Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Virenprogramm aht bei mir einen Trojaner entdeckt. Jedoch via Internet keine Infos gefunden (https://www.trojaner-board.de/114947-virenprogramm-aht-mir-trojaner-entdeckt-jedoch-via-internet-keine-infos-gefunden.html)

Bensi 08.05.2012 18:20
Virenprogramm aht bei mir einen Trojaner entdeckt. Jedoch via Internet keine Infos gefunden
 
Mein Antivirenprogramm hat vorhin folgende Meldung bekommen:
"In der Datei 'C:\Dokumente und Einstellungen\x\Lokale Einstellungen\Temp\csrssr.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Agent.229376.37' [trojan] gefunden.
Ausgeführte Aktion: Zugriff verweigern"

Kann mir einer sagen,w as das für ein Trojaner ist? Und vor allem, was ich dagegen tun muss?
Habe via Internet erstmal nichts gefunden! :(

cosinus 11.05.2012 11:12
Bitte erstmal routinemäßig einen Vollscan mit malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen!
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Außerdem müssen alle Funde entfernt werden.

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!



ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset





Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log

Bensi 11.05.2012 16:16
Habe Malwarebytes einmal durchlaufen lassen. Folgendes kam dabei heraus:

Malwarebytes Anti-Malware 1.61.0.1400
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Datenbank Version: v2012.05.11.04

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
x :: X-EC10DDBFD8434 [Administrator]

11.05.2012 16:20:32
mbam-log-2012-05-11 (16-20-32).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 248925
Laufzeit: 53 Minute(n), 26 Sekunde(n)

Infizierte Speicherprozesse: 1
C:\WINDOWS\system32\svchosptd.exe (Trojan.Agent) -> 2648 -> Löschen bei Neustart.

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 2
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon|Microsoft Windows Firewall Service (Trojan.Agent.Gen) -> Daten: C:\DOKUME~1\x\LOKALE~1\Temp\csrssr.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon|Microsoft Windows Firewall Service (Trojan.Agent.Gen) -> Daten: C:\DOKUME~1\x\LOKALE~1\Temp\csrssr.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 2
C:\WINDOWS\system32\svchosptd.exe (Trojan.Agent) -> Löschen bei Neustart.
C:\System Volume Information\_restore{E088838E-3721-49B0-8FDE-DEFE3D7E9A96}\RP1\A0000007.exe (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

Und folgendes kam mit dem anderen Programm nach PC- Neustart heraus:

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=42d6969d62538643ac716f5040c614f5
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-05-11 05:21:19
# local_time=2012-05-11 07:21:19 (+0100, Westeuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=1792 16777195 100 0 10729802 10729802 0 0
# compatibility_mode=8192 67108863 100 0 270 270 0 0
# scanned=64245
# found=5
# cleaned=5
# scan_time=3663
C:\Programme\iMesh Applications\MediaBar\Datamngr\BrowserConnection.dll Win32/Toolbar.SearchSuite application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Programme\iMesh Applications\MediaBar\Datamngr\datamngr.dll Win32/Toolbar.SearchSuite application (cleaned by deleting (after the next restart) - quarantined) 00000000000000000000000000000000 C
C:\Programme\iMesh Applications\MediaBar\Datamngr\datamngrUI.exe Win32/Toolbar.SearchSuite application (cleaned by deleting (after the next restart) - quarantined) 00000000000000000000000000000000 C
C:\Programme\iMesh Applications\MediaBar\Datamngr\DnsBHO.dll Win32/Toolbar.SearchSuite application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Programme\iMesh Applications\MediaBar\Datamngr\IEBHO.dll Win32/Toolbar.SearchSuite application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

Was bedeutet das nun alles auf Deutsch?

cosinus 11.05.2012 20:42
Malwarebytes erstellt bei jedem Scanvorgang genau ein Log. Hast du in der Vergangenheit schonmal mit Malwarebytes gescannt?
Wenn ja dann stehen auch alle Logs zu jedem Scanvorgang im Reiter Logdateien. Bitte alle posten, die dort sichtbar sind.

Bensi 11.05.2012 22:29
Nein, ich habe beide Programme heute zum ersten Mal benutzt.

cosinus 11.05.2012 23:03
Hätte da mal zwei Fragen bevor es weiter geht

1.) Geht der normale Modus uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

Bensi 12.05.2012 11:52
zu 1.) Ich weiß grad nicht genau was du mit normalem Modus meinst. Wenn du den ganz normalen, täglichen Betrieb meinst, dann lautet die Antwort nein. Der PC ist in letzter Zeit extrem langsam geworden und hat manchmal Probleme beim Hochfahren. Ich dachte eig. das sind Alterserscheinungen, weil der PC schon relativ alt ist. Darüber hinaus habe ich seit ein paar Tagen das Problem, dass der PC manchmal abstürzt und dann wieder hochfährt. Direkt vor dem Absturz erscheint dann ein blauer Screen mit weißer Schrift, wird aber zu kurz eingeblendet, um es lesen zu können. Das Problem tritt häufig bei youtube- Videos o.ä. auf.

zu 2.) Du hast Recht. Der Ordner "Autostart" ist leer! o.O

cosinus 12.05.2012 21:11
Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log
CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

Bensi 13.05.2012 14:50
OTL Logfile:
Code:
OTL logfile created on: 13.05.2012 15:02:43 - Run 2
OTL by OldTimer - Version 3.2.42.3    Folder = C:\Dokumente und Einstellungen\x\Eigene Dateien\Downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
767,48 Mb Total Physical Memory | 467,60 Mb Available Physical Memory | 60,93% Memory free
1,83 Gb Paging File | 1,52 Gb Available in Paging File | 82,88% Paging File free
Paging file location(s): C:\pagefile.sys 1152 2304 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 37,26 Gb Total Space | 7,72 Gb Free Space | 20,73% Space Free | Partition Type: NTFS
Drive D: | 3,95 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
Drive G: | 931,51 Gb Total Space | 917,56 Gb Free Space | 98,50% Space Free | Partition Type: NTFS
 
Computer Name: X-EC10DDBFD8434 | User Name: x | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.05.13 13:07:23 | 000,595,456 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\x\Eigene Dateien\Downloads\OTL.exe
PRC - [2012.05.11 19:32:47 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.11 19:32:45 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2012.05.11 19:32:44 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.05.11 19:32:44 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.12.21 15:19:30 | 001,003,520 | -H-- | M] (FK2) -- C:\WINDOWS\system32\svchospt.exe
PRC - [2008.04.14 04:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007.04.03 18:50:00 | 001,603,152 | ---- | M] (CANON INC.) -- C:\Programme\Canon\MyPrinter\BJMYPRT.EXE
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.05.11 19:32:47 | 000,398,288 | ---- | M] () -- C:\Programme\Avira\AntiVir Desktop\sqlite3.dll
MOD - [2012.04.04 07:53:56 | 000,301,056 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.DEU
MOD - [2011.05.28 22:04:56 | 000,140,288 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll
MOD - [2005.11.27 21:07:30 | 000,417,792 | ---- | M] () -- C:\WINDOWS\system32\CoolXPCombo.ocx
MOD - [2005.11.27 21:07:12 | 000,491,520 | ---- | M] () -- C:\WINDOWS\system32\CoolXPButton.ocx
MOD - [2005.11.27 21:06:54 | 000,360,448 | ---- | M] () -- C:\WINDOWS\system32\CoolXPLabel.ocx
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Disabled | Stopped] -- %SystemRoot%\System32\hidserv.dll -- (HidServ)
SRV - File not found [On_Demand | Stopped] -- %SystemRoot%\System32\appmgmts.dll -- (AppMgmt)
SRV - [2012.05.11 19:32:47 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.11 19:32:44 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.04.26 19:15:18 | 000,129,976 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2010.09.06 18:56:38 | 000,247,096 | ---- | M] () [Auto | Stopped] -- C:\Programme\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service)
SRV - [2003.07.28 13:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] --  -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] --  -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] --  -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] --  -- (Changer)
DRV - [2012.05.11 19:32:47 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2012.05.11 19:32:47 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011.12.15 16:00:00 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2010.06.17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2008.04.13 20:45:29 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)
DRV - [2005.03.03 19:53:57 | 000,048,640 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sfdrv01.sys -- (sfdrv01) StarForce Protection Environment Driver (version 1.x)
DRV - [2005.02.23 17:59:54 | 000,006,656 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sfhlp02.sys -- (sfhlp02) StarForce Protection Helper Driver (version 2.x)
DRV - [2004.12.03 12:20:41 | 000,020,544 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sfsync02.sys -- (sfsync02) StarForce Protection Synchronization Driver (version 2.x)
DRV - [2002.07.24 05:30:00 | 000,032,128 | ---- | M] (VIA Technologies, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\VIAAGP1.SYS -- (viaagp1)
DRV - [2002.03.11 19:57:00 | 000,043,776 | R--- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\viaudio.sys -- (VIAudio) VIA AC'97 Enhanced Audio Controller (WDM)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://search.babylon.com/?babsrc=SP_ss&q={searchTerms}&mntrId=58e102e0000000000000000c6e76d901&tlver=1.4.19.19&affID=17160
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.babylon.com/?babsrc=HP_ss&mntrId=58e102e0000000000000000c6e76d901&tlver=1.4.19.19&affID=17160
IE - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\..\URLSearchHook:  - No CLSID value found
IE - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
IE - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\..\SearchScopes\{1F096B29-E9DA-4D64-8D63-936BE7762CC5}: "URL" = hxxp://search.babylon.com/?babsrc=SP_ss&q={searchTerms}&mntrId=58e102e0000000000000000c6e76d901&tlver=1.4.19.19&affID=17160
IE - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
IE - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050
IE - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Search Results"
FF - prefs.js..browser.search.defaultthis.engineName: "Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Search Results"
FF - prefs.js..browser.search.selectedEngine: "Ecosia"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://ecosia.org/"
FF - prefs.js..extensions.enabledItems: {d04b0b40-3dab-4f0b-97a6-04ec3eddbfb0}:2.0.5
FF - prefs.js..keyword.URL: "hxxp://dts.search-results.com/sr?src=ffb&appid=1083&systemid=1&sr=0&q="
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@zylom.com/ZylomGamesPlayer: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll (Zylom)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.04.26 19:15:18 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2012.04.11 15:55:01 | 000,000,000 | ---D | M]
 
[2012.01.29 16:39:13 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Mozilla\Extensions
[2012.05.02 21:54:33 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Mozilla\Firefox\Profiles\nuokokjf.default\extensions
[2011.01.03 18:32:57 | 000,000,873 | ---- | M] () -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Mozilla\Firefox\Profiles\nuokokjf.default\searchplugins\conduit.xml
[2011.05.17 15:07:33 | 000,005,212 | ---- | M] () -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Mozilla\Firefox\Profiles\nuokokjf.default\searchplugins\ecosia.xml
[2012.05.11 08:16:19 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Mozilla\Firefox\Profiles\nuokokjf.default\searchplugins\icqplugin-1.xml
[2011.05.07 09:36:46 | 000,001,056 | ---- | M] () -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Mozilla\Firefox\Profiles\nuokokjf.default\searchplugins\icqplugin.xml
[2012.01.29 16:38:43 | 000,002,517 | ---- | M] () -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Mozilla\Firefox\Profiles\nuokokjf.default\searchplugins\Search_Results.xml
[2011.11.15 20:36:18 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2011.10.25 22:00:30 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012.03.04 15:40:59 | 000,092,840 | ---- | M] () (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\X\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NUOKOKJF.DEFAULT\EXTENSIONS\FOXFILTER@INSPIREDEFFECT.NET.XPI
[2011.01.05 00:46:08 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
[2012.04.26 19:15:18 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2009.03.25 13:02:08 | 000,114,688 | ---- | M] (Zylom) -- C:\Programme\mozilla firefox\plugins\npzylomgamesplayer.dll
[2012.01.14 15:31:24 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.05.10 15:24:35 | 000,002,423 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\babylon.xml
[2012.01.14 15:31:24 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2012.01.14 15:31:24 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2012.01.14 15:31:24 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.01.29 16:38:43 | 000,002,517 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\Search_Results.xml
[2012.01.14 15:31:24 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.01.14 15:31:24 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2004.08.04 14:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (CescrtHlpr Object) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Programme\BabylonToolbar\BabylonToolbar\1.4.19.19\bh\BabylonToolbar.dll File not found
O2 - BHO: (CescrtHlpr Object) - {64182481-4F71-486b-A045-B233BD0DA8FC} - C:\Programme\facemoods.com\facemoods\1.4.17.8\bh\facemoods.dll File not found
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (DataMngr) - {BE7A24F5-69CB-4708-B77B-B1EDA6043B95} - C:\PROGRA~1\IMESHA~1\MediaBar\Datamngr\BROWSE~1.DLL File not found
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Programme\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarTlbr.dll File not found
O3 - HKLM\..\Toolbar: (facemoods Toolbar) - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - C:\Programme\facemoods.com\facemoods\1.4.17.8\facemoodsTlbr.dll File not found
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [BabylonToolbar] "C:\Programme\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarsrv.exe" /md I File not found
O4 - HKLM..\Run: [CanonMyPrinter] C:\Programme\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [CanonSolutionMenu] C:\Programme\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4 - HKLM..\Run: [ChicoSys] C:\WINDOWS\system32\cc32\webtmr.exe File not found
O4 - HKLM..\Run: [DATAMNGR] C:\PROGRA~1\IMESHA~1\MediaBar\Datamngr\DATAMN~1.EXE File not found
O4 - HKLM..\Run: [facemoods] "C:\Programme\facemoods.com\facemoods\1.4.17.8\facemoodssrv.exe" /md I File not found
O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found
O4 - HKLM..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe ()
O4 - HKLM..\Run: [svchospt] C:\WINDOWS\system32\svchospt.exe (FK2)
O4 - HKU\S-1-5-21-1960408961-1935655697-682003330-1004..\Run: [ICQ] C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Privacy present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0
O7 - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSaveSettings = 0
O7 - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: RestrictRun = 0
O7 - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableClock = 0
O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B5D274BF-909E-4433-9527-AA904D4F92A0}: NameServer = 217.0.43.193 217.0.43.1
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\IMESHA~1\MediaBar\Datamngr\datamngr.dll) -  File not found
O20 - AppInit_DLLs: (C:\PROGRA~1\IMESHA~1\MediaBar\Datamngr\IEBHO.dll) -  File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\x\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\x\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.12.14 16:55:36 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2006.09.06 10:18:27 | 000,000,000 | R--D | M] - D:\AutoRun -- [ UDF ]
O32 - AutoRun File - [2006.09.06 09:52:46 | 000,741,376 | R--- | M] (Electronic Arts Inc.) - D:\AutoRun.exe -- [ UDF ]
O32 - AutoRun File - [2006.09.06 10:07:35 | 000,000,136 | R--- | M] () - D:\autorun.inf -- [ UDF ]
O32 - AutoRun File - [2006.08.24 02:58:17 | 000,593,920 | R--- | M] (Electronic Arts Inc.) - D:\AutoRunGUI.dll -- [ UDF ]
O33 - MountPoints2\{39804407-0795-11e0-998d-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{39804407-0795-11e0-998d-806d6172696f}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{39804407-0795-11e0-998d-806d6172696f}\Shell\AutoRun\command - "" = D:\AutoRun.exe -- [2006.09.06 09:52:46 | 000,741,376 | R--- | M] (Electronic Arts Inc.)
O33 - MountPoints2\{485cb503-0861-11e0-aaf9-000c6e76d901}\Shell - "" = AutoRun
O33 - MountPoints2\{485cb503-0861-11e0-aaf9-000c6e76d901}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{485cb503-0861-11e0-aaf9-000c6e76d901}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL StartAudials.exe
O33 - MountPoints2\{6912fff5-8857-11e0-ae28-000c6e76d901}\Shell - "" = AutoRun
O33 - MountPoints2\{6912fff5-8857-11e0-ae28-000c6e76d901}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{6912fff5-8857-11e0-ae28-000c6e76d901}\Shell\AutoRun\command - "" = G:\DPFMate.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.05.11 18:15:47 | 000,000,000 | ---D | C] -- C:\Programme\ESET
[2012.05.11 16:17:24 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Malwarebytes
[2012.05.11 16:16:53 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
[2012.05.11 16:16:50 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2012.05.11 16:16:47 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012.05.11 16:16:46 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2012.05.11 15:39:18 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Ahead Nero
[2012.05.11 15:38:32 | 000,000,000 | ---D | C] -- C:\Programme\Ahead
[2012.05.09 20:24:59 | 000,000,000 | ---D | C] -- C:\Programme\MSECache
[2012.04.26 19:15:30 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Mozilla
[2012.04.26 19:15:28 | 000,000,000 | ---D | C] -- C:\Programme\Mozilla Maintenance Service
[2012.04.23 18:55:22 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\x\Recent
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.05.13 12:49:47 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.05.13 12:49:45 | 804,835,328 | -HS- | M] () -- C:\hiberfil.sys
[2012.05.11 19:32:47 | 000,137,928 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys
[2012.05.11 19:32:47 | 000,083,392 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntflt.sys
[2012.05.11 16:16:54 | 000,000,756 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012.05.10 22:10:41 | 000,135,664 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012.05.10 19:50:10 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2012.05.10 19:28:15 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.05.09 10:19:06 | 000,519,428 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2012.05.09 10:19:06 | 000,496,026 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012.05.09 10:19:06 | 000,102,850 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2012.05.09 10:19:06 | 000,085,738 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012.05.05 17:05:01 | 009,607,006 | ---- | M] () -- C:\Dokumente und Einstellungen\x\Desktop\Robert Johnson Workshop.mp3
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.05.11 16:16:54 | 000,000,756 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012.05.09 22:34:32 | 000,001,374 | ---- | C] () -- C:\WINDOWS\imsins.BAK
[2012.05.05 17:04:23 | 009,607,006 | ---- | C] () -- C:\Dokumente und Einstellungen\x\Desktop\Robert Johnson Workshop.mp3
[2012.03.04 00:31:19 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\excltmp~.dat
[2012.03.04 00:31:13 | 000,000,140 | -H-- | C] () -- C:\WINDOWS\System32\ctlsw.ini
[2012.03.04 00:31:13 | 000,000,100 | ---- | C] () -- C:\WINDOWS\System32\SWCTL.DLL
[2012.02.15 18:47:29 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2011.12.23 15:27:28 | 000,043,520 | ---- | C] () -- C:\WINDOWS\System32\CmdLineExt03.dll
[2011.11.15 20:48:17 | 000,032,256 | ---- | C] () -- C:\WINDOWS\System32\AVSredirect.dll
[2011.10.30 17:13:43 | 000,109,250 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-System.dat
[2011.10.30 17:13:43 | 000,109,250 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-S-1-5-21-1960408961-1935655697-682003330-1004-0.dat
[2011.09.25 09:52:14 | 000,017,408 | ---- | C] () -- C:\Dokumente und Einstellungen\x\Lokale Einstellungen\Anwendungsdaten\WebpageIcons.db
[2011.09.14 22:28:23 | 000,124,416 | ---- | C] () -- C:\WINDOWS\System32\dXCtrls.dll
[2011.09.14 22:28:21 | 000,544,256 | ---- | C] () -- C:\WINDOWS\System32\janGraphics.dll
[2011.04.16 23:37:48 | 000,000,567 | ---- | C] () -- C:\WINDOWS\eReg.dat
[2011.04.15 17:23:02 | 000,354,816 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2011.04.15 14:04:41 | 000,823,296 | R--- | C] () -- C:\WINDOWS\KochRun.exe
[2011.04.15 14:04:41 | 000,001,062 | R--- | C] () -- C:\WINDOWS\KochRun.ini
[2011.03.01 22:38:02 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2011.01.25 17:46:56 | 000,005,002 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\amjmwaey.gaf
[2010.12.26 20:35:40 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2010.12.22 14:23:02 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2010.12.16 13:42:29 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\UnAudioNT.dll
[2010.12.16 13:41:24 | 000,002,817 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini
[2010.12.16 13:41:23 | 000,005,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2010.12.15 20:04:05 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2010.12.15 17:35:42 | 000,031,232 | ---- | C] () -- C:\Dokumente und Einstellungen\x\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.12.14 16:58:13 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2010.12.14 16:52:46 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2010.12.14 16:45:35 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2010.12.14 16:44:24 | 000,135,664 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
 
========== LOP Check ==========
 
[2012.01.29 19:34:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\boost_interprocess
[2010.12.16 14:07:08 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonBJ
[2011.04.08 21:15:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ICQ
[2011.12.23 14:43:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ScanSoft
[2011.05.07 14:22:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Zylom
[2011.10.23 15:00:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\AnvSoft
[2012.02.24 19:47:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Audacity
[2011.05.10 18:53:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\BabylonToolbar
[2011.03.10 17:54:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Canon
[2012.05.11 19:01:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\DVDVideoSoft
[2011.07.31 17:12:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\facemoods.com
[2012.01.08 19:21:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\GetRightToGo
[2011.05.07 14:22:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\GOL_byHasbro
[2012.05.10 22:22:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\ICQ
[2010.12.25 11:19:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Leadertech
[2011.06.26 14:34:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\ObviousIdea
[2011.09.18 13:56:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\PriceGong
[2011.07.31 14:39:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Rovio
[2011.05.07 14:22:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Zylom
 
========== Purity Check ==========
 
 

< End of report >
--- --- ---

cosinus 13.05.2012 16:18
Sry aber das war kein CustomScan

Bensi 13.05.2012 18:39
OTL Logfile:
Code:
OTL logfile created on: 13.05.2012 19:30:36 - Run 3
OTL by OldTimer - Version 3.2.42.3    Folder = C:\Dokumente und Einstellungen\x\Eigene Dateien\Downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
767,48 Mb Total Physical Memory | 515,12 Mb Available Physical Memory | 67,12% Memory free
1,83 Gb Paging File | 1,53 Gb Available in Paging File | 83,61% Paging File free
Paging file location(s): C:\pagefile.sys 1152 2304 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 37,26 Gb Total Space | 7,68 Gb Free Space | 20,62% Space Free | Partition Type: NTFS
Drive G: | 931,51 Gb Total Space | 917,56 Gb Free Space | 98,50% Space Free | Partition Type: NTFS
 
Computer Name: X-EC10DDBFD8434 | User Name: x | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.05.13 13:07:23 | 000,595,456 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\x\Eigene Dateien\Downloads\OTL.exe
PRC - [2012.05.11 19:32:47 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.11 19:32:45 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2012.05.11 19:32:44 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.05.11 19:32:44 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.12.21 15:19:30 | 001,003,520 | -H-- | M] (FK2) -- C:\WINDOWS\system32\svchospt.exe
PRC - [2008.04.14 04:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007.04.03 18:50:00 | 001,603,152 | ---- | M] (CANON INC.) -- C:\Programme\Canon\MyPrinter\BJMYPRT.EXE
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.05.11 19:32:47 | 000,398,288 | ---- | M] () -- C:\Programme\Avira\AntiVir Desktop\sqlite3.dll
MOD - [2012.04.04 07:53:56 | 000,301,056 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.DEU
MOD - [2005.11.27 21:07:30 | 000,417,792 | ---- | M] () -- C:\WINDOWS\system32\CoolXPCombo.ocx
MOD - [2005.11.27 21:07:12 | 000,491,520 | ---- | M] () -- C:\WINDOWS\system32\CoolXPButton.ocx
MOD - [2005.11.27 21:06:54 | 000,360,448 | ---- | M] () -- C:\WINDOWS\system32\CoolXPLabel.ocx
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Disabled | Stopped] -- %SystemRoot%\System32\hidserv.dll -- (HidServ)
SRV - File not found [On_Demand | Stopped] -- %SystemRoot%\System32\appmgmts.dll -- (AppMgmt)
SRV - [2012.05.11 19:32:47 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.11 19:32:44 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.04.26 19:15:18 | 000,129,976 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2010.09.06 18:56:38 | 000,247,096 | ---- | M] () [Auto | Stopped] -- C:\Programme\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service)
SRV - [2003.07.28 13:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] --  -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] --  -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] --  -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] --  -- (Changer)
DRV - [2012.05.11 19:32:47 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2012.05.11 19:32:47 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011.12.15 16:00:00 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2010.06.17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2008.04.13 20:45:29 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)
DRV - [2005.03.03 19:53:57 | 000,048,640 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sfdrv01.sys -- (sfdrv01) StarForce Protection Environment Driver (version 1.x)
DRV - [2005.02.23 17:59:54 | 000,006,656 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sfhlp02.sys -- (sfhlp02) StarForce Protection Helper Driver (version 2.x)
DRV - [2004.12.03 12:20:41 | 000,020,544 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sfsync02.sys -- (sfsync02) StarForce Protection Synchronization Driver (version 2.x)
DRV - [2002.07.24 05:30:00 | 000,032,128 | ---- | M] (VIA Technologies, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\VIAAGP1.SYS -- (viaagp1)
DRV - [2002.03.11 19:57:00 | 000,043,776 | R--- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\viaudio.sys -- (VIAudio) VIA AC'97 Enhanced Audio Controller (WDM)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://search.babylon.com/?babsrc=SP_ss&q={searchTerms}&mntrId=58e102e0000000000000000c6e76d901&tlver=1.4.19.19&affID=17160
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Babylon Search
IE - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\..\URLSearchHook:  - No CLSID value found
IE - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
IE - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\..\SearchScopes\{1F096B29-E9DA-4D64-8D63-936BE7762CC5}: "URL" = hxxp://search.babylon.com/?babsrc=SP_ss&q={searchTerms}&mntrId=58e102e0000000000000000c6e76d901&tlver=1.4.19.19&affID=17160
IE - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
IE - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050
IE - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Search Results"
FF - prefs.js..browser.search.defaultthis.engineName: "Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Search Results"
FF - prefs.js..browser.search.selectedEngine: "Ecosia"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://ecosia.org/"
FF - prefs.js..extensions.enabledItems: {d04b0b40-3dab-4f0b-97a6-04ec3eddbfb0}:2.0.5
FF - prefs.js..keyword.URL: "hxxp://dts.search-results.com/sr?src=ffb&appid=1083&systemid=1&sr=0&q="
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@zylom.com/ZylomGamesPlayer: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll (Zylom)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.04.26 19:15:18 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2012.04.11 15:55:01 | 000,000,000 | ---D | M]
 
[2012.01.29 16:39:13 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Mozilla\Extensions
[2012.05.02 21:54:33 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Mozilla\Firefox\Profiles\nuokokjf.default\extensions
[2011.01.03 18:32:57 | 000,000,873 | ---- | M] () -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Mozilla\Firefox\Profiles\nuokokjf.default\searchplugins\conduit.xml
[2011.05.17 15:07:33 | 000,005,212 | ---- | M] () -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Mozilla\Firefox\Profiles\nuokokjf.default\searchplugins\ecosia.xml
[2012.05.11 08:16:19 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Mozilla\Firefox\Profiles\nuokokjf.default\searchplugins\icqplugin-1.xml
[2011.05.07 09:36:46 | 000,001,056 | ---- | M] () -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Mozilla\Firefox\Profiles\nuokokjf.default\searchplugins\icqplugin.xml
[2012.01.29 16:38:43 | 000,002,517 | ---- | M] () -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Mozilla\Firefox\Profiles\nuokokjf.default\searchplugins\Search_Results.xml
[2011.11.15 20:36:18 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2011.10.25 22:00:30 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012.03.04 15:40:59 | 000,092,840 | ---- | M] () (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\X\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NUOKOKJF.DEFAULT\EXTENSIONS\FOXFILTER@INSPIREDEFFECT.NET.XPI
[2011.01.05 00:46:08 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
[2012.04.26 19:15:18 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2009.03.25 13:02:08 | 000,114,688 | ---- | M] (Zylom) -- C:\Programme\mozilla firefox\plugins\npzylomgamesplayer.dll
[2012.01.14 15:31:24 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.05.10 15:24:35 | 000,002,423 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\babylon.xml
[2012.01.14 15:31:24 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2012.01.14 15:31:24 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2012.01.14 15:31:24 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.01.29 16:38:43 | 000,002,517 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\Search_Results.xml
[2012.01.14 15:31:24 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.01.14 15:31:24 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2004.08.04 14:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (CescrtHlpr Object) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Programme\BabylonToolbar\BabylonToolbar\1.4.19.19\bh\BabylonToolbar.dll File not found
O2 - BHO: (CescrtHlpr Object) - {64182481-4F71-486b-A045-B233BD0DA8FC} - C:\Programme\facemoods.com\facemoods\1.4.17.8\bh\facemoods.dll File not found
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (DataMngr) - {BE7A24F5-69CB-4708-B77B-B1EDA6043B95} - C:\PROGRA~1\IMESHA~1\MediaBar\Datamngr\BROWSE~1.DLL File not found
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Programme\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarTlbr.dll File not found
O3 - HKLM\..\Toolbar: (facemoods Toolbar) - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - C:\Programme\facemoods.com\facemoods\1.4.17.8\facemoodsTlbr.dll File not found
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [BabylonToolbar] "C:\Programme\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarsrv.exe" /md I File not found
O4 - HKLM..\Run: [CanonMyPrinter] C:\Programme\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [CanonSolutionMenu] C:\Programme\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4 - HKLM..\Run: [ChicoSys] C:\WINDOWS\system32\cc32\webtmr.exe File not found
O4 - HKLM..\Run: [DATAMNGR] C:\PROGRA~1\IMESHA~1\MediaBar\Datamngr\DATAMN~1.EXE File not found
O4 - HKLM..\Run: [facemoods] "C:\Programme\facemoods.com\facemoods\1.4.17.8\facemoodssrv.exe" /md I File not found
O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found
O4 - HKLM..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe ()
O4 - HKLM..\Run: [svchospt] C:\WINDOWS\system32\svchospt.exe (FK2)
O4 - HKU\S-1-5-21-1960408961-1935655697-682003330-1004..\Run: [ICQ] C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Privacy present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0
O7 - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSaveSettings = 0
O7 - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: RestrictRun = 0
O7 - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableClock = 0
O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B5D274BF-909E-4433-9527-AA904D4F92A0}: NameServer = 217.0.43.193 217.0.43.1
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\IMESHA~1\MediaBar\Datamngr\datamngr.dll) -  File not found
O20 - AppInit_DLLs: (C:\PROGRA~1\IMESHA~1\MediaBar\Datamngr\IEBHO.dll) -  File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\x\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\x\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.12.14 16:55:36 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{485cb503-0861-11e0-aaf9-000c6e76d901}\Shell - "" = AutoRun
O33 - MountPoints2\{485cb503-0861-11e0-aaf9-000c6e76d901}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{485cb503-0861-11e0-aaf9-000c6e76d901}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL StartAudials.exe
O33 - MountPoints2\{6912fff5-8857-11e0-ae28-000c6e76d901}\Shell - "" = AutoRun
O33 - MountPoints2\{6912fff5-8857-11e0-ae28-000c6e76d901}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{6912fff5-8857-11e0-ae28-000c6e76d901}\Shell\AutoRun\command - "" = G:\DPFMate.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
NetSvcs: 6to4 -  File not found
NetSvcs: AppMgmt - %SystemRoot%\System32\appmgmts.dll File not found
NetSvcs: HidServ - %SystemRoot%\System32\hidserv.dll File not found
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: Irmon -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: WmdmPmSp -  File not found
 
 
SafeBootMin: AppMgmt - %SystemRoot%\System32\appmgmts.dll File not found
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: ksupmgr -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vds - Service
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
SafeBootNet: AppMgmt - %SystemRoot%\System32\appmgmts.dll File not found
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: ksupmgr -  File not found
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015C} - Microsoft DirectX
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Sicherheitsupdate für Windows XP (KB923789)
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C314CE45-3392-3B73-B4E1-139CD41CA933} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Shockwave Flash
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
 
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.I420 - C:\WINDOWS\System32\i420vfw.dll (www.helixcommunity.org)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.yv12 - C:\WINDOWS\System32\yv12vfw.dll (www.helixcommunity.org)
 
CREATERESTOREPOINT
Unable to start System Restore Service. Error code 5
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.05.11 18:15:47 | 000,000,000 | ---D | C] -- C:\Programme\ESET
[2012.05.11 16:17:24 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Malwarebytes
[2012.05.11 16:16:53 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
[2012.05.11 16:16:50 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2012.05.11 16:16:47 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012.05.11 16:16:46 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2012.05.11 15:39:18 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Ahead Nero
[2012.05.11 15:38:32 | 000,000,000 | ---D | C] -- C:\Programme\Ahead
[2012.05.09 20:24:59 | 000,000,000 | ---D | C] -- C:\Programme\MSECache
[2012.04.26 19:15:30 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Mozilla
[2012.04.26 19:15:28 | 000,000,000 | ---D | C] -- C:\Programme\Mozilla Maintenance Service
[2012.04.23 18:55:22 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\x\Recent
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.05.13 18:26:37 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.05.13 18:26:35 | 804,835,328 | -HS- | M] () -- C:\hiberfil.sys
[2012.05.11 19:32:47 | 000,137,928 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys
[2012.05.11 19:32:47 | 000,083,392 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntflt.sys
[2012.05.11 16:16:54 | 000,000,756 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012.05.10 22:10:41 | 000,135,664 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012.05.10 19:50:10 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2012.05.10 19:28:15 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.05.09 10:19:06 | 000,519,428 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2012.05.09 10:19:06 | 000,496,026 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012.05.09 10:19:06 | 000,102,850 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2012.05.09 10:19:06 | 000,085,738 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012.05.05 17:05:01 | 009,607,006 | ---- | M] () -- C:\Dokumente und Einstellungen\x\Desktop\Robert Johnson Workshop.mp3
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.05.11 16:16:54 | 000,000,756 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012.05.09 22:34:32 | 000,001,374 | ---- | C] () -- C:\WINDOWS\imsins.BAK
[2012.05.05 17:04:23 | 009,607,006 | ---- | C] () -- C:\Dokumente und Einstellungen\x\Desktop\Robert Johnson Workshop.mp3
[2012.03.04 00:31:19 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\excltmp~.dat
[2012.03.04 00:31:13 | 000,000,140 | -H-- | C] () -- C:\WINDOWS\System32\ctlsw.ini
[2012.03.04 00:31:13 | 000,000,100 | ---- | C] () -- C:\WINDOWS\System32\SWCTL.DLL
[2012.02.15 18:47:29 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2011.12.23 15:27:28 | 000,043,520 | ---- | C] () -- C:\WINDOWS\System32\CmdLineExt03.dll
[2011.11.15 20:48:17 | 000,032,256 | ---- | C] () -- C:\WINDOWS\System32\AVSredirect.dll
[2011.10.30 17:13:43 | 000,109,250 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-System.dat
[2011.10.30 17:13:43 | 000,109,250 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-S-1-5-21-1960408961-1935655697-682003330-1004-0.dat
[2011.09.25 09:52:14 | 000,017,408 | ---- | C] () -- C:\Dokumente und Einstellungen\x\Lokale Einstellungen\Anwendungsdaten\WebpageIcons.db
[2011.09.14 22:28:23 | 000,124,416 | ---- | C] () -- C:\WINDOWS\System32\dXCtrls.dll
[2011.09.14 22:28:21 | 000,544,256 | ---- | C] () -- C:\WINDOWS\System32\janGraphics.dll
[2011.04.16 23:37:48 | 000,000,567 | ---- | C] () -- C:\WINDOWS\eReg.dat
[2011.04.15 17:23:02 | 000,354,816 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2011.04.15 14:04:41 | 000,823,296 | R--- | C] () -- C:\WINDOWS\KochRun.exe
[2011.04.15 14:04:41 | 000,001,062 | R--- | C] () -- C:\WINDOWS\KochRun.ini
[2011.03.01 22:38:02 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2011.01.25 17:46:56 | 000,005,002 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\amjmwaey.gaf
[2010.12.26 20:35:40 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2010.12.22 14:23:02 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2010.12.16 13:42:29 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\UnAudioNT.dll
[2010.12.16 13:41:24 | 000,002,817 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini
[2010.12.16 13:41:23 | 000,005,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2010.12.15 20:04:05 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2010.12.15 17:35:42 | 000,031,232 | ---- | C] () -- C:\Dokumente und Einstellungen\x\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.12.14 16:58:13 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2010.12.14 16:52:46 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2010.12.14 16:45:35 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2010.12.14 16:44:24 | 000,135,664 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
 
========== LOP Check ==========
 
[2012.01.29 19:34:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\boost_interprocess
[2010.12.16 14:07:08 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonBJ
[2011.04.08 21:15:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ICQ
[2011.12.23 14:43:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ScanSoft
[2011.05.07 14:22:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Zylom
[2011.10.23 15:00:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\AnvSoft
[2012.02.24 19:47:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Audacity
[2011.05.10 18:53:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\BabylonToolbar
[2011.03.10 17:54:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Canon
[2012.05.11 19:01:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\DVDVideoSoft
[2011.07.31 17:12:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\facemoods.com
[2012.01.08 19:21:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\GetRightToGo
[2011.05.07 14:22:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\GOL_byHasbro
[2012.05.10 22:22:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\ICQ
[2010.12.25 11:19:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Leadertech
[2011.06.26 14:34:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\ObviousIdea
[2011.09.18 13:56:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\PriceGong
[2011.07.31 14:39:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Rovio
[2011.05.07 14:22:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Zylom
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
[2011.09.25 09:50:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Application Data\Kaspersky Lab
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2010.12.20 16:53:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Adobe
[2011.10.23 15:00:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\AnvSoft
[2010.12.29 18:04:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Apple Computer
[2012.02.24 19:47:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Audacity
[2012.01.08 14:56:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Avira
[2011.05.10 18:53:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\BabylonToolbar
[2011.03.10 17:54:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Canon
[2012.01.21 20:14:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\dvdcss
[2012.05.11 19:01:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\DVDVideoSoft
[2011.07.31 17:12:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\facemoods.com
[2012.01.08 19:21:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\GetRightToGo
[2011.05.07 14:22:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\GOL_byHasbro
[2012.05.10 22:22:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\ICQ
[2011.05.07 14:22:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Identities
[2010.12.25 11:19:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Leadertech
[2010.12.15 20:36:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Macromedia
[2012.05.11 16:17:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Malwarebytes
[2012.05.09 20:27:51 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Microsoft
[2010.12.15 20:04:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Mozilla
[2011.06.26 14:34:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\ObviousIdea
[2011.09.18 13:56:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\PriceGong
[2011.07.31 14:39:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Rovio
[2012.02.24 17:35:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Skype
[2011.08.15 19:05:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\skypePM
[2012.03.31 16:47:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\vlc
[2011.02.11 15:41:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\WinRAR
[2011.05.07 14:22:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Zylom
 
< %APPDATA%\*.exe /s >
[2011.05.10 15:25:24 | 000,003,310 | R--- | M] () -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Microsoft\Installer\{6B3CA80E-6AC0-4725-BABF-9B0FEF880CB3}\_16496df1.exe
[2011.05.10 15:25:24 | 000,001,078 | R--- | M] () -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Microsoft\Installer\{6B3CA80E-6AC0-4725-BABF-9B0FEF880CB3}\_18be6784.exe
[2011.05.10 15:25:24 | 000,001,078 | R--- | M] () -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Microsoft\Installer\{6B3CA80E-6AC0-4725-BABF-9B0FEF880CB3}\_294823.exe
[2011.05.10 15:25:24 | 000,001,078 | R--- | M] () -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Microsoft\Installer\{6B3CA80E-6AC0-4725-BABF-9B0FEF880CB3}\_2cd672ae.exe
[2011.05.10 15:25:24 | 000,001,078 | R--- | M] () -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Microsoft\Installer\{6B3CA80E-6AC0-4725-BABF-9B0FEF880CB3}\_4ae13d6c.exe
[2011.05.10 15:25:24 | 000,001,078 | R--- | M] () -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Microsoft\Installer\{6B3CA80E-6AC0-4725-BABF-9B0FEF880CB3}\_69525f90.exe
[2011.07.15 13:05:57 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Microsoft\Installer\{D98C9637-93DA-44DB-B73A-B11A1192AB26}\ARPPRODUCTICON.exe
[2011.07.15 13:05:57 | 000,045,056 | R--- | M] (InstallShield Software Corp.) -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Microsoft\Installer\{D98C9637-93DA-44DB-B73A-B11A1192AB26}\GameShadow.exe1_D9316813509243FDA4C292F72F483E61.exe
[2011.07.15 13:05:57 | 000,045,056 | R--- | M] (InstallShield Software Corp.) -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Microsoft\Installer\{D98C9637-93DA-44DB-B73A-B11A1192AB26}\GameShadow.exe_D9316813509243FDA4C292F72F483E61.exe
[2011.07.15 13:05:57 | 000,040,960 | R--- | M] (InstallShield Software Corp.) -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Microsoft\Installer\{D98C9637-93DA-44DB-B73A-B11A1192AB26}\GSDR.exe_D9316813509243FDA4C292F72F483E61.exe
[2011.07.15 13:05:57 | 000,008,854 | R--- | M] () -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Microsoft\Installer\{D98C9637-93DA-44DB-B73A-B11A1192AB26}\NewShortcut1_D98C963793DA44DBB73AB11A1192AB26.exe
 
< %SYSTEMDRIVE%\*.exe >
 
< MD5 for: AGP440.SYS  >
[2004.08.04 14:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2010.12.21 22:06:42 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2010.12.21 22:06:42 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys
 
< MD5 for: ATAPI.SYS  >
[2004.08.04 14:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2010.12.21 22:06:42 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2010.12.21 22:06:42 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004.08.04 14:00:00 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
 
< MD5 for: EVENTLOG.DLL  >
[2008.04.14 04:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008.04.14 04:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll
[2004.08.04 14:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll
 
< MD5 for: NETLOGON.DLL  >
[2008.04.14 04:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008.04.14 04:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll
[2004.08.04 14:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D27395EDCD3416AFD125A9370DCB585C -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll
[2009.02.06 20:46:10 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=ED4BBAD725A21632FB205452749FC8F5 -- C:\WINDOWS\$hf_mig$\KB968389\SP2QFE\netlogon.dll
[2009.02.06 20:46:10 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=ED4BBAD725A21632FB205452749FC8F5 -- C:\WINDOWS\$hf_mig$\KB975467\SP2QFE\netlogon.dll
 
< MD5 for: SCECLI.DLL  >
[2008.04.14 04:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008.04.14 04:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll
[2004.08.04 14:00:00 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
 
< MD5 for: USER32.DLL  >
[2004.08.04 14:00:00 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=56785FD5236D7B22CF471A6DA9DB46D8 -- C:\WINDOWS\$NtServicePackUninstall$\user32.dll
[2008.04.14 04:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\ServicePackFiles\i386\user32.dll
[2008.04.14 04:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.04.14 04:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008.04.14 04:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe
[2004.08.04 14:00:00 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2012.04.04 15:56:38 | 000,199,240 | ---- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D -- C:\Programme\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2004.08.04 14:00:00 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2008.04.14 04:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008.04.14 04:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2004.08.04 14:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys
[2004.08.04 14:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2010.12.14 17:43:43 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav
[2010.12.14 17:43:43 | 000,638,976 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav
[2010.12.14 17:43:42 | 000,413,696 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< End of report >
--- --- ---


OTL Logfile:
Code:
OTL logfile created on: 13.05.2012 19:30:36 - Run 3
OTL by OldTimer - Version 3.2.42.3    Folder = C:\Dokumente und Einstellungen\x\Eigene Dateien\Downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
767,48 Mb Total Physical Memory | 515,12 Mb Available Physical Memory | 67,12% Memory free
1,83 Gb Paging File | 1,53 Gb Available in Paging File | 83,61% Paging File free
Paging file location(s): C:\pagefile.sys 1152 2304 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 37,26 Gb Total Space | 7,68 Gb Free Space | 20,62% Space Free | Partition Type: NTFS
Drive G: | 931,51 Gb Total Space | 917,56 Gb Free Space | 98,50% Space Free | Partition Type: NTFS
 
Computer Name: X-EC10DDBFD8434 | User Name: x | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.05.13 13:07:23 | 000,595,456 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\x\Eigene Dateien\Downloads\OTL.exe
PRC - [2012.05.11 19:32:47 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.11 19:32:45 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2012.05.11 19:32:44 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.05.11 19:32:44 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.12.21 15:19:30 | 001,003,520 | -H-- | M] (FK2) -- C:\WINDOWS\system32\svchospt.exe
PRC - [2008.04.14 04:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007.04.03 18:50:00 | 001,603,152 | ---- | M] (CANON INC.) -- C:\Programme\Canon\MyPrinter\BJMYPRT.EXE
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.05.11 19:32:47 | 000,398,288 | ---- | M] () -- C:\Programme\Avira\AntiVir Desktop\sqlite3.dll
MOD - [2012.04.04 07:53:56 | 000,301,056 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.DEU
MOD - [2005.11.27 21:07:30 | 000,417,792 | ---- | M] () -- C:\WINDOWS\system32\CoolXPCombo.ocx
MOD - [2005.11.27 21:07:12 | 000,491,520 | ---- | M] () -- C:\WINDOWS\system32\CoolXPButton.ocx
MOD - [2005.11.27 21:06:54 | 000,360,448 | ---- | M] () -- C:\WINDOWS\system32\CoolXPLabel.ocx
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Disabled | Stopped] -- %SystemRoot%\System32\hidserv.dll -- (HidServ)
SRV - File not found [On_Demand | Stopped] -- %SystemRoot%\System32\appmgmts.dll -- (AppMgmt)
SRV - [2012.05.11 19:32:47 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.11 19:32:44 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.04.26 19:15:18 | 000,129,976 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2010.09.06 18:56:38 | 000,247,096 | ---- | M] () [Auto | Stopped] -- C:\Programme\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service)
SRV - [2003.07.28 13:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] --  -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] --  -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] --  -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] --  -- (Changer)
DRV - [2012.05.11 19:32:47 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2012.05.11 19:32:47 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011.12.15 16:00:00 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2010.06.17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2008.04.13 20:45:29 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)
DRV - [2005.03.03 19:53:57 | 000,048,640 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sfdrv01.sys -- (sfdrv01) StarForce Protection Environment Driver (version 1.x)
DRV - [2005.02.23 17:59:54 | 000,006,656 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sfhlp02.sys -- (sfhlp02) StarForce Protection Helper Driver (version 2.x)
DRV - [2004.12.03 12:20:41 | 000,020,544 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sfsync02.sys -- (sfsync02) StarForce Protection Synchronization Driver (version 2.x)
DRV - [2002.07.24 05:30:00 | 000,032,128 | ---- | M] (VIA Technologies, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\VIAAGP1.SYS -- (viaagp1)
DRV - [2002.03.11 19:57:00 | 000,043,776 | R--- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\viaudio.sys -- (VIAudio) VIA AC'97 Enhanced Audio Controller (WDM)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://search.babylon.com/?babsrc=SP_ss&q={searchTerms}&mntrId=58e102e0000000000000000c6e76d901&tlver=1.4.19.19&affID=17160
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.babylon.com/?babsrc=HP_ss&mntrId=58e102e0000000000000000c6e76d901&tlver=1.4.19.19&affID=17160
IE - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\..\URLSearchHook:  - No CLSID value found
IE - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
IE - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\..\SearchScopes\{1F096B29-E9DA-4D64-8D63-936BE7762CC5}: "URL" = hxxp://search.babylon.com/?babsrc=SP_ss&q={searchTerms}&mntrId=58e102e0000000000000000c6e76d901&tlver=1.4.19.19&affID=17160
IE - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
IE - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050
IE - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Search Results"
FF - prefs.js..browser.search.defaultthis.engineName: "Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Search Results"
FF - prefs.js..browser.search.selectedEngine: "Ecosia"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://ecosia.org/"
FF - prefs.js..extensions.enabledItems: {d04b0b40-3dab-4f0b-97a6-04ec3eddbfb0}:2.0.5
FF - prefs.js..keyword.URL: "hxxp://dts.search-results.com/sr?src=ffb&appid=1083&systemid=1&sr=0&q="
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@zylom.com/ZylomGamesPlayer: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll (Zylom)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.04.26 19:15:18 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2012.04.11 15:55:01 | 000,000,000 | ---D | M]
 
[2012.01.29 16:39:13 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Mozilla\Extensions
[2012.05.02 21:54:33 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Mozilla\Firefox\Profiles\nuokokjf.default\extensions
[2011.01.03 18:32:57 | 000,000,873 | ---- | M] () -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Mozilla\Firefox\Profiles\nuokokjf.default\searchplugins\conduit.xml
[2011.05.17 15:07:33 | 000,005,212 | ---- | M] () -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Mozilla\Firefox\Profiles\nuokokjf.default\searchplugins\ecosia.xml
[2012.05.11 08:16:19 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Mozilla\Firefox\Profiles\nuokokjf.default\searchplugins\icqplugin-1.xml
[2011.05.07 09:36:46 | 000,001,056 | ---- | M] () -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Mozilla\Firefox\Profiles\nuokokjf.default\searchplugins\icqplugin.xml
[2012.01.29 16:38:43 | 000,002,517 | ---- | M] () -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Mozilla\Firefox\Profiles\nuokokjf.default\searchplugins\Search_Results.xml
[2011.11.15 20:36:18 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2011.10.25 22:00:30 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012.03.04 15:40:59 | 000,092,840 | ---- | M] () (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\X\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NUOKOKJF.DEFAULT\EXTENSIONS\FOXFILTER@INSPIREDEFFECT.NET.XPI
[2011.01.05 00:46:08 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
[2012.04.26 19:15:18 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2009.03.25 13:02:08 | 000,114,688 | ---- | M] (Zylom) -- C:\Programme\mozilla firefox\plugins\npzylomgamesplayer.dll
[2012.01.14 15:31:24 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.05.10 15:24:35 | 000,002,423 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\babylon.xml
[2012.01.14 15:31:24 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2012.01.14 15:31:24 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2012.01.14 15:31:24 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.01.29 16:38:43 | 000,002,517 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\Search_Results.xml
[2012.01.14 15:31:24 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.01.14 15:31:24 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2004.08.04 14:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (CescrtHlpr Object) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Programme\BabylonToolbar\BabylonToolbar\1.4.19.19\bh\BabylonToolbar.dll File not found
O2 - BHO: (CescrtHlpr Object) - {64182481-4F71-486b-A045-B233BD0DA8FC} - C:\Programme\facemoods.com\facemoods\1.4.17.8\bh\facemoods.dll File not found
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (DataMngr) - {BE7A24F5-69CB-4708-B77B-B1EDA6043B95} - C:\PROGRA~1\IMESHA~1\MediaBar\Datamngr\BROWSE~1.DLL File not found
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Programme\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarTlbr.dll File not found
O3 - HKLM\..\Toolbar: (facemoods Toolbar) - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - C:\Programme\facemoods.com\facemoods\1.4.17.8\facemoodsTlbr.dll File not found
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [BabylonToolbar] "C:\Programme\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarsrv.exe" /md I File not found
O4 - HKLM..\Run: [CanonMyPrinter] C:\Programme\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [CanonSolutionMenu] C:\Programme\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4 - HKLM..\Run: [ChicoSys] C:\WINDOWS\system32\cc32\webtmr.exe File not found
O4 - HKLM..\Run: [DATAMNGR] C:\PROGRA~1\IMESHA~1\MediaBar\Datamngr\DATAMN~1.EXE File not found
O4 - HKLM..\Run: [facemoods] "C:\Programme\facemoods.com\facemoods\1.4.17.8\facemoodssrv.exe" /md I File not found
O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found
O4 - HKLM..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe ()
O4 - HKLM..\Run: [svchospt] C:\WINDOWS\system32\svchospt.exe (FK2)
O4 - HKU\S-1-5-21-1960408961-1935655697-682003330-1004..\Run: [ICQ] C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Privacy present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0
O7 - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSaveSettings = 0
O7 - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: RestrictRun = 0
O7 - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableClock = 0
O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B5D274BF-909E-4433-9527-AA904D4F92A0}: NameServer = 217.0.43.193 217.0.43.1
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\IMESHA~1\MediaBar\Datamngr\datamngr.dll) -  File not found
O20 - AppInit_DLLs: (C:\PROGRA~1\IMESHA~1\MediaBar\Datamngr\IEBHO.dll) -  File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\x\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\x\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.12.14 16:55:36 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{485cb503-0861-11e0-aaf9-000c6e76d901}\Shell - "" = AutoRun
O33 - MountPoints2\{485cb503-0861-11e0-aaf9-000c6e76d901}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{485cb503-0861-11e0-aaf9-000c6e76d901}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL StartAudials.exe
O33 - MountPoints2\{6912fff5-8857-11e0-ae28-000c6e76d901}\Shell - "" = AutoRun
O33 - MountPoints2\{6912fff5-8857-11e0-ae28-000c6e76d901}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{6912fff5-8857-11e0-ae28-000c6e76d901}\Shell\AutoRun\command - "" = G:\DPFMate.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
NetSvcs: 6to4 -  File not found
NetSvcs: AppMgmt - %SystemRoot%\System32\appmgmts.dll File not found
NetSvcs: HidServ - %SystemRoot%\System32\hidserv.dll File not found
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: Irmon -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: WmdmPmSp -  File not found
 
 
SafeBootMin: AppMgmt - %SystemRoot%\System32\appmgmts.dll File not found
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: ksupmgr -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vds - Service
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
SafeBootNet: AppMgmt - %SystemRoot%\System32\appmgmts.dll File not found
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: ksupmgr -  File not found
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015C} - Microsoft DirectX
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Sicherheitsupdate für Windows XP (KB923789)
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C314CE45-3392-3B73-B4E1-139CD41CA933} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Shockwave Flash
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
 
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.I420 - C:\WINDOWS\System32\i420vfw.dll (www.helixcommunity.org)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.yv12 - C:\WINDOWS\System32\yv12vfw.dll (www.helixcommunity.org)
 
CREATERESTOREPOINT
Unable to start System Restore Service. Error code 5
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.05.11 18:15:47 | 000,000,000 | ---D | C] -- C:\Programme\ESET
[2012.05.11 16:17:24 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Malwarebytes
[2012.05.11 16:16:53 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
[2012.05.11 16:16:50 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2012.05.11 16:16:47 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012.05.11 16:16:46 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2012.05.11 15:39:18 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Ahead Nero
[2012.05.11 15:38:32 | 000,000,000 | ---D | C] -- C:\Programme\Ahead
[2012.05.09 20:24:59 | 000,000,000 | ---D | C] -- C:\Programme\MSECache
[2012.04.26 19:15:30 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Mozilla
[2012.04.26 19:15:28 | 000,000,000 | ---D | C] -- C:\Programme\Mozilla Maintenance Service
[2012.04.23 18:55:22 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\x\Recent
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.05.13 18:26:37 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.05.13 18:26:35 | 804,835,328 | -HS- | M] () -- C:\hiberfil.sys
[2012.05.11 19:32:47 | 000,137,928 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys
[2012.05.11 19:32:47 | 000,083,392 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntflt.sys
[2012.05.11 16:16:54 | 000,000,756 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012.05.10 22:10:41 | 000,135,664 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012.05.10 19:50:10 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2012.05.10 19:28:15 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.05.09 10:19:06 | 000,519,428 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2012.05.09 10:19:06 | 000,496,026 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012.05.09 10:19:06 | 000,102,850 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2012.05.09 10:19:06 | 000,085,738 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012.05.05 17:05:01 | 009,607,006 | ---- | M] () -- C:\Dokumente und Einstellungen\x\Desktop\Robert Johnson Workshop.mp3
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.05.11 16:16:54 | 000,000,756 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012.05.09 22:34:32 | 000,001,374 | ---- | C] () -- C:\WINDOWS\imsins.BAK
[2012.05.05 17:04:23 | 009,607,006 | ---- | C] () -- C:\Dokumente und Einstellungen\x\Desktop\Robert Johnson Workshop.mp3
[2012.03.04 00:31:19 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\excltmp~.dat
[2012.03.04 00:31:13 | 000,000,140 | -H-- | C] () -- C:\WINDOWS\System32\ctlsw.ini
[2012.03.04 00:31:13 | 000,000,100 | ---- | C] () -- C:\WINDOWS\System32\SWCTL.DLL
[2012.02.15 18:47:29 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2011.12.23 15:27:28 | 000,043,520 | ---- | C] () -- C:\WINDOWS\System32\CmdLineExt03.dll
[2011.11.15 20:48:17 | 000,032,256 | ---- | C] () -- C:\WINDOWS\System32\AVSredirect.dll
[2011.10.30 17:13:43 | 000,109,250 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-System.dat
[2011.10.30 17:13:43 | 000,109,250 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-S-1-5-21-1960408961-1935655697-682003330-1004-0.dat
[2011.09.25 09:52:14 | 000,017,408 | ---- | C] () -- C:\Dokumente und Einstellungen\x\Lokale Einstellungen\Anwendungsdaten\WebpageIcons.db
[2011.09.14 22:28:23 | 000,124,416 | ---- | C] () -- C:\WINDOWS\System32\dXCtrls.dll
[2011.09.14 22:28:21 | 000,544,256 | ---- | C] () -- C:\WINDOWS\System32\janGraphics.dll
[2011.04.16 23:37:48 | 000,000,567 | ---- | C] () -- C:\WINDOWS\eReg.dat
[2011.04.15 17:23:02 | 000,354,816 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2011.04.15 14:04:41 | 000,823,296 | R--- | C] () -- C:\WINDOWS\KochRun.exe
[2011.04.15 14:04:41 | 000,001,062 | R--- | C] () -- C:\WINDOWS\KochRun.ini
[2011.03.01 22:38:02 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2011.01.25 17:46:56 | 000,005,002 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\amjmwaey.gaf
[2010.12.26 20:35:40 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2010.12.22 14:23:02 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2010.12.16 13:42:29 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\UnAudioNT.dll
[2010.12.16 13:41:24 | 000,002,817 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini
[2010.12.16 13:41:23 | 000,005,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2010.12.15 20:04:05 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2010.12.15 17:35:42 | 000,031,232 | ---- | C] () -- C:\Dokumente und Einstellungen\x\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.12.14 16:58:13 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2010.12.14 16:52:46 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2010.12.14 16:45:35 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2010.12.14 16:44:24 | 000,135,664 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
 
========== LOP Check ==========
 
[2012.01.29 19:34:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\boost_interprocess
[2010.12.16 14:07:08 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonBJ
[2011.04.08 21:15:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ICQ
[2011.12.23 14:43:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ScanSoft
[2011.05.07 14:22:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Zylom
[2011.10.23 15:00:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\AnvSoft
[2012.02.24 19:47:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Audacity
[2011.05.10 18:53:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\BabylonToolbar
[2011.03.10 17:54:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Canon
[2012.05.11 19:01:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\DVDVideoSoft
[2011.07.31 17:12:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\facemoods.com
[2012.01.08 19:21:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\GetRightToGo
[2011.05.07 14:22:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\GOL_byHasbro
[2012.05.10 22:22:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\ICQ
[2010.12.25 11:19:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Leadertech
[2011.06.26 14:34:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\ObviousIdea
[2011.09.18 13:56:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\PriceGong
[2011.07.31 14:39:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Rovio
[2011.05.07 14:22:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Zylom
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
[2011.09.25 09:50:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Application Data\Kaspersky Lab
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2010.12.20 16:53:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Adobe
[2011.10.23 15:00:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\AnvSoft
[2010.12.29 18:04:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Apple Computer
[2012.02.24 19:47:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Audacity
[2012.01.08 14:56:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Avira
[2011.05.10 18:53:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\BabylonToolbar
[2011.03.10 17:54:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Canon
[2012.01.21 20:14:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\dvdcss
[2012.05.11 19:01:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\DVDVideoSoft
[2011.07.31 17:12:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\facemoods.com
[2012.01.08 19:21:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\GetRightToGo
[2011.05.07 14:22:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\GOL_byHasbro
[2012.05.10 22:22:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\ICQ
[2011.05.07 14:22:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Identities
[2010.12.25 11:19:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Leadertech
[2010.12.15 20:36:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Macromedia
[2012.05.11 16:17:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Malwarebytes
[2012.05.09 20:27:51 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Microsoft
[2010.12.15 20:04:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Mozilla
[2011.06.26 14:34:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\ObviousIdea
[2011.09.18 13:56:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\PriceGong
[2011.07.31 14:39:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Rovio
[2012.02.24 17:35:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Skype
[2011.08.15 19:05:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\skypePM
[2012.03.31 16:47:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\vlc
[2011.02.11 15:41:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\WinRAR
[2011.05.07 14:22:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Zylom
 
< %APPDATA%\*.exe /s >
[2011.05.10 15:25:24 | 000,003,310 | R--- | M] () -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Microsoft\Installer\{6B3CA80E-6AC0-4725-BABF-9B0FEF880CB3}\_16496df1.exe
[2011.05.10 15:25:24 | 000,001,078 | R--- | M] () -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Microsoft\Installer\{6B3CA80E-6AC0-4725-BABF-9B0FEF880CB3}\_18be6784.exe
[2011.05.10 15:25:24 | 000,001,078 | R--- | M] () -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Microsoft\Installer\{6B3CA80E-6AC0-4725-BABF-9B0FEF880CB3}\_294823.exe
[2011.05.10 15:25:24 | 000,001,078 | R--- | M] () -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Microsoft\Installer\{6B3CA80E-6AC0-4725-BABF-9B0FEF880CB3}\_2cd672ae.exe
[2011.05.10 15:25:24 | 000,001,078 | R--- | M] () -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Microsoft\Installer\{6B3CA80E-6AC0-4725-BABF-9B0FEF880CB3}\_4ae13d6c.exe
[2011.05.10 15:25:24 | 000,001,078 | R--- | M] () -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Microsoft\Installer\{6B3CA80E-6AC0-4725-BABF-9B0FEF880CB3}\_69525f90.exe
[2011.07.15 13:05:57 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Microsoft\Installer\{D98C9637-93DA-44DB-B73A-B11A1192AB26}\ARPPRODUCTICON.exe
[2011.07.15 13:05:57 | 000,045,056 | R--- | M] (InstallShield Software Corp.) -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Microsoft\Installer\{D98C9637-93DA-44DB-B73A-B11A1192AB26}\GameShadow.exe1_D9316813509243FDA4C292F72F483E61.exe
[2011.07.15 13:05:57 | 000,045,056 | R--- | M] (InstallShield Software Corp.) -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Microsoft\Installer\{D98C9637-93DA-44DB-B73A-B11A1192AB26}\GameShadow.exe_D9316813509243FDA4C292F72F483E61.exe
[2011.07.15 13:05:57 | 000,040,960 | R--- | M] (InstallShield Software Corp.) -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Microsoft\Installer\{D98C9637-93DA-44DB-B73A-B11A1192AB26}\GSDR.exe_D9316813509243FDA4C292F72F483E61.exe
[2011.07.15 13:05:57 | 000,008,854 | R--- | M] () -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Microsoft\Installer\{D98C9637-93DA-44DB-B73A-B11A1192AB26}\NewShortcut1_D98C963793DA44DBB73AB11A1192AB26.exe
 
< %SYSTEMDRIVE%\*.exe >
 
< MD5 for: AGP440.SYS  >
[2004.08.04 14:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2010.12.21 22:06:42 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2010.12.21 22:06:42 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys
 
< MD5 for: ATAPI.SYS  >
[2004.08.04 14:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2010.12.21 22:06:42 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2010.12.21 22:06:42 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004.08.04 14:00:00 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
 
< MD5 for: EVENTLOG.DLL  >
[2008.04.14 04:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008.04.14 04:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll
[2004.08.04 14:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll
 
< MD5 for: NETLOGON.DLL  >
[2008.04.14 04:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008.04.14 04:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll
[2004.08.04 14:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D27395EDCD3416AFD125A9370DCB585C -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll
[2009.02.06 20:46:10 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=ED4BBAD725A21632FB205452749FC8F5 -- C:\WINDOWS\$hf_mig$\KB968389\SP2QFE\netlogon.dll
[2009.02.06 20:46:10 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=ED4BBAD725A21632FB205452749FC8F5 -- C:\WINDOWS\$hf_mig$\KB975467\SP2QFE\netlogon.dll
 
< MD5 for: SCECLI.DLL  >
[2008.04.14 04:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008.04.14 04:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll
[2004.08.04 14:00:00 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
 
< MD5 for: USER32.DLL  >
[2004.08.04 14:00:00 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=56785FD5236D7B22CF471A6DA9DB46D8 -- C:\WINDOWS\$NtServicePackUninstall$\user32.dll
[2008.04.14 04:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\ServicePackFiles\i386\user32.dll
[2008.04.14 04:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.04.14 04:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008.04.14 04:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe
[2004.08.04 14:00:00 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2012.04.04 15:56:38 | 000,199,240 | ---- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D -- C:\Programme\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2004.08.04 14:00:00 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2008.04.14 04:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008.04.14 04:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2004.08.04 14:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys
[2004.08.04 14:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2010.12.14 17:43:43 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav
[2010.12.14 17:43:43 | 000,638,976 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav
[2010.12.14 17:43:42 | 000,413,696 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< End of report >
--- --- ---
[/code]

cosinus 14.05.2012 08:42
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Hinweis: Falls Du Deinen Benutzernamen unkenntlich gemacht hast, musst Du ihn wieder in Deinen richtigen Benutzernamen verwandeln, sonst funktioniert das Script nicht!!

Code:
:OTL
IE - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Babylon Search
IE - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\..\URLSearchHook:  - No CLSID value found
IE - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
IE - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\..\SearchScopes\{1F096B29-E9DA-4D64-8D63-936BE7762CC5}: "URL" = http://search.babylon.com/?babsrc=SP_ss&q={searchTerms}&mntrId=58e102e0000000000000000c6e76d901&tlver=1.4.19.19&affID=17160
IE - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = http://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
IE - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.babylon.com/?babsrc=SP_ss&q={searchTerms}&mntrId=58e102e0000000000000000c6e76d901&tlver=1.4.19.19&affID=17160
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
FF - prefs.js..browser.search.defaultenginename: "Search Results"
FF - prefs.js..browser.search.defaultthis.engineName: "Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Search Results"
FF - prefs.js..browser.search.selectedEngine: "Ecosia"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://ecosia.org/"
FF - prefs.js..extensions.enabledItems: {d04b0b40-3dab-4f0b-97a6-04ec3eddbfb0}:2.0.5
FF - prefs.js..keyword.URL: "http://dts.search-results.com/sr?src=ffb&appid=1083&systemid=1&sr=0&q="
FF - user.js - File not found
[2011.01.03 18:32:57 | 000,000,873 | ---- | M] () -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Mozilla\Firefox\Profiles\nuokokjf.default\searchplugins\conduit.xml
[2011.05.17 15:07:33 | 000,005,212 | ---- | M] () -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Mozilla\Firefox\Profiles\nuokokjf.default\searchplugins\ecosia.xml
[2012.05.11 08:16:19 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Mozilla\Firefox\Profiles\nuokokjf.default\searchplugins\icqplugin-1.xml
[2011.05.07 09:36:46 | 000,001,056 | ---- | M] () -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Mozilla\Firefox\Profiles\nuokokjf.default\searchplugins\icqplugin.xml
[2012.01.29 16:38:43 | 000,002,517 | ---- | M] () -- C:\Dokumente und Einstellungen\x\Anwendungsdaten\Mozilla\Firefox\Profiles\nuokokjf.default\searchplugins\Search_Results.xml
[2011.05.10 15:24:35 | 000,002,423 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\babylon.xml
[2012.01.29 16:38:43 | 000,002,517 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\Search_Results.xml
O2 - BHO: (CescrtHlpr Object) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Programme\BabylonToolbar\BabylonToolbar\1.4.19.19\bh\BabylonToolbar.dll File not found
O2 - BHO: (CescrtHlpr Object) - {64182481-4F71-486b-A045-B233BD0DA8FC} - C:\Programme\facemoods.com\facemoods\1.4.17.8\bh\facemoods.dll File not found
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (DataMngr) - {BE7A24F5-69CB-4708-B77B-B1EDA6043B95} - C:\PROGRA~1\IMESHA~1\MediaBar\Datamngr\BROWSE~1.DLL File not found
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Programme\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarTlbr.dll File not found
O3 - HKLM\..\Toolbar: (facemoods Toolbar) - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - C:\Programme\facemoods.com\facemoods\1.4.17.8\facemoodsTlbr.dll File not found
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4 - HKLM..\Run: [BabylonToolbar] "C:\Programme\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarsrv.exe" /md I File not found
O4 - HKLM..\Run: [ChicoSys] C:\WINDOWS\system32\cc32\webtmr.exe File not found
O4 - HKLM..\Run: [DATAMNGR] C:\PROGRA~1\IMESHA~1\MediaBar\Datamngr\DATAMN~1.EXE File not found
O4 - HKLM..\Run: [facemoods] "C:\Programme\facemoods.com\facemoods\1.4.17.8\facemoodssrv.exe" /md I File not found
O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found
O4 - HKLM..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe ()
O4 - HKLM..\Run: [svchospt] C:\WINDOWS\system32\svchospt.exe (FK2)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Privacy present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0
O7 - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSaveSettings = 0
O7 - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: RestrictRun = 0
O7 - HKU\S-1-5-21-1960408961-1935655697-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableClock = 0
O20 - AppInit_DLLs: (C:\PROGRA~1\IMESHA~1\MediaBar\Datamngr\datamngr.dll) -  File not found
O20 - AppInit_DLLs: (C:\PROGRA~1\IMESHA~1\MediaBar\Datamngr\IEBHO.dll) -  File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.12.14 16:55:36 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{485cb503-0861-11e0-aaf9-000c6e76d901}\Shell - "" = AutoRun
O33 - MountPoints2\{485cb503-0861-11e0-aaf9-000c6e76d901}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{485cb503-0861-11e0-aaf9-000c6e76d901}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL StartAudials.exe
O33 - MountPoints2\{6912fff5-8857-11e0-ae28-000c6e76d901}\Shell - "" = AutoRun
O33 - MountPoints2\{6912fff5-8857-11e0-ae28-000c6e76d901}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{6912fff5-8857-11e0-ae28-000c6e76d901}\Shell\AutoRun\command - "" = G:\DPFMate.exe
:Files
C:\Dokumente und Einstellungen\x\Anwendungsdaten\facemoods.com
C:\WINDOWS\System32\excltmp~.dat
C:\WINDOWS\system32\svchospt.exe
C:\Dokumente und Einstellungen\x\Anwendungsdaten\ObviousIdea
C:\Dokumente und Einstellungen\x\Anwendungsdaten\PriceGong
:Commands
[purity]
[emptytemp]
[emptyflash]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Bensi 17.05.2012 10:10
All processes killed
========== OTL ==========
HKU\S-1-5-21-1960408961-1935655697-682003330-1004\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
Registry value HKEY_USERS\S-1-5-21-1960408961-1935655697-682003330-1004\Software\Microsoft\Internet Explorer\URLSearchHooks\\ deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1960408961-1935655697-682003330-1004\Software\Microsoft\Internet Explorer\URLSearchHooks\\{855F3B16-6D32-4fe6-8A56-BBB695989046} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4fe6-8A56-BBB695989046}\ deleted successfully.
C:\Programme\ICQ6Toolbar\ICQToolBar.dll moved successfully.
HKEY_USERS\S-1-5-21-1960408961-1935655697-682003330-1004\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_USERS\S-1-5-21-1960408961-1935655697-682003330-1004\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_USERS\S-1-5-21-1960408961-1935655697-682003330-1004\Software\Microsoft\Internet Explorer\SearchScopes\{1F096B29-E9DA-4D64-8D63-936BE7762CC5}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1F096B29-E9DA-4D64-8D63-936BE7762CC5}\ not found.
Registry key HKEY_USERS\S-1-5-21-1960408961-1935655697-682003330-1004\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6552C7DD-90A4-4387-B795-F8F96747DE19}\ not found.
Registry key HKEY_USERS\S-1-5-21-1960408961-1935655697-682003330-1004\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ not found.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Search\\SearchAssistant| /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Prefs.js: "Search Results" removed from browser.search.defaultenginename
Prefs.js: "Search" removed from browser.search.defaultthis.engineName
Prefs.js: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}" removed from browser.search.defaulturl
Prefs.js: "Search Results" removed from browser.search.order.1
Prefs.js: "Ecosia" removed from browser.search.selectedEngine
Prefs.js: true removed from browser.search.useDBForOrder
Prefs.js: "hxxp://ecosia.org/" removed from browser.startup.homepage
Prefs.js: {d04b0b40-3dab-4f0b-97a6-04ec3eddbfb0}:2.0.5 removed from extensions.enabledItems
Prefs.js: "hxxp://dts.search-results.com/sr?src=ffb&appid=1083&systemid=1&sr=0&q=" removed from keyword.URL
C:\Dokumente und Einstellungen\x\Anwendungsdaten\Mozilla\Firefox\Profiles\nuokokjf.default\searchplugins\conduit.xml moved successfully.
C:\Dokumente und Einstellungen\x\Anwendungsdaten\Mozilla\Firefox\Profiles\nuokokjf.default\searchplugins\ecosia.xml moved successfully.
C:\Dokumente und Einstellungen\x\Anwendungsdaten\Mozilla\Firefox\Profiles\nuokokjf.default\searchplugins\icqplugin-1.xml moved successfully.
C:\Dokumente und Einstellungen\x\Anwendungsdaten\Mozilla\Firefox\Profiles\nuokokjf.default\searchplugins\icqplugin.xml moved successfully.
C:\Dokumente und Einstellungen\x\Anwendungsdaten\Mozilla\Firefox\Profiles\nuokokjf.default\searchplugins\Search_Results.xml moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\babylon.xml moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\Search_Results.xml moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2EECD738-5844-4a99-B4B6-146BF802613B}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2EECD738-5844-4a99-B4B6-146BF802613B}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64182481-4F71-486b-A045-B233BD0DA8FC}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{64182481-4F71-486b-A045-B233BD0DA8FC}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}\ deleted successfully.
C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BE7A24F5-69CB-4708-B77B-B1EDA6043B95}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BE7A24F5-69CB-4708-B77B-B1EDA6043B95}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{855F3B16-6D32-4FE6-8A56-BBB695989046} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4FE6-8A56-BBB695989046}\ not found.
File C:\Programme\ICQ6Toolbar\ICQToolBar.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{98889811-442D-49dd-99D7-DC866BE87DBC} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{98889811-442D-49dd-99D7-DC866BE87DBC}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{DB4E9724-F518-4dfd-9C7C-78B52103CAB9} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DB4E9724-F518-4dfd-9C7C-78B52103CAB9}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\10 deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1960408961-1935655697-682003330-1004\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\BabylonToolbar deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ChicoSys deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\DATAMNGR deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\facemoods deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\KernelFaultCheck deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\NeroCheck deleted successfully.
File move failed. C:\WINDOWS\System32\\NeroCheck.exe scheduled to be moved on reboot.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\svchospt deleted successfully.
C:\WINDOWS\system32\svchospt.exe moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Privacy\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\HonorAutoRunSetting deleted successfully.
Registry value HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun not found.
Registry value HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1960408961-1935655697-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1960408961-1935655697-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoControlPanel deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1960408961-1935655697-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoSaveSettings deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1960408961-1935655697-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDrives deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1960408961-1935655697-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\RestrictRun deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1960408961-1935655697-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableClock deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:C:\PROGRA~1\IMESHA~1\MediaBar\Datamngr\datamngr.dll deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:C:\PROGRA~1\IMESHA~1\MediaBar\Datamngr\IEBHO.dll deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\AUTOEXEC.BAT moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{485cb503-0861-11e0-aaf9-000c6e76d901}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{485cb503-0861-11e0-aaf9-000c6e76d901}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{485cb503-0861-11e0-aaf9-000c6e76d901}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{485cb503-0861-11e0-aaf9-000c6e76d901}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{485cb503-0861-11e0-aaf9-000c6e76d901}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{485cb503-0861-11e0-aaf9-000c6e76d901}\ not found.
File C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL StartAudials.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6912fff5-8857-11e0-ae28-000c6e76d901}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6912fff5-8857-11e0-ae28-000c6e76d901}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6912fff5-8857-11e0-ae28-000c6e76d901}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6912fff5-8857-11e0-ae28-000c6e76d901}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6912fff5-8857-11e0-ae28-000c6e76d901}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6912fff5-8857-11e0-ae28-000c6e76d901}\ not found.
File G:\DPFMate.exe not found.
========== FILES ==========
C:\Dokumente und Einstellungen\x\Anwendungsdaten\facemoods.com\facemoods folder moved successfully.
C:\Dokumente und Einstellungen\x\Anwendungsdaten\facemoods.com folder moved successfully.
C:\WINDOWS\System32\excltmp~.dat moved successfully.
File\Folder C:\WINDOWS\system32\svchospt.exe not found.
C:\Dokumente und Einstellungen\x\Anwendungsdaten\ObviousIdea folder moved successfully.
C:\Dokumente und Einstellungen\x\Anwendungsdaten\PriceGong\Data folder moved successfully.
C:\Dokumente und Einstellungen\x\Anwendungsdaten\PriceGong folder moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 1573187 bytes

User: x
->Temp folder emptied: 2064622379 bytes
->Temporary Internet Files folder emptied: 71348992 bytes
->FireFox cache emptied: 608268088 bytes
->Flash cache emptied: 7099 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2153902 bytes
%systemroot%\System32 .tmp files removed: 2951 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 3473441 bytes
RecycleBin emptied: 738442114 bytes

Total Files Cleaned = 3.328,00 mb


[EMPTYFLASH]

User: All Users

User: Default User

User: LocalService

User: NetworkService

User: x
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0,00 mb

C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTL by OldTimer - Version 3.2.42.3 log created on 05172012_105309

Files\Folders moved on Reboot...
C:\WINDOWS\System32\\NeroCheck.exe moved successfully.

Registry entries deleted on Reboot...


Der PC war grade bei dem neustart übrigens noch viel alngsamer als vorher. Soll das so?!

cosinus 17.05.2012 18:10
Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

Bensi 19.05.2012 17:59
Code:
18:43:17.0765 3296        TDSS rootkit removing tool 2.7.35.0 May 16 2012 07:37:57
18:43:18.0171 3296        ============================================================
18:43:18.0171 3296        Current date / time: 2012/05/19 18:43:18.0171
18:43:18.0171 3296        SystemInfo:
18:43:18.0171 3296       
18:43:18.0171 3296        OS Version: 5.1.2600 ServicePack: 3.0
18:43:18.0171 3296        Product type: Workstation
18:43:18.0171 3296        ComputerName: X-EC10DDBFD8434
18:43:18.0171 3296        UserName: x
18:43:18.0171 3296        Windows directory: C:\WINDOWS
18:43:18.0171 3296        System windows directory: C:\WINDOWS
18:43:18.0171 3296        Processor architecture: Intel x86
18:43:18.0171 3296        Number of processors: 1
18:43:18.0171 3296        Page size: 0x1000
18:43:18.0171 3296        Boot type: Normal boot
18:43:18.0171 3296        ============================================================
18:43:20.0625 3296        Drive \Device\Harddisk0\DR0 - Size: 0x9516AE000 (37.27 Gb), SectorSize: 0x200, Cylinders: 0x1301, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
18:43:20.0625 3296        Drive \Device\Harddisk1\DR2 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
18:43:20.0640 3296        Drive \Device\Harddisk2\DR3 - Size: 0x3AE80000 (0.92 Gb), SectorSize: 0x200, Cylinders: 0x78, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
18:43:20.0640 3296        ============================================================
18:43:20.0640 3296        \Device\Harddisk0\DR0:
18:43:20.0640 3296        MBR partitions:
18:43:20.0640 3296        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x4A852C1
18:43:20.0640 3296        \Device\Harddisk1\DR2:
18:43:20.0640 3296        MBR partitions:
18:43:20.0640 3296        \Device\Harddisk1\DR2\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x74705982
18:43:20.0640 3296        \Device\Harddisk2\DR3:
18:43:20.0640 3296        MBR partitions:
18:43:20.0640 3296        ============================================================
18:43:20.0656 3296        C: <-> \Device\Harddisk0\DR0\Partition0
18:43:20.0812 3296        G: <-> \Device\Harddisk1\DR2\Partition0
18:43:20.0843 3296        ============================================================
18:43:20.0843 3296        Initialize success
18:43:20.0843 3296        ============================================================
18:45:12.0812 2904        ============================================================
18:45:12.0812 2904        Scan started
18:45:12.0812 2904        Mode: Manual; SigCheck; TDLFS;
18:45:12.0812 2904        ============================================================
18:45:13.0000 2904        Scan interrupted by user!
18:45:13.0000 2904        Scan interrupted by user!
18:45:13.0000 2904        Scan interrupted by user!
18:45:13.0000 2904        ============================================================
18:45:13.0000 2904        Scan finished
18:45:13.0000 2904        ============================================================
18:45:13.0078 2540        Detected object count: 0
18:45:13.0078 2540        Actual detected object count: 0
18:45:16.0781 2608        ============================================================
18:45:16.0781 2608        Scan started
18:45:16.0781 2608        Mode: Manual; SigCheck; TDLFS;
18:45:16.0781 2608        ============================================================
18:45:16.0875 2608        Scan interrupted by user!
18:45:16.0875 2608        Scan interrupted by user!
18:45:16.0875 2608        Scan interrupted by user!
18:45:16.0875 2608        ============================================================
18:45:16.0875 2608        Scan finished
18:45:16.0875 2608        ============================================================
18:45:16.0953 2600        Detected object count: 0
18:45:16.0953 2600        Actual detected object count: 0
18:45:17.0812 3952        ============================================================
18:45:17.0812 3952        Scan started
18:45:17.0812 3952        Mode: Manual; SigCheck; TDLFS;
18:45:17.0812 3952        ============================================================
18:45:18.0109 3952        Abiosdsk - ok
18:45:18.0156 3952        abp480n5 - ok
18:45:18.0234 3952        ACPI            (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys
18:45:20.0406 3952        ACPI - ok
18:45:20.0453 3952        ACPIEC          (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\drivers\ACPIEC.sys
18:45:20.0781 3952        ACPIEC - ok
18:45:20.0828 3952        adpu160m - ok
18:45:20.0921 3952        aec            (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
18:45:21.0265 3952        aec - ok
18:45:21.0343 3952        AFD            (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
18:45:21.0437 3952        AFD - ok
18:45:21.0484 3952        Aha154x - ok
18:45:21.0531 3952        aic78u2 - ok
18:45:21.0593 3952        aic78xx - ok
18:45:21.0687 3952        Alerter        (738d80cc01d7bc7584be917b7f544394) C:\WINDOWS\system32\alrsvc.dll
18:45:22.0000 3952        Alerter - ok
18:45:22.0078 3952        ALG            (190cd73d4984f94d823f9444980513e5) C:\WINDOWS\System32\alg.exe
18:45:22.0171 3952        ALG - ok
18:45:22.0218 3952        AliIde - ok
18:45:22.0296 3952        AmdK7          (3a0dafac778236559c14c7203fb550eb) C:\WINDOWS\system32\DRIVERS\amdk7.sys
18:45:22.0593 3952        AmdK7 - ok
18:45:22.0625 3952        amsint - ok
18:45:22.0734 3952        AntiVirSchedulerService (466a0d95960dad3222c896d2cea99993) C:\Programme\Avira\AntiVir Desktop\sched.exe
18:45:22.0765 3952        AntiVirSchedulerService - ok
18:45:22.0812 3952        AntiVirService  (a489be6bb0aa1ff406b488b60542314b) C:\Programme\Avira\AntiVir Desktop\avguard.exe
18:45:22.0843 3952        AntiVirService - ok
18:45:22.0906 3952        AppMgmt - ok
18:45:22.0953 3952        asc - ok
18:45:23.0000 3952        asc3350p - ok
18:45:23.0046 3952        asc3550 - ok
18:45:23.0250 3952        aspnet_state    (776acefa0ca9df0faa51a5fb2f435705) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
18:45:23.0281 3952        aspnet_state - ok
18:45:23.0343 3952        AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
18:45:23.0671 3952        AsyncMac - ok
18:45:23.0718 3952        atapi          (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
18:45:24.0109 3952        atapi - ok
18:45:24.0156 3952        Atdisk - ok
18:45:24.0203 3952        Atmarpc        (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
18:45:24.0609 3952        Atmarpc - ok
18:45:24.0656 3952        AudioSrv        (58ed0d5452df7be732193e7999c6b9a4) C:\WINDOWS\System32\audiosrv.dll
18:45:25.0078 3952        AudioSrv - ok
18:45:25.0109 3952        audstub        (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
18:45:25.0500 3952        audstub - ok
18:45:25.0578 3952        avgntflt        (d5541f0afb767e85fc412fc609d96a74) C:\WINDOWS\system32\DRIVERS\avgntflt.sys
18:45:25.0625 3952        avgntflt - ok
18:45:25.0687 3952        avipbb          (7d967a682d4694df7fa57d63a2db01fe) C:\WINDOWS\system32\DRIVERS\avipbb.sys
18:45:25.0718 3952        avipbb - ok
18:45:25.0750 3952        avkmgr          (271cfd1a989209b1964e24d969552bf7) C:\WINDOWS\system32\DRIVERS\avkmgr.sys
18:45:25.0796 3952        avkmgr - ok
18:45:25.0875 3952        Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
18:45:26.0250 3952        Beep - ok
18:45:26.0375 3952        BITS            (d6f603772a789bb3228f310d650b8bd1) C:\WINDOWS\system32\qmgr.dll
18:45:26.0781 3952        BITS - ok
18:45:26.0828 3952        Browser        (b42057f06bbb98b31876c0b3f2b54e33) C:\WINDOWS\System32\browser.dll
18:45:27.0187 3952        Browser - ok
18:45:27.0250 3952        cbidf2k        (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
18:45:27.0656 3952        cbidf2k - ok
18:45:27.0656 3952        cd20xrnt - ok
18:45:27.0718 3952        Cdaudio        (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
18:45:28.0093 3952        Cdaudio - ok
18:45:28.0140 3952        Cdfs            (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
18:45:28.0515 3952        Cdfs - ok
18:45:28.0578 3952        Cdrom          (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
18:45:28.0921 3952        Cdrom - ok
18:45:28.0953 3952        Changer - ok
18:45:29.0046 3952        CiSvc          (28e3040d1f1ca2008cd6b29dfebc9a5e) C:\WINDOWS\system32\cisvc.exe
18:45:29.0437 3952        CiSvc - ok
18:45:29.0484 3952        ClipSrv        (778a30ed3c134eb7e406afc407e9997d) C:\WINDOWS\system32\clipsrv.exe
18:45:29.0875 3952        ClipSrv - ok
18:45:29.0921 3952        clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
18:45:29.0953 3952        clr_optimization_v2.0.50727_32 - ok
18:45:30.0062 3952        clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
18:45:30.0156 3952        clr_optimization_v4.0.30319_32 - ok
18:45:30.0171 3952        CmdIde - ok
18:45:30.0218 3952        COMSysApp - ok
18:45:30.0312 3952        Cpqarray - ok
18:45:30.0375 3952        CryptSvc        (611f824e5c703a5a899f84c5f1699e4d) C:\WINDOWS\System32\cryptsvc.dll
18:45:30.0750 3952        CryptSvc - ok
18:45:30.0781 3952        dac2w2k - ok
18:45:30.0828 3952        dac960nt - ok
18:45:30.0937 3952        DcomLaunch      (3127afbf2c1ed0ab14a1bbb7aaecb85b) C:\WINDOWS\system32\rpcss.dll
18:45:31.0031 3952        DcomLaunch - ok
18:45:31.0109 3952        Dhcp            (c29a1c9b75ba38fa37f8c44405dec360) C:\WINDOWS\System32\dhcpcsvc.dll
18:45:31.0500 3952        Dhcp - ok
18:45:31.0546 3952        Disk            (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
18:45:31.0921 3952        Disk - ok
18:45:31.0937 3952        dmadmin - ok
18:45:32.0078 3952        dmboot          (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys
18:45:32.0468 3952        dmboot - ok
18:45:32.0531 3952        dmio            (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys
18:45:32.0875 3952        dmio - ok
18:45:32.0953 3952        dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
18:45:33.0296 3952        dmload - ok
18:45:33.0390 3952        dmserver        (25c83ffbba13b554eb6d59a9b2e2ee78) C:\WINDOWS\System32\dmserver.dll
18:45:33.0781 3952        dmserver - ok
18:45:33.0875 3952        DMusic          (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
18:45:34.0203 3952        DMusic - ok
18:45:34.0265 3952        Dnscache        (407f3227ac618fd1ca54b335b083de07) C:\WINDOWS\System32\dnsrslvr.dll
18:45:34.0390 3952        Dnscache - ok
18:45:34.0437 3952        Dot3svc        (676e36c4ff5bcea1900f44182b9723e6) C:\WINDOWS\System32\dot3svc.dll
18:45:34.0796 3952        Dot3svc - ok
18:45:34.0828 3952        dpti2o - ok
18:45:34.0890 3952        drmkaud        (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
18:45:35.0281 3952        drmkaud - ok
18:45:35.0359 3952        EapHost        (4e4f2fddab0a0736d7671134dcce91fb) C:\WINDOWS\System32\eapsvc.dll
18:45:35.0781 3952        EapHost - ok
18:45:35.0812 3952        ERSvc          (877c18558d70587aa7823a1a308ac96b) C:\WINDOWS\System32\ersvc.dll
18:45:36.0203 3952        ERSvc - ok
18:45:36.0281 3952        Eventlog        (a3edbe9053889fb24ab22492472b39dc) C:\WINDOWS\system32\services.exe
18:45:36.0328 3952        Eventlog - ok
18:45:36.0421 3952        EventSystem    (af4f6b5739d18ca7972ab53e091cbc74) C:\WINDOWS\system32\es.dll
18:45:36.0531 3952        EventSystem - ok
18:45:36.0578 3952        Fastfat        (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
18:45:36.0921 3952        Fastfat - ok
18:45:36.0968 3952        FastUserSwitchingCompatibility (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
18:45:37.0062 3952        FastUserSwitchingCompatibility - ok
18:45:37.0140 3952        Fdc            (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
18:45:37.0484 3952        Fdc - ok
18:45:37.0546 3952        FETNDIS        (b6ae399c4bb11966d0ff7a54dc798c0e) C:\WINDOWS\system32\DRIVERS\fetnd5b.sys
18:45:37.0625 3952        FETNDIS - ok
18:45:37.0687 3952        Fips            (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys
18:45:38.0015 3952        Fips - ok
18:45:38.0062 3952        Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
18:45:38.0406 3952        Flpydisk - ok
18:45:38.0453 3952        FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
18:45:38.0796 3952        FltMgr - ok
18:45:38.0906 3952        FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
18:45:38.0921 3952        FontCache3.0.0.0 - ok
18:45:38.0968 3952        Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
18:45:39.0328 3952        Fs_Rec - ok
18:45:39.0390 3952        Ftdisk          (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
18:45:39.0703 3952        Ftdisk - ok
18:45:39.0765 3952        gameenum        (065639773d8b03f33577f6cdaea21063) C:\WINDOWS\system32\DRIVERS\gameenum.sys
18:45:40.0125 3952        gameenum - ok
18:45:40.0171 3952        Gpc            (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
18:45:40.0500 3952        Gpc - ok
18:45:40.0578 3952        helpsvc        (cb66bf85bf599befd6c6a57c2e20357f) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
18:45:40.0953 3952        helpsvc - ok
18:45:41.0000 3952        HidServ - ok
18:45:41.0109 3952        hkmsvc          (ed29f14101523a6e0e808107405d452c) C:\WINDOWS\System32\kmsvc.dll
18:45:41.0453 3952        hkmsvc - ok
18:45:41.0484 3952        hpn - ok
18:45:41.0562 3952        HSFHWBS2        (970178e8e003eb1481293830069624b9) C:\WINDOWS\system32\DRIVERS\HSFBS2S2.sys
18:45:41.0859 3952        HSFHWBS2 - ok
18:45:41.0984 3952        HSF_DP          (ebb354438a4c5a3327fb97306260714a) C:\WINDOWS\system32\DRIVERS\HSFDPSP2.sys
18:45:42.0421 3952        HSF_DP - ok
18:45:42.0484 3952        HTTP            (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
18:45:42.0546 3952        HTTP - ok
18:45:42.0625 3952        HTTPFilter      (9e4adb854cebcfb81a4b36718feecd16) C:\WINDOWS\System32\w3ssl.dll
18:45:42.0984 3952        HTTPFilter - ok
18:45:43.0015 3952        i2omgmt - ok
18:45:43.0062 3952        i2omp - ok
18:45:43.0125 3952        i8042prt        (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
18:45:43.0484 3952        i8042prt - ok
18:45:43.0562 3952        ICQ Service    (b1a28fa1afde10b95ff9354b15701d70) C:\Programme\ICQ6Toolbar\ICQ Service.exe
18:45:43.0593 3952        ICQ Service - ok
18:45:43.0750 3952        idsvc          (c01ac32dc5c03076cfb852cb5da5229c) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
18:45:43.0859 3952        idsvc - ok
18:45:43.0921 3952        Imapi          (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
18:45:44.0281 3952        Imapi - ok
18:45:44.0359 3952        ImapiService    (d4b413aa210c21e46aedd2ba5b68d38e) C:\WINDOWS\system32\imapi.exe
18:45:44.0718 3952        ImapiService - ok
18:45:44.0781 3952        ini910u - ok
18:45:44.0875 3952        IntelIde - ok
18:45:44.0953 3952        Ip6Fw          (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
18:45:45.0296 3952        Ip6Fw - ok
18:45:45.0343 3952        IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
18:45:45.0718 3952        IpFilterDriver - ok
18:45:45.0750 3952        IpInIp          (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
18:45:46.0109 3952        IpInIp - ok
18:45:46.0187 3952        IpNat          (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
18:45:46.0562 3952        IpNat - ok
18:45:46.0625 3952        IPSec          (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
18:45:46.0937 3952        IPSec - ok
18:45:47.0000 3952        IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
18:45:47.0109 3952        IRENUM - ok
18:45:47.0187 3952        isapnp          (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys
18:45:47.0593 3952        isapnp - ok
18:45:47.0656 3952        Kbdclass        (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
18:45:47.0984 3952        Kbdclass - ok
18:45:48.0093 3952        kmixer          (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
18:45:48.0515 3952        kmixer - ok
18:45:48.0578 3952        KSecDD          (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
18:45:48.0765 3952        KSecDD - ok
18:45:48.0843 3952        lanmanserver    (2bbdcb79900990f0716dfcb714e72de7) C:\WINDOWS\System32\srvsvc.dll
18:45:48.0875 3952        lanmanserver - ok
18:45:48.0937 3952        lanmanworkstation (1869b14b06b44b44af70548e1ea3303f) C:\WINDOWS\System32\wkssvc.dll
18:45:48.0984 3952        lanmanworkstation - ok
18:45:49.0015 3952        lbrtfdc - ok
18:45:49.0140 3952        LmHosts        (636714b7d43c8d0c80449123fd266920) C:\WINDOWS\System32\lmhsvc.dll
18:45:49.0515 3952        LmHosts - ok
18:45:49.0593 3952        mdmxsdk        (195741aee20369980796b557358cd774) C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys
18:45:49.0890 3952        mdmxsdk - ok
18:45:49.0968 3952        Messenger      (b7550a7107281d170ce85524b1488c98) C:\WINDOWS\System32\msgsvc.dll
18:45:50.0343 3952        Messenger - ok
18:45:50.0390 3952        mnmdd          (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
18:45:50.0718 3952        mnmdd - ok
18:45:50.0796 3952        mnmsrvc        (c2f1d365fd96791b037ee504868065d3) C:\WINDOWS\system32\mnmsrvc.exe
18:45:51.0156 3952        mnmsrvc - ok
18:45:51.0218 3952        Modem          (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys
18:45:51.0578 3952        Modem - ok
18:45:51.0609 3952        Mouclass        (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys
18:45:51.0968 3952        Mouclass - ok
18:45:52.0046 3952        MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
18:45:52.0421 3952        MountMgr - ok
18:45:52.0500 3952        MozillaMaintenance (96aa8ba23142cc8e2b30f3cae0c80254) C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe
18:45:52.0531 3952        MozillaMaintenance - ok
18:45:52.0578 3952        mraid35x - ok
18:45:52.0640 3952        MRxDAV          (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
18:45:52.0937 3952        MRxDAV - ok
18:45:53.0031 3952        MRxSmb          (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
18:45:53.0125 3952        MRxSmb - ok
18:45:53.0187 3952        MSDTC          (35a031af38c55f92d28aa03ee9f12cc9) C:\WINDOWS\system32\msdtc.exe
18:45:53.0593 3952        MSDTC - ok
18:45:53.0687 3952        Msfs            (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
18:45:54.0015 3952        Msfs - ok
18:45:54.0062 3952        MSIServer - ok
18:45:54.0140 3952        MSKSSRV        (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
18:45:54.0453 3952        MSKSSRV - ok
18:45:54.0500 3952        MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
18:45:54.0859 3952        MSPCLOCK - ok
18:45:54.0937 3952        MSPQM          (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
18:45:55.0281 3952        MSPQM - ok
18:45:55.0343 3952        mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
18:45:55.0671 3952        mssmbios - ok
18:45:55.0750 3952        Mup            (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
18:45:55.0828 3952        Mup - ok
18:45:55.0906 3952        napagent        (46bb15ae2ac7d025d6d2567b876817bd) C:\WINDOWS\System32\qagentrt.dll
18:45:56.0281 3952        napagent - ok
18:45:56.0343 3952        NDIS            (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
18:45:56.0687 3952        NDIS - ok
18:45:56.0718 3952        NdisTapi        (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
18:45:56.0812 3952        NdisTapi - ok
18:45:56.0875 3952        Ndisuio        (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
18:45:57.0187 3952        Ndisuio - ok
18:45:57.0250 3952        NdisWan        (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
18:45:57.0593 3952        NdisWan - ok
18:45:57.0656 3952        NDProxy        (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
18:45:57.0703 3952        NDProxy - ok
18:45:57.0734 3952        NetBIOS        (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
18:45:58.0156 3952        NetBIOS - ok
18:45:58.0234 3952        NetBT          (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
18:45:58.0531 3952        NetBT - ok
18:45:58.0593 3952        NetDDE          (8ace4251bffd09ce75679fe940e996cc) C:\WINDOWS\system32\netdde.exe
18:45:58.0953 3952        NetDDE - ok
18:45:59.0000 3952        NetDDEdsdm      (8ace4251bffd09ce75679fe940e996cc) C:\WINDOWS\system32\netdde.exe
18:45:59.0312 3952        NetDDEdsdm - ok
18:45:59.0375 3952        Netlogon        (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
18:45:59.0718 3952        Netlogon - ok
18:45:59.0781 3952        Netman          (e6d88f1f6745bf00b57e7855a2ab696c) C:\WINDOWS\System32\netman.dll
18:46:00.0093 3952        Netman - ok
18:46:00.0218 3952        NetTcpPortSharing (d34612c5d02d026535b3095d620626ae) c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
18:46:00.0250 3952        NetTcpPortSharing - ok
18:46:00.0312 3952        Nla            (f1b67b6b0751ae0e6e964b02821206a3) C:\WINDOWS\System32\mswsock.dll
18:46:00.0359 3952        Nla - ok
18:46:00.0437 3952        Npfs            (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
18:46:00.0781 3952        Npfs - ok
18:46:00.0859 3952        Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
18:46:01.0250 3952        Ntfs - ok
18:46:01.0281 3952        NtLmSsp        (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
18:46:01.0609 3952        NtLmSsp - ok
18:46:01.0734 3952        NtmsSvc        (56af4064996fa5bac9c449b1514b4770) C:\WINDOWS\system32\ntmssvc.dll
18:46:02.0093 3952        NtmsSvc - ok
18:46:02.0125 3952        NTSIM          (aa56a73370f0a29bcb8aff177b6c68f8) C:\WINDOWS\system32\ntsim.sys
18:46:02.0156 3952        NTSIM ( UnsignedFile.Multi.Generic ) - warning
18:46:02.0156 3952        NTSIM - detected UnsignedFile.Multi.Generic (1)
18:46:02.0187 3952        Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
18:46:02.0484 3952        Null - ok
18:46:02.0671 3952        nv              (2b298519edbfcf451d43e0f1e8f1006d) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
18:46:03.0125 3952        nv - ok
18:46:03.0250 3952        NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
18:46:03.0593 3952        NwlnkFlt - ok
18:46:03.0640 3952        NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
18:46:04.0031 3952        NwlnkFwd - ok
18:46:04.0125 3952        ose            (7a56cf3e3f12e8af599963b16f50fb6a) C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE
18:46:04.0171 3952        ose - ok
18:46:04.0218 3952        Parport        (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\DRIVERS\parport.sys
18:46:04.0562 3952        Parport - ok
18:46:04.0609 3952        PartMgr        (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
18:46:04.0953 3952        PartMgr - ok
18:46:05.0031 3952        ParVdm          (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys
18:46:05.0359 3952        ParVdm - ok
18:46:05.0406 3952        PCI            (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys
18:46:05.0796 3952        PCI - ok
18:46:05.0843 3952        PCIDump - ok
18:46:05.0921 3952        PCIIde - ok
18:46:05.0984 3952        Pcmcia          (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\drivers\Pcmcia.sys
18:46:06.0343 3952        Pcmcia - ok
18:46:06.0375 3952        PDCOMP - ok
18:46:06.0390 3952        PDFRAME - ok
18:46:06.0437 3952        PDRELI - ok
18:46:06.0484 3952        PDRFRAME - ok
18:46:06.0531 3952        perc2 - ok
18:46:06.0578 3952        perc2hib - ok
18:46:06.0718 3952        PlugPlay        (a3edbe9053889fb24ab22492472b39dc) C:\WINDOWS\system32\services.exe
18:46:06.0765 3952        PlugPlay - ok
18:46:06.0828 3952        PolicyAgent    (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
18:46:07.0109 3952        PolicyAgent - ok
18:46:07.0187 3952        PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
18:46:07.0578 3952        PptpMiniport - ok
18:46:07.0609 3952        ProtectedStorage (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
18:46:07.0921 3952        ProtectedStorage - ok
18:46:07.0984 3952        PSched          (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
18:46:08.0359 3952        PSched - ok
18:46:08.0421 3952        Ptilink        (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
18:46:09.0031 3952        Ptilink - ok
18:46:09.0078 3952        ql1080 - ok
18:46:09.0125 3952        Ql10wnt - ok
18:46:09.0171 3952        ql12160 - ok
18:46:09.0218 3952        ql1240 - ok
18:46:09.0281 3952        ql1280 - ok
18:46:09.0343 3952        RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
18:46:09.0718 3952        RasAcd - ok
18:46:09.0812 3952        RasAuto        (f5ba6caccdb66c8f048e867563203246) C:\WINDOWS\System32\rasauto.dll
18:46:10.0093 3952        RasAuto - ok
18:46:10.0140 3952        Rasl2tp        (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
18:46:10.0515 3952        Rasl2tp - ok
18:46:10.0593 3952        RasMan          (f9a7b66ea345726edb5862a46b1eccd5) C:\WINDOWS\System32\rasmans.dll
18:46:10.0953 3952        RasMan - ok
18:46:11.0000 3952        RasPppoe        (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
18:46:11.0421 3952        RasPppoe - ok
18:46:11.0453 3952        Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
18:46:11.0796 3952        Raspti - ok
18:46:11.0875 3952        Rdbss          (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
18:46:12.0203 3952        Rdbss - ok
18:46:12.0265 3952        RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
18:46:12.0609 3952        RDPCDD - ok
18:46:12.0718 3952        RDPWD          (5b3055daa788bd688594d2f5981f2a83) C:\WINDOWS\system32\drivers\RDPWD.sys
18:46:12.0750 3952        RDPWD - ok
18:46:12.0812 3952        RDSessMgr      (263af18af0f3db99f574c95f284ccec9) C:\WINDOWS\system32\sessmgr.exe
18:46:13.0109 3952        RDSessMgr - ok
18:46:13.0218 3952        redbook        (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys
18:46:13.0562 3952        redbook - ok
18:46:13.0609 3952        RemoteAccess    (0e97ec96d6942ceec2d188cc2eb69a01) C:\WINDOWS\System32\mprdim.dll
18:46:13.0953 3952        RemoteAccess - ok
18:46:14.0015 3952        RpcLocator      (2a02e21867497df20b8fc95631395169) C:\WINDOWS\system32\locator.exe
18:46:14.0390 3952        RpcLocator - ok
18:46:14.0453 3952        RpcSs          (3127afbf2c1ed0ab14a1bbb7aaecb85b) C:\WINDOWS\system32\rpcss.dll
18:46:14.0546 3952        RpcSs - ok
18:46:14.0625 3952        RSVP            (4bdd71b4b521521499dfd14735c4f398) C:\WINDOWS\system32\rsvp.exe
18:46:14.0921 3952        RSVP - ok
18:46:14.0984 3952        SamSs          (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
18:46:15.0312 3952        SamSs - ok
18:46:15.0375 3952        SCardSvr        (dcec079fad95d36c8dd5cb6d779dfe32) C:\WINDOWS\System32\SCardSvr.exe
18:46:15.0718 3952        SCardSvr - ok
18:46:15.0781 3952        Schedule        (a050194a44d7fa8d7186ed2f4e8367ae) C:\WINDOWS\system32\schedsvc.dll
18:46:16.0140 3952        Schedule - ok
18:46:16.0234 3952        Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
18:46:16.0312 3952        Secdrv - ok
18:46:16.0375 3952        seclogon        (bee4cfd1d48c23b44cf4b974b0b79b2b) C:\WINDOWS\System32\seclogon.dll
18:46:16.0718 3952        seclogon - ok
18:46:16.0781 3952        SENS            (2aac9b6ed9eddffb721d6452e34d67e3) C:\WINDOWS\system32\sens.dll
18:46:17.0125 3952        SENS - ok
18:46:17.0171 3952        serenum        (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
18:46:17.0484 3952        serenum - ok
18:46:17.0531 3952        Serial          (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\DRIVERS\serial.sys
18:46:17.0859 3952        Serial - ok
18:46:18.0046 3952        sfdrv01        (00de597b81b381053cb5b21a7f20e365) C:\WINDOWS\system32\drivers\sfdrv01.sys
18:46:18.0109 3952        sfdrv01 ( UnsignedFile.Multi.Generic ) - warning
18:46:18.0109 3952        sfdrv01 - detected UnsignedFile.Multi.Generic (1)
18:46:18.0187 3952        sfhlp02        (64b9ab76f1b16eb059cb6cdd906c067a) C:\WINDOWS\system32\drivers\sfhlp02.sys
18:46:18.0218 3952        sfhlp02 ( UnsignedFile.Multi.Generic ) - warning
18:46:18.0218 3952        sfhlp02 - detected UnsignedFile.Multi.Generic (1)
18:46:18.0296 3952        Sfloppy        (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
18:46:18.0609 3952        Sfloppy - ok
18:46:18.0687 3952        sfsync02        (798d918d8f20380008277ce3ce5319d1) C:\WINDOWS\system32\drivers\sfsync02.sys
18:46:18.0687 3952        sfsync02 ( UnsignedFile.Multi.Generic ) - warning
18:46:18.0687 3952        sfsync02 - detected UnsignedFile.Multi.Generic (1)
18:46:18.0781 3952        SharedAccess    (cad058d5f8b889a87ca3eb3cf624dcef) C:\WINDOWS\System32\ipnathlp.dll
18:46:19.0109 3952        SharedAccess - ok
18:46:19.0187 3952        ShellHWDetection (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
18:46:19.0234 3952        ShellHWDetection - ok
18:46:19.0265 3952        Simbad - ok
18:46:19.0343 3952        Sparrow - ok
18:46:19.0406 3952        splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
18:46:19.0734 3952        splitter - ok
18:46:19.0812 3952        Spooler        (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe
18:46:19.0875 3952        Spooler - ok
18:46:19.0921 3952        sr              (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys
18:46:20.0031 3952        sr - ok
18:46:20.0093 3952        srservice      (fe77a85495065f3ad59c5c65b6c54182) C:\WINDOWS\system32\srsvc.dll
18:46:20.0218 3952        srservice - ok
18:46:20.0312 3952        Srv            (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
18:46:20.0421 3952        Srv - ok
18:46:20.0515 3952        SSDPSRV        (4df5b05dfaec29e13e1ed6f6ee12c500) C:\WINDOWS\System32\ssdpsrv.dll
18:46:20.0640 3952        SSDPSRV - ok
18:46:20.0718 3952        ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
18:46:20.0734 3952        ssmdrv - ok
18:46:20.0812 3952        stisvc          (bc2c5985611c5356b24aeb370953ded9) C:\WINDOWS\system32\wiaservc.dll
18:46:21.0140 3952        stisvc - ok
18:46:21.0171 3952        swenum          (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
18:46:21.0546 3952        swenum - ok
18:46:21.0609 3952        swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
18:46:21.0906 3952        swmidi - ok
18:46:21.0937 3952        SwPrv - ok
18:46:22.0000 3952        symc810 - ok
18:46:22.0046 3952        symc8xx - ok
18:46:22.0078 3952        sym_hi - ok
18:46:22.0125 3952        sym_u3 - ok
18:46:22.0203 3952        sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
18:46:22.0546 3952        sysaudio - ok
18:46:22.0593 3952        SysmonLog      (2903fffa2523926d6219428040dce6b9) C:\WINDOWS\system32\smlogsvc.exe
18:46:22.0890 3952        SysmonLog - ok
18:46:22.0968 3952        TapiSrv        (05903cac4b98908d55ea5774775b382e) C:\WINDOWS\System32\tapisrv.dll
18:46:23.0296 3952        TapiSrv - ok
18:46:23.0406 3952        Tcpip          (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
18:46:23.0484 3952        Tcpip - ok
18:46:23.0531 3952        TDPIPE          (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
18:46:23.0843 3952        TDPIPE - ok
18:46:23.0906 3952        TDTCP          (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
18:46:24.0218 3952        TDTCP - ok
18:46:24.0312 3952        TermDD          (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
18:46:24.0687 3952        TermDD - ok
18:46:24.0765 3952        TermService    (b7de02c863d8f5a005a7bf375375a6a4) C:\WINDOWS\System32\termsrv.dll
18:46:25.0109 3952        TermService - ok
18:46:25.0171 3952        Themes          (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
18:46:25.0187 3952        Themes - ok
18:46:25.0234 3952        TosIde - ok
18:46:25.0281 3952        TrkWks          (626504572b175867f30f3215c04b3e2f) C:\WINDOWS\system32\trkwks.dll
18:46:25.0593 3952        TrkWks - ok
18:46:25.0687 3952        Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
18:46:26.0000 3952        Udfs - ok
18:46:26.0031 3952        ultra - ok
18:46:26.0140 3952        Update          (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
18:46:26.0500 3952        Update - ok
18:46:26.0562 3952        upnphost        (1dfd8975d8c89214b98d9387c1125b49) C:\WINDOWS\System32\upnphost.dll
18:46:26.0703 3952        upnphost - ok
18:46:26.0750 3952        UPS            (9b11e6118958e63e1fef129466e2bda7) C:\WINDOWS\System32\ups.exe
18:46:27.0109 3952        UPS - ok
18:46:27.0203 3952        usbccgp        (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
18:46:27.0531 3952        usbccgp - ok
18:46:27.0562 3952        usbehci        (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
18:46:27.0875 3952        usbehci - ok
18:46:27.0968 3952        usbhub          (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
18:46:28.0250 3952        usbhub - ok
18:46:28.0312 3952        usbprint        (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
18:46:28.0625 3952        usbprint - ok
18:46:28.0703 3952        usbscan        (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
18:46:28.0984 3952        usbscan - ok
18:46:29.0078 3952        USBSTOR        (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
18:46:29.0406 3952        USBSTOR - ok
18:46:29.0453 3952        usbuhci        (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
18:46:29.0765 3952        usbuhci - ok
18:46:29.0812 3952        VgaSave        (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
18:46:30.0156 3952        VgaSave - ok
18:46:30.0187 3952        viaagp          (754292ce5848b3738281b4f3607eaef4) C:\WINDOWS\system32\DRIVERS\viaagp.sys
18:46:30.0546 3952        viaagp - ok
18:46:30.0609 3952        viaagp1        (f76ea9ae8d32ec50159795d29674465e) C:\WINDOWS\system32\DRIVERS\viaagp1.sys
18:46:30.0656 3952        viaagp1 - ok
18:46:30.0703 3952        ViaIde          (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\DRIVERS\viaide.sys
18:46:31.0015 3952        ViaIde - ok
18:46:31.0078 3952        VIAudio        (7c6dd89e2b5e78a8247e327c2b301db1) C:\WINDOWS\system32\drivers\viaudio.sys
18:46:31.0125 3952        VIAudio - ok
18:46:31.0171 3952        VolSnap        (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys
18:46:31.0515 3952        VolSnap - ok
18:46:31.0609 3952        VSS            (68f106273be29e7b7ef8266977268e78) C:\WINDOWS\System32\vssvc.exe
18:46:31.0750 3952        VSS - ok
18:46:31.0828 3952        W32Time        (7b353059e665f8b7ad2bbeaef597cf45) C:\WINDOWS\system32\w32time.dll
18:46:32.0109 3952        W32Time - ok
18:46:32.0187 3952        Wanarp          (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
18:46:32.0593 3952        Wanarp - ok
18:46:32.0609 3952        WDICA - ok
18:46:32.0687 3952        wdmaud          (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
18:46:32.0984 3952        wdmaud - ok
18:46:33.0062 3952        WebClient      (81727c9873e3905a2ffc1ebd07265002) C:\WINDOWS\System32\webclnt.dll
18:46:33.0390 3952        WebClient - ok
18:46:33.0484 3952        winachsf        (1225ebea76aac3c84df6c54fe5e5d8be) C:\WINDOWS\system32\DRIVERS\HSFCXTS2.sys
18:46:33.0875 3952        winachsf - ok
18:46:33.0984 3952        winmgmt        (6f3f3973d97714cc5f906a19fe883729) C:\WINDOWS\system32\wbem\WMIsvc.dll
18:46:34.0343 3952        winmgmt - ok
18:46:34.0437 3952        WmdmPmSN        (c51b4a5c05a5475708e3c81c7765b71d) C:\WINDOWS\system32\MsPMSNSv.dll
18:46:34.0562 3952        WmdmPmSN - ok
18:46:34.0656 3952        WmiApSrv        (93908111ba57a6e60ec2fa2de202105c) C:\WINDOWS\system32\wbem\wmiapsrv.exe
18:46:34.0968 3952        WmiApSrv - ok
18:46:35.0109 3952        WMPNetworkSvc  (bf05650bb7df5e9ebdd25974e22403bb) C:\Programme\Windows Media Player\WMPNetwk.exe
18:46:35.0234 3952        WMPNetworkSvc - ok
18:46:35.0328 3952        WpdUsb          (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys
18:46:35.0359 3952        WpdUsb - ok
18:46:35.0640 3952        WPFFontCache_v0400 (dcf3e3edf5109ee8bc02fe6e1f045795) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
18:46:35.0828 3952        WPFFontCache_v0400 - ok
18:46:35.0921 3952        wscsvc          (300b3e84faf1a5c1f791c159ba28035d) C:\WINDOWS\system32\wscsvc.dll
18:46:36.0250 3952        wscsvc - ok
18:46:36.0296 3952        wuauserv        (7b4fe05202aa6bf9f4dfd0e6a0d8a085) C:\WINDOWS\system32\wuauserv.dll
18:46:36.0656 3952        wuauserv - ok
18:46:36.0734 3952        WudfPf          (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
18:46:36.0843 3952        WudfPf - ok
18:46:36.0890 3952        WudfRd          (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
18:46:36.0953 3952        WudfRd - ok
18:46:37.0000 3952        WudfSvc        (05231c04253c5bc30b26cbaae680ed89) C:\WINDOWS\System32\WUDFSvc.dll
18:46:37.0093 3952        WudfSvc - ok
18:46:37.0156 3952        WZCSVC          (c4f109c005f6725162d2d12ca751e4a7) C:\WINDOWS\System32\wzcsvc.dll
18:46:37.0515 3952        WZCSVC - ok
18:46:37.0578 3952        xmlprov        (0ada34871a2e1cd2caafed1237a47750) C:\WINDOWS\System32\xmlprov.dll
18:46:37.0890 3952        xmlprov - ok
18:46:37.0984 3952        MBR (0x1B8)    (72b8ce41af0de751c946802b3ed844b4) \Device\Harddisk0\DR0
18:46:38.0515 3952        \Device\Harddisk0\DR0 - ok
18:46:38.0562 3952        MBR (0x1B8)    (5fb38429d5d77768867c76dcbdb35194) \Device\Harddisk1\DR2
18:46:38.0640 3952        \Device\Harddisk1\DR2 - ok
18:46:38.0671 3952        MBR (0x1B8)    (f5bd775be911a7c8920cb381ead9f50e) \Device\Harddisk2\DR3
18:46:42.0156 3952        \Device\Harddisk2\DR3 - ok
18:46:42.0203 3952        Boot (0x1200)  (f647f176187165327dd49a5d6214a341) \Device\Harddisk0\DR0\Partition0
18:46:42.0203 3952        \Device\Harddisk0\DR0\Partition0 - ok
18:46:42.0234 3952        Boot (0x1200)  (4d97139a2867bdfb9bf19a4e03df3ab7) \Device\Harddisk1\DR2\Partition0
18:46:42.0234 3952        \Device\Harddisk1\DR2\Partition0 - ok
18:46:42.0250 3952        ============================================================
18:46:42.0250 3952        Scan finished
18:46:42.0250 3952        ============================================================
18:46:42.0421 3948        Detected object count: 4
18:46:42.0421 3948        Actual detected object count: 4
18:58:08.0875 3948        NTSIM ( UnsignedFile.Multi.Generic ) - skipped by user
18:58:08.0875 3948        NTSIM ( UnsignedFile.Multi.Generic ) - User select action: Skip
18:58:08.0875 3948        sfdrv01 ( UnsignedFile.Multi.Generic ) - skipped by user
18:58:08.0875 3948        sfdrv01 ( UnsignedFile.Multi.Generic ) - User select action: Skip
18:58:08.0875 3948        sfhlp02 ( UnsignedFile.Multi.Generic ) - skipped by user
18:58:08.0875 3948        sfhlp02 ( UnsignedFile.Multi.Generic ) - User select action: Skip
18:58:08.0875 3948        sfsync02 ( UnsignedFile.Multi.Generic ) - skipped by user
18:58:08.0875 3948        sfsync02 ( UnsignedFile.Multi.Generic ) - User select action: Skip


Alle Zeitangaben in WEZ +1. Es ist jetzt 21:00 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2024, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129