Trojaner-Board - Das System hat ein Problem mit einem oder mehreren installierten IDE-/SATA-Festplatten erkannt

Guten Tag zusammen,

ich hoffe ihr könnt mich mal wieder aus der scheiße holen.

Die oben stehende Fehlermeldung bekam ich vor circa 2 Wochen schon. Habe dann Windows neu aufgespielt, nun kam die Meldung jedoch wieder.

Habe nun Scann mit OTL und Malwarebytes durchgeführt.

Code:

OTL logfile created on: 15.05.2011 14:58:02 - Run 1

OTL by OldTimer - Version 3.2.22.3     Folder = C:\Users\Heinz04\Downloads

 Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7600.16385)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 67,00% Memory free

7,00 Gb Paging File | 6,00 Gb Available in Paging File | 83,00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 115,13 Gb Total Space | 67,66 Gb Free Space | 58,76% Space Free | Partition Type: NTFS

Drive D: | 116,29 Gb Total Space | 2,78 Gb Free Space | 2,39% Space Free | Partition Type: NTFS

 

Computer Name: HEINZ04-PC | User Name: Heinz04 | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2011.05.14 20:59:09 | 000,580,608 | -H-- | M] (OldTimer Tools) -- C:\Users\Heinz04\Downloads\OTL.exe

PRC - [2011.05.10 14:10:58 | 003,459,712 | ---- | M] (AVAST Software) -- C:\Programme\AVAST Software\Avast\AvastUI.exe

PRC - [2011.05.10 14:10:57 | 000,042,184 | ---- | M] (AVAST Software) -- C:\Programme\AVAST Software\Avast\AvastSvc.exe

PRC - [2011.03.28 16:15:17 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe

PRC - [2011.03.28 16:15:04 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe

PRC - [2011.03.28 16:14:56 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe

PRC - [2011.03.28 16:14:56 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe

PRC - [2011.02.26 07:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2011.02.24 07:32:52 | 000,673,040 | ---- | M] (Microsoft Corporation) -- C:\Programme\Internet Explorer\iexplore.exe

PRC - [2010.07.28 02:23:50 | 000,526,992 | ---- | M] (Corel, Inc.) -- C:\Programme\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe

PRC - [2010.06.21 17:47:04 | 000,246,584 | ---- | M] () -- C:\Programme\ICQ6Toolbar\ICQ Service.exe

PRC - [2010.03.10 14:26:48 | 000,189,728 | ---- | M] (Protexis Inc.) -- c:\Programme\Common Files\Protexis\License Service\PsiService_2.exe

PRC - [2009.08.18 02:36:36 | 000,348,160 | ---- | M] (AMD) -- C:\Windows\System32\atieclxx.exe

PRC - [2009.08.18 02:36:08 | 000,176,128 | ---- | M] (AMD) -- C:\Windows\System32\atiesrxx.exe

PRC - [2009.07.14 03:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe

PRC - [2009.07.14 03:14:15 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe

 

 
 ========== Modules (SafeList) ==========

 

MOD - [2011.05.14 20:59:09 | 000,580,608 | -H-- | M] (OldTimer Tools) -- C:\Users\Heinz04\Downloads\OTL.exe

MOD - [2010.08.21 07:21:32 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - [2011.05.10 14:10:57 | 000,042,184 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)

SRV - [2011.04.29 01:03:20 | 003,274,328 | ---- | M] () [Auto | Running] -- C:\Programme\Common Files\Akamai\netsession_win_3f211bc.dll -- (Akamai)

SRV - [2011.03.28 16:15:04 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2011.03.28 16:14:56 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2010.06.21 17:47:04 | 000,246,584 | ---- | M] () [Auto | Running] -- C:\Programme\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service)

SRV - [2010.03.10 14:26:48 | 000,189,728 | ---- | M] (Protexis Inc.) [Auto | Running] -- c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2)

SRV - [2009.08.18 02:36:08 | 000,176,128 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)

SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)

SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - [2011.05.10 14:03:54 | 000,441,176 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\System32\drivers\aswSnx.sys -- (aswSnx)

DRV - [2011.05.10 14:03:44 | 000,307,928 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswSP.sys -- (aswSP)

DRV - [2011.05.10 14:02:37 | 000,049,240 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswTdi.sys -- (aswTdi)

DRV - [2011.05.10 13:59:56 | 000,025,432 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswRdr.sys -- (aswRdr)

DRV - [2011.05.10 13:59:44 | 000,053,592 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswMonFlt.sys -- (aswMonFlt)

DRV - [2011.05.10 13:59:35 | 000,019,544 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswFsBlk.sys -- (aswFsBlk)

DRV - [2011.04.01 17:07:25 | 000,137,656 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)

DRV - [2011.04.01 17:07:25 | 000,061,960 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2010.06.17 15:27:02 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2009.08.18 03:48:06 | 004,994,560 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)

DRV - [2009.07.14 00:13:48 | 001,035,776 | ---- | M] (LSI Corp) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)

DRV - [2009.07.14 00:02:53 | 000,347,136 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTL8187B.sys -- (RTL8187B) RTL8187B Drahtlos-802.11b/g-USB 2.0-Netzwerkadapter (54 MBit/s)

DRV - [2007.11.09 05:00:52 | 000,023,640 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\TVALZ_O.SYS -- (TVALZ)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://search.babylon.com/?babsrc=SP_ss&q={searchTerms}&mntrId=a0dc1db20000000000000021636bbfd4&tlver=1.4.19.19&ss=1&affID=17395

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.babylon.com/?babsrc=HP_ss&mntrId=a0dc1db20000000000000021636bbfd4&tlver=1.4.19.19&ss=1&affID=17395

IE - HKCU\..\URLSearchHook:  - Reg Error: Key error. File not found

IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultenginename: "ICQ Search"

FF - prefs.js..browser.search.selectedEngine: "Google"

FF - prefs.js..browser.startup.homepage: "hxxp://search.babylon.com/?babsrc=HP_ss&mntrId=a0dc1db20000000000000021636bbfd4&tlver=1.4.19.19&ss=1&affID=17395"

FF - prefs.js..keyword.URL: "hxxp://search.babylon.com/?babsrc=SP_ss&mntrId=a0dc1db20000000000000021636bbfd4&tlver=1.4.19.19&instlRef=sst&ss=1&affID=17395&q="

 

FF - HKLM\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2011.05.14 20:48:14 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.05.10 22:18:22 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins

 

[2011.05.03 16:23:44 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Heinz04\AppData\Roaming\mozilla\Extensions

[2011.05.03 22:34:24 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Heinz04\AppData\Roaming\mozilla\Firefox\Profiles\rd8mk46y.default\extensions

[2011.05.03 16:33:54 | 000,000,000 | -H-D | M] ("ICQ Toolbar") -- C:\Users\Heinz04\AppData\Roaming\mozilla\Firefox\Profiles\rd8mk46y.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}

[2011.05.03 22:34:25 | 000,000,000 | -H-D | M] (Babylon) -- C:\Users\Heinz04\AppData\Roaming\mozilla\Firefox\Profiles\rd8mk46y.default\extensions\ffxtlbr@babylon.com

[2011.05.10 22:33:48 | 000,001,056 | -H-- | M] () -- C:\Users\Heinz04\AppData\Roaming\Mozilla\Firefox\Profiles\rd8mk46y.default\searchplugins\icqplugin.xml

[2011.05.09 12:17:50 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions

[2011.05.03 16:44:44 | 000,000,000 | ---D | M] (Skype extension) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}

[2011.05.09 12:17:50 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

File not found (No name found) -- 

[2011.05.14 20:48:14 | 000,000,000 | ---D | M] (avast! WebRep) -- C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\WEBREP\FF

[2011.05.03 16:44:44 | 000,000,000 | ---D | M] (Skype extension) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}

[2011.05.09 12:17:50 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

[2011.04.14 18:40:03 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Programme\Mozilla Firefox\components\browsercomps.dll

[2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml

[2011.05.03 22:34:25 | 000,002,428 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\babylon.xml

[2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\bing.xml

[2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml

[2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml

[2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml

[2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -  File not found

O2 - BHO: (CescrtHlpr Object) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Programme\BabylonToolbar\BabylonToolbar\1.4.19.19\bh\BabylonToolbar.dll (Babylon BHO)

O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)

O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Programme\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarTlbr.dll (Babylon Ltd.)

O4 - HKLM..\Run: [Adobe ARM]  File not found

O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [BabylonToolbar] C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarsrv.exe (Babylon Ltd.)

O4 - HKLM..\Run: [Corel File Shell Monitor]  File not found

O4 - HKCU..\Run: [Corel Photo Downloader] c:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe (Corel, Inc.)

O4 - HKCU..\Run: [eGJterJSMsHHPPC]  File not found

O4 - HKCU..\Run: [ICQ] C:\Program Files\ICQ7.5\ICQ.exe (ICQ, LLC.)

O4 - Startup: C:\Users\Heinz04\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Programme\OpenOffice.org 3\program\quickstart.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)

O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)

O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)

O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - c:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)

O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - D:\autoexec.bat -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *) -  File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

NetSvcs: FastUserSwitchingCompatibility -  File not found

NetSvcs: Ias -  File not found

NetSvcs: Nla -  File not found

NetSvcs: Ntmssvc -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: SRService -  File not found

NetSvcs: WmdmPmSp -  File not found

NetSvcs: LogonHours -  File not found

NetSvcs: PCAudit -  File not found

NetSvcs: helpsvc -  File not found

NetSvcs: uploadmgr -  File not found

 

 

SafeBootMin: AppMgmt - Service

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: HelpSvc - Service

SafeBootMin: NTDS -  File not found

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: sacsvr - Service

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: vmms - Service

SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

SafeBootNet: AppMgmt - Service

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: HelpSvc - Service

SafeBootNet: Messenger - Service

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: NTDS -  File not found

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: rdsessmgr - Service

SafeBootNet: sacsvr - Service

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: vmms - Service

SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)

SafeBootNet: WudfUsbccidDriver - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)

Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
 

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2011.05.14 20:56:58 | 000,000,000 | -H-D | C] -- C:\Users\Heinz04\AppData\Roaming\Malwarebytes

[2011.05.14 20:56:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2011.05.14 20:56:46 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys

[2011.05.14 20:56:43 | 000,000,000 | -H-D | C] -- C:\ProgramData\Malwarebytes

[2011.05.14 20:56:40 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware

[2011.05.14 20:49:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\avast! Free Antivirus

[2011.05.14 20:49:08 | 000,307,928 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswSP.sys

[2011.05.14 20:49:08 | 000,019,544 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswFsBlk.sys

[2011.05.14 20:49:01 | 000,025,432 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswRdr.sys

[2011.05.14 20:48:59 | 000,049,240 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswTdi.sys

[2011.05.14 20:48:57 | 000,441,176 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswSnx.sys

[2011.05.14 20:48:49 | 000,053,592 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswMonFlt.sys

[2011.05.14 20:48:45 | 000,000,000 | -H-D | C] -- C:\Users\Heinz04\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows 7 Recovery

[2011.05.14 20:48:05 | 000,040,112 | ---- | C] (AVAST Software) -- C:\Windows\avastSS.scr

[2011.05.14 20:48:04 | 000,199,304 | ---- | C] (AVAST Software) -- C:\Windows\System32\aswBoot.exe

[2011.05.14 20:47:51 | 000,000,000 | -H-D | C] -- C:\ProgramData\AVAST Software

[2011.05.14 20:47:51 | 000,000,000 | ---D | C] -- C:\Programme\AVAST Software

[2011.05.12 09:33:36 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Adobe

[2011.05.12 09:33:34 | 000,000,000 | -H-D | C] -- C:\ProgramData\Adobe

[2011.05.12 09:33:33 | 000,000,000 | -H-D | C] -- C:\Users\Heinz04\AppData\Roaming\Adobe

[2011.05.12 09:33:33 | 000,000,000 | -H-D | C] -- C:\Users\Heinz04\AppData\Local\Adobe

[2011.05.11 09:39:22 | 000,000,000 | -H-D | C] -- C:\Users\Heinz04\AppData\Roaming\XnView

[2011.05.11 09:39:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XnView

[2011.05.11 09:39:15 | 000,000,000 | ---D | C] -- C:\Programme\XnView

[2011.05.10 23:10:43 | 000,000,000 | -H-D | C] -- C:\Users\Heinz04\Documents\Meine Paletten

[2011.05.10 23:09:59 | 000,000,000 | -H-D | C] -- C:\ProgramData\Protexis

[2011.05.10 23:06:55 | 000,000,000 | -H-D | C] -- C:\Users\Heinz04\Documents\Corel

[2011.05.10 23:06:39 | 000,000,000 | -H-D | C] -- C:\Users\Heinz04\Documents\Visual Studio 2008

[2011.05.10 23:06:35 | 000,000,000 | -H-D | C] -- C:\Users\Heinz04\AppData\Local\Microsoft Help

[2011.05.10 23:04:54 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft SDKs

[2011.05.10 23:04:52 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft Visual Studio 9.0

[2011.05.10 23:04:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft Help

[2011.05.10 22:59:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CorelDRAW Graphics Suite X5

[2011.05.10 22:58:13 | 000,000,000 | -H-D | C] -- C:\ProgramData\CorelDRAW Graphics Suite X5

[2011.05.10 22:32:06 | 607,091,504 | -H-- | C] (Acresso Software Inc.                                        ) -- C:\Users\Heinz04\Documents\CorelDRAWGraphicsSuiteX5Installer_DE.exe

[2011.05.10 22:28:39 | 000,000,000 | -H-D | C] -- C:\Users\Heinz04\Documents\Meine Corel-Shows

[2011.05.10 22:18:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime

[2011.05.10 22:18:03 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Apple

[2011.05.10 22:18:00 | 000,000,000 | -H-D | C] -- C:\ProgramData\Apple Computer

[2011.05.10 22:18:00 | 000,000,000 | ---D | C] -- C:\Programme\QuickTime

[2011.05.10 22:16:32 | 000,000,000 | -H-D | C] -- C:\ProgramData\Corel

[2011.05.10 22:16:32 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Protexis

[2011.05.10 22:14:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Corel PaintShop Photo Pro X3

[2011.05.10 22:14:21 | 000,000,000 | -H-D | C] -- C:\Users\Heinz04\AppData\Local\Corel

[2011.05.10 22:14:11 | 000,000,000 | -H-D | C] -- C:\Users\Heinz04\Documents\My PSP Files

[2011.05.10 22:14:11 | 000,000,000 | -H-D | C] -- C:\Users\Heinz04\AppData\Roaming\Corel

[2011.05.10 22:12:24 | 000,000,000 | -H-D | C] -- C:\ProgramData\Ulead Systems

[2011.05.10 22:12:24 | 000,000,000 | ---D | C] -- C:\Programme\Corel

[2011.05.10 22:12:24 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Corel

[2011.05.10 17:24:02 | 509,192,096 | -H-- | C] (Acresso Software Inc.) -- C:\Users\Heinz04\Documents\PSPP_X3_TBYB.exe

[2011.05.10 17:23:36 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Akamai

[2011.05.09 14:27:19 | 000,000,000 | -H-D | C] -- C:\Users\Heinz04\Documents\ICQ

[2011.05.09 12:20:17 | 000,000,000 | -H-D | C] -- C:\Users\Heinz04\AppData\Roaming\OpenOffice.org

[2011.05.09 12:19:23 | 000,000,000 | --SD | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice.org 3.3

[2011.05.09 12:18:33 | 000,000,000 | ---D | C] -- C:\Programme\OpenOffice.org 3

[2011.05.09 12:18:02 | 000,000,000 | -H-D | C] -- C:\ProgramData\Sun

[2011.05.09 12:18:01 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Java

[2011.05.09 12:17:31 | 000,000,000 | ---D | C] -- C:\Programme\Java

[2011.05.09 12:16:48 | 000,000,000 | -H-D | C] -- C:\Users\Heinz04\Desktop\OpenOffice.org 3.3 (de) Installation Files

[2011.05.06 23:49:58 | 000,000,000 | -H-D | C] -- C:\Users\Heinz04\AppData\Local\Adobe-BackupByPhotoshopCS5Portable

[2011.05.06 23:48:52 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Adobe-BackupByPhotoshopCS5Portable

[2011.05.06 23:48:52 | 000,000,000 | ---D | C] -- C:\Programme\Adobe

[2011.05.06 23:47:29 | 000,000,000 | -H-D | C] -- C:\ProgramData\Adobe-BackupByPhotoshopCS5Portable

[2011.05.05 14:54:25 | 000,000,000 | RH-D | C] -- C:\Users\Heinz04\Documents\Scanned Documents

[2011.05.05 14:54:25 | 000,000,000 | -H-D | C] -- C:\Users\Heinz04\Documents\Fax

[2011.05.05 12:49:56 | 000,000,000 | -H-D | C] -- C:\Users\Heinz04\AppData\Roaming\Adobe-BackupByPhotoshopCS5Portable

[2011.05.05 12:17:43 | 000,000,000 | -H-D | C] -- C:\ProgramData\regid.1986-12.com.adobe

[2011.05.04 23:52:30 | 000,000,000 | -H-D | C] -- C:\Users\Heinz04\AppData\Local\Microsoft Games

[2011.05.04 14:47:46 | 000,000,000 | -H-D | C] -- C:\Users\Heinz04\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\R-Studio

[2011.05.04 14:47:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\R-Studio

[2011.05.04 14:47:18 | 000,000,000 | -H-D | C] -- C:\Users\Heinz04\AppData\Roaming\R-TT

[2011.05.04 14:46:16 | 000,000,000 | -H-D | C] -- C:\Users\Heinz04\AppData\Roaming\WinRAR

[2011.05.04 14:46:16 | 000,000,000 | -H-D | C] -- C:\Users\Heinz04\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR

[2011.05.04 14:46:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR

[2011.05.04 14:46:12 | 000,000,000 | ---D | C] -- C:\Programme\WinRAR

[2011.05.04 14:38:59 | 000,000,000 | -H-D | C] -- C:\Users\Heinz04\Documents\R-TT

[2011.05.04 14:38:59 | 000,000,000 | ---D | C] -- C:\Programme\R-Studio

[2011.05.04 14:34:12 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft.NET

[2011.05.03 22:34:23 | 000,000,000 | ---D | C] -- C:\Programme\BabylonToolbar

[2011.05.03 22:34:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Recuva

[2011.05.03 22:34:03 | 000,000,000 | ---D | C] -- C:\Programme\Recuva

[2011.05.03 22:33:33 | 002,451,576 | -H-- | C] (Piriform Ltd) -- C:\Users\Heinz04\Desktop\rcsetup1.40.525.exe

[2011.05.03 22:25:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RStudio

[2011.05.03 22:23:48 | 000,000,000 | -H-D | C] -- C:\Users\Heinz04\Documents\R

[2011.05.03 22:23:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\R

[2011.05.03 22:22:34 | 000,000,000 | ---D | C] -- C:\Programme\R

[2011.05.03 19:29:35 | 000,000,000 | -H-D | C] -- C:\Users\Heinz04\AppData\Roaming\RStudio

[2011.05.03 19:29:15 | 000,000,000 | -H-D | C] -- C:\Users\Heinz04\AppData\Local\RStudio-Desktop

[2011.05.03 19:28:51 | 000,000,000 | ---D | C] -- C:\Programme\RStudio

[2011.05.03 17:37:13 | 000,000,000 | -H-D | C] -- C:\Users\Heinz04\AppData\Roaming\Macromedia

[2011.05.03 17:37:05 | 000,000,000 | ---D | C] -- C:\Windows\System32\Macromed

[2011.05.03 17:29:01 | 000,000,000 | -H-D | C] -- C:\Log

[2011.05.03 17:28:52 | 000,000,000 | -H-D | C] -- C:\ProgramData\TEMP

[2011.05.03 17:28:36 | 001,207,808 | ---- | C] (Dmitry Streblechenko) -- C:\Windows\System32\PhoenixDll.dll

[2011.05.03 17:28:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Stellar Phoenix Windows Data Recovery-Home

[2011.05.03 17:28:35 | 000,000,000 | ---D | C] -- C:\Programme\Stellar Phoenix Windows Data Recovery

[2011.05.03 16:50:55 | 000,000,000 | -H-D | C] -- C:\Users\Heinz04\AppData\Roaming\Avira

[2011.05.03 16:50:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

[2011.05.03 16:50:12 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys

[2011.05.03 16:50:11 | 000,137,656 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys

[2011.05.03 16:50:11 | 000,061,960 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys

[2011.05.03 16:50:10 | 000,000,000 | -H-D | C] -- C:\ProgramData\Avira

[2011.05.03 16:50:10 | 000,000,000 | ---D | C] -- C:\Programme\Avira

[2011.05.03 16:45:51 | 000,000,000 | ---D | C] -- C:\Programme\Synaptics

[2011.05.03 16:45:32 | 000,000,000 | -H-D | C] -- C:\Users\Heinz04\AppData\Roaming\WinBatch

[2011.05.03 16:45:14 | 000,000,000 | -H-D | C] -- C:\Users\Heinz04\AppData\Roaming\skypePM

[2011.05.03 16:45:14 | 000,000,000 | -H-D | C] -- C:\ProgramData\Skype Extras

[2011.05.03 16:44:50 | 000,000,000 | -H-D | C] -- C:\Users\Heinz04\AppData\Roaming\Skype

[2011.05.03 16:44:25 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Skype

[2011.05.03 16:44:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

[2011.05.03 16:44:24 | 000,000,000 | R--D | C] -- C:\Programme\Skype

[2011.05.03 16:44:21 | 000,000,000 | -HSD | C] -- C:\Windows\Installer

[2011.05.03 16:44:20 | 000,000,000 | -H-D | C] -- C:\ProgramData\Skype

[2011.05.03 16:40:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ICQ7.5

[2011.05.03 16:33:57 | 000,000,000 | ---D | C] -- C:\Programme\ICQ6Toolbar

[2011.05.03 16:33:54 | 000,000,000 | -H-D | C] -- C:\Programme\InstallShield Installation Information

[2011.05.03 16:33:54 | 000,000,000 | -H-D | C] -- C:\ProgramData\ICQ

[2011.05.03 16:32:14 | 000,000,000 | -H-D | C] -- C:\Users\Heinz04\AppData\Roaming\ICQ

[2011.05.03 16:32:08 | 000,000,000 | -H-D | C] -- C:\Programme\ICQ7.5

[2011.05.03 16:23:38 | 000,000,000 | -H-D | C] -- C:\Users\Heinz04\AppData\Local\Mozilla

[2011.05.03 16:23:35 | 000,000,000 | -H-D | C] -- C:\Users\Heinz04\AppData\Roaming\Mozilla

[2011.05.03 16:23:30 | 000,000,000 | ---D | C] -- C:\Programme\Mozilla Firefox

[2011.05.02 23:34:00 | 000,000,000 | ---D | C] -- C:\Windows\Panther

[2011.05.02 22:43:18 | 000,000,000 | RH-D | C] -- C:\Users\Heinz04\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

[2011.05.02 22:43:18 | 000,000,000 | RH-D | C] -- C:\Users\Heinz04\Searches

[2011.05.02 22:43:18 | 000,000,000 | RH-D | C] -- C:\Users\Heinz04\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools

[2011.05.02 22:43:08 | 000,000,000 | -H-D | C] -- C:\Users\Heinz04\AppData\Roaming\Identities

[2011.05.02 22:43:03 | 000,000,000 | RH-D | C] -- C:\Users\Heinz04\Contacts

[2011.05.02 22:42:40 | 000,000,000 | -H-D | C] -- C:\Users\Heinz04\AppData\Local\VirtualStore

[2011.05.02 22:42:37 | 000,000,000 | -HSD | C] -- C:\Users\Heinz04\Vorlagen

[2011.05.02 22:42:37 | 000,000,000 | -HSD | C] -- C:\Users\Heinz04\AppData\Local\Verlauf

[2011.05.02 22:42:37 | 000,000,000 | -HSD | C] -- C:\Users\Heinz04\AppData\Local\Temporary Internet Files

[2011.05.02 22:42:37 | 000,000,000 | -HSD | C] -- C:\Users\Heinz04\Startmenü

[2011.05.02 22:42:37 | 000,000,000 | -HSD | C] -- C:\Users\Heinz04\SendTo

[2011.05.02 22:42:37 | 000,000,000 | -HSD | C] -- C:\Users\Heinz04\Recent

[2011.05.02 22:42:37 | 000,000,000 | -HSD | C] -- C:\Users\Heinz04\Netzwerkumgebung

[2011.05.02 22:42:37 | 000,000,000 | -HSD | C] -- C:\Users\Heinz04\Lokale Einstellungen

[2011.05.02 22:42:37 | 000,000,000 | -HSD | C] -- C:\Users\Heinz04\Documents\Eigene Videos

[2011.05.02 22:42:37 | 000,000,000 | -HSD | C] -- C:\Users\Heinz04\Documents\Eigene Musik

[2011.05.02 22:42:37 | 000,000,000 | -HSD | C] -- C:\Users\Heinz04\Eigene Dateien

[2011.05.02 22:42:37 | 000,000,000 | -HSD | C] -- C:\Users\Heinz04\Documents\Eigene Bilder

[2011.05.02 22:42:37 | 000,000,000 | -HSD | C] -- C:\Users\Heinz04\Druckumgebung

[2011.05.02 22:42:37 | 000,000,000 | -HSD | C] -- C:\Users\Heinz04\Cookies

[2011.05.02 22:42:37 | 000,000,000 | -HSD | C] -- C:\Users\Heinz04\AppData\Local\Anwendungsdaten

[2011.05.02 22:42:37 | 000,000,000 | -HSD | C] -- C:\Users\Heinz04\Anwendungsdaten

[2011.05.02 22:42:36 | 000,000,000 | --SD | C] -- C:\Users\Heinz04\AppData\Roaming\Microsoft

[2011.05.02 22:42:36 | 000,000,000 | RH-D | C] -- C:\Users\Heinz04\Videos

[2011.05.02 22:42:36 | 000,000,000 | RH-D | C] -- C:\Users\Heinz04\Saved Games

[2011.05.02 22:42:36 | 000,000,000 | RH-D | C] -- C:\Users\Heinz04\Pictures

[2011.05.02 22:42:36 | 000,000,000 | RH-D | C] -- C:\Users\Heinz04\Music

[2011.05.02 22:42:36 | 000,000,000 | RH-D | C] -- C:\Users\Heinz04\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance

[2011.05.02 22:42:36 | 000,000,000 | RH-D | C] -- C:\Users\Heinz04\Links

[2011.05.02 22:42:36 | 000,000,000 | RH-D | C] -- C:\Users\Heinz04\Favorites

[2011.05.02 22:42:36 | 000,000,000 | RH-D | C] -- C:\Users\Heinz04\Downloads

[2011.05.02 22:42:36 | 000,000,000 | RH-D | C] -- C:\Users\Heinz04\Documents

[2011.05.02 22:42:36 | 000,000,000 | RH-D | C] -- C:\Users\Heinz04\Desktop

[2011.05.02 22:42:36 | 000,000,000 | RH-D | C] -- C:\Users\Heinz04\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories

[2011.05.02 22:42:36 | 000,000,000 | -H-D | C] -- C:\Users\Heinz04\AppData\Local\Temp

[2011.05.02 22:42:36 | 000,000,000 | -H-D | C] -- C:\Users\Heinz04\AppData\Local\Microsoft

[2011.05.02 22:42:36 | 000,000,000 | -H-D | C] -- C:\Users\Heinz04\AppData\Roaming\Media Center Programs

[2011.05.02 22:42:36 | 000,000,000 | -H-D | C] -- C:\Users\Heinz04\AppData

[2011.05.02 22:42:26 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen

[2011.05.02 22:42:26 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü

[2011.05.02 22:42:26 | 000,000,000 | -HSD | C] -- C:\Recovery

[2011.05.02 22:42:26 | 000,000,000 | -HSD | C] -- C:\Programme

[2011.05.02 22:42:26 | 000,000,000 | -HSD | C] -- C:\Programme\Gemeinsame Dateien

[2011.05.02 22:42:26 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten

[2011.05.02 22:42:26 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos

[2011.05.02 22:42:26 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik

[2011.05.02 22:42:26 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder

[2011.05.02 22:42:26 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen

[2011.05.02 22:42:26 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente

[2011.05.02 22:42:26 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten

[2011.05.02 22:38:14 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution

[2011.05.02 22:35:24 | 000,000,000 | ---D | C] -- C:\Windows\Prefetch

[2011.04.29 00:02:51 | 000,000,000 | -H-D | C] -- C:\9213529c8c5a9aa2c34d9a

 
 ========== Files - Modified Within 30 Days ==========

 

[2011.05.15 14:51:29 | 000,654,166 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2011.05.15 14:51:29 | 000,616,008 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2011.05.15 14:51:29 | 000,130,006 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2011.05.15 14:51:29 | 000,106,388 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2011.05.15 14:20:15 | 000,009,584 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2011.05.15 14:20:15 | 000,009,584 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2011.05.15 09:17:40 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2011.05.15 09:17:31 | 2816,864,256 | -HS- | M] () -- C:\hiberfil.sys

[2011.05.14 20:48:49 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt

[2011.05.14 20:48:46 | 000,000,144 | -H-- | M] () -- C:\ProgramData\~30007032r

[2011.05.14 20:48:46 | 000,000,128 | -H-- | M] () -- C:\ProgramData\~30007032

[2011.05.14 20:48:45 | 000,000,639 | -H-- | M] () -- C:\Users\Heinz04\Desktop\Windows 7 Recovery.lnk

[2011.05.14 20:48:40 | 000,000,336 | -H-- | M] () -- C:\ProgramData\30007032

[2011.05.14 20:48:38 | 000,378,880 | -H-- | M] () -- C:\ProgramData\30007032.exe

[2011.05.11 23:36:56 | 000,000,132 | -H-- | M] () -- C:\Users\Heinz04\AppData\Roaming\Adobe PNG Format CS5 Prefs

[2011.05.11 09:40:11 | 000,002,828 | -HS- | M] () -- C:\ProgramData\KGyGaAvL.sys

[2011.05.11 09:39:54 | 000,000,088 | RHS- | M] () -- C:\ProgramData\E187D790B1.sys

[2011.05.11 09:39:26 | 000,000,893 | -H-- | M] () -- C:\Users\Heinz04\Desktop\XnView.lnk

[2011.05.11 09:29:48 | 000,315,680 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[2011.05.10 22:58:03 | 607,091,504 | -H-- | M] (Acresso Software Inc.                                        ) -- C:\Users\Heinz04\Documents\CorelDRAWGraphicsSuiteX5Installer_DE.exe

[2011.05.10 22:28:50 | 000,003,584 | -H-- | M] () -- C:\Users\Heinz04\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2011.05.10 22:07:33 | 509,192,096 | -H-- | M] (Acresso Software Inc.) -- C:\Users\Heinz04\Documents\PSPP_X3_TBYB.exe

[2011.05.10 14:10:59 | 000,040,112 | ---- | M] (AVAST Software) -- C:\Windows\avastSS.scr

[2011.05.10 14:10:55 | 000,199,304 | ---- | M] (AVAST Software) -- C:\Windows\System32\aswBoot.exe

[2011.05.10 14:03:54 | 000,441,176 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswSnx.sys

[2011.05.10 14:03:44 | 000,307,928 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswSP.sys

[2011.05.10 14:02:37 | 000,049,240 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswTdi.sys

[2011.05.10 13:59:56 | 000,025,432 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswRdr.sys

[2011.05.10 13:59:44 | 000,053,592 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswMonFlt.sys

[2011.05.10 13:59:35 | 000,019,544 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswFsBlk.sys

[2011.05.09 12:34:52 | 000,014,743 | -H-- | M] () -- C:\Users\Heinz04\Documents\seindeschal.ods

[2011.05.09 12:20:28 | 000,001,197 | -H-- | M] () -- C:\Users\Heinz04\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk

[2011.05.05 14:54:37 | 000,000,425 | -H-- | M] () -- C:\Windows\BRWMARK.INI

[2011.05.05 14:54:37 | 000,000,027 | ---- | M] () -- C:\Windows\BRPP2KA.INI

[2011.05.05 14:53:21 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_09_00.Wdf

[2011.05.04 22:52:33 | 000,000,000 | -H-- | M] () -- C:\Users\Heinz04\Documents\.Rhistory

[2011.05.03 22:33:40 | 002,451,576 | -H-- | M] (Piriform Ltd) -- C:\Users\Heinz04\Desktop\rcsetup1.40.525.exe

[2011.05.03 17:30:21 | 000,000,070 | ---- | M] () -- C:\Windows\spwdrhag.INI

[2011.05.03 17:28:37 | 000,001,172 | -H-- | M] () -- C:\Users\Heinz04\Desktop\Stellar Phoenix Windows Data Recovery-Home.lnk

[2011.05.03 16:45:56 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_Kernel_SynTP_01007.Wdf

[2011.05.03 16:45:20 | 000,000,056 | -H-- | M] () -- C:\ProgramData\ezsidmv.dat

[2011.05.02 22:39:17 | 000,056,735 | ---- | M] () -- C:\Windows\System32\license.rtf

[2011.05.02 22:37:45 | 000,000,000 | ---- | M] () -- C:\Windows\ativpsrm.bin

 
 ========== Files Created - No Company Name ==========

 

[2011.05.14 20:48:46 | 000,000,144 | -H-- | C] () -- C:\ProgramData\~30007032r

[2011.05.14 20:48:46 | 000,000,128 | -H-- | C] () -- C:\ProgramData\~30007032

[2011.05.14 20:48:45 | 000,000,639 | -H-- | C] () -- C:\Users\Heinz04\Desktop\Windows 7 Recovery.lnk

[2011.05.14 20:48:40 | 000,000,336 | -H-- | C] () -- C:\ProgramData\30007032

[2011.05.14 20:48:38 | 000,378,880 | -H-- | C] () -- C:\ProgramData\30007032.exe

[2011.05.11 09:39:26 | 000,000,893 | -H-- | C] () -- C:\Users\Heinz04\Desktop\XnView.lnk

[2011.05.10 22:28:50 | 000,003,584 | -H-- | C] () -- C:\Users\Heinz04\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2011.05.10 22:24:47 | 000,002,828 | -HS- | C] () -- C:\ProgramData\KGyGaAvL.sys

[2011.05.10 22:24:47 | 000,000,088 | RHS- | C] () -- C:\ProgramData\E187D790B1.sys

[2011.05.09 12:34:50 | 000,014,743 | -H-- | C] () -- C:\Users\Heinz04\Documents\seindeschal.ods

[2011.05.09 12:20:28 | 000,001,197 | -H-- | C] () -- C:\Users\Heinz04\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk

[2011.05.05 14:54:37 | 000,000,425 | -H-- | C] () -- C:\Windows\BRWMARK.INI

[2011.05.05 14:54:37 | 000,000,027 | ---- | C] () -- C:\Windows\BRPP2KA.INI

[2011.05.05 14:53:21 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_09_00.Wdf

[2011.05.05 14:23:58 | 000,000,132 | -H-- | C] () -- C:\Users\Heinz04\AppData\Roaming\Adobe PNG Format CS5 Prefs

[2011.05.03 22:23:55 | 000,000,000 | -H-- | C] () -- C:\Users\Heinz04\Documents\.Rhistory

[2011.05.03 17:28:37 | 000,001,172 | -H-- | C] () -- C:\Users\Heinz04\Desktop\Stellar Phoenix Windows Data Recovery-Home.lnk

[2011.05.03 17:28:36 | 000,178,176 | ---- | C] () -- C:\Windows\System32\StellarProfile.dll

[2011.05.03 17:28:36 | 000,000,070 | ---- | C] () -- C:\Windows\spwdrhag.INI

[2011.05.03 16:45:56 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_Kernel_SynTP_01007.Wdf

[2011.05.03 16:45:20 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat

[2011.05.02 22:43:19 | 000,001,413 | -H-- | C] () -- C:\Users\Heinz04\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

[2011.05.02 22:37:45 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin

[2011.05.02 22:35:04 | 2816,864,256 | -HS- | C] () -- C:\hiberfil.sys

[2009.07.14 10:47:43 | 000,654,166 | ---- | C] () -- C:\Windows\System32\perfh007.dat

[2009.07.14 10:47:43 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat

[2009.07.14 10:47:43 | 000,130,006 | ---- | C] () -- C:\Windows\System32\perfc007.dat

[2009.07.14 10:47:43 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat

[2009.07.14 06:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat

[2009.07.14 06:33:53 | 000,315,680 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT

[2009.07.14 04:05:48 | 000,616,008 | ---- | C] () -- C:\Windows\System32\perfh009.dat

[2009.07.14 04:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat

[2009.07.14 04:05:48 | 000,106,388 | ---- | C] () -- C:\Windows\System32\perfc009.dat

[2009.07.14 04:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat

[2009.07.14 04:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT

[2009.07.14 04:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat

[2009.07.14 01:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin

[2009.07.14 01:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll

[2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll

[2009.06.18 19:29:04 | 000,197,654 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat

[2009.06.10 23:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat

 
 ========== LOP Check ==========

 

[2011.05.15 09:18:44 | 000,000,000 | -H-D | M] -- C:\Users\Heinz04\AppData\Roaming\ICQ

[2011.05.09 12:20:17 | 000,000,000 | -H-D | M] -- C:\Users\Heinz04\AppData\Roaming\OpenOffice.org

[2011.05.04 14:47:18 | 000,000,000 | -H-D | M] -- C:\Users\Heinz04\AppData\Roaming\R-TT

[2011.05.03 19:29:35 | 000,000,000 | -H-D | M] -- C:\Users\Heinz04\AppData\Roaming\RStudio

[2011.05.03 16:45:32 | 000,000,000 | -H-D | M] -- C:\Users\Heinz04\AppData\Roaming\WinBatch

[2011.05.11 09:40:40 | 000,000,000 | -H-D | M] -- C:\Users\Heinz04\AppData\Roaming\XnView

[2009.07.14 06:53:46 | 000,009,196 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2011.05.12 16:07:11 | 000,000,000 | -H-D | M] -- C:\Users\Heinz04\AppData\Roaming\Adobe

[2011.05.06 23:49:58 | 000,000,000 | -H-D | M] -- C:\Users\Heinz04\AppData\Roaming\Adobe-BackupByPhotoshopCS5Portable

[2011.05.03 16:50:55 | 000,000,000 | -H-D | M] -- C:\Users\Heinz04\AppData\Roaming\Avira

[2011.05.10 23:09:48 | 000,000,000 | -H-D | M] -- C:\Users\Heinz04\AppData\Roaming\Corel

[2011.05.15 09:18:44 | 000,000,000 | -H-D | M] -- C:\Users\Heinz04\AppData\Roaming\ICQ

[2011.05.02 22:43:08 | 000,000,000 | -H-D | M] -- C:\Users\Heinz04\AppData\Roaming\Identities

[2011.05.03 17:37:13 | 000,000,000 | -H-D | M] -- C:\Users\Heinz04\AppData\Roaming\Macromedia

[2011.05.14 20:56:58 | 000,000,000 | -H-D | M] -- C:\Users\Heinz04\AppData\Roaming\Malwarebytes

[2009.07.14 10:56:41 | 000,000,000 | -H-D | M] -- C:\Users\Heinz04\AppData\Roaming\Media Center Programs

[2011.05.11 23:14:44 | 000,000,000 | --SD | M] -- C:\Users\Heinz04\AppData\Roaming\Microsoft

[2011.05.03 16:23:44 | 000,000,000 | -H-D | M] -- C:\Users\Heinz04\AppData\Roaming\Mozilla

[2011.05.09 12:20:17 | 000,000,000 | -H-D | M] -- C:\Users\Heinz04\AppData\Roaming\OpenOffice.org

[2011.05.04 14:47:18 | 000,000,000 | -H-D | M] -- C:\Users\Heinz04\AppData\Roaming\R-TT

[2011.05.03 19:29:35 | 000,000,000 | -H-D | M] -- C:\Users\Heinz04\AppData\Roaming\RStudio

[2011.05.15 09:18:33 | 000,000,000 | -H-D | M] -- C:\Users\Heinz04\AppData\Roaming\Skype

[2011.05.15 09:18:42 | 000,000,000 | -H-D | M] -- C:\Users\Heinz04\AppData\Roaming\skypePM

[2011.05.03 16:45:32 | 000,000,000 | -H-D | M] -- C:\Users\Heinz04\AppData\Roaming\WinBatch

[2011.05.04 14:46:25 | 000,000,000 | -H-D | M] -- C:\Users\Heinz04\AppData\Roaming\WinRAR

[2011.05.11 09:40:40 | 000,000,000 | -H-D | M] -- C:\Users\Heinz04\AppData\Roaming\XnView

 
 < %APPDATA%\*.exe /s >

 
 < %SYSTEMDRIVE%\*.exe >

 

 
 < MD5 for: AGP440.SYS  >

[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys

[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_65848c2d7375a720\AGP440.sys

[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys

[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_f64b9c35a3a5be81\atapi.sys

[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll

 
 < MD5 for: IASTORV.SYS  >

[2011.03.11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_b0daddb9e6380745\iaStorV.sys

[2011.03.11 07:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\System32\drivers\iaStorV.sys

[2011.03.11 07:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_0033117673c16921\iaStorV.sys

[2011.03.11 07:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_aef580fde910b4b0\iaStorV.sys

[2011.03.11 07:28:00 | 000,332,160 | ---- | M] (Intel Corporation) MD5=778D0E6D7D9EBA0C403BADBAAD41DB20 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_b152a892ff64119f\iaStorV.sys

[2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_18cccb83b34e1453\iaStorV.sys

[2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys

[2011.03.11 07:52:21 | 000,332,160 | ---- | M] (Intel Corporation) MD5=B9039A34C2F8769490DCC494E2402445 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_afae2d45020c148b\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\System32\netlogon.dll

[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2011.03.11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_3ba44e691d6eb11d\nvstor.sys

[2011.03.11 07:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\System32\drivers\nvstor.sys

[2011.03.11 07:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_38e464dbe521cc7f\nvstor.sys

[2011.03.11 07:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_39bef1ad20475e88\nvstor.sys

[2011.03.11 07:28:10 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=66D468654A58594F5F3BA63D5AD5B1AF -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_3c1c1942369abb77\nvstor.sys

[2011.03.11 07:52:25 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=8A7583A3B58D3EEB28BB26626526BC91 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_3a779df43942be63\nvstor.sys

[2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_5bde3fe2945bce9e\nvstor.sys

[2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\System32\scecli.dll

[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2009.07.14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\System32\user32.dll

[2009.07.14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\System32\userinit.exe

[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe

 
 < MD5 for: WININIT.EXE  >

[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\System32\wininit.exe

[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2009.10.28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\System32\winlogon.exe

[2009.10.28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe

[2009.10.28 07:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe

[2009.07.14 03:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys

[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >

 
 ========== Alternate Data Streams ==========

 

@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:C3AE45C9
 

< End of report >

Code:

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org
 

Datenbank Version: 6579
 

Windows 6.1.7600

Internet Explorer 8.0.7600.16385
 

15.05.2011 14:55:00

mbam-log-2011-05-15 (14-54-54).txt
 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)

Durchsuchte Objekte: 526331

Laufzeit: 3 Stunde(n), 44 Minute(n), 53 Sekunde(n)
 

Infizierte Speicherprozesse: 0

Infizierte Speichermodule: 0

Infizierte Registrierungsschlüssel: 0

Infizierte Registrierungswerte: 0

Infizierte Dateiobjekte der Registrierung: 0

Infizierte Verzeichnisse: 0

Infizierte Dateien: 10
 

Infizierte Speicherprozesse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung:

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien:

c:\Users\Heinz04\AppData\Local\Temp\2143E8.tmp (Trojan.Agent) -> No action taken.

c:\Users\Heinz04\AppData\Local\Temp\ldr8fe0.tmp (Trojan.Agent) -> No action taken.

c:\Users\Heinz04\AppData\Local\Temp\tmp8A83.tmp (Rogue.Installer.Gen) -> No action taken.

d:\$Recycle.Bin\s-1-5-21-2963585822-2094767381-2026818199-1000\$RF4GTOB\alcohol soft\alcohol 120\Langs\AX_RU.dll (Malware.Packer.GenX) -> No action taken.

d:\Users\Heinz\AppData\Local\RLGPSvi.dll (Trojan.Hiloti) -> No action taken.

d:\Users\Heinz\AppData\Local\ugoqevoyoxajijoh.dll (Trojan.Hiloti) -> No action taken.

d:\Users\Heinz\AppData\Local\Temp\sxnwrcemoa.exe (Trojan.FraudPack.Gen) -> No action taken.

d:\Users\Heinz\AppData\Local\Temp\wexsoarcmn.exe (Trojan.Hiloti) -> No action taken.

d:\Users\Heinz\downloads\o10_32b\mini-kms_activator_v1.052.exe (Riskware.Keygen) -> No action taken.

c:\programdata\30007032.exe (Trojan.FakeAlert.Gen) -> No action taken.

Zudem sind nun alle meine Datein weg wie ich grad feststellen musst.

Ich hoffe ihr könnt mir helfen.

Gruß

Westi