\Canon\CAL\CALMAIN.exe -- (CCALib8)
SRV - [2002.01.16 15:15:14 | 000,081,920 | ---- | M] (Matrox Graphics Inc.) [Auto | Running] -- C:\WINDOWS\system32\mgabg.exe -- (MGABGEXE)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\usbser_lowerfltj.sys -- (UsbserFilt)
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\Drivers\usbaapl.sys -- (USBAAPL)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\usbser_lowerflt.sys -- (upperdev)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\NIS\1002000.007\SYMREDRV.SYS -- (SYMREDRV)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\NIS\1008000.029\SYMNDIS.SYS -- (SYMNDIS)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\NIS\1008000.029\SYMIDS.SYS -- (SYMIDS)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\NIS\1008000.029\SYMFW.SYS -- (SYMFW)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\NIS\1002000.007\SYMDNS.SYS -- (SYMDNS)
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\DRIVERS\RTL8139.SYS -- (rtl8139) NT-Treiber für Realtek RTL8139(A/B/C)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] --  -- (PCIDump)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\nmwcdnsuc.sys -- (nmwcdnsuc)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\nmwcdnsu.sys -- (nmwcdnsu)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\ccdcmbo.sys -- (nmwcdc)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\ccdcmb.sys -- (nmwcd)
DRV - File not found [Kernel | System | Stopped] --  -- (lbrtfdc)
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\DRIVERS\wATV03nt.sys -- (iAimTV2)
DRV - File not found [Kernel | System | Stopped] --  -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] --  -- (Changer)
DRV - [2012.06.19 02:01:14 | 000,821,920 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.7.1.5\Definitions\BASHDefs\20120619.001\BHDrvx86.sys -- (BHDrvx86)
DRV - [2012.06.14 20:39:26 | 000,369,632 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.7.1.5\Definitions\IPSDefs\20120705.001\IDSXpx86.sys -- (IDSxpx86)
DRV - [2012.05.31 14:38:23 | 000,141,944 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SYMEVENT.SYS -- (SymEvent)
DRV - [2012.05.31 04:11:15 | 000,106,656 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2012.05.31 04:11:14 | 000,376,480 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2012.05.30 01:00:00 | 001,589,752 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.7.1.5\Definitions\VirusDefs\20120705.018\NAVEX15.SYS -- (NAVEX15)
DRV - [2012.05.30 01:00:00 | 000,087,928 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.7.1.5\Definitions\VirusDefs\20120705.018\NAVENG.SYS -- (NAVENG)
DRV - [2012.03.29 08:28:38 | 000,388,216 | R--- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\NIS\1307010.005\symtdi.sys -- (SYMTDI)
DRV - [2012.03.29 08:28:30 | 000,905,336 | R--- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\NIS\1307010.005\SymEFA.sys -- (SymEFA)
DRV - [2012.03.29 08:28:25 | 000,340,088 | R--- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\NIS\1307010.005\SymDS.sys -- (SymDS)
DRV - [2012.03.29 08:06:25 | 000,149,624 | R--- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\NIS\1307010.005\Ironx86.sys -- (SymIRON)
DRV - [2012.03.29 08:03:27 | 000,574,072 | R--- | M] (Symantec Corporation) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\NIS\1307010.005\srtsp.sys -- (SRTSP)
DRV - [2012.03.29 08:03:27 | 000,032,888 | R--- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\NIS\1307010.005\srtspx.sys -- (SRTSPX) Symantec Real Time Storage Protection (PEL)
DRV - [2011.11.30 00:44:14 | 000,132,744 | R--- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\NIS\1307010.005\ccSetx86.sys -- (ccSet_NIS)
DRV - [2011.10.07 08:54:13 | 000,083,360 | ---- | M] (LogMeIn, Inc.) [File_System | Disabled | Stopped] -- C:\WINDOWS\System32\LMIRfsClientNP.dll -- (LMIRfsClientNP)
DRV - [2009.12.18 11:58:52 | 000,011,336 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Programme\SystemRequirementsLab\cpudrv.sys -- (cpudrv)
DRV - [2008.08.26 11:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2008.07.24 18:46:08 | 000,047,640 | ---- | M] (LogMeIn, Inc.) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\LMIRfsDriver.sys -- (LMIRfsDriver)
DRV - [2008.06.07 18:07:12 | 000,012,856 | ---- | M] (LogMeIn, Inc.) [Kernel | Auto | Running] -- C:\Programme\LogMeIn\x86\rainfo.sys -- (LMIInfo)
DRV - [2007.01.30 20:57:50 | 004,474,368 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2006.11.17 15:10:00 | 000,011,264 | R--- | M] (Silicon Laboratories) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\FS20 IRP.sys -- (FS20 IRP)
DRV - [2006.11.07 04:32:00 | 000,046,976 | R--- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\HPKBCCID.sys -- (HPKBCCID)
DRV - [2005.02.16 07:43:20 | 000,028,800 | ---- | M] (Cypress Semiconductor) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\CyUsbNT.sys -- (CyUsbNT)
DRV - [2004.10.25 00:04:00 | 000,007,796 | ---- | M] (SCM Microsystems Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Stc2Dfu.sys -- (STC2DFU)
DRV - [2004.10.15 17:49:00 | 000,029,292 | R--- | M] (FTDI Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\FTD2XX.sys -- (FTD2XX)
DRV - [2004.09.14 10:33:48 | 000,260,992 | ---- | M] (Matrox Graphics Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\g200mini.sys -- (G200)
DRV - [2004.08.04 07:29:49 | 000,019,455 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wvchntxx.sys -- (iAimFP4)
DRV - [2004.08.04 07:29:47 | 000,012,063 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wsiintxx.sys -- (iAimFP3)
DRV - [2004.08.04 07:29:45 | 000,025,471 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\watv10nt.sys -- (iAimTV5)
DRV - [2004.08.04 07:29:45 | 000,023,615 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wch7xxnt.sys -- (iAimTV4)
DRV - [2004.08.04 07:29:44 | 000,022,271 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\watv06nt.sys -- (iAimTV6)
DRV - [2004.08.04 07:29:43 | 000,033,599 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\watv04nt.sys -- (iAimTV3)
DRV - [2004.08.04 07:29:42 | 000,019,551 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\watv02nt.sys -- (iAimTV1)
DRV - [2004.08.04 07:29:41 | 000,029,311 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\watv01nt.sys -- (iAimTV0)
DRV - [2004.08.04 07:29:40 | 000,011,871 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wadv09nt.sys -- (iAimFP7)
DRV - [2004.08.04 07:29:39 | 000,011,295 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wadv08nt.sys -- (iAimFP6)
DRV - [2004.08.04 07:29:38 | 000,011,807 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wadv07nt.sys -- (iAimFP5)
DRV - [2004.08.04 07:29:37 | 000,012,415 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wadv01nt.sys -- (iAimFP0)
DRV - [2004.08.04 07:29:37 | 000,012,127 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wadv02nt.sys -- (iAimFP1)
DRV - [2004.08.04 07:29:37 | 000,011,775 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wadv05nt.sys -- (iAimFP2)
DRV - [2004.08.04 07:29:36 | 000,161,020 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\i81xnt5.sys -- (i81x)
DRV - [2003.03.14 13:18:30 | 000,004,228 | ---- | M] (PowerQuest Corporation) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\PQNTDRV.sys -- (PQNTDrv)
DRV - [2001.12.18 15:45:04 | 000,003,279 | ---- | M] (VIA Technologies. Inc.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\VIAPFD.SYS -- (VIAPFD)
DRV - [2001.08.17 12:19:56 | 000,063,360 | ---- | M] (ESS Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ess.sys -- (ess) ESS Audiotreiber (WDM)
DRV - [2001.08.17 12:11:06 | 000,066,591 | ---- | M] (3Com Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\el90xbc5.sys -- (EL90XBC)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.thomasleuchten.at/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKCU\..\SearchScopes,DefaultScope = {6F6246AE-444E-494D-9180-99E91E3732CC}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKCU\..\SearchScopes\{6F6246AE-444E-494D-9180-99E91E3732CC}: "URL" = hxxp://www.google.at/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7GGLD_deAT310
IE - HKCU\..\SearchScopes\Live Search: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&mkt=de-at&FORM=MICPAT
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "hxxp://www.thomasleuchten.at/"
FF - prefs.js..extensions.enabledItems: {4D144BC3-23FB-47de-90C5-63CCB0139CCF}:1.0
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: smartwebprinting@hp.com:4.5
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {BBDA0591-3099-440a-AA10-41764D9DB4DB}:2.0
FF - prefs.js..extensions.enabledItems: {2D3F3651-74B9-4795-BDEC-6DA2F431CB62}:5.5
FF - prefs.js..extensions.enabledItems: {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}:7.3.3.42
FF - prefs.js..extensions.enabledItems: bkmrksync@nokia.com:1.0.0.732
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.9.2
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_262.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Programme\Tracker Software\npPDFXCviewNPPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Programme\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Programme\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Programme\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Programme\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Programme\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Programme\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=14: C:\Programme\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\ZEON/PDF,version=2.0: C:\Programme\Nuance\PDF Reader\bin\nppdf.dll (Zeon Corporation)
FF - HKCU\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Programme\Tracker Software\npPDFXCviewNPPlugin.dll File not found
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\smartwebprinting@hp.com: C:\Programme\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010.09.17 10:26:28 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.7.1.5\IPSFFPlgn\ [2012.05.31 14:44:57 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.7.1.5\coFFPlgn\ [2012.07.06 10:22:37 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.06.19 10:33:01 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2012.04.25 14:20:14 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Programme\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010.09.17 10:26:28 | 000,000,000 | ---D | M]
 
[2010.04.06 14:28:14 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\thomas\Anwendungsdaten\Mozilla\Extensions
[2010.04.06 14:28:14 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\thomas\Anwendungsdaten\Mozilla\Extensions\home2@tomtom.com
[2012.05.22 08:41:00 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\thomas\Anwendungsdaten\Mozilla\Firefox\Profiles\onwfeoa8.default\extensions
[2010.06.29 08:13:36 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\thomas\Anwendungsdaten\Mozilla\Firefox\Profiles\onwfeoa8.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.11.18 09:22:08 | 000,000,000 | ---D | M] (TradeManager-Plugin) -- C:\Dokumente und Einstellungen\thomas\Anwendungsdaten\Mozilla\Firefox\Profiles\onwfeoa8.default\extensions\{4D144BC3-23FB-47de-90C5-63CCB0139CCF}
[2012.05.22 08:41:00 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Dokumente und Einstellungen\thomas\Anwendungsdaten\Mozilla\Firefox\Profiles\onwfeoa8.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2011.09.08 08:17:45 | 000,000,000 | ---D | M] (SkyFex Remote Desktop) -- C:\Dokumente und Einstellungen\thomas\Anwendungsdaten\Mozilla\Firefox\Profiles\onwfeoa8.default\extensions\skyfex@skyfex.com
[2011.06.20 11:52:18 | 000,000,000 | ---D | M] ("AutocompletePro - Your handy search suggestions tool") -- C:\Dokumente und Einstellungen\thomas\Anwendungsdaten\Mozilla\Firefox\Profiles\onwfeoa8.default\extensions\support@predictad.com
[2012.06.04 15:28:20 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.06.13 15:16:06 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012.06.19 10:33:01 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2012.01.09 09:04:37 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.01.09 09:04:37 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2012.01.09 09:04:37 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2012.01.09 09:04:37 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.01.09 09:04:37 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.01.09 09:04:37 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2012.05.10 08:33:50 | 000,001,842 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: 127.0.0.1                                activate.adobe.com
O1 - Hosts: 127.0.0.1                                practivate.adobe.com
O1 - Hosts: 127.0.0.1                                ereg.adobe.com
O1 - Hosts: 127.0.0.1                                activate.wip3.adobe.com
O1 - Hosts: 127.0.0.1                                wip3.adobe.com
O1 - Hosts: 127.0.0.1                                3dns-3.adobe.com
O1 - Hosts: 127.0.0.1                                3dns-2.adobe.com
O1 - Hosts: 127.0.0.1                                adobe-dns.adobe.com
O1 - Hosts: 127.0.0.1                                adobe-dns-2.adobe.com
O1 - Hosts: 127.0.0.1                                adobe-dns-3.adobe.com
O1 - Hosts: 127.0.0.1                                ereg.wip3.adobe.com
O1 - Hosts: 127.0.0.1                                activate-sea.adobe.com
O1 - Hosts: 127.0.0.1                                wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1                                activate-sjc0.adobe.com
O1 - Hosts: 127.0.0.1                              adobe.activate.com
O1 - Hosts: 127.0.0.1                              adobeereg.com                       
O1 - Hosts: 127.0.0.1                              www.adobeereg.com                   
O1 - Hosts: 127.0.0.1                              wwis-dubc1-vip60.adobe.com         
O1 - Hosts: 127.0.0.1                              125.252.224.90                     
O1 - Hosts: 127.0.0.1                              125.252.224.91
O1 - Hosts: 127.0.0.1                              hl2rcv.adobe.com
O2 - BHO: (AC-Pro) - {0FB6A909-6086-458F-BD92-1F8EE10042A0} - C:\Programme\AutocompletePro\AutocompletePro.dll (SimplyGen)
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Norton Identity Protection) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Programme\Norton Internet Security\Norton Internet Security\Engine\19.7.1.5\CoIEPlg.dll (Symantec Corporation)
O2 - BHO: (DIALux 3.1 ULDBrowserHelper Class) - {69AB812A-8CE4-4BF3-B49B-3B60A9F31FB2} - C:\Programme\DIALux\DLXShellExtension.dll (DIAL GmbH, Germany)
O2 - BHO: (Norton Vulnerability Protection) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Programme\Norton Internet Security\Norton Internet Security\Engine\19.7.1.5\IPS\IPSBHO.dll (Symantec Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.7.7018.1622\swg.dll (Google Inc.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Programme\Norton Internet Security\Norton Internet Security\Engine\19.7.1.5\CoIEPlg.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Programme\Norton Internet Security\Norton Internet Security\Engine\19.7.1.5\CoIEPlg.dll (Symantec Corporation)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Programme\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] C:\Programme\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Programme\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [FileZilla Server Interface] C:\Programme\FileZilla Server\FileZilla Server Interface.exe (FileZilla Project)
O4 - HKLM..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\imekrmig.exe (Microsoft Corporation)
O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [LayoutM] C:\WINDOWS\KLayMgr.exe (Chicony)
O4 - HKLM..\Run: [LogMeIn GUI] C:\Programme\LogMeIn\x86\LogMeInSystray.exe (LogMeIn, Inc.)
O4 - HKLM..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe ()
O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [Nuance PDF Reader-reminder] C:\Programme\Nuance\PDF Reader\Ereg\Ereg.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [OpwareSE4] C:\Programme\ScanSoft\OmniPageSE4.0\OpwareSE4.exe (ScanSoft, Inc.)
O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [SetRefresh] C:\Programme\COMPAQ\SetRefresh\\SetRefresh.exe ()
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [VirtualCloneDrive] C:\Programme\VirtualCloneDrive\VCDDaemon.exe (Elaborate Bytes AG)
O4 - HKLM..\Run: [WrtMon.exe] C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe ()
O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe (Nero AG)
O4 - HKCU..\Run: [ISUSPM] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\FLEXnet\Connect\11\ISUSPM.exe (Acresso Corporation)
O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Reader - Schnellstart.lnk =  File not found
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Canon LBP3300 Statusfenster.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\CNAB5LAK.EXE (CANON INC.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\VPN Drucker-Internet.lnk =  File not found
O4 - Startup: C:\Dokumente und Einstellungen\thomas\Startmenü\Programme\Autostart\Adobe Gamma.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Dokumente und Einstellungen\thomas\Startmenü\Programme\Autostart\Verknüpfung mit Mail Postgasse -Höpflergasse.lnk =  File not found
O4 - Startup: C:\Dokumente und Einstellungen\thomas\Startmenü\Programme\Autostart\VPN Drucker-Internet.lnk =  File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} hxxp://www.cult3d.com/download/cult.cab (Cult3D ActiveX Player)
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} hxxp://a1540.g.akamai.net/7/1540/52/20021126/qtinstall.info.apple.com/dribnif/de/win/QuickTimeInstaller.exe (Reg Error: Key error.)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} hxxp://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab (MSN Photo Upload Tool)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1158794628677 (WUWebControl Class)
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} https://webdl.symantec.com/activex/symdlmgr.cab (Symantec Download Manager)
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} hxxp://toolbar.google.com/data/de/big/1.1.62-big/GoogleNav.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} hxxp://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37639.1924768519 (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0014-0002-0006-ABCDEFFEDCBA} hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} hxxp://java.sun.com/products/plugin/autodl/jinstall-150-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} https://secure.logmein.com/activex/ractrl.cab?lmi=100 (Performance Viewer Activex Control)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{656C01D1-A252-4CD2-953F-B3CD44F56750}: NameServer = 193.186.161.35,193.186.161.66
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{75BA237D-CD34-49E3-8345-D9EC827F3B6E}: NameServer = 193.186.161.66 193.186.161.35
O18 - Protocol\Handler\dialux {8352FA4C-39C6-11D3-ADBA-00A0244FB1A2} - C:\Programme\DIALux\DLXToolBox.dll (DIAL GmbH, Germany)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\LMIinit: DllName - (LMIinit.dll) - C:\WINDOWS\System32\LMIinit.dll (LogMeIn, Inc.)
O20 - Winlogon\Notify\NavLogon: DllName - (C:\WINDOWS\System32\NavLogon.dll) - C:\WINDOWS\system32\NavLogon.dll ()
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011.03.17 12:15:52 | 000,000,000 | ---D | M] - C:\Autodesk -- [ NTFS ]
O32 - AutoRun File - [2003.01.07 13:21:02 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2008.12.15 11:52:18 | 000,000,080 | ---- | M] () - H:\Autorun.inf -- [ NTFS ]
O33 - MountPoints2\{86e23e14-0ce3-11e0-b684-0019dbd59b92}\Shell\AutoRun\command - "" = H:\TranscendService(JF).exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.07.06 11:30:01 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\thomas\Desktop\OTL.exe
[2012.07.06 10:55:12 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\thomas\Anwendungsdaten\Malwarebytes
[2012.07.06 10:55:03 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
[2012.07.06 10:55:02 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012.07.06 10:55:02 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2012.07.06 10:55:01 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2012.07.06 10:09:46 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\thomas\Desktop\RK_Quarantine
[2012.07.06 08:46:26 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\HijackThis
[2012.07.06 08:46:25 | 000,000,000 | ---D | C] -- C:\Programme\Trend Micro
[2012.06.20 12:37:08 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\thomas\Anwendungsdaten\ScanToPDF_4
[2012.06.20 12:35:29 | 000,000,000 | ---D | C] -- C:\Programme\ScanToPDF
[2012.06.13 15:25:03 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\thomas\Eigene Dateien\!!! FTP
[2012.06.13 09:15:58 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\FileZilla Server
[2012.06.13 09:15:50 | 000,000,000 | ---D | C] -- C:\Programme\FileZilla Server
[10 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.07.06 11:29:01 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012.07.06 11:28:41 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\thomas\Desktop\OTL.exe
[2012.07.06 11:06:01 | 000,001,090 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012.07.06 10:55:04 | 000,000,770 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012.07.06 10:24:14 | 000,012,676 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.07.06 10:24:06 | 000,000,236 | ---- | M] () -- C:\WINDOWS\tasks\OGALogon.job
[2012.07.06 10:24:04 | 000,001,086 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012.07.06 10:21:58 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.07.06 10:21:52 | 2137,509,888 | -HS- | M] () -- C:\hiberfil.sys
[2012.07.06 08:46:26 | 000,001,712 | ---- | M] () -- C:\Dokumente und Einstellungen\thomas\Desktop\HijackThis.lnk
[2012.07.05 21:26:43 | 000,000,183 | ---- | M] () -- C:\WINDOWS\hpbafd.ini
[2012.07.05 11:47:00 | 000,001,044 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2012.07.04 08:06:27 | 000,000,260 | ---- | M] () -- C:\WINDOWS\tasks\dfrg.job
[2012.07.03 15:07:39 | 000,002,241 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Skype.lnk
[2012.06.28 08:25:09 | 000,002,736 | ---- | M] () -- C:\WINDOWS\System32\NEWSOFT
[2012.06.22 13:06:08 | 000,014,848 | ---- | M] () -- C:\Dokumente und Einstellungen\thomas\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.06.22 13:06:08 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2012.06.20 16:27:06 | 003,660,272 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012.06.20 16:22:41 | 000,549,688 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2012.06.20 16:22:41 | 000,516,262 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012.06.20 16:22:41 | 000,117,596 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2012.06.20 16:22:41 | 000,100,664 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012.06.20 16:15:17 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2012.06.13 15:50:00 | 000,000,764 | ---- | M] () -- C:\Dokumente und Einstellungen\thomas\Desktop\Verknüpfung mit FileZilla server.exe.lnk
[2012.06.13 09:15:58 | 000,001,724 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\FileZilla Server Interface.lnk
[2012.06.12 16:15:06 | 000,032,400 | ---- | M] () -- C:\{DCF18B38-ADA6-4F8B-AEA1-E8118964E4EC}
[10 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.07.06 10:55:04 | 000,000,770 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012.07.06 08:46:25 | 000,001,712 | ---- | C] () -- C:\Dokumente und Einstellungen\thomas\Desktop\HijackThis.lnk
[2012.06.13 15:50:00 | 000,000,764 | ---- | C] () -- C:\Dokumente und Einstellungen\thomas\Desktop\Verknüpfung mit FileZilla server.exe.lnk
[2012.06.13 09:15:58 | 000,001,724 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\FileZilla Server Interface.lnk
[2012.06.12 16:15:06 | 000,032,400 | ---- | C] () -- C:\{DCF18B38-ADA6-4F8B-AEA1-E8118964E4EC}
[2012.04.11 08:26:39 | 000,003,910 | ---- | C] () -- C:\WINDOWS\scad3.INI
[2012.02.22 14:12:04 | 000,000,806 | ---- | C] () -- C:\Dokumente und Einstellungen\thomas\.openerprc
[2012.02.15 07:17:13 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2012.02.14 12:11:14 | 000,000,873 | ---- | C] () -- C:\WINDOWS\CADSymbols.ini
[2011.11.08 16:21:23 | 000,032,706 | ---- | C] () -- C:\Dokumente und Einstellungen\thomas\Dokument-1
[2011.10.25 13:33:04 | 000,001,657 | ---- | C] () -- C:\Dokumente und Einstellungen\thomas\.recently-used.xbel
[2011.09.27 09:17:53 | 000,000,091 | ---- | C] () -- C:\WINDOWS\Dialux.ini
[2011.05.26 09:53:31 | 000,038,365 | ---- | C] () -- C:\Dokumente und Einstellungen\thomas\Expert2.lst
[2011.05.26 09:53:30 | 000,000,101 | ---- | C] () -- C:\Dokumente und Einstellungen\thomas\Expert2.prf
[2011.05.26 09:53:27 | 000,004,564 | ---- | C] () -- C:\Dokumente und Einstellungen\thomas\Expert2.dic
[2011.05.24 15:02:34 | 000,000,155 | ---- | C] () -- C:\Dokumente und Einstellungen\thomas\.copernicus.ini
[2011.04.07 13:47:39 | 000,000,166 | ---- | C] () -- C:\WINDOWS\LuminancesDlg.ini
[2010.10.27 15:03:21 | 000,001,940 | ---- | C] () -- C:\Dokumente und Einstellungen\thomas\Lokale Einstellungen\Anwendungsdaten\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini
[2010.10.27 14:58:13 | 000,001,940 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini
[2010.09.17 10:06:38 | 000,225,211 | ---- | C] () -- C:\WINDOWS\hpoins40.dat
[2010.09.17 10:06:38 | 000,000,992 | ---- | C] () -- C:\WINDOWS\hpomdl40.dat
[2008.10.20 09:47:04 | 000,000,099 | ---- | C] () -- C:\Dokumente und Einstellungen\thomas\Anwendungsdaten\AVSDVDPlayer.m3u
[2004.02.10 20:09:37 | 000,014,848 | ---- | C] () -- C:\Dokumente und Einstellungen\thomas\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2003.09.09 11:19:36 | 000,000,139 | ---- | C] () -- C:\Dokumente und Einstellungen\thomas\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
 
========== LOP Check ==========
 
[2008.07.04 21:35:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Acronis
[2011.03.21 15:20:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Autodesk
[2011.09.27 09:18:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DIAL GmbH
[2011.09.27 13:32:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DIALux
[2010.09.28 08:43:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Downloaded Installations
[2010.06.10 12:59:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\GlobalSCAPE
[2012.02.29 14:34:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\IMSIDesign
[2012.01.26 14:54:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\inFlow Inventory
[2010.12.13 14:31:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Installations
[2011.09.30 08:57:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\LDTeditor
[2009.01.12 14:07:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\LightScribe
[2011.12.09 08:54:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\LogMeIn
[2010.12.13 13:28:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Nokia
[2010.12.13 09:29:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NokiaInstallerCache
[2011.10.12 12:47:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Nuance
[2009.04.22 08:18:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Office-Kit.com
[2008.10.20 09:27:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Suite
[2009.01.12 15:37:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PCSettings
[2009.04.08 14:29:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PixelPlanet
[2012.05.11 08:13:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\regid.1986-12.com.adobe
[2010.09.28 08:44:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ScanSoft
[2012.05.14 13:10:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
[2010.04.06 14:33:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TomTom
[2011.09.29 15:22:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ZEMAX
[2009.10.08 09:39:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009.09.02 13:24:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2012.03.22 15:05:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\thomas\Anwendungsdaten\Album Shaper
[2009.05.27 08:35:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\thomas\Anwendungsdaten\AMPSoft
[2006.12.19 15:11:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\thomas\Anwendungsdaten\Artweaver
[2011.03.21 15:20:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\thomas\Anwendungsdaten\Autodesk
[2009.04.20 15:00:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\thomas\Anwendungsdaten\Canon
[2010.06.09 14:32:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\thomas\Anwendungsdaten\DriveHQ
[2012.02.09 12:02:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\thomas\Anwendungsdaten\ElevatedDiagnostics
[2012.06.25 10:55:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\thomas\Anwendungsdaten\FileZilla
[2012.02.22 14:50:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\thomas\Anwendungsdaten\GetRightToGo
[2010.06.10 12:58:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\thomas\Anwendungsdaten\GlobalSCAPE
[2011.10.25 13:33:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\thomas\Anwendungsdaten\gtk-2.0
[2008.09.11 08:45:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\thomas\Anwendungsdaten\IMSIDesign
[2010.08.30 09:21:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\thomas\Anwendungsdaten\inFlow Inventory
[2011.06.20 09:22:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\thomas\Anwendungsdaten\InfraRecorder
[2009.01.14 14:21:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\thomas\Anwendungsdaten\Leadertech
[2011.06.29 08:46:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\thomas\Anwendungsdaten\NewSoft
[2012.01.19 15:10:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\thomas\Anwendungsdaten\Nokia
[2010.12.13 12:26:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\thomas\Anwendungsdaten\Nokia Ovi Suite
[2011.10.12 12:47:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\thomas\Anwendungsdaten\Nuance
[2009.04.22 08:18:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\thomas\Anwendungsdaten\Office-Kit.com
[2008.08.28 08:21:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\thomas\Anwendungsdaten\Opera
[2012.02.21 16:35:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\thomas\Anwendungsdaten\Oracle
[2010.12.13 15:42:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\thomas\Anwendungsdaten\PC Suite
[2009.04.08 14:29:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\thomas\Anwendungsdaten\PixelPlanet
[2012.02.22 14:17:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\thomas\Anwendungsdaten\postgresql
[2011.02.01 12:21:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\thomas\Anwendungsdaten\RCP 5
[2011.09.27 09:50:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\thomas\Anwendungsdaten\Relux Informatik AG
[2009.04.03 12:31:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\thomas\Anwendungsdaten\ScanSoft
[2012.06.20 12:37:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\thomas\Anwendungsdaten\ScanToPDF_4
[2012.01.23 10:55:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\thomas\Anwendungsdaten\Scribus
[2011.05.11 16:14:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\thomas\Anwendungsdaten\SendBlaster2
[2010.04.06 14:27:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\thomas\Anwendungsdaten\TomTom
[2011.05.23 10:41:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\thomas\Anwendungsdaten\TRIWORKS
[2011.05.24 15:07:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\thomas\Anwendungsdaten\XnView
[2010.10.12 11:43:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\thomas\Anwendungsdaten\Zeon
[2012.07.04 08:06:27 | 000,000,260 | ---- | M] () -- C:\WINDOWS\Tasks\dfrg.job
[2012.07.06 10:24:06 | 000,000,236 | ---- | M] () -- C:\WINDOWS\Tasks\OGALogon.job
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 144 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:F34493AA
@Alternate Data Stream - 132 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:19F783D8

< End of report >
--- --- ---

OTL EXTRAS Logfile:
Code:
OTL Extras logfile created on: 06.07.2012 11:33:48 - Run 1
OTL by OldTimer - Version 3.2.53.1    Folder = C:\Dokumente und Einstellungen\thomas\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000C07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy
 
1,99 Gb Total Physical Memory | 1,24 Gb Available Physical Memory | 62,35% Memory free
3,32 Gb Paging File | 2,50 Gb Available in Paging File | 75,16% Paging File free
Paging file location(s): C:\pagefile.sys 1520 2500 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 148,87 Gb Total Space | 68,93 Gb Free Space | 46,30% Space Free | Partition Type: NTFS
Drive D: | 180,41 Mb Total Space | 106,84 Mb Free Space | 59,22% Space Free | Partition Type: NTFS
Drive H: | 931,51 Gb Total Space | 778,77 Gb Free Space | 83,60% Space Free | Partition Type: NTFS
 
Computer Name: THOMASRECHNER | User Name: thomas | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = htmlfile] -- Reg Error: Key error. File not found
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Betrachten mit XnView] -- "C:\Programme\XnView\xnview.exe" "%1" (XnView, hxxp://www.xnview.com)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 1
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 1
"FirstRunDisabled" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Programme\HP\Digital Imaging\bin\hpofxm08.exe" = C:\Programme\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe -- (Hewlett-Packard Development Company, L.P.)
"C:\Programme\HP\Digital Imaging\bin\hposfx08.exe" = C:\Programme\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe -- (Hewlett-Packard Development Company, L.P.)
"C:\Programme\HP\Digital Imaging\bin\hposid01.exe" = C:\Programme\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe -- (Hewlett-Packard Co.)
"C:\Programme\HP\Digital Imaging\bin\hpfcCopy.exe" = C:\Programme\HP\Digital Imaging\bin\hpfcCopy.exe:*:Enabled:hpfccopy.exe -- ()
"C:\Programme\HP\Digital Imaging\bin\hpzwiz01.exe" = C:\Programme\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe -- (Hewlett-Packard Development Company, L.P.)
"C:\Programme\HP\Digital Imaging\bin\hpoews01.exe" = C:\Programme\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe -- (Hewlett-Packard Co.)
"C:\Programme\HP\Digital Imaging\bin\hpiscnapp.exe" = C:\Programme\HP\Digital Imaging\bin\hpiscnapp.exe:*:Enabled:hpiscnapp.exe -- (Hewlett-Packard)
"C:\Programme\HP\Digital Imaging\bin\hpofxs08.exe" = C:\Programme\HP\Digital Imaging\bin\hpofxs08.exe:*:Enabled:hpofxs08.exe -- (Hewlett-Packard Development Company, L.P.)
"C:\Programme\HP\Digital Imaging\bin\hpqgplgtupl.exe" = C:\Programme\HP\Digital Imaging\bin\hpqgplgtupl.exe:*:Enabled:hpqgplgtupl.exe -- (Hewlett-Packard Co.)
"C:\Programme\HP\Digital Imaging\bin\hpqusgm.exe" = C:\Programme\HP\Digital Imaging\bin\hpqusgm.exe:*:Enabled:hpqusgm.exe -- (Hewlett-Packard Co.)
"C:\Programme\HP\Digital Imaging\bin\hpqusgh.exe" = C:\Programme\HP\Digital Imaging\bin\hpqusgh.exe:*:Enabled:hpqusgh.exe -- (Hewlett-Packard Co.)
"C:\Programme\HP\HP Software Update\hpwucli.exe" = C:\Programme\HP\HP Software Update\hpwucli.exe:*:Enabled:hpwucli.exe -- (Hewlett-Packard)
"C:\Programme\HP\Digital Imaging\smart web printing\SmartWebPrintExe.exe" = C:\Programme\HP\Digital Imaging\smart web printing\SmartWebPrintExe.exe:*:Enabled:smartwebprintexe.exe -- (Hewlett-Packard Co.)
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\WINDOWS\system32\CNAB5RPK.EXE" = C:\WINDOWS\system32\CNAB5RPK.EXE:*:Enabled:Canon LBP3300 RPC Server Process -- (CANON INC.)
"C:\Programme\HP\Digital Imaging\bin\hpqscnvw.exe" = C:\Programme\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe
"C:\Programme\HP\Digital Imaging\bin\hpqCopy.exe" = C:\Programme\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe -- (Hewlett-Packard Development Company, L.P.)
"C:\Programme\HP\Digital Imaging\Unload\HpqPhUnl.exe" = C:\Programme\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe -- (Hewlett-Packard)
"C:\Programme\HP\Digital Imaging\Unload\HpqDIA.exe" = C:\Programme\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe -- ( )
"C:\Programme\Gemeinsame Dateien\XpressUpdate\XPressUpdate.exe" = C:\Programme\Gemeinsame Dateien\XpressUpdate\XPressUpdate.exe:*:Enabled:XPressUpdate -- (PixelPlanet GmbH)
"C:\Programme\HP\Digital Imaging\bin\hpofxm08.exe" = C:\Programme\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe -- (Hewlett-Packard Development Company, L.P.)
"C:\Programme\HP\Digital Imaging\bin\hposfx08.exe" = C:\Programme\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe -- (Hewlett-Packard Development Company, L.P.)
"C:\Programme\HP\Digital Imaging\bin\hposid01.exe" = C:\Programme\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe -- (Hewlett-Packard Co.)
"C:\Programme\HP\Digital Imaging\bin\hpfccopy.exe" = C:\Programme\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe -- ()
"C:\Programme\HP\Digital Imaging\bin\hpzwiz01.exe" = C:\Programme\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe -- (Hewlett-Packard Development Company, L.P.)
"C:\Programme\HP\Digital Imaging\bin\hpoews01.exe" = C:\Programme\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe -- (Hewlett-Packard Co.)
"C:\Programme\HP\Digital Imaging\bin\hpiscnapp.exe" = C:\Programme\HP\Digital Imaging\bin\hpiscnapp.exe:*:Enabled:hpiscnapp.exe -- (Hewlett-Packard)
"C:\Programme\HP\Digital Imaging\bin\hpofxs08.exe" = C:\Programme\HP\Digital Imaging\bin\hpofxs08.exe:*:Enabled:hpofxs08.exe -- (Hewlett-Packard Development Company, L.P.)
"C:\Programme\HP\Digital Imaging\bin\hpqgplgtupl.exe" = C:\Programme\HP\Digital Imaging\bin\hpqgplgtupl.exe:*:Enabled:hpqgplgtupl.exe -- (Hewlett-Packard Co.)
"C:\Programme\HP\Digital Imaging\bin\hpqusgm.exe" = C:\Programme\HP\Digital Imaging\bin\hpqusgm.exe:*:Enabled:hpqusgm.exe -- (Hewlett-Packard Co.)
"C:\Programme\HP\Digital Imaging\bin\hpqusgh.exe" = C:\Programme\HP\Digital Imaging\bin\hpqusgh.exe:*:Enabled:hpqusgh.exe -- (Hewlett-Packard Co.)
"C:\Programme\HP\HP Software Update\hpwucli.exe" = C:\Programme\HP\HP Software Update\hpwucli.exe:*:Enabled:hpwucli.exe -- (Hewlett-Packard)
"C:\Programme\HP\Digital Imaging\smart web printing\SmartWebPrintExe.exe" = C:\Programme\HP\Digital Imaging\smart web printing\SmartWebPrintExe.exe:*:Enabled:smartwebprintexe.exe -- (Hewlett-Packard Co.)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{07FB17D8-7DB6-4F06-80C4-8BE1719CB6A1}" = hpWLPGInstaller
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0A042C19-1F48-4952-B3B6-828E8028A187}" = B209a-m
"{0A65A3BD-54B5-4d0d-B084-7688507813F5}" = SlideShow
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{0F367CA3-3B2F-43F9-A44A-25A8EE69E45D}" = Scan
"{1111706F-666A-4037-7777-211328764D10}" = JavaFX 2.1.1
"{1280E900-35DA-4E08-A700-B79A5B2B8532}" = Microsoft Antimalware Service DE-DE Language Pack
"{15C0AF59-4877-49B6-B8C6-A61CE54515F5}" = cp_OnlineProjectsConfig
"{175F0111-2968-4935-8F70-33108C6A4DE3}" = MarketResearch
"{181EAEE6-AAE5-485B-8BAC-0FB564626781}" = Brava! Reader 3.1
"{1A9DEF19-760C-4e01-958F-D9B8E6C61B90}" = c5100_Help
"{1E5007FA-DA5E-4EDD-BDE5-14D128D66887}" = PowerQuest PartitionMagic 7.0
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{20F1FFAF-1BFF-450C-A8C7-03D1BE24B950}" = Microsoft .NET Framework (German)
"{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86
"{21A2F5EE-1DC5-488A-BE7E-E526F8C61488}" = DeviceDiscovery
"{2222706F-666A-4037-7777-203328764D10}" = JavaFX 2.0.3 SDK
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{236BB7C4-4419-42FD-0409-1E257A25E34D}" = Adobe Photoshop CS2
"{2376813B-2E5A-4641-B7B3-A0D5ADB55229}" = HPPhotoSmartExpress
"{269DBC9C-CAFC-472d-B1F1-0D327C2FFA76}" = Canon MF3200 Series
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{26A24AE4-039D-4CA4-87B4-2F83217005FF}" = Java(TM) 7 Update 5
"{2BC3CCC0-1149-424F-AF73-4D0C5C053033}" = TurboCAD Professional 15
"{2EEA7AA4-C203-4b90-A34F-19FB7EF1C81C}" = BufferChm
"{2F58D60D-2BFD-4467-9B4D-64E7355C329D}" = Sonic_PrimoSDK
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6
"{3248F0A8-6813-11D6-A77B-00B0D0150090}" = J2SE Runtime Environment 5.0 Update 9
"{3248F0A8-6813-11D6-A77B-00B0D0150100}" = J2SE Runtime Environment 5.0 Update 10
"{3248F0A8-6813-11D6-A77B-00B0D0150110}" = J2SE Runtime Environment 5.0 Update 11
"{3248F0A8-6813-11D6-A77B-00B0D0160010}" = Java(TM) SE Runtime Environment 6 Update 1
"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java(TM) 6 Update 2
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java(TM) 6 Update 3
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java(TM) 6 Update 5
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{32A3A4F4-B792-11D6-A78A-00B0D0170030}" = Java(TM) SE Development Kit 7 Update 3
"{33BF0960-DBA3-4187-B6CC-C969FCFA2D25}" = SkinsHP1
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{363790D2-DA98-41DD-9C9F-69FA36B169DE}" = PanoStandAlone
"{37603EBD-149D-4761-B86D-958A8AF6C3B1}" = FHZ 1300 PC
"{37B5CFDB-3BA5-4A63-AD7D-D6CFE8C00E85}" = FHZ 1xxx PC
"{3D6B5B20-7783-4984-948F-5EC6D94711D4}" = IESviewer 2.99n
"{3ED4A6E7-D452-455D-81F5-5DD2CDFE5931}" = System Requirements Lab for Intel
"{3FEC3A5B-60FF-4626-B425-08E09B121A15}" = LogMeIn
"{41E776A5-9B12-416D-9A12-B4F7B044EBED}" = CP_Package_Basic1
"{43CDF946-F5D9-4292-B006-BA0D92013021}" = WebReg
"{43DCF766-6838-4F9A-8C91-D92DA586DFA7}" = Microsoft Windows-Journal-Viewer
"{45DF6D99-666D-41FA-8D62-0E183B6240F3}" = PC Connectivity Solution
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A70EF07-7F88-4434-BB61-D1DE8AE93DD4}" = SolutionCenter
"{4BDFD2CE-6329-42E4-9801-9B3D1F10D79B}" = Adobe® Photoshop® Album Starter Edition 3.0
"{50779A29-834E-4E36-BBEB-B7CABC67A825}" = Microsoft Security Client DE-DE Language Pack
"{53EE9E42-CECB-4C92-BF76-9CA65DAF8F1C}" = FullDPAppQFolder
"{562D0D31-FBAF-4505-8B27-4EC92EEA91D6}" = DIAL Communication Framework
"{5783F2D7-8001-0409-0002-0060B0CE6BBA}" = AutoCAD 2010 - English
"{5783F2D7-8001-0409-1002-0060B0CE6BBA}" = AutoCAD 2010 Language Pack - English
"{586509F0-350D-48B5-B763-9CC2F8D96C4C}" = Windows Live Sync
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{63569CE9-FA00-469C-AF5C-E5D4D93ACF91}" = Windows Genuine Advantage v1.3.0254.0
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{63FF21C9-A810-464F-B60A-3111747B1A6D}" = GPBaseService2
"{6696D9A4-28A8-4F5A-8E9A-2E8974C8C39C}" = RandMap
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{6767DFEE-8909-453A-B553-C7693912B2EB}" = Canon MF Toolbox 4.9.1.1.mf07
"{68763C27-235D-4165-A961-FDEA228CE504}" = AiOSoftwareNPI
"{68A10D12-0D0F-4212-BDE6-D87FAD32A8FA}" = SmartWebPrinting
"{6909F917-5499-482e-9AA1-FAD06A99F231}" = Toolbox
"{6B2FFB21-AC88-45C3-9A7D-4BB3E744EC91}" = HPSSupply
"{6BBA26E9-AB03-4FE7-831A-3535584CA002}" = Toolbox
"{6BE2A4A4-99FB-48ED-AE1E-4E850389F804}" = PartitionMagic
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{6D9B4C6B-7879-477A-B5EE-7DF068B91F34}" = PdfGrabber 5.0
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7148F0A8-6813-11D6-A77B-00B0D0142060}" = Java 2 Runtime Environment, SE v1.4.2_06
"{736C803C-DD3B-4015-BC51-AFB9E67B9076}" = Readme
"{75247E38-5C9B-45D6-ADF8-E11CB56B4990}" = Network
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{786C5747-1033-0000-B58E-000000000001}" = Adobe Stock Photos 1.0
"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime
"{7C03270C-4FAB-4F5C-B10D-52FEDA190790}" = DocumentViewerQFolder
"{7E576E0C-9609-4237-880F-6424DD70AC1A}" = TurboCAD Professional 17
"{7E7B7865-6C80-4373-8BC1-C2EB9431F9DE}" = ProductContextNPI
"{7EFA9E45-BC04-4613-B88F-079B01C9F862}" = HP USB Smart Card Keyboard
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83E2CFA9-E0EB-4E08-9F85-43E577FF3D60}" = Windows Live Anmelde-Assistent
"{850C7BD3-9F3F-46AD-9396-E7985B38C55E}" = Windows Live Fotogalerie
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A4CE7FD-9657-4B06-9943-E1819F3D5D67}" = DocProc
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{8CE4E6E9-9D55-43FB-9DDB-688C976BFC05}" = Unload
"{8D273DE5-ABFA-4BD0-A9D7-EE9C971438C4}_is1" = PDF-Viewer
"{8D840E74-A760-487F-AE4E-A1B2CFDB28E1}_is1" = Yet Another Duplicate File Remover 1.0.0
"{8EDBA74D-0686-4C99-BFDD-F894678E5B39}" = Adobe Common File Installer
"{900A29A0-52BA-4a78-8E6C-5F4F821397CE}" = Canon MF4010-Serie
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90280407-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional mit FrontPage
"{91F34319-08DE-457a-99C0-0BCDFAC145B9}" = CuteFTP 8 Professional
"{92127AF5-FDD8-4ADF-BC40-C356C9EE0B7D}" = 32 Bit HP CIO Components Installer
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9743AF47-B746-4324-B4C4-512E67D04370}" = Symantec Technical Support Web Controls
"{996512CF-F35B-48DE-9291-557FA5316967}" = ScannerCopy
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9FEF1A18-8F26-4F49-A5A4-956C12210624}" = HP Photosmart Plus B209a-m All-In-One Driver Software 13.0 Rel .6
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A29800BA-0BF1-4E63-9F31-DF05A87F4104}" = InstantShareDevices
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A43BF6A5-D5F0-4AAA-BF41-65995063EC44}" = MSXML 6.0 Parser
"{A87B11AC-4344-4E5D-8B12-8F471A87DAD9}" = LightScribe  1.4.136.1
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A93C4E94-1005-489D-BEAA-B873C1AA6CFC}" = HP Help and Support
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC76BA86-1033-F400-7760-000000000004}" = Adobe Acrobat 9 Pro - English, Français, Deutsch
"{AC76BA86-1033-F400-7760-000000000004}{AC76BA86-1033-F400-7760-000000000004}" = Adobe Acrobat 9 Pro - English, Français, Deutsch
"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3 - Deutsch
"{AC76BA86-7AD7-2447-0000-900000000003}" = Chinese Simplified Fonts Support For Adobe Reader 9
"{AC76BA86-7AD7-2448-0000-900000000003}" = Chinese Traditional Fonts Support For Adobe Reader 9
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{AC76BA86-7AD7-5670-0000-800000000003}" = Korean Fonts Support For Adobe Reader 8
"{AC76BA86-7AD7-5760-0000-900000000003}" = Japanese Fonts Support For Adobe Reader 9
"{AE8705FB-E13C-40A9-8A2D-68D6733FBFC2}" = Status
"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger
"{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86
"{B0069CFA-5BB9-4C03-B1C6-89CE290E5AFE}" = HP Update
"{B2157760-AA3C-4E2E-BFE6-D20BC52495D9}" = cp_PosterPrintConfig
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B28B351F-1232-46EA-85EF-B8EA91641031}" = Nero 7 Essentials
"{B3B9BC18-2A09-4728-9B46-12E85FF3F628}" = C5100
"{B40DED06-B52E-4970-8689-578D162638ED}" = DWGSee DWG Viewer
"{B480904D-F73F-4673-B034-8A5F492C9184}" = Nuance PDF Reader
"{B6286A44-7505-471A-A72B-04EC2DB2F442}" = CueTour
"{B65759DD-26C6-4EA6-9014-CA798907EBFD}" = PS_AIO_06_B209a-m_SW_Min
"{B69CFE29-FD03-4E0A-87A7-6ED97F98E5B3}" = CP_Panorama1Config
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{B74D4E10-6884-0000-0000-000000000103}" = Adobe Bridge 1.0
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{BD7204BA-DD64-499E-9B55-6A282CDF4FA4}" = Destinations
"{BDBE2F3E-42DB-4d4a-8CB1-19BA765DBC6C}" = HP Photosmart, Officejet and Deskjet 7.0.A
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C1C6767D-B395-43CB-BF99-051B58B86DA6}" = PhotoGallery
"{C1E693A4-B1D5-4DCD-B68D-2087835B7184}" = ScanSoft OmniPage SE 4.0
"{C2C284D2-6BD7-3B34-B0C5-B2CAED168DF7}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - DEU
"{C314CE45-3392-3B73-B4E1-139CD41CA933}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - DEU
"{C43326F5-F135-4551-8270-7F7ABA0462E1}" = HPProductAssistant
"{C75CDBA2-3C86-481e-BD10-BDDA758F9DFF}" = hpPrintProjects
"{C8753E28-2680-49BF-BD48-DD38FD086EFE}" = AiO_Scan_CDA
"{C9618743-1A5C-461E-91C4-E013A3D70F3C}" = Adobe® Photoshop® Album Starter Edition 3.0.1
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE26F10F-C80F-4377-908B-1B7882AE2CE3}" = Crystal Reports Basic Runtime for Visual Studio 2008
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call
"{D2D6B9EB-C6DC-4DAA-B4DE-BB7D9735E7DA}" = Presto! PageManager
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DADECAEB-542D-4000-AB26-999BBAC67A46}" = LDT Editor
"{DC0A5F99-FD66-433F-9D3A-05DCBA64BE42}" = TrayApp
"{DD098BF1-0FE2-413B-8E26-F87454306A27}_is1" = PhotoManager 1.2.0
"{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{E9787678-1033-0000-8E67-000000000001}" = Adobe Help Center 1.0
"{ED2C557E-9C18-41FF-B58E-A05EEF0B3B5F}" = CP_CalendarTemplates1
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.8
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F157460F-720E-482f-8625-AD7843891E5F}" = InstantShareDevicesMFC
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F5242227-2051-4158-AC42-0F2BAA3CD3D6}" = HP SetRefresh
"{F6076EF9-08E1-442F-B6A2-BFB61B295A14}" = Fax_CDA
"{FBB980B0-63F8-4B48-8D65-90F1D9F81D9F}" = NewCopy_CDA
"{FCE65C4E-B0E8-4FBD-AD16-EDCBE6CD591F}" = HighMAT-Erweiterung für den Microsoft Windows XP-Assistenten zum Schreiben von CDs
"{FE7E1DD7-EBCE-4696-ADE2-22BDBF2372DA}" = DocumentViewer
"3308E613-328E-40EE-8023-C21070FB3CEC" = Heatsink Calculator
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Photoshop CS2 - {236BB7C4-4419-42FD-0409-1E257A25E34D}" = Adobe Photoshop CS2
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"AFPL Ghostscript 8.54" = AFPL Ghostscript 8.54
"AFPL Ghostscript Fonts" = AFPL Ghostscript Fonts
"AMP Font Viewer" = AMP Font Viewer
"AutoCAD 2010 - English" = AutoCAD 2010 - English
"AutocompletePro3_is1" = AutocompletePro
"AVS DVD Player_is1" = AVS DVD Player version 2.4
"AVS4YOU Software Navigator_is1" = AVS4YOU Software Navigator 1.2
"CAL" = Canon Camera Access Library
"CameraWindowDVC5" = Canon Camera Window DC_DV 5 for ZoomBrowser EX
"CameraWindowDVC6" = Canon Camera Window DC_DV 6 for ZoomBrowser EX
"CameraWindowMC" = Canon Camera Window MC 6 for ZoomBrowser EX
"CANON iMAGE GATEWAY Task" = CANON iMAGE GATEWAY Task for ZoomBrowser EX
"Canon Internet Library for ZoomBrowser EX" = Canon Internet Library for ZoomBrowser EX
"Canon LBP3300" = Canon LBP3300
"CCleaner" = CCleaner
"Color Calculator" = Radiant Imaging Color Calculator
"CSCLIB" = Canon Camera Support Core Library
"DIALux" = DIALux 4.9
"DigiBookShelf Light" = DigiBookShelf Light (V11.2)
"DPP" = Canon Utilities Digital Photo Professional 2.2
"Duplicate File Remover_is1" = Duplicate File Remover 2.4 build 545
"EOS Utility" = Canon Utilities EOS Utility
"EVEREST Home Edition_is1" = EVEREST Home Edition v2.20
"FileZilla Client" = FileZilla Client 3.5.3
"FileZilla Server" = FileZilla Server
"Font Viewer_is1" = Font Viewer 2.0
"FPAdjust" = FPAdjust
"Free M4a to MP3 Converter_is1" = Free M4a to MP3 Converter 6.2
"Free PDF to Word Doc Converter_is1" = Free PDF to Word Doc Converter v1.1
"Free WAV to MP3 Converter" = Free WAV to MP3 Converter
"FS20 IR Programmer_is1" = FS20 IR Programmer 1.0
"FS20 IRP&18EF&E007" = ELV FS20 IR Programmer Driver Set
"FTD2XX" = FTDI FTD2XX USB Drivers
"Google Updater" = Google Updater
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"HijackThis" = HijackThis 2.0.2
"HP Document Viewer" = HP Document Viewer 7.0
"HP Imaging Device Functions" = HP Imaging Device Functions 13.0
"HP Photo & Imaging" = HP Photosmart Premier Software 6.5
"HP Print Projects" = HP Print Projects 1.0
"HP Smart Web Printing" = HP Smart Web Printing 4.5
"HP Solution Center & Imaging Support Tools" = HP Solution Center 13.0
"HPExtendedCapabilities" = HP Customer Participation Program 13.0
"HPLJ2100 Uninstaller" = HP LaserJet 2100-Software
"HPOCR" = OCR Software by I.R.I.S 7.0
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InfraRecorder" = InfraRecorder
"InstallShield_{6BE2A4A4-99FB-48ED-AE1E-4E850389F804}" = PowerQuest PartitionMagic 8.0
"LTspice IV" = LTspice IV
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.61.0.1400
"Matrox Graphics Uninstaller" = Matrox Grafik Software (nur entfernen)
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework Full v1.0.3705 (1031)" = Microsoft .NET Framework (German) v1.0.3705
"Mozilla Firefox 13.0.1 (x86 de)" = Mozilla Firefox 13.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NIS" = Norton Internet Security
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Paketomat_is1" = Paketomat 8.2.1
"PhotoStitch" = Canon Utilities PhotoStitch
"PHP Coder_is1" = PHP Coder Release R2 Final PreRelease 3
"Picasa 3" = Picasa 3
"PreDesigner_is1" = PreDesigner
"PROSet" = Intel(R) PRO Network Connections Drivers
"RAW Image Task" = Canon RAW Image Task for ZoomBrowser EX
"ReaConverter 5.5 Pro_is1" = ReaConverter 5.5 Pro
"RemoteCaptureTask" = Canon RemoteCapture Task for ZoomBrowser EX
"Replay Media Catcher 3.02" = Replay Media Catcher 3.02
"Scribus 1.4.0" = Scribus 1.4.0.rc6
"Shop for HP Supplies" = Shop for HP Supplies
"ShowMe2.0" = ShowMe2.0
"ST5UNST #1" = Paketomat
"ST5UNST #2" = Paketomat (C:\Programme\Paketomat\)
"ST6UNST #1" = dbOptic
"VirtualCloneDrive" = VirtualCloneDrive
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"Wdf01009" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
"WinAce Archiver" = WinAce Archiver
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinGimp-2.0_is1" = GIMP 2.6.11
"WinLens3D Basic_is1" = WinLens3D Basic
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01009" = Microsoft User-Mode Driver Framework Feature Pack 1.9
"XnView_is1" = XnView 1.95.3
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
"ZEMAX Demo_is1" = ZEMAX Demo
"ZoomBrowser EX" = Canon Utilities ZoomBrowser EX
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 20.06.2012 10:13:44 | Computer Name = THOMASRECHNER | Source = NativeWrapper | ID = 5000
Description =
 
Error - 20.06.2012 10:15:34 | Computer Name = THOMASRECHNER | Source = MsiInstaller | ID = 10005
Description = Produkt: Microsoft .NET Framework 1.1 -- Interner Fehler 2705. Directory
 
Error - 20.06.2012 10:15:34 | Computer Name = THOMASRECHNER | Source = MsiInstaller | ID = 1023
Description = Produkt: Microsoft .NET Framework 1.1 - Update "{0213C6AF-5562-4D09-884C-2ADCFC8C2F35}"
 konnte nicht installiert werden. Fehlercode 1603. Weitere Informationen sind in
 der Protokolldatei C:\DOKUME~1\thomas\LOKALE~1\Temp\NDP1.1sp1-KB2656353-X86\NDP1.1sp1-KB2656353-X86-msi.0.log
 enthalten.
 
Error - 20.06.2012 10:15:35 | Computer Name = THOMASRECHNER | Source = NativeWrapper | ID = 5000
Description =
 
Error - 04.07.2012 08:59:27 | Computer Name = THOMASRECHNER | Source = MsiInstaller | ID = 10005
Description = Produkt: Microsoft .NET Framework 1.1 -- Interner Fehler 2705. Directory
 
Error - 04.07.2012 08:59:27 | Computer Name = THOMASRECHNER | Source = MsiInstaller | ID = 1023
Description = Produkt: Microsoft .NET Framework 1.1 - Update "{A38B334A-A0A2-436D-BAA0-34FE5E517E44}"
 konnte nicht installiert werden. Fehlercode 1603. Weitere Informationen sind in
 der Protokolldatei C:\DOKUME~1\thomas\LOKALE~1\Temp\NDP1.1sp1-KB2656370-X86\NDP1.1sp1-KB2656370-X86-msi.0.log
 enthalten.
 
Error - 04.07.2012 08:59:27 | Computer Name = THOMASRECHNER | Source = NativeWrapper | ID = 5000
Description =
 
Error - 04.07.2012 08:59:44 | Computer Name = THOMASRECHNER | Source = MsiInstaller | ID = 10005
Description = Produkt: Microsoft .NET Framework 1.1 -- Interner Fehler 2705. Directory
 
Error - 04.07.2012 08:59:44 | Computer Name = THOMASRECHNER | Source = MsiInstaller | ID = 1023
Description = Produkt: Microsoft .NET Framework 1.1 - Update "{0213C6AF-5562-4D09-884C-2ADCFC8C2F35}"
 konnte nicht installiert werden. Fehlercode 1603. Weitere Informationen sind in
 der Protokolldatei C:\DOKUME~1\thomas\LOKALE~1\Temp\NDP1.1sp1-KB2656353-X86\NDP1.1sp1-KB2656353-X86-msi.0.log
 enthalten.
 
Error - 04.07.2012 08:59:44 | Computer Name = THOMASRECHNER | Source = NativeWrapper | ID = 5000
Description =
 
[ System Events ]
Error - 06.07.2012 02:29:20 | Computer Name = THOMASRECHNER | Source = Service Control Manager | ID = 7031
Description = Der Dienst "IIS Admin" wurde unerwartet beendet. Dies ist bereits
3 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 1 Millisekunden durchgeführt:
 Führen Sie das konfigurierte Wiederherstellungspr.
 
Error - 06.07.2012 02:29:20 | Computer Name = THOMASRECHNER | Source = Service Control Manager | ID = 7034
Description = Dienst "Simple Mail Transfer Protocol (SMTP)" wurde unerwartet beendet.
 Dies ist bereits 3 Mal passiert.
 
Error - 06.07.2012 02:29:20 | Computer Name = THOMASRECHNER | Source = Service Control Manager | ID = 7034
Description = Dienst "WWW-Publishing" wurde unerwartet beendet. Dies ist bereits
 3 Mal passiert.
 
Error - 06.07.2012 02:36:38 | Computer Name = THOMASRECHNER | Source = Schannel | ID = 36871
Description = Ein schwerwiegender Fehler ist beim Erstellen der Referenz Server
für SSL aufgetreten.
 
Error - 06.07.2012 04:09:47 | Computer Name = THOMASRECHNER | Source = Service Control Manager | ID = 7034
Description = Dienst "Skype C2C Service" wurde unerwartet beendet. Dies ist bereits
 1 Mal passiert.
 
Error - 06.07.2012 04:22:34 | Computer Name = THOMASRECHNER | Source = smtpsvc | ID = 2013
Description = SMTP konnte keine Verbindung zu einem DNS-Server herstellen. Entweder
 sind keine Server konfiguriert, oder sie sind nicht verfügbar.
 
Error - 06.07.2012 04:23:20 | Computer Name = THOMASRECHNER | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Eingabegerätezugang" wurde mit folgendem Fehler beendet:
  %%126
 
Error - 06.07.2012 04:23:34 | Computer Name = THOMASRECHNER | Source = smtpsvc | ID = 2013
Description = SMTP konnte keine Verbindung zu einem DNS-Server herstellen. Entweder
 sind keine Server konfiguriert, oder sie sind nicht verfügbar.
 
Error - 06.07.2012 04:24:34 | Computer Name = THOMASRECHNER | Source = smtpsvc | ID = 2013
Description = SMTP konnte keine Verbindung zu einem DNS-Server herstellen. Entweder
 sind keine Server konfiguriert, oder sie sind nicht verfügbar.
 
Error - 06.07.2012 04:37:22 | Computer Name = THOMASRECHNER | Source = Schannel | ID = 36871
Description = Ein schwerwiegender Fehler ist beim Erstellen der Referenz Server
für SSL aufgetreten.
 
 
< End of report >
--- --- ---

Hier die erwünschte Log-files.....

Hoffe es hilft :-)

markusg 06.07.2012 17:29
hör bitte auf, irgendwelche enderungen oder weiteren programme auszuführen
öffne malwarebytes, berichte, poste alle logs

nicom028 10.07.2012 07:14
Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.07.06.05

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
thomas :: THOMASRECHNER [Administrator]

09.07.2012 08:22:07
mbam-log-2012-07-09 (08-22-07).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 566359
Laufzeit: 6 Stunde(n), 1 Minute(n), 55 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 1
HKCU\SOFTWARE\EGDHTML (Adware.EGDAccess) -> Keine Aktion durchgeführt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 1
HKLM\SOFTWARE\Microsoft\Security Center|AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bösartig: (1) Gut: (0) -> Keine Aktion durchgeführt.

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

(Ende)

markusg 11.07.2012 01:38
das log ist nicht vollständig, poste es erneut

nicom028 11.07.2012 13:10
Leider bekomme ich wirklich nichts mehr im Logdatei, habe kein einstellungen in Malwarebytes geändert.


Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.07.11.03

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
thomas :: THOMASRECHNER [Administrator]

11.07.2012 13:08:00
mbam-log-2012-07-11 (14-04-49).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 570417
Laufzeit: 48 Minute(n), 36 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 1
HKCU\SOFTWARE\EGDHTML (Adware.EGDAccess) -> Keine Aktion durchgeführt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 1
HKLM\SOFTWARE\Microsoft\Security Center|AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bösartig: (1) Gut: (0) -> Keine Aktion durchgeführt.

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

markusg 11.07.2012 16:19
Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.
Downloade dir bitte Combofix von einem dieser Downloadspiegel

Link 1
Link 2


WICHTIG - Speichere Combofix auf deinem Desktop
  • Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.
Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

nicom028 12.07.2012 08:02
Combofix Logfile:
Code:
ComboFix 12-07-11.03 - thomas 12.07.2012  8:29.1.1 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.49.1031.18.2038.839 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\thomas\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\dokumente und einstellungen\All Users\Anwendungsdaten\TEMP
c:\dokumente und einstellungen\thomas\WINDOWS
c:\programme\AutocompletePro
c:\programme\AutocompletePro\AutocompletePro.dll
c:\programme\AutocompletePro\chrome\autocompleteprochrome.crx
c:\programme\AutocompletePro\FireFoxExtension.exe
c:\programme\AutocompletePro\InstTracker.exe
c:\programme\AutocompletePro\support@predictad.com\chrome.manifest
c:\programme\AutocompletePro\support@predictad.com\chrome\content\browserOverlay.xul
c:\programme\AutocompletePro\support@predictad.com\chrome\content\options.js
c:\programme\AutocompletePro\support@predictad.com\chrome\content\options.xul
c:\programme\AutocompletePro\support@predictad.com\chrome\content\utils.js
c:\programme\AutocompletePro\support@predictad.com\defaults\preferences\predictad.js
c:\programme\AutocompletePro\support@predictad.com\install.rdf
c:\programme\AutocompletePro\unins000.dat
c:\programme\AutocompletePro\unins000.exe
c:\windows\IsUn0407.exe
c:\windows\system32\Cache
c:\windows\system32\PowerToyReadme.htm
c:\windows\unin0407.exe
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-06-12 bis 2012-07-12  ))))))))))))))))))))))))))))))
.
.
2012-07-10 23:37 . 2012-07-10 23:37        --------        d-----w-        c:\windows\LastGood
2012-07-10 06:42 . 2012-07-10 06:42        83064        ----a-w-        c:\windows\system32\drivers\SMR300.SYS
2012-07-10 06:42 . 2012-07-10 06:58        --------        d-----w-        c:\dokumente und einstellungen\thomas\Lokale Einstellungen\Anwendungsdaten\NPE
2012-07-09 12:42 . 2012-07-09 12:42        61440        ----a-r-        c:\dokumente und einstellungen\thomas\Anwendungsdaten\Microsoft\Installer\{3CA54984-A14B-42FE-9FF1-7EA90151D725}\NewShortcut2_E88611396FF84AFCB2EE5C1594058E02.exe
2012-07-09 12:42 . 2012-07-09 12:42        61440        ----a-r-        c:\dokumente und einstellungen\thomas\Anwendungsdaten\Microsoft\Installer\{3CA54984-A14B-42FE-9FF1-7EA90151D725}\ARPPRODUCTICON.exe
2012-07-09 12:42 . 2012-07-09 12:42        106496        ----a-r-        c:\dokumente und einstellungen\thomas\Anwendungsdaten\Microsoft\Installer\{3CA54984-A14B-42FE-9FF1-7EA90151D725}\NewShortcut311_0951773981FA4AB2BC21B7DCEC95892A.exe
2012-07-09 12:42 . 2012-07-09 12:42        106496        ----a-r-        c:\dokumente und einstellungen\thomas\Anwendungsdaten\Microsoft\Installer\{3CA54984-A14B-42FE-9FF1-7EA90151D725}\NewShortcut31_2F252077BA3F4362913955273A708467.exe
2012-07-09 12:42 . 2012-07-09 12:42        106496        ----a-r-        c:\dokumente und einstellungen\thomas\Anwendungsdaten\Microsoft\Installer\{3CA54984-A14B-42FE-9FF1-7EA90151D725}\NewShortcut1_EDD4ABB1C1B34A9D84CE33FBFB5D3639.exe
2012-07-09 12:41 . 2012-07-09 12:42        --------        d-----w-        c:\programme\Gemeinsame Dateien\Tencent
2012-07-09 12:40 . 2012-07-09 12:40        --------        d-----w-        c:\programme\Tencent
2012-07-09 12:40 . 2012-07-09 12:42        --------        d-----w-        c:\dokumente und einstellungen\thomas\Anwendungsdaten\Tencent
2012-07-06 08:55 . 2012-07-06 08:55        --------        d-----w-        c:\dokumente und einstellungen\thomas\Anwendungsdaten\Malwarebytes
2012-07-06 08:55 . 2012-07-06 08:55        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2012-07-06 08:55 . 2012-04-04 13:56        22344        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-07-06 08:55 . 2012-07-06 08:55        --------        d-----w-        c:\programme\Malwarebytes' Anti-Malware
2012-07-06 06:46 . 2012-07-06 06:46        --------        d-----w-        c:\programme\Trend Micro
2012-06-23 13:29 . 2012-06-23 13:29        9815752        ----a-w-        c:\windows\system32\FlashPlayerInstaller.exe
2012-06-20 10:37 . 2012-06-20 10:37        --------        d-----w-        c:\dokumente und einstellungen\thomas\Anwendungsdaten\ScanToPDF_4
2012-06-20 10:35 . 2012-06-20 10:38        --------        d-----w-        c:\programme\ScanToPDF
2012-06-19 15:35 . 2012-06-19 15:35        4967624        ----a-w-        c:\programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\components\SkypeFfComponent.dll
2012-06-13 13:31 . 2012-05-11 14:40        521728        -c----w-        c:\windows\system32\dllcache\jsdbgui.dll
2012-06-13 07:18 . 2012-06-13 07:17        143872        ----a-w-        c:\windows\system32javacpl.cpl
2012-06-13 07:15 . 2012-06-13 13:41        --------        d-----w-        c:\programme\FileZilla Server
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-06-23 13:29 . 2012-04-26 10:29        426184        ----a-w-        c:\windows\system32\FlashPlayerApp.exe
2012-06-23 13:29 . 2011-06-28 07:05        70344        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2012-06-02 13:19 . 2007-06-07 23:21        18456        ----a-w-        c:\windows\system32\wuaueng.dll.mui
2012-06-02 13:19 . 2007-06-07 23:21        15896        ----a-w-        c:\windows\system32\wuapi.dll.mui
2012-06-02 13:19 . 2004-08-17 04:35        329240        ----a-w-        c:\windows\system32\wucltui.dll
2012-06-02 13:19 . 2004-08-17 04:35        219160        ----a-w-        c:\windows\system32\wuaucpl.cpl
2012-06-02 13:19 . 2004-08-17 04:35        210968        ----a-w-        c:\windows\system32\wuweb.dll
2012-06-02 13:19 . 2007-06-07 23:21        15896        ----a-w-        c:\windows\system32\wuaucpl.cpl.mui
2012-06-02 13:19 . 2006-02-28 12:00        97304        ----a-w-        c:\windows\system32\cdm.dll
2012-06-02 13:19 . 2005-05-26 02:16        45080        ----a-w-        c:\windows\system32\wups2.dll
2012-06-02 13:19 . 2004-08-17 04:35        35864        ----a-w-        c:\windows\system32\wups.dll
2012-06-02 13:19 . 2003-01-07 11:15        53784        ----a-w-        c:\windows\system32\wuauclt.exe
2012-06-02 13:19 . 2007-06-07 23:21        23576        ----a-w-        c:\windows\system32\wucltui.dll.mui
2012-06-02 13:19 . 2004-08-17 04:35        577048        ----a-w-        c:\windows\system32\wuapi.dll
2012-06-02 13:19 . 2003-01-07 11:15        1933848        ----a-w-        c:\windows\system32\wuaueng.dll
2012-06-02 13:18 . 2008-05-07 06:41        214256        ----a-w-        c:\windows\system32\muweb.dll
2012-06-02 13:18 . 2008-05-07 06:41        18160        ----a-w-        c:\windows\system32\mucltui.dll.mui
2012-06-02 13:18 . 2008-05-07 06:40        275696        ----a-w-        c:\windows\system32\mucltui.dll
2012-05-31 13:22 . 2006-02-28 12:00        604160        ----a-w-        c:\windows\system32\crypt32.dll
2012-05-31 12:38 . 2009-01-12 14:04        60872        ----a-w-        c:\windows\system32\S32EVNT1.DLL
2012-05-31 12:38 . 2009-01-12 14:04        141944        ----a-w-        c:\windows\system32\drivers\SYMEVENT.SYS
2012-05-16 15:07 . 2006-02-28 12:00        916992        ----a-w-        c:\windows\system32\wininet.dll
2012-05-15 13:56 . 2006-02-28 12:00        1863296        ----a-w-        c:\windows\system32\win32k.sys
2012-05-11 14:40 . 2006-02-28 12:00        43520        ----a-w-        c:\windows\system32\licmgr10.dll
2012-05-11 14:40 . 2006-02-28 12:00        1469440        ------w-        c:\windows\system32\inetcpl.cpl
2012-05-11 11:38 . 2006-02-28 12:00        385024        ----a-w-        c:\windows\system32\html.iec
2012-05-05 03:14 . 2006-02-28 12:00        2194944        ----a-w-        c:\windows\system32\ntoskrnl.exe
2012-05-05 03:14 . 2004-08-04 00:50        2071424        ----a-w-        c:\windows\system32\ntkrnlpa.exe
2012-05-04 17:29 . 2007-04-20 12:28        143872        ----a-w-        c:\windows\system32\javacpl.cpl
2012-05-04 17:29 . 2012-02-21 14:33        772504        ----a-w-        c:\windows\system32\npdeployJava1.dll
2012-05-04 17:29 . 2010-04-23 09:16        687504        ----a-w-        c:\windows\system32\deployJava1.dll
2012-05-02 13:46 . 2003-01-07 11:15        139656        ----a-w-        c:\windows\system32\drivers\rdpwd.sys
2012-06-19 08:33 . 2011-05-02 08:37        85472        ----a-w-        c:\programme\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe" [2006-12-23 143360]
"ISUSPM"="c:\dokumente und einstellungen\All Users\Anwendungsdaten\FLEXnet\Connect\11\ISUSPM.exe" [2009-05-05 222496]
"WMPNSCFG"="c:\programme\Windows Media Player\WMPNSCFG.exe" [2006-11-03 204288]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LogMeIn GUI"="c:\programme\LogMeIn\x86\LogMeInSystray.exe" [2007-04-17 63048]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-09-25 98304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-09-25 114688]
"Persistence"="c:\windows\system32\igfxpers.exe" [2006-09-25 94208]
"SetRefresh"="c:\programme\COMPAQ\SetRefresh\\SetRefresh.exe" [2003-11-20 525824]
"LayoutM"="KLayMgr.exe" [2004-08-26 45056]
"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-21 35760]
"HP Software Update"="c:\programme\HP\HP Software Update\HPWuSchd2.exe" [2010-06-09 49208]
"NeroFilterCheck"="c:\programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"OpwareSE4"="c:\programme\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-10-11 75304]
"WrtMon.exe"="c:\windows\system32\spool\drivers\w32x86\3\WrtMon.exe" [2006-09-20 20480]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-04-13 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2008-04-13 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-13 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-13 455168]
"VirtualCloneDrive"="c:\programme\VirtualCloneDrive\VCDDaemon.exe" [2011-03-07 89456]
"QuickTime Task"="c:\programme\QuickTime\QTTask.exe" [2011-10-24 421888]
"Adobe Acrobat Speed Launcher"="c:\programme\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2008-06-12 37232]
"Acrobat Assistant 8.0"="c:\programme\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2008-06-11 640376]
"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2012-01-17 252296]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\GEMEIN~1\MICROS~1\DW\dwtrig20.exe" [2007-02-25 437160]
.
c:\dokumente und einstellungen\thomas\Startmenü\Programme\Autostart\
Adobe Gamma.lnk - c:\programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
Verknüpfung mit Mail Postgasse -Höpflergasse.lnk -  [N/A]
VPN Drucker-Internet.lnk -  [N/A]
.
c:\dokumente und einstellungen\thomas\Startmenü\Programme\Autostart\
Adobe Gamma.lnk - c:\programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
Verknüpfung mit Mail Postgasse -Höpflergasse.lnk -  [N/A]
VPN Drucker-Internet.lnk -  [N/A]
.
c:\dokumente und einstellungen\thomas\Startmenü\Programme\Autostart\
Adobe Gamma.lnk - c:\programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
Verknüpfung mit Mail Postgasse -Höpflergasse.lnk -  [N/A]
VPN Drucker-Internet.lnk -  [N/A]
.
c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\
Adobe Reader - Schnellstart.lnk - c:\programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe [N/A]
Canon LBP3300 Statusfenster.lnk - c:\windows\system32\spool\drivers\w32x86\3\CNAB5LAK.EXE [2008-10-10 50848]
VPN Drucker-Internet.lnk -  [N/A]
.
c:\dokumente und einstellungen\thomas\Startmenü\Programme\Autostart\
Adobe Gamma.lnk - c:\programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
Verknüpfung mit Mail Postgasse -Höpflergasse.lnk -  [N/A]
VPN Drucker-Internet.lnk -  [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2011-10-07 06:54        87424        ----a-w-        c:\windows\system32\LMIinit.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^HP Digital Imaging Monitor.lnk]
path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^HP Photosmart Premier – Schnellstart.lnk]
path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\HP Photosmart Premier – Schnellstart.lnk
backup=c:\windows\pss\HP Photosmart Premier – Schnellstart.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TradeManager]
c:\progra~1\Alibaba\TRADEM~1\TradeManager -hideframe [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 05:52        1695232        ----a-w-        c:\programme\messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
2010-04-16 21:12        3872080        ----a-w-        c:\programme\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2011-10-24 12:28        421888        ----a-w-        c:\programme\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\scheduler_monitor]
2007-06-15 10:17        27136        ----a-w-        c:\programme\ReaConverter 5.5 Pro\init_scheduler.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
2006-09-28 11:16        185896        ----a-w-        c:\programme\Gemeinsame Dateien\ScanSoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programme\\messenger\\msmsgs.exe"=
"c:\\WINDOWS\\system32\\CNAB5RPK.EXE"=
"c:\\Programme\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Programme\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Programme\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Programme\\Gemeinsame Dateien\\XpressUpdate\\XPressUpdate.exe"=
"c:\\Programme\\Bonjour\\mDNSResponder.exe"=
"c:\\Programme\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Programme\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Programme\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Programme\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Programme\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Programme\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Programme\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Programme\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Programme\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Programme\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Programme\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Programme\\HP\\Digital Imaging\\bin\\hpofxs08.exe"=
"c:\\Programme\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"=
"c:\\Programme\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"=
"c:\\Programme\\HP\\Digital Imaging\\bin\\hpqusgm.exe"=
"c:\\Programme\\HP\\Digital Imaging\\bin\\hpqusgh.exe"=
"c:\\Programme\\HP\\HP Software Update\\hpwucli.exe"=
"c:\\Programme\\HP\\Digital Imaging\\smart web printing\\SmartWebPrintExe.exe"=
"c:\\Programme\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Programme\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Programme\\Skype\\Phone\\Skype.exe"=
"c:\\Programme\\Tencent\\QQIntl\\Bin\\QQ.exe"=
"c:\\Programme\\Tencent\\QQIntl\\Bin\\auclt.exe"=
"c:\\Programme\\Tencent\\QQIntl\\Bin\\txupd.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
.
R0 SMR300;Symantec SMR Utility Service 3.0.0;c:\windows\system32\drivers\SMR300.SYS [10.07.2012 08:42 83064]
R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NIS\1307010.005\SymDS.sys [31.05.2012 14:36 340088]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1307010.005\SymEFA.sys [31.05.2012 14:36 905336]
R1 BHDrvx86;BHDrvx86;c:\dokumente und einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.7.1.5\Definitions\BASHDefs\20120711.001\BHDrvx86.sys [12.07.2012 03:12 821920]
R1 ccSet_NIS;Norton Internet Security Settings Manager;c:\windows\system32\drivers\NIS\1307010.005\ccSetx86.sys [31.05.2012 14:36 132744]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NIS\1307010.005\Ironx86.sys [31.05.2012 14:36 149624]
R2 LMIGuardianSvc;LMIGuardianSvc;c:\programme\LogMeIn\x86\LMIGuardianSvc.exe [29.08.2011 08:54 374152]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\programme\LogMeIn\x86\rainfo.sys [17.04.2007 14:00 12856]
R2 NIS;Norton Internet Security;c:\programme\Norton Internet Security\Norton Internet Security\Engine\19.7.1.5\ccSvcHst.exe [31.05.2012 14:36 138232]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\programme\Gemeinsame Dateien\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [31.05.2012 11:55 106656]
R3 IDSxpx86;IDSxpx86;c:\dokumente und einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.7.1.5\Definitions\IPSDefs\20120711.001\IDSXpx86.sys [12.07.2012 03:13 369632]
S2 SkypeUpdate;Skype Updater;c:\programme\Skype\Updater\Updater.exe [15.02.2012 13:30 158856]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [26.04.2012 12:29 250056]
S3 cpudrv;cpudrv;c:\programme\SystemRequirementsLab\cpudrv.sys [18.12.2009 11:58 11336]
S3 CyUsbNT;Cypress Manufacturing Driver;c:\windows\system32\drivers\CyUsbNT.sys [16.02.2005 07:43 28800]
S3 DialComService;DIAL Communication Service;c:\programme\DIAL GmbH\DIAL Communication Framework\DialComService.exe [15.05.2011 22:57 1639216]
S3 ess;ESS Audiotreiber (WDM);c:\windows\system32\drivers\ess.sys [20.09.2006 23:49 63360]
S3 FS20 IRP;FS20 IRP;c:\windows\system32\drivers\FS20 IRP.sys [25.03.2010 11:04 11264]
S3 FTD2XX;FTD2XX.SYS FT8U2XX device driver;c:\windows\system32\drivers\FTD2XX.sys [25.03.2010 11:09 29292]
S3 G200;G200;c:\windows\system32\drivers\g200mini.sys [14.09.2004 10:33 260992]
S3 gupdatem;Google Update-Dienst (gupdatem);c:\programme\Google\Update\GoogleUpdate.exe [25.05.2009 11:01 133104]
S3 HPKBCCID;HP Keyboard Smart Card Driver;c:\windows\system32\drivers\HPKBCCID.sys [13.07.2008 15:31 46976]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\programme\Mozilla Maintenance Service\maintenanceservice.exe [27.04.2012 08:18 113120]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys --> c:\windows\system32\drivers\nmwcdnsu.sys [?]
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys --> c:\windows\system32\drivers\nmwcdnsuc.sys [?]
S3 rcp_service;ReaConverter scheduler service;c:\programme\ReaConverter 5.5 Pro\rcp_scheduler.exe [30.11.2007 13:27 558592]
S3 STC2DFU;STCII DFU Adapter;c:\windows\system32\drivers\Stc2Dfu.sys [25.10.2004 00:04 7796]
S4 gupdate1c9dd17746cffd0;Google Update Service (gupdate1c9dd17746cffd0);c:\programme\Google\Update\GoogleUpdate.exe [25.05.2009 11:01 133104]
S4 Skype C2C Service;Skype C2C Service;c:\dokumente und einstellungen\All Users\Anwendungsdaten\Skype\Toolbars\Skype C2C Service\c2c_service.exe [19.06.2012 17:32 3048136]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPService        REG_MULTI_SZ          HPSLPSVC
HPZ12        REG_MULTI_SZ          Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt        REG_MULTI_SZ          hpqcxs08 hpqddsvc
.
Inhalt des "geplante Tasks" Ordners
.
2012-07-12 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-26 13:29]
.
2012-07-04 c:\windows\Tasks\dfrg.job
- c:\windows\system32\dfrg.msc [2006-02-28 12:00]
.
2012-07-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programme\Google\Update\GoogleUpdate.exe [2009-05-25 08:59]
.
2012-07-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programme\Google\Update\GoogleUpdate.exe [2009-05-25 08:59]
.
2012-07-10 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC.exe [2009-08-03 13:07]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.XXXXXXXXXX.at/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: An vorhandene PDF-Datei anfügen - c:\programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: In Adobe PDF konvertieren - c:\programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Linkziel an vorhandene PDF-Datei anhängen - c:\programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Linkziel in Adobe PDF konvertieren - c:\programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
TCP: Interfaces\{656C01D1-A252-4CD2-953F-B3CD44F56750}: NameServer = 193.186.161.35,193.186.161.66
TCP: Interfaces\{75BA237D-CD34-49E3-8345-D9EC827F3B6E}: NameServer = 193.186.161.66 193.186.161.35
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\dokumente und einstellungen\thomas\Anwendungsdaten\Mozilla\Firefox\Profiles\onwfeoa8.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.XXXXXXXXXX.at/
.
.
------- Dateityp-Verknüpfung -------
.
.scr=AutoCADScriptFile
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
SafeBoot-WudfPf
SafeBoot-WudfRd
MSConfigStartUp-PC Suite Tray - c:\programme\Nokia\Nokia PC Suite 6\PCSuite.exe
AddRemove-AutocompletePro3_is1 - c:\programme\AutocompletePro\unins000.exe
AddRemove-ShowMe2.0 - c:\dokume~1\thomas\EIGENE~1\!INFOR~1\SOFTWARE\ShowMe\UNWISE.EXE
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-07-12 08:39
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\NIS]
"ImagePath"="\"c:\programme\Norton Internet Security\Norton Internet Security\Engine\19.7.1.5\ccSvcHst.exe\" /s \"NIS\" /m \"c:\programme\Norton Internet Security\Norton Internet Security\Engine\19.7.1.5\diMaster.dll\" /prefetch:1"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-1645522239-152049171-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{932C7C0C-5A25-9FEF-925E-EB3EF2F2AAC7}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"eabkfmcimo"=hex:66,61,68,6d,6f,68,6a,6a,70,67,68,6f,00,31
"daojkpic"=hex:64,62,6e,6c,6d,68,6b,6e,70,66,6c,65,69,62,6e,6b,64,65,61,65,68,
  6b,64,63,6e,62,6f,63,70,67,65,6c,6a,63,69,69,64,6c,6f,67,00,00
"iajpgfleeoplnkfckj"=hex:6b,61,65,69,61,6c,61,67,6c,6c,66,63,66,6c,63,6a,65,69,
  67,64,69,64,00,00
"haplahbecodeoaoe"=hex:69,61,65,69,65,6d,69,66,61,6e,70,6c,6e,70,66,67,68,64,
  00,00
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'winlogon.exe'(852)
c:\windows\system32\LMIinit.dll
c:\windows\System32\NavLogon.dll
.
Zeit der Fertigstellung: 2012-07-12  08:42:53
ComboFix-quarantined-files.txt  2012-07-12 06:42
.
Vor Suchlauf: 18 Verzeichnis(se), 73.426.567.168 Bytes frei
Nach Suchlauf: 20 Verzeichnis(se), 74.374.094.848 Bytes frei
.
WindowsXP-KB310994-SP2-Pro-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /noexecute=optin
.
- - End Of File - - 3A57923D01983EB20956AFA1F05C3132
--- --- ---

markusg 12.07.2012 19:39
bisher alles unauffällig, sind neue spams hinzugekommen?

nicom028 13.07.2012 07:40
Am moment werden kein Spam mails mehr verschickt.

Ich werde es im Auge behalten und falls es wieder anfangt mich melden, aber diesmal ohne selber was zu unternehmen ;-)

Vielen Dank !!!!!!

markusg 13.07.2012 10:54
download tdss killer:
http://www.trojaner-board.de/82358-t...entfernen.html
Klicke auf Change parameters
• Setze die Haken bei Verify driver digital signatures und Detect TDLFS file system
• Klick auf OK und anschließend auf Start scan
- bei funden erst mal immer skip wählen, log posten

nicom028 13.07.2012 13:41
14:36:40.0533 5980 TDSS rootkit removing tool 2.7.45.0 Jul 9 2012 12:46:35
14:36:41.0314 5980 ============================================================
14:36:41.0314 5980 Current date / time: 2012/07/13 14:36:41.0314
14:36:41.0314 5980 SystemInfo:
14:36:41.0314 5980
14:36:41.0314 5980 OS Version: 5.1.2600 ServicePack: 3.0
14:36:41.0314 5980 Product type: Workstation
14:36:41.0314 5980 ComputerName: THOMASRECHNER
14:36:41.0314 5980 UserName: thomas
14:36:41.0314 5980 Windows directory: C:\WINDOWS
14:36:41.0314 5980 System windows directory: C:\WINDOWS
14:36:41.0314 5980 Processor architecture: Intel x86
14:36:41.0314 5980 Number of processors: 1
14:36:41.0314 5980 Page size: 0x1000
14:36:41.0314 5980 Boot type: Normal boot
14:36:41.0314 5980 ============================================================
14:36:43.0087 5980 Drive \Device\Harddisk0\DR0 - Size: 0x25433D6000 (149.05 Gb), SectorSize: 0x200, Cylinders: 0x4C01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
14:36:43.0097 5980 Drive \Device\Harddisk1\DR5 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
14:36:43.0117 5980 ============================================================
14:36:43.0117 5980 \Device\Harddisk0\DR0:
14:36:43.0117 5980 MBR partitions:
14:36:43.0117 5980 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x129BE72B
14:36:43.0117 5980 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x129BE76A, BlocksNum 0x5A357
14:36:43.0117 5980 \Device\Harddisk1\DR5:
14:36:43.0117 5980 MBR partitions:
14:36:43.0117 5980 \Device\Harddisk1\DR5\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x747059C1
14:36:43.0117 5980 ============================================================
14:36:43.0237 5980 C: <-> \Device\Harddisk0\DR0\Partition0
14:36:43.0267 5980 H: <-> \Device\Harddisk1\DR5\Partition0
14:36:43.0297 5980 D: <-> \Device\Harddisk0\DR0\Partition1
14:36:43.0297 5980 ============================================================
14:36:43.0297 5980 Initialize success
14:36:43.0297 5980 ============================================================
14:37:17.0756 5384 ============================================================
14:37:17.0756 5384 Scan started
14:37:17.0756 5384 Mode: Manual; SigCheck; TDLFS;
14:37:17.0756 5384 ============================================================
14:37:17.0977 5384 Abiosdsk - ok
14:37:17.0987 5384 abp480n5 - ok
14:37:18.0017 5384 ac97intc (0f2d66d5f08ebe2f77bb904288dcf6f0) C:\WINDOWS\system32\drivers\ac97intc.sys
14:37:20.0000 5384 ac97intc - ok
14:37:20.0070 5384 ACPI (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys
14:37:20.0260 5384 ACPI - ok
14:37:20.0310 5384 ACPIEC (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\drivers\ACPIEC.sys
14:37:20.0430 5384 ACPIEC - ok
14:37:20.0520 5384 Adobe LM Service (c1eb9968ec89fba5f3a264e2e57923ab) C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
14:37:20.0550 5384 Adobe LM Service ( UnsignedFile.Multi.Generic ) - warning
14:37:20.0550 5384 Adobe LM Service - detected UnsignedFile.Multi.Generic (1)
14:37:20.0630 5384 AdobeFlashPlayerUpdateSvc (5e1a953c6472e7bb644892a4d0df5e72) C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
14:37:20.0661 5384 AdobeFlashPlayerUpdateSvc - ok
14:37:20.0661 5384 adpu160m - ok
14:37:20.0711 5384 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
14:37:20.0911 5384 aec - ok
14:37:20.0971 5384 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
14:37:21.0091 5384 AFD - ok
14:37:21.0141 5384 agp440 (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys
14:37:21.0281 5384 agp440 - ok
14:37:21.0291 5384 Aha154x - ok
14:37:21.0301 5384 aic78u2 - ok
14:37:21.0311 5384 aic78xx - ok
14:37:21.0352 5384 Alerter (738d80cc01d7bc7584be917b7f544394) C:\WINDOWS\system32\alrsvc.dll
14:37:21.0502 5384 Alerter - ok
14:37:21.0572 5384 ALG (190cd73d4984f94d823f9444980513e5) C:\WINDOWS\System32\alg.exe
14:37:21.0662 5384 ALG - ok
14:37:21.0672 5384 AliIde - ok
14:37:21.0682 5384 amsint - ok
14:37:21.0732 5384 AppMgmt (d45960be52c3c610d361977057f98c54) C:\WINDOWS\System32\appmgmts.dll
14:37:21.0822 5384 AppMgmt - ok
14:37:21.0832 5384 asc - ok
14:37:21.0842 5384 asc3350p - ok
14:37:21.0842 5384 asc3550 - ok
14:37:21.0952 5384 aspnet_state (0e5e4957549056e2bf2c49f4f6b601ad) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
14:37:21.0992 5384 aspnet_state - ok
14:37:22.0012 5384 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
14:37:22.0163 5384 AsyncMac - ok
14:37:22.0193 5384 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
14:37:22.0333 5384 atapi - ok
14:37:22.0343 5384 Atdisk - ok
14:37:22.0393 5384 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
14:37:22.0533 5384 Atmarpc - ok
14:37:22.0583 5384 AudioSrv (58ed0d5452df7be732193e7999c6b9a4) C:\WINDOWS\System32\audiosrv.dll
14:37:22.0744 5384 AudioSrv - ok
14:37:22.0804 5384 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
14:37:22.0964 5384 audstub - ok
14:37:23.0004 5384 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
14:37:23.0164 5384 Beep - ok
14:37:23.0384 5384 BHDrvx86 (a9e111a358ac5f7eba7ac61e43fc6725) C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.7.1.5\Definitions\BASHDefs\20120711.002\BHDrvx86.sys
14:37:23.0455 5384 BHDrvx86 - ok
14:37:23.0535 5384 BITS (d6f603772a789bb3228f310d650b8bd1) C:\WINDOWS\system32\qmgr.dll
14:37:23.0885 5384 BITS - ok
14:37:23.0945 5384 Browser (b42057f06bbb98b31876c0b3f2b54e33) C:\WINDOWS\System32\browser.dll
14:37:24.0095 5384 Browser - ok
14:37:24.0206 5384 catchme - ok
14:37:24.0256 5384 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
14:37:24.0406 5384 cbidf2k - ok
14:37:24.0526 5384 CCALib8 (5753532c476b83119d85aa43b1b10ab3) C:\Programme\Canon\CAL\CALMAIN.exe
14:37:24.0556 5384 CCALib8 ( UnsignedFile.Multi.Generic ) - warning
14:37:24.0556 5384 CCALib8 - detected UnsignedFile.Multi.Generic (1)
14:37:24.0666 5384 ccSet_NIS (599e7f6259a127c174c49938d2aa6a60) C:\WINDOWS\system32\drivers\NIS\1307010.005\ccSetx86.sys
14:37:24.0686 5384 ccSet_NIS - ok
14:37:24.0696 5384 cd20xrnt - ok
14:37:24.0756 5384 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
14:37:24.0907 5384 Cdaudio - ok
14:37:24.0967 5384 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
14:37:25.0127 5384 Cdfs - ok
14:37:25.0197 5384 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
14:37:25.0347 5384 Cdrom - ok
14:37:25.0357 5384 Changer - ok
14:37:25.0407 5384 cisvc (28e3040d1f1ca2008cd6b29dfebc9a5e) C:\WINDOWS\system32\cisvc.exe
14:37:25.0528 5384 cisvc - ok
14:37:25.0578 5384 ClipSrv (778a30ed3c134eb7e406afc407e9997d) C:\WINDOWS\system32\clipsrv.exe
14:37:25.0738 5384 ClipSrv - ok
14:37:25.0818 5384 clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
14:37:25.0898 5384 clr_optimization_v2.0.50727_32 - ok
14:37:25.0908 5384 CmdIde - ok
14:37:25.0918 5384 COMSysApp - ok
14:37:25.0928 5384 Cpqarray - ok
14:37:26.0028 5384 cpudrv (d01f685f8b4598d144b0cce9ff95d8d5) C:\Programme\SystemRequirementsLab\cpudrv.sys
14:37:26.0038 5384 cpudrv - ok
14:37:26.0118 5384 CryptSvc (611f824e5c703a5a899f84c5f1699e4d) C:\WINDOWS\System32\cryptsvc.dll
14:37:26.0279 5384 CryptSvc - ok
14:37:26.0329 5384 CyUsbNT (90a71fc40eade3d1789b0ed2ca80b1cf) C:\WINDOWS\system32\Drivers\CyUsbNT.sys
14:37:26.0349 5384 CyUsbNT ( UnsignedFile.Multi.Generic ) - warning
14:37:26.0349 5384 CyUsbNT - detected UnsignedFile.Multi.Generic (1)
14:37:26.0359 5384 dac2w2k - ok
14:37:26.0369 5384 dac960nt - ok
14:37:26.0419 5384 DcomLaunch (3127afbf2c1ed0ab14a1bbb7aaecb85b) C:\WINDOWS\system32\rpcss.dll
14:37:26.0539 5384 DcomLaunch - ok
14:37:26.0599 5384 Dhcp (c29a1c9b75ba38fa37f8c44405dec360) C:\WINDOWS\System32\dhcpcsvc.dll
14:37:26.0749 5384 Dhcp - ok
14:37:26.0910 5384 DialComService (3ccf97a963fa6ea21c215744480bf349) C:\Programme\DIAL GmbH\DIAL Communication Framework\DialComService.exe
14:37:27.0020 5384 DialComService - ok
14:37:27.0140 5384 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
14:37:27.0290 5384 Disk - ok
14:37:27.0300 5384 dmadmin - ok
14:37:27.0360 5384 dmboot (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys
14:37:27.0550 5384 dmboot - ok
14:37:27.0580 5384 dmio (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\DRIVERS\dmio.sys
14:37:27.0751 5384 dmio - ok
14:37:27.0791 5384 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
14:37:27.0921 5384 dmload - ok
14:37:27.0981 5384 dmserver (25c83ffbba13b554eb6d59a9b2e2ee78) C:\WINDOWS\System32\dmserver.dll
14:37:28.0141 5384 dmserver - ok
14:37:28.0181 5384 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
14:37:28.0312 5384 DMusic - ok
14:37:28.0382 5384 Dnscache (407f3227ac618fd1ca54b335b083de07) C:\WINDOWS\System32\dnsrslvr.dll
14:37:28.0532 5384 Dnscache - ok
14:37:28.0582 5384 Dot3svc (676e36c4ff5bcea1900f44182b9723e6) C:\WINDOWS\System32\dot3svc.dll
14:37:28.0722 5384 Dot3svc - ok
14:37:28.0732 5384 dpti2o - ok
14:37:28.0772 5384 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
14:37:28.0912 5384 drmkaud - ok
14:37:28.0983 5384 E100B (5c940a174dfb2c42b9f6ba6edc2baa0b) C:\WINDOWS\system32\DRIVERS\e100b325.sys
14:37:29.0013 5384 E100B - ok
14:37:29.0063 5384 EapHost (4e4f2fddab0a0736d7671134dcce91fb) C:\WINDOWS\System32\eapsvc.dll
14:37:29.0213 5384 EapHost - ok
14:37:29.0283 5384 eeCtrl (fce87ba643d5e9a8b6e0378508d1b22d) C:\Programme\Gemeinsame Dateien\Symantec Shared\EENGINE\eeCtrl.sys
14:37:29.0313 5384 eeCtrl - ok
14:37:29.0373 5384 EL90XBC (6e883bf518296a40959131c2304af714) C:\WINDOWS\system32\DRIVERS\el90xbc5.sys
14:37:29.0513 5384 EL90XBC - ok
14:37:29.0573 5384 ElbyCDIO (d71233d7ccc2e64f8715a20428d5a33b) C:\WINDOWS\system32\Drivers\ElbyCDIO.sys
14:37:29.0583 5384 ElbyCDIO - ok
14:37:29.0633 5384 EraserUtilRebootDrv (115dc729465a8c386615207f28875255) C:\Programme\Gemeinsame Dateien\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
14:37:29.0653 5384 EraserUtilRebootDrv - ok
14:37:29.0694 5384 ERSvc (877c18558d70587aa7823a1a308ac96b) C:\WINDOWS\System32\ersvc.dll
14:37:29.0854 5384 ERSvc - ok
14:37:29.0894 5384 ess (ab570fb40832bee65f4d90a7f02792bf) C:\WINDOWS\system32\drivers\ess.sys
14:37:30.0034 5384 ess - ok
14:37:30.0074 5384 Eventlog (a3edbe9053889fb24ab22492472b39dc) C:\WINDOWS\system32\services.exe
14:37:30.0094 5384 Eventlog - ok
14:37:30.0174 5384 EventSystem (af4f6b5739d18ca7972ab53e091cbc74) C:\WINDOWS\system32\es.dll
14:37:30.0304 5384 EventSystem - ok
14:37:30.0344 5384 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
14:37:30.0495 5384 Fastfat - ok
14:37:30.0555 5384 FastUserSwitchingCompatibility (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
14:37:30.0635 5384 FastUserSwitchingCompatibility - ok
14:37:30.0685 5384 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
14:37:30.0835 5384 Fdc - ok
14:37:30.0945 5384 FileZilla Server (7e76eed28b8b8696b7f7ed5f757aa304) C:\Programme\FileZilla Server\FileZilla Server.exe
14:37:31.0005 5384 FileZilla Server ( UnsignedFile.Multi.Generic ) - warning
14:37:31.0005 5384 FileZilla Server - detected UnsignedFile.Multi.Generic (1)
14:37:31.0065 5384 Fips (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys
14:37:31.0216 5384 Fips - ok
14:37:31.0316 5384 FLEXnet Licensing Service (f76d04f7413b07daa029f6520b64b4e8) C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
14:37:31.0366 5384 FLEXnet Licensing Service ( UnsignedFile.Multi.Generic ) - warning
14:37:31.0366 5384 FLEXnet Licensing Service - detected UnsignedFile.Multi.Generic (1)
14:37:31.0416 5384 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
14:37:31.0556 5384 Flpydisk - ok
14:37:31.0616 5384 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
14:37:31.0746 5384 FltMgr - ok
14:37:31.0847 5384 FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
14:37:31.0867 5384 FontCache3.0.0.0 - ok
14:37:31.0917 5384 FS20 IRP (739b948c5c6ea11414e8bbb899c6c768) C:\WINDOWS\system32\drivers\FS20 IRP.sys
14:37:31.0947 5384 FS20 IRP ( UnsignedFile.Multi.Generic ) - warning
14:37:31.0947 5384 FS20 IRP - detected UnsignedFile.Multi.Generic (1)
14:37:32.0007 5384 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
14:37:32.0157 5384 Fs_Rec - ok
14:37:32.0187 5384 FTD2XX (ab40574f179b60be08fe87df70ecf9eb) C:\WINDOWS\system32\Drivers\FTD2XX.sys
14:37:32.0207 5384 FTD2XX ( UnsignedFile.Multi.Generic ) - warning
14:37:32.0207 5384 FTD2XX - detected UnsignedFile.Multi.Generic (1)
14:37:32.0247 5384 Ftdisk (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
14:37:32.0397 5384 Ftdisk - ok
14:37:32.0457 5384 G200 (11ef4d6d08a926b037b72ca35f746607) C:\WINDOWS\system32\DRIVERS\g200mini.sys
14:37:32.0528 5384 G200 - ok
14:37:32.0568 5384 GEARAspiWDM (f2f431d1573ee632975c524418655b84) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
14:37:32.0578 5384 GEARAspiWDM - ok
14:37:32.0608 5384 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
14:37:32.0758 5384 Gpc - ok
14:37:32.0858 5384 gupdate1c9dd17746cffd0 (626a24ed1228580b9518c01930936df9) C:\Programme\Google\Update\GoogleUpdate.exe
14:37:32.0888 5384 gupdate1c9dd17746cffd0 - ok
14:37:32.0898 5384 gupdatem (626a24ed1228580b9518c01930936df9) C:\Programme\Google\Update\GoogleUpdate.exe
14:37:32.0918 5384 gupdatem - ok
14:37:32.0958 5384 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
14:37:33.0128 5384 HDAudBus - ok
14:37:33.0209 5384 helpsvc (cb66bf85bf599befd6c6a57c2e20357f) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
14:37:33.0359 5384 helpsvc - ok
14:37:33.0369 5384 HidServ - ok
14:37:33.0409 5384 hidusb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
14:37:33.0529 5384 hidusb - ok
14:37:33.0569 5384 hkmsvc (ed29f14101523a6e0e808107405d452c) C:\WINDOWS\System32\kmsvc.dll
14:37:33.0709 5384 hkmsvc - ok
14:37:33.0789 5384 HP Port Resolver (c5f00d15aa15cb7f55a027ff75e44bb7) C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
14:37:33.0870 5384 HP Port Resolver - ok
14:37:33.0910 5384 HP Status Server (c5a288e4ceef5a26d105117baa3763ab) C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
14:37:33.0980 5384 HP Status Server - ok
14:37:34.0030 5384 HPKBCCID (1ffda46b645473d56c72aae6e1002825) C:\WINDOWS\system32\DRIVERS\HPKBCCID.sys
14:37:34.0080 5384 HPKBCCID - ok
14:37:34.0090 5384 hpn - ok
14:37:34.0190 5384 hpqcxs08 (0a3c6aa4a9fc38c20ba4eac2c3351c05) C:\Programme\HP\Digital Imaging\bin\hpqcxs08.dll
14:37:34.0280 5384 hpqcxs08 ( UnsignedFile.Multi.Generic ) - warning
14:37:34.0280 5384 hpqcxs08 - detected UnsignedFile.Multi.Generic (1)
14:37:34.0320 5384 hpqddsvc (f3f72a2a86c22610bca5439fa789dd52) C:\Programme\HP\Digital Imaging\bin\hpqddsvc.dll
14:37:34.0340 5384 hpqddsvc ( UnsignedFile.Multi.Generic ) - warning
14:37:34.0340 5384 hpqddsvc - detected UnsignedFile.Multi.Generic (1)
14:37:34.0410 5384 HPSLPSVC (79737e0f7d25de8405cb34d4c9882253) C:\Programme\HP\Digital Imaging\bin\HPSLPSVC32.DLL
14:37:34.0470 5384 HPSLPSVC ( UnsignedFile.Multi.Generic ) - warning
14:37:34.0470 5384 HPSLPSVC - detected UnsignedFile.Multi.Generic (1)
14:37:34.0611 5384 hpt3xx - ok
14:37:34.0641 5384 HPZid412 (d03d10f7ded688fecf50f8fbf1ea9b8a) C:\WINDOWS\system32\DRIVERS\HPZid412.sys
14:37:34.0951 5384 HPZid412 - ok
14:37:35.0001 5384 HPZipr12 (89f41658929393487b6b7d13c8528ce3) C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
14:37:35.0041 5384 HPZipr12 - ok
14:37:35.0091 5384 HPZius12 (abcb05ccdbf03000354b9553820e39f8) C:\WINDOWS\system32\DRIVERS\HPZius12.sys
14:37:35.0131 5384 HPZius12 - ok
14:37:35.0191 5384 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
14:37:35.0282 5384 HTTP - ok
14:37:35.0322 5384 HTTPFilter (9e4adb854cebcfb81a4b36718feecd16) C:\WINDOWS\System32\w3ssl.dll
14:37:35.0452 5384 HTTPFilter - ok
14:37:35.0462 5384 i2omgmt - ok
14:37:35.0472 5384 i2omp - ok
14:37:35.0512 5384 i8042prt (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
14:37:35.0662 5384 i8042prt - ok
14:37:35.0692 5384 i81x (06b7ef73ba5f302eecc294cdf7e19702) C:\WINDOWS\system32\DRIVERS\i81xnt5.sys
14:37:35.0872 5384 i81x - ok
14:37:35.0922 5384 iAimFP0 (7b5b44efe5eb9dadfb8ee29700885d23) C:\WINDOWS\system32\DRIVERS\wADV01nt.sys
14:37:36.0043 5384 iAimFP0 - ok
14:37:36.0063 5384 iAimFP1 (eb1f6bab6c22ede0ba551b527475f7e9) C:\WINDOWS\system32\DRIVERS\wADV02NT.sys
14:37:36.0203 5384 iAimFP1 - ok
14:37:36.0223 5384 iAimFP2 (03ce989d846c1aa81145cb22fcb86d06) C:\WINDOWS\system32\DRIVERS\wADV05NT.sys
14:37:36.0363 5384 iAimFP2 - ok
14:37:36.0393 5384 iAimFP3 (525849b4469de021d5d61b4db9be3a9d) C:\WINDOWS\system32\DRIVERS\wSiINTxx.sys
14:37:36.0533 5384 iAimFP3 - ok
14:37:36.0573 5384 iAimFP4 (589c2bcdb5bd602bf7b63d210407ef8c) C:\WINDOWS\system32\DRIVERS\wVchNTxx.sys
14:37:36.0714 5384 iAimFP4 - ok
14:37:36.0774 5384 iAimFP5 (0308aef61941e4af478fa1a0f83812f5) C:\WINDOWS\system32\DRIVERS\wADV07nt.sys
14:37:36.0914 5384 iAimFP5 - ok
14:37:36.0944 5384 iAimFP6 (714038a8aa5de08e12062202cd7eaeb5) C:\WINDOWS\system32\DRIVERS\wADV08nt.sys
14:37:37.0094 5384 iAimFP6 - ok
14:37:37.0134 5384 iAimFP7 (7bb3aa595e4507a788de1cdc63f4c8c4) C:\WINDOWS\system32\DRIVERS\wADV09nt.sys
14:37:37.0264 5384 iAimFP7 - ok
14:37:37.0294 5384 iAimTV0 (d83bdd5c059667a2f647a6be5703a4d2) C:\WINDOWS\system32\DRIVERS\wATV01nt.sys
14:37:37.0425 5384 iAimTV0 - ok
14:37:37.0485 5384 iAimTV1 (ed968d23354daa0d7c621580c012a1f6) C:\WINDOWS\system32\DRIVERS\wATV02NT.sys
14:37:37.0635 5384 iAimTV1 - ok
14:37:37.0645 5384 iAimTV2 - ok
14:37:37.0665 5384 iAimTV3 (d738273f218a224c1ddac04203f27a84) C:\WINDOWS\system32\DRIVERS\wATV04nt.sys
14:37:37.0795 5384 iAimTV3 - ok
14:37:37.0845 5384 iAimTV4 (0052d118995cbab152daabe6106d1442) C:\WINDOWS\system32\DRIVERS\wCh7xxNT.sys
14:37:37.0965 5384 iAimTV4 - ok
14:37:38.0026 5384 iAimTV5 (791cc45de6e50445be72e8ad6401ff45) C:\WINDOWS\system32\DRIVERS\wATV10nt.sys
14:37:38.0176 5384 iAimTV5 - ok
14:37:38.0186 5384 iAimTV6 (352fa0e98bc461ce1ce5d41f64db558d) C:\WINDOWS\system32\DRIVERS\wATV06nt.sys
14:37:38.0356 5384 iAimTV6 - ok
14:37:38.0446 5384 ialm (85d42b7f0dd406adf5e3ec7659a279ec) C:\WINDOWS\system32\DRIVERS\igxpmp32.sys
14:37:38.0566 5384 ialm - ok
14:37:38.0706 5384 idsvc (c01ac32dc5c03076cfb852cb5da5229c) c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
14:37:38.0787 5384 idsvc - ok
14:37:38.0977 5384 IDSxpx86 (eeebf3616db90124c1c57019d39aa9a2) C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.7.1.5\Definitions\IPSDefs\20120712.001\IDSxpx86.sys
14:37:39.0007 5384 IDSxpx86 - ok
14:37:39.0187 5384 IISADMIN (f8d14349fb28a8d8db21fd69bc0e102d) C:\WINDOWS\system32\inetsrv\inetinfo.exe
14:37:39.0267 5384 IISADMIN - ok
14:37:39.0337 5384 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
14:37:39.0478 5384 Imapi - ok
14:37:39.0508 5384 ImapiService (d4b413aa210c21e46aedd2ba5b68d38e) C:\WINDOWS\system32\imapi.exe
14:37:39.0648 5384 ImapiService - ok
14:37:39.0668 5384 ini910u - ok
14:37:39.0868 5384 IntcAzAudAddService (b29781b9a90cd55fc5d859c0b1c243bc) C:\WINDOWS\system32\drivers\RtkHDAud.sys
14:37:40.0229 5384 IntcAzAudAddService - ok
14:37:40.0379 5384 IntelIde (69c4e3c9e67a1f103b94e14fdd5f3213) C:\WINDOWS\system32\DRIVERS\intelide.sys
14:37:40.0529 5384 IntelIde - ok
14:37:40.0559 5384 intelppm (4c7d2750158ed6e7ad642d97bffae351) C:\WINDOWS\system32\DRIVERS\intelppm.sys
14:37:40.0699 5384 intelppm - ok
14:37:40.0739 5384 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
14:37:40.0870 5384 Ip6Fw - ok
14:37:40.0910 5384 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
14:37:41.0040 5384 IpFilterDriver - ok
14:37:41.0090 5384 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
14:37:41.0220 5384 IpInIp - ok
14:37:41.0260 5384 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
14:37:41.0400 5384 IpNat - ok
14:37:41.0440 5384 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
14:37:41.0581 5384 IPSec - ok
14:37:41.0631 5384 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
14:37:41.0701 5384 IRENUM - ok
14:37:41.0761 5384 isapnp (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys
14:37:41.0881 5384 isapnp - ok
14:37:41.0981 5384 JavaQuickStarterService (c2c1660ddcc9bd67eb98d6d5f91c107f) C:\Programme\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe
14:37:42.0001 5384 JavaQuickStarterService - ok
14:37:42.0041 5384 Kbdclass (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
14:37:42.0171 5384 Kbdclass - ok
14:37:42.0202 5384 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
14:37:42.0342 5384 kmixer - ok
14:37:42.0382 5384 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
14:37:42.0502 5384 KSecDD - ok
14:37:42.0542 5384 lanmanserver (2bbdcb79900990f0716dfcb714e72de7) C:\WINDOWS\System32\srvsvc.dll
14:37:42.0632 5384 lanmanserver - ok
14:37:42.0672 5384 lanmanworkstation (1869b14b06b44b44af70548e1ea3303f) C:\WINDOWS\System32\wkssvc.dll
14:37:42.0752 5384 lanmanworkstation - ok
14:37:42.0762 5384 lbrtfdc - ok
14:37:42.0822 5384 LightScribeService (559c9b7800fac92fc515cd0003d7c631) C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
14:37:42.0842 5384 LightScribeService ( UnsignedFile.Multi.Generic ) - warning
14:37:42.0842 5384 LightScribeService - detected UnsignedFile.Multi.Generic (1)
14:37:42.0882 5384 LmHosts (636714b7d43c8d0c80449123fd266920) C:\WINDOWS\System32\lmhsvc.dll
14:37:43.0033 5384 LmHosts - ok
14:37:43.0123 5384 LMIGuardianSvc (850cc3ee0507654c40e1971982f4b698) C:\Programme\LogMeIn\x86\LMIGuardianSvc.exe
14:37:43.0153 5384 LMIGuardianSvc - ok
14:37:43.0183 5384 LMIInfo (4f69faaabb7db0d43e327c0b6aab40fc) C:\Programme\LogMeIn\x86\RaInfo.sys
14:37:43.0203 5384 LMIInfo - ok
14:37:43.0263 5384 LMIMaint (47dc389d96a34debdf9c2c2555da2f01) C:\Programme\LogMeIn\x86\RaMaint.exe
14:37:43.0283 5384 LMIMaint - ok
14:37:43.0323 5384 lmimirr (4477689e2d8ae6b78ba34c9af4cc1ed1) C:\WINDOWS\system32\DRIVERS\lmimirr.sys
14:37:43.0333 5384 lmimirr - ok
14:37:43.0343 5384 LMIRfsClientNP - ok
14:37:43.0383 5384 LMIRfsDriver (3faa563ddf853320f90259d455a01d79) C:\WINDOWS\system32\drivers\LMIRfsDriver.sys
14:37:43.0393 5384 LMIRfsDriver - ok
14:37:43.0443 5384 LogMeIn (432618fa75b61059d2c57d6a7e55147a) C:\Programme\LogMeIn\x86\LogMeIn.exe
14:37:43.0493 5384 LogMeIn - ok
14:37:43.0533 5384 Messenger (b7550a7107281d170ce85524b1488c98) C:\WINDOWS\System32\msgsvc.dll
14:37:43.0674 5384 Messenger - ok
14:37:43.0714 5384 MGABGEXE (99950c81909d240d41308008e3b1d073) C:\WINDOWS\system32\mgabg.exe
14:37:43.0734 5384 MGABGEXE - ok
14:37:43.0774 5384 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
14:37:43.0924 5384 mnmdd - ok
14:37:43.0964 5384 mnmsrvc (c2f1d365fd96791b037ee504868065d3) C:\WINDOWS\System32\mnmsrvc.exe
14:37:44.0104 5384 mnmsrvc - ok
14:37:44.0154 5384 Modem (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys
14:37:44.0274 5384 Modem - ok
14:37:44.0295 5384 Mouclass (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys
14:37:44.0435 5384 Mouclass - ok
14:37:44.0475 5384 mouhid (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys
14:37:44.0605 5384 mouhid - ok
14:37:44.0645 5384 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
14:37:44.0805 5384 MountMgr - ok
14:37:44.0905 5384 MozillaMaintenance (15d5398eed42c2504bb3d4fc875c15d1) C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe
14:37:44.0965 5384 MozillaMaintenance - ok
14:37:44.0975 5384 mraid35x - ok
14:37:45.0136 5384 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
14:37:45.0276 5384 MRxDAV - ok
14:37:45.0336 5384 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
14:37:45.0446 5384 MRxSmb - ok
14:37:45.0476 5384 MSDTC (35a031af38c55f92d28aa03ee9f12cc9) C:\WINDOWS\System32\msdtc.exe
14:37:45.0606 5384 MSDTC - ok
14:37:45.0656 5384 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
14:37:45.0787 5384 Msfs - ok
14:37:45.0797 5384 MSIServer - ok
14:37:45.0827 5384 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
14:37:45.0967 5384 MSKSSRV - ok
14:37:46.0017 5384 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
14:37:46.0147 5384 MSPCLOCK - ok
14:37:46.0197 5384 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
14:37:46.0337 5384 MSPQM - ok
14:37:46.0378 5384 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
14:37:46.0498 5384 mssmbios - ok
14:37:46.0528 5384 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
14:37:46.0608 5384 Mup - ok
14:37:46.0648 5384 napagent (46bb15ae2ac7d025d6d2567b876817bd) C:\WINDOWS\System32\qagentrt.dll
14:37:46.0798 5384 napagent - ok
14:37:47.0008 5384 NAVENG (f11033730b38260b6892e837c457fb4b) C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.7.1.5\Definitions\VirusDefs\20120712.034\NAVENG.SYS
14:37:47.0028 5384 NAVENG - ok
14:37:47.0109 5384 NAVEX15 (4e4e7c0259d3bb97de24a636c0e06aba) C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.7.1.5\Definitions\VirusDefs\20120712.034\NAVEX15.SYS
14:37:47.0199 5384 NAVEX15 - ok
14:37:47.0339 5384 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
14:37:47.0489 5384 NDIS - ok
14:37:47.0529 5384 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
14:37:47.0589 5384 NdisTapi - ok
14:37:47.0619 5384 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
14:37:47.0760 5384 Ndisuio - ok
14:37:47.0790 5384 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
14:37:47.0930 5384 NdisWan - ok
14:37:47.0980 5384 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
14:37:48.0060 5384 NDProxy - ok
14:37:48.0120 5384 Net Driver HPZ12 (510c138564486ff926a3f773205c63d1) C:\WINDOWS\system32\HPZinw12.dll
14:37:48.0140 5384 Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
14:37:48.0140 5384 Net Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
14:37:48.0180 5384 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
14:37:48.0320 5384 NetBIOS - ok
14:37:48.0350 5384 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
14:37:48.0501 5384 NetBT - ok
14:37:48.0541 5384 NetDDE (8ace4251bffd09ce75679fe940e996cc) C:\WINDOWS\system32\netdde.exe
14:37:48.0701 5384 NetDDE - ok
14:37:48.0711 5384 NetDDEdsdm (8ace4251bffd09ce75679fe940e996cc) C:\WINDOWS\system32\netdde.exe
14:37:48.0831 5384 NetDDEdsdm - ok
14:37:48.0871 5384 Netlogon (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
14:37:49.0021 5384 Netlogon - ok
14:37:49.0061 5384 Netman (e6d88f1f6745bf00b57e7855a2ab696c) C:\WINDOWS\System32\netman.dll
14:37:49.0202 5384 Netman - ok
14:37:49.0322 5384 NetTcpPortSharing (d34612c5d02d026535b3095d620626ae) c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
14:37:49.0372 5384 NetTcpPortSharing - ok
14:37:49.0462 5384 NIS (c6948f034d7edabcfa2234d399fc78bc) C:\Programme\Norton Internet Security\Norton Internet Security\Engine\19.7.1.5\ccSvcHst.exe
14:37:49.0482 5384 NIS - ok
14:37:49.0522 5384 Nla (f1b67b6b0751ae0e6e964b02821206a3) C:\WINDOWS\System32\mswsock.dll
14:37:49.0562 5384 Nla - ok
14:37:49.0672 5384 NMIndexingService (c4ebbbd7165be535f0bfd06b80601d91) C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe
14:37:49.0712 5384 NMIndexingService ( UnsignedFile.Multi.Generic ) - warning
14:37:49.0712 5384 NMIndexingService - detected UnsignedFile.Multi.Generic (1)
14:37:49.0742 5384 nmwcd - ok
14:37:49.0752 5384 nmwcdc - ok
14:37:49.0762 5384 nmwcdnsu - ok
14:37:49.0772 5384 nmwcdnsuc - ok
14:37:49.0802 5384 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
14:37:49.0923 5384 Npfs - ok
14:37:49.0963 5384 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
14:37:50.0143 5384 Ntfs - ok
14:37:50.0183 5384 NtLmSsp (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
14:37:50.0303 5384 NtLmSsp - ok
14:37:50.0353 5384 NtmsSvc (56af4064996fa5bac9c449b1514b4770) C:\WINDOWS\system32\ntmssvc.dll
14:37:50.0523 5384 NtmsSvc - ok
14:37:50.0564 5384 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
14:37:50.0674 5384 Null - ok
14:37:50.0714 5384 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
14:37:50.0844 5384 NwlnkFlt - ok
14:37:50.0874 5384 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
14:37:51.0004 5384 NwlnkFwd - ok
14:37:51.0034 5384 P3 (a7af0c0860f1c43fc6581ba8a99eabef) C:\WINDOWS\system32\DRIVERS\p3.sys
14:37:51.0174 5384 P3 - ok
14:37:51.0204 5384 Parport (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\DRIVERS\parport.sys
14:37:51.0355 5384 Parport - ok
14:37:51.0385 5384 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
14:37:51.0505 5384 PartMgr - ok
14:37:51.0545 5384 ParVdm (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys
14:37:51.0675 5384 ParVdm - ok
14:37:51.0725 5384 pccsmcfd (fd2041e9ba03db7764b2248f02475079) C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys
14:37:51.0795 5384 pccsmcfd - ok
14:37:51.0835 5384 PCI (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys
14:37:51.0986 5384 PCI - ok
14:37:51.0996 5384 PCIDump - ok
14:37:52.0026 5384 PCIIde (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\DRIVERS\pciide.sys
14:37:52.0156 5384 PCIIde - ok
14:37:52.0186 5384 Pcmcia (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\drivers\Pcmcia.sys
14:37:52.0326 5384 Pcmcia - ok
14:37:52.0326 5384 PDCOMP - ok
14:37:52.0336 5384 PDFRAME - ok
14:37:52.0346 5384 PDRELI - ok
14:37:52.0356 5384 PDRFRAME - ok
14:37:52.0366 5384 perc2 - ok
14:37:52.0376 5384 perc2hib - ok
14:37:52.0426 5384 PlugPlay (a3edbe9053889fb24ab22492472b39dc) C:\WINDOWS\system32\services.exe
14:37:52.0436 5384 PlugPlay - ok
14:37:52.0476 5384 Pml Driver HPZ12 (37e5e8ffbad35605daeec3224ea0e465) C:\WINDOWS\system32\HPZipm12.dll
14:37:52.0506 5384 Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
14:37:52.0506 5384 Pml Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
14:37:52.0516 5384 PolicyAgent (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
14:37:52.0637 5384 PolicyAgent - ok
14:37:52.0677 5384 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
14:37:52.0817 5384 PptpMiniport - ok
14:37:52.0867 5384 PQNTDrv (b26019a686d36e22f954e67c8fec4297) C:\WINDOWS\system32\drivers\PQNTDrv.sys
14:37:52.0897 5384 PQNTDrv ( UnsignedFile.Multi.Generic ) - warning
14:37:52.0897 5384 PQNTDrv - detected UnsignedFile.Multi.Generic (1)
14:37:52.0937 5384 Processor (2cb55427c58679f49ad600fccba76360) C:\WINDOWS\system32\DRIVERS\processr.sys
14:37:53.0067 5384 Processor - ok
14:37:53.0077 5384 ProtectedStorage (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
14:37:53.0207 5384 ProtectedStorage - ok
14:37:53.0237 5384 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
14:37:53.0378 5384 PSched - ok
14:37:53.0418 5384 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
14:37:53.0558 5384 Ptilink - ok
14:37:53.0598 5384 PxHelp20 (0457e25bb122b854e267cf552dcdc370) C:\WINDOWS\system32\Drivers\PxHelp20.sys
14:37:53.0628 5384 PxHelp20 ( UnsignedFile.Multi.Generic ) - warning
14:37:53.0628 5384 PxHelp20 - detected UnsignedFile.Multi.Generic (1)
14:37:53.0628 5384 ql1080 - ok
14:37:53.0638 5384 Ql10wnt - ok
14:37:53.0648 5384 ql12160 - ok
14:37:53.0658 5384 ql1240 - ok
14:37:53.0668 5384 ql1280 - ok
14:37:53.0708 5384 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
14:37:53.0848 5384 RasAcd - ok
14:37:53.0888 5384 RasAuto (f5ba6caccdb66c8f048e867563203246) C:\WINDOWS\System32\rasauto.dll
14:37:54.0019 5384 RasAuto - ok
14:37:54.0069 5384 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
14:37:54.0189 5384 Rasl2tp - ok
14:37:54.0229 5384 RasMan (f9a7b66ea345726edb5862a46b1eccd5) C:\WINDOWS\System32\rasmans.dll
14:37:54.0369 5384 RasMan - ok
14:37:54.0379 5384 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
14:37:54.0509 5384 RasPppoe - ok
14:37:54.0539 5384 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
14:37:54.0649 5384 Raspti - ok
14:37:54.0750 5384 rcp_service (b694467b0325267c8eabf04a71d53d99) C:\Programme\ReaConverter 5.5 Pro\rcp_scheduler.exe
14:37:54.0790 5384 rcp_service ( UnsignedFile.Multi.Generic ) - warning
14:37:54.0790 5384 rcp_service - detected UnsignedFile.Multi.Generic (1)
14:37:54.0840 5384 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
14:37:54.0970 5384 Rdbss - ok
14:37:55.0010 5384 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
14:37:55.0140 5384 RDPCDD - ok
14:37:55.0180 5384 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
14:37:55.0320 5384 rdpdr - ok
14:37:55.0370 5384 RDPWD (6589db6e5969f8eee594cf71171c5028) C:\WINDOWS\system32\drivers\RDPWD.sys
14:37:55.0421 5384 RDPWD - ok
14:37:55.0461 5384 RDSessMgr (263af18af0f3db99f574c95f284ccec9) C:\WINDOWS\system32\sessmgr.exe
14:37:55.0611 5384 RDSessMgr - ok
14:37:55.0651 5384 redbook (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys
14:37:55.0781 5384 redbook - ok
14:37:55.0831 5384 RemoteAccess (0e97ec96d6942ceec2d188cc2eb69a01) C:\WINDOWS\System32\mprdim.dll
14:37:55.0951 5384 RemoteAccess - ok
14:37:55.0991 5384 RemoteRegistry (e4cd1f3d84e1c2ca0b8cf7501e201593) C:\WINDOWS\system32\regsvc.dll
14:37:56.0132 5384 RemoteRegistry - ok
14:37:56.0172 5384 RpcLocator (2a02e21867497df20b8fc95631395169) C:\WINDOWS\system32\locator.exe
14:37:56.0292 5384 RpcLocator - ok
14:37:56.0332 5384 RpcSs (3127afbf2c1ed0ab14a1bbb7aaecb85b) C:\WINDOWS\System32\rpcss.dll
14:37:56.0382 5384 RpcSs - ok
14:37:56.0442 5384 RSVP (4bdd71b4b521521499dfd14735c4f398) C:\WINDOWS\system32\rsvp.exe
14:37:56.0572 5384 RSVP - ok
14:37:56.0582 5384 rtl8139 - ok
14:37:56.0622 5384 SamSs (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
14:37:56.0732 5384 SamSs - ok
14:37:56.0772 5384 SCardSvr (dcec079fad95d36c8dd5cb6d779dfe32) C:\WINDOWS\System32\SCardSvr.exe
14:37:56.0923 5384 SCardSvr - ok
14:37:56.0963 5384 Schedule (a050194a44d7fa8d7186ed2f4e8367ae) C:\WINDOWS\system32\schedsvc.dll
14:37:57.0113 5384 Schedule - ok
14:37:57.0173 5384 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
14:37:57.0243 5384 Secdrv - ok
14:37:57.0273 5384 seclogon (bee4cfd1d48c23b44cf4b974b0b79b2b) C:\WINDOWS\System32\seclogon.dll
14:37:57.0413 5384 seclogon - ok
14:37:57.0453 5384 SENS (2aac9b6ed9eddffb721d6452e34d67e3) C:\WINDOWS\system32\sens.dll
14:37:57.0584 5384 SENS - ok
14:37:57.0624 5384 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
14:37:57.0764 5384 serenum - ok
14:37:57.0774 5384 Serial (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\DRIVERS\serial.sys
14:37:57.0924 5384 Serial - ok
14:37:58.0024 5384 ServiceLayer (2d841b7b7f6dec32162edfcc69d61f42) C:\Programme\PC Connectivity Solution\ServiceLayer.exe
14:37:58.0054 5384 ServiceLayer ( UnsignedFile.Multi.Generic ) - warning
14:37:58.0054 5384 ServiceLayer - detected UnsignedFile.Multi.Generic (1)
14:37:58.0104 5384 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
14:37:58.0235 5384 Sfloppy - ok
14:37:58.0285 5384 SharedAccess (cad058d5f8b889a87ca3eb3cf624dcef) C:\WINDOWS\System32\ipnathlp.dll
14:37:58.0455 5384 SharedAccess - ok
14:37:58.0495 5384 ShellHWDetection (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
14:37:58.0505 5384 ShellHWDetection - ok
14:37:58.0515 5384 Simbad - ok
14:37:58.0735 5384 Skype C2C Service (2a99850c2a6edd6c6602e822c716edaf) C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Skype\Toolbars\Skype C2C Service\c2c_service.exe
14:37:58.0875 5384 Skype C2C Service - ok
14:37:58.0936 5384 SkypeUpdate (db0405d9aad62f0762e0876ac142b7e1) C:\Programme\Skype\Updater\Updater.exe
14:37:58.0956 5384 SkypeUpdate - ok
14:37:59.0076 5384 SMR300 (964c7e906079a61320bad4f992e7d777) C:\WINDOWS\system32\drivers\SMR300.SYS
14:37:59.0096 5384 SMR300 - ok
14:37:59.0166 5384 SMTPSVC (f8d14349fb28a8d8db21fd69bc0e102d) C:\WINDOWS\System32\inetsrv\inetinfo.exe
14:37:59.0256 5384 SMTPSVC - ok
14:37:59.0306 5384 smwdm (4931615ef9543728e0204973be27b350) C:\WINDOWS\system32\drivers\smwdm.sys
14:37:59.0426 5384 smwdm - ok
14:37:59.0466 5384 SONYPVU1 (a1eceeaa5c5e74b2499eb51d38185b84) C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS
14:37:59.0607 5384 SONYPVU1 - ok
14:37:59.0617 5384 Sparrow - ok
14:37:59.0657 5384 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
14:37:59.0787 5384 splitter - ok
14:37:59.0837 5384 Spooler (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe
14:37:59.0887 5384 Spooler - ok
14:37:59.0907 5384 sr (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys
14:37:59.0987 5384 sr - ok
14:38:00.0037 5384 srservice (fe77a85495065f3ad59c5c65b6c54182) C:\WINDOWS\system32\srsvc.dll
14:38:00.0127 5384 srservice - ok
14:38:00.0237 5384 SRTSP (9dd258ee034afd36259cb7357e19d0b1) C:\WINDOWS\System32\Drivers\NIS\1307010.005\SRTSP.SYS
14:38:00.0288 5384 SRTSP - ok
14:38:00.0338 5384 SRTSPX (0cc3a10f363436c7b478419eb73f8d91) C:\WINDOWS\system32\drivers\NIS\1307010.005\SRTSPX.SYS
14:38:00.0348 5384 SRTSPX - ok
14:38:00.0408 5384 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
14:38:00.0488 5384 Srv - ok
14:38:00.0538 5384 SSDPSRV (4df5b05dfaec29e13e1ed6f6ee12c500) C:\WINDOWS\System32\ssdpsrv.dll
14:38:00.0648 5384 SSDPSRV - ok
14:38:00.0688 5384 STC2DFU (594898b175b8b7d2897a71227d4bbda1) C:\WINDOWS\system32\DRIVERS\Stc2Dfu.SYS
14:38:00.0728 5384 STC2DFU - ok
14:38:00.0778 5384 stisvc (bc2c5985611c5356b24aeb370953ded9) C:\WINDOWS\system32\wiaservc.dll
14:38:00.0918 5384 stisvc - ok
14:38:00.0958 5384 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
14:38:01.0099 5384 swenum - ok
14:38:01.0129 5384 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
14:38:01.0249 5384 swmidi - ok
14:38:01.0259 5384 SwPrv - ok
14:38:01.0269 5384 symc810 - ok
14:38:01.0279 5384 symc8xx - ok
14:38:01.0289 5384 SYMDNS - ok
14:38:01.0329 5384 SymDS (690fa0e61b90084c4d9a721bd4f3d779) C:\WINDOWS\system32\drivers\NIS\1307010.005\SYMDS.SYS
14:38:01.0359 5384 SymDS - ok
14:38:01.0439 5384 SymEFA (4e55148a2e044d02245cbcdbb266b98c) C:\WINDOWS\system32\drivers\NIS\1307010.005\SYMEFA.SYS
14:38:01.0489 5384 SymEFA - ok
14:38:01.0529 5384 SymEvent (74e2521e96176a4449570e50be91954d) C:\WINDOWS\system32\Drivers\SYMEVENT.SYS
14:38:01.0549 5384 SymEvent - ok
14:38:01.0559 5384 SYMFW - ok
14:38:01.0569 5384 SYMIDS - ok
14:38:01.0609 5384 SymIRON (2c356cca706505cf63cbe39d532b9236) C:\WINDOWS\system32\drivers\NIS\1307010.005\Ironx86.SYS
14:38:01.0629 5384 SymIRON - ok
14:38:01.0639 5384 SYMNDIS - ok
14:38:01.0649 5384 SYMREDRV - ok
14:38:01.0690 5384 SYMTDI (508bd882040f9cb12319e3a4fc78edb9) C:\WINDOWS\System32\Drivers\NIS\1307010.005\SYMTDI.SYS
14:38:01.0720 5384 SYMTDI - ok
14:38:01.0730 5384 sym_hi - ok
14:38:01.0740 5384 sym_u3 - ok
14:38:01.0780 5384 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
14:38:01.0920 5384 sysaudio - ok
14:38:01.0960 5384 SysmonLog (2903fffa2523926d6219428040dce6b9) C:\WINDOWS\system32\smlogsvc.exe
14:38:02.0100 5384 SysmonLog - ok
14:38:02.0160 5384 TapiSrv (05903cac4b98908d55ea5774775b382e) C:\WINDOWS\System32\tapisrv.dll
14:38:02.0290 5384 TapiSrv - ok
14:38:02.0330 5384 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
14:38:02.0381 5384 Tcpip - ok
14:38:02.0431 5384 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
14:38:02.0551 5384 TDPIPE - ok
14:38:02.0591 5384 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
14:38:02.0721 5384 TDTCP - ok
14:38:02.0761 5384 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
14:38:02.0901 5384 TermDD - ok
14:38:02.0951 5384 TermService (b7de02c863d8f5a005a7bf375375a6a4) C:\WINDOWS\System32\termsrv.dll
14:38:03.0082 5384 TermService - ok
14:38:03.0132 5384 Themes (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
14:38:03.0152 5384 Themes - ok
14:38:03.0212 5384 TlntSvr (03681a1ce77f51586903869a5ab1deab) C:\WINDOWS\System32\tlntsvr.exe
14:38:03.0302 5384 TlntSvr - ok
14:38:03.0312 5384 TosIde - ok
14:38:03.0342 5384 TrkWks (626504572b175867f30f3215c04b3e2f) C:\WINDOWS\system32\trkwks.dll
14:38:03.0482 5384 TrkWks - ok
14:38:03.0542 5384 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
14:38:03.0662 5384 Udfs - ok
14:38:03.0672 5384 ultra - ok
14:38:03.0722 5384 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
14:38:03.0863 5384 Update - ok
14:38:03.0913 5384 upnphost (1dfd8975d8c89214b98d9387c1125b49) C:\WINDOWS\System32\upnphost.dll
14:38:04.0023 5384 upnphost - ok
14:38:04.0033 5384 upperdev - ok
14:38:04.0063 5384 UPS (9b11e6118958e63e1fef129466e2bda7) C:\WINDOWS\System32\ups.exe
14:38:04.0193 5384 UPS - ok
14:38:04.0203 5384 USBAAPL - ok
14:38:04.0253 5384 usbaudio (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys
14:38:04.0373 5384 usbaudio - ok
14:38:04.0393 5384 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
14:38:04.0534 5384 usbccgp - ok
14:38:04.0574 5384 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
14:38:04.0714 5384 usbehci - ok
14:38:04.0764 5384 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
14:38:04.0904 5384 usbhub - ok
14:38:04.0944 5384 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
14:38:05.0094 5384 usbprint - ok
14:38:05.0124 5384 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
14:38:05.0285 5384 usbscan - ok
14:38:05.0315 5384 usbser (1c888b000c2f9492f4b15b5b6b84873e) C:\WINDOWS\system32\drivers\usbser.sys
14:38:05.0445 5384 usbser - ok
14:38:05.0455 5384 UsbserFilt - ok
14:38:05.0485 5384 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
14:38:05.0625 5384 USBSTOR - ok
14:38:05.0665 5384 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
14:38:05.0805 5384 usbuhci - ok
14:38:05.0846 5384 VClone (fce98c43b5c5db8e0da8ea0e2b45e044) C:\WINDOWS\system32\DRIVERS\VClone.sys
14:38:05.0866 5384 VClone ( UnsignedFile.Multi.Generic ) - warning
14:38:05.0866 5384 VClone - detected UnsignedFile.Multi.Generic (1)
14:38:05.0896 5384 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
14:38:06.0036 5384 VgaSave - ok
14:38:06.0046 5384 ViaIde - ok
14:38:06.0076 5384 VIAPFD (662626bccf060f2f4b6d5af7ac121ff5) C:\WINDOWS\System32\Drivers\VIAPFD.SYS
14:38:06.0076 5384 VIAPFD ( UnsignedFile.Multi.Generic ) - warning
14:38:06.0076 5384 VIAPFD - detected UnsignedFile.Multi.Generic (1)
14:38:06.0106 5384 VolSnap (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys
14:38:06.0236 5384 VolSnap - ok
14:38:06.0266 5384 VSS (68f106273be29e7b7ef8266977268e78) C:\WINDOWS\System32\vssvc.exe
14:38:06.0356 5384 VSS - ok
14:38:06.0396 5384 W32Time (7b353059e665f8b7ad2bbeaef597cf45) C:\WINDOWS\system32\w32time.dll
14:38:06.0526 5384 W32Time - ok
14:38:06.0587 5384 W3SVC (f8d14349fb28a8d8db21fd69bc0e102d) C:\WINDOWS\system32\inetsrv\inetinfo.exe
14:38:06.0677 5384 W3SVC - ok
14:38:06.0727 5384 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
14:38:06.0867 5384 Wanarp - ok
14:38:06.0917 5384 Wdf01000 (d918617b46457b9ac28027722e30f647) C:\WINDOWS\system32\Drivers\wdf01000.sys
14:38:06.0957 5384 Wdf01000 - ok
14:38:06.0967 5384 WDICA - ok
14:38:07.0007 5384 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
14:38:07.0137 5384 wdmaud - ok
14:38:07.0177 5384 WebClient (81727c9873e3905a2ffc1ebd07265002) C:\WINDOWS\System32\webclnt.dll
14:38:07.0308 5384 WebClient - ok
14:38:07.0378 5384 winmgmt (6f3f3973d97714cc5f906a19fe883729) C:\WINDOWS\system32\wbem\WMIsvc.dll
14:38:07.0508 5384 winmgmt - ok
14:38:07.0588 5384 WinRM (f10075c2ec96d2eb118012e78ece2fc2) C:\WINDOWS\system32\WsmSvc.dll
14:38:07.0748 5384 WinRM - ok
14:38:07.0808 5384 WmdmPmSN (c51b4a5c05a5475708e3c81c7765b71d) C:\WINDOWS\system32\MsPMSNSv.dll
14:38:07.0949 5384 WmdmPmSN - ok
14:38:08.0059 5384 Wmi (ffa4d901d46d07a5bab2d8307fbb51a6) C:\WINDOWS\System32\advapi32.dll
14:38:08.0129 5384 Wmi - ok
14:38:08.0179 5384 WmiApSrv (93908111ba57a6e60ec2fa2de202105c) C:\WINDOWS\system32\wbem\wmiapsrv.exe
14:38:08.0299 5384 WmiApSrv - ok
14:38:08.0399 5384 WMPNetworkSvc (bf05650bb7df5e9ebdd25974e22403bb) C:\Programme\Windows Media Player\WMPNetwk.exe
14:38:08.0489 5384 WMPNetworkSvc - ok
14:38:08.0549 5384 WpdUsb (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys
14:38:08.0579 5384 WpdUsb - ok
14:38:08.0609 5384 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
14:38:08.0740 5384 WS2IFSL - ok
14:38:08.0790 5384 wscsvc (300b3e84faf1a5c1f791c159ba28035d) C:\WINDOWS\system32\wscsvc.dll
14:38:08.0940 5384 wscsvc - ok
14:38:08.0960 5384 wuauserv (7b4fe05202aa6bf9f4dfd0e6a0d8a085) C:\WINDOWS\system32\wuauserv.dll
14:38:09.0080 5384 wuauserv - ok
14:38:09.0120 5384 WudfPf (eaa6324f51214d2f6718977ec9ce0def) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
14:38:09.0200 5384 WudfPf - ok
14:38:09.0250 5384 WudfRd (f91ff1e51fca30b3c3981db7d5924252) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
14:38:09.0270 5384 WudfRd - ok
14:38:09.0300 5384 WudfSvc (ddee3682fe97037c45f4d7ab467cb8b6) C:\WINDOWS\System32\WUDFSvc.dll
14:38:09.0321 5384 WudfSvc - ok
14:38:09.0361 5384 WZCSVC (c4f109c005f6725162d2d12ca751e4a7) C:\WINDOWS\System32\wzcsvc.dll
14:38:09.0521 5384 WZCSVC - ok
14:38:09.0561 5384 xmlprov (0ada34871a2e1cd2caafed1237a47750) C:\WINDOWS\System32\xmlprov.dll
14:38:09.0701 5384 xmlprov - ok
14:38:09.0721 5384 MBR (0x1B8) (72b8ce41af0de751c946802b3ed844b4) \Device\Harddisk0\DR0
14:38:10.0152 5384 \Device\Harddisk0\DR0 - ok
14:38:10.0162 5384 MBR (0x1B8) (739b36f7a373fc81121d831231b6d311) \Device\Harddisk1\DR5
14:38:10.0532 5384 \Device\Harddisk1\DR5 - ok
14:38:10.0542 5384 Boot (0x1200) (7aa8a8dc4eb530c5989cbbdbfc3eba72) \Device\Harddisk0\DR0\Partition0
14:38:10.0542 5384 \Device\Harddisk0\DR0\Partition0 - ok
14:38:10.0582 5384 Boot (0x1200) (dd11549d43e261653d88147850445739) \Device\Harddisk0\DR0\Partition1
14:38:10.0582 5384 \Device\Harddisk0\DR0\Partition1 - ok
14:38:10.0592 5384 Boot (0x1200) (aacb6b58daa0c5de4719b9d30bec1fd3) \Device\Harddisk1\DR5\Partition0
14:38:10.0592 5384 \Device\Harddisk1\DR5\Partition0 - ok
14:38:10.0602 5384 ============================================================
14:38:10.0602 5384 Scan finished
14:38:10.0602 5384 ============================================================
14:38:10.0723 4368 Detected object count: 20
14:38:10.0723 4368 Actual detected object count: 20
14:38:50.0570 4368 Adobe LM Service ( UnsignedFile.Multi.Generic ) - skipped by user
14:38:50.0570 4368 Adobe LM Service ( UnsignedFile.Multi.Generic ) - User select action: Skip
14:38:50.0570 4368 CCALib8 ( UnsignedFile.Multi.Generic ) - skipped by user
14:38:50.0570 4368 CCALib8 ( UnsignedFile.Multi.Generic ) - User select action: Skip
14:38:50.0570 4368 CyUsbNT ( UnsignedFile.Multi.Generic ) - skipped by user
14:38:50.0570 4368 CyUsbNT ( UnsignedFile.Multi.Generic ) - User select action: Skip
14:38:50.0570 4368 FileZilla Server ( UnsignedFile.Multi.Generic ) - skipped by user
14:38:50.0570 4368 FileZilla Server ( UnsignedFile.Multi.Generic ) - User select action: Skip
14:38:50.0570 4368 FLEXnet Licensing Service ( UnsignedFile.Multi.Generic ) - skipped by user
14:38:50.0570 4368 FLEXnet Licensing Service ( UnsignedFile.Multi.Generic ) - User select action: Skip
14:38:50.0570 4368 FS20 IRP ( UnsignedFile.Multi.Generic ) - skipped by user
14:38:50.0570 4368 FS20 IRP ( UnsignedFile.Multi.Generic ) - User select action: Skip
14:38:50.0580 4368 FTD2XX ( UnsignedFile.Multi.Generic ) - skipped by user
14:38:50.0580 4368 FTD2XX ( UnsignedFile.Multi.Generic ) - User select action: Skip
14:38:50.0580 4368 hpqcxs08 ( UnsignedFile.Multi.Generic ) - skipped by user
14:38:50.0580 4368 hpqcxs08 ( UnsignedFile.Multi.Generic ) - User select action: Skip
14:38:50.0580 4368 hpqddsvc ( UnsignedFile.Multi.Generic ) - skipped by user
14:38:50.0580 4368 hpqddsvc ( UnsignedFile.Multi.Generic ) - User select action: Skip
14:38:50.0580 4368 HPSLPSVC ( UnsignedFile.Multi.Generic ) - skipped by user
14:38:50.0580 4368 HPSLPSVC ( UnsignedFile.Multi.Generic ) - User select action: Skip
14:38:50.0590 4368 LightScribeService ( UnsignedFile.Multi.Generic ) - skipped by user
14:38:50.0590 4368 LightScribeService ( UnsignedFile.Multi.Generic ) - User select action: Skip
14:38:50.0590 4368 Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
14:38:50.0590 4368 Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip
14:38:50.0590 4368 NMIndexingService ( UnsignedFile.Multi.Generic ) - skipped by user
14:38:50.0590 4368 NMIndexingService ( UnsignedFile.Multi.Generic ) - User select action: Skip
14:38:50.0590 4368 Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
14:38:50.0590 4368 Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip
14:38:50.0590 4368 PQNTDrv ( UnsignedFile.Multi.Generic ) - skipped by user
14:38:50.0590 4368 PQNTDrv ( UnsignedFile.Multi.Generic ) - User select action: Skip
14:38:50.0590 4368 PxHelp20 ( UnsignedFile.Multi.Generic ) - skipped by user
14:38:50.0590 4368 PxHelp20 ( UnsignedFile.Multi.Generic ) - User select action: Skip
14:38:50.0600 4368 rcp_service ( UnsignedFile.Multi.Generic ) - skipped by user
14:38:50.0600 4368 rcp_service ( UnsignedFile.Multi.Generic ) - User select action: Skip
14:38:50.0600 4368 ServiceLayer ( UnsignedFile.Multi.Generic ) - skipped by user
14:38:50.0600 4368 ServiceLayer ( UnsignedFile.Multi.Generic ) - User select action: Skip
14:38:50.0600 4368 VClone ( UnsignedFile.Multi.Generic ) - skipped by user
14:38:50.0600 4368 VClone ( UnsignedFile.Multi.Generic ) - User select action: Skip
14:38:50.0600 4368 VIAPFD ( UnsignedFile.Multi.Generic ) - skipped by user
14:38:50.0600 4368 VIAPFD ( UnsignedFile.Multi.Generic ) - User select action: Skip

markusg 14.07.2012 17:27
das sieht alles soweit io aus
machst du irgendwas wichtiges mit dem pc? banking, einkäufe etc?

nicom028 16.07.2012 07:21
Also, ins wochenende ist es wieder los gegangen.

Ich mache jetzt nichts und lasse die spam mails weiterlaufen, bitte um anweisungen.......

Unterstehend mal ein mail:

From: postmaster@Thomasrechner
To: sloboz@muie.com
Date: Mon, 16 Jul 2012 05:49:24 +0200
MIME-Version: 1.0
Content-Type: multipart/report; report-type=delivery-status;
boundary="9B095B5ADSN=_01CD5FF8CC8072C000000005Thomasrechner"
Message-ID: <FRaqbC8wS00000003@Thomasrechner>
Subject: Benachrichtung
zum
=?unicode-1-1-utf-7?Q?+ANw-bermittlungsstatus
(Fehlgeschlagen)?=

This is a MIME-formatted message.
Portions of this message may be unreadable without a MIME-capable mail program.

--9B095B5ADSN=_01CD5FF8CC8072C000000005Thomasrechner
Content-Type: text/plain; charset=unicode-1-1-utf-7

Dies ist eine automatisch erstellte Benachrichtigung +APw-ber den Zustellstatus.

Den folgenden Empf+AOQ-ngern konnte die Nachricht nicht zugestellt werden, weil keine Verbindung mit dem Zielserver hergestellt werden konnte.

daumuie4@libero.it




--9B095B5ADSN=_01CD5FF8CC8072C000000005Thomasrechner
Content-Type: message/delivery-status

Reporting-MTA: dns;Thomasrechner
Received-From-MTA: dns;cartasi
Arrival-Date: Sat, 14 Jul 2012 03:31:24 +0200

Final-Recipient: rfc822;daumuie4@libero.it
Action: failed
Status: 4.4.7

--9B095B5ADSN=_01CD5FF8CC8072C000000005Thomasrechner
Content-Type: message/rfc822

Received: from cartasi ([109.99.149.198]) by Thomasrechner with Microsoft SMTPSVC(6.0.2600.5949);
Sat, 14 Jul 2012 03:31:24 +0200
MIME-Version: 1.0
From: sloboz@muie.com
To: daumuie4@libero.it
Date: 14 Jul 2012 04:31:09 +0300
Subject: 194.112.246.13,spam@Vienna-RemoteB013.profinet.at,spam
Return-Path: sloboz@muie.com
Message-ID: <THOMASRECHNERKp3QGq00000001@Thomasrechner>
X-OriginalArrivalTime: 14 Jul 2012 01:31:24.0323 (UTC) FILETIME=[61720730:01CD6160]





--9B095B5ADSN=_01CD5FF8CC8072C000000005Thomasrechner--


Alle Zeitangaben in WEZ +1. Es ist jetzt 04:52 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131