Trojaner-Board
Seite 1 von 3 1 23
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Trojaner / Malware ? Mail Account hat Spam Mails verschickt (https://www.trojaner-board.de/116160-trojaner-malware-mail-account-hat-spam-mails-verschickt.html)

28missi 01.06.2012 12:37
Trojaner / Malware ? Mail Account hat Spam Mails verschickt
 
Hallo Zusammen!

Bin langsam verzweifelt. Hatte mir einen Trojaner eingefangen Rootkit.gen
Hatte dann auch noch worm32. Habe alles entfernt. Hatte damals Avira laufen. Habe jetzt auf Zone Alarm gewechselt in der Hoffnung mit einer guten Firewall mir erst gar keine neuen Bedrohungen einzufangen.
Nun hat mein Mail Account bei web.de letzte Nacht Spam Mails verschickt.
Waren die alten doch noch aktiv? Warum hat Zone Alarm nichts gefunden?

hier die Log DatenOTL Logfile:
Code:
OTL logfile created on: 01.06.2012 09:05:00 - Run 1
OTL by OldTimer - Version 3.2.45.0 Folder = C:\Dokumente und Einstellungen\test\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,24 Gb Total Physical Memory | 0,80 Gb Available Physical Memory | 64,26% Memory free
1,83 Gb Paging File | 1,37 Gb Available in Paging File | 74,61% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 37,25 Gb Total Space | 24,82 Gb Free Space | 66,63% Space Free | Partition Type: NTFS
 
Computer Name: TEST-101EE4A811 | User Name: test | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.06.01 09:04:26 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\test\Desktop\OTL.exe
PRC - [2011.08.10 13:53:16 | 002,419,592 | ---- | M] (Check Point Software Technologies LTD) -- C:\Programme\CheckPoint\ZoneAlarm\vsmon.exe
PRC - [2011.08.10 13:31:08 | 000,072,848 | ---- | M] (Check Point Software Technologies LTD) -- C:\Programme\CheckPoint\ZoneAlarm\zatray.exe
PRC - [2011.07.25 15:00:58 | 000,493,184 | ---- | M] (Check Point Software Technologies) -- C:\Programme\CheckPoint\ZAForceField\ISWSVC.exe
PRC - [2011.07.25 15:00:56 | 000,738,944 | ---- | M] (Check Point Software Technologies) -- C:\Programme\CheckPoint\ZAForceField\ForceField.exe
PRC - [2011.07.22 09:49:26 | 000,511,920 | ---- | M] (REINER SCT) -- C:\WINDOWS\system32\cjpcsc.exe
PRC - [2011.06.09 14:06:06 | 000,254,696 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
PRC - [2010.02.18 17:44:15 | 000,202,256 | ---- | M] (RealNetworks, Inc.) -- C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
PRC - [2008.04.14 14:00:00 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2006.03.03 21:03:10 | 000,069,632 | ---- | M] (HP) -- C:\WINDOWS\system32\HPZipm12.exe
PRC - [2003.09.08 15:48:26 | 000,065,536 | ---- | M] () -- C:\Programme\Launch Manager\WButton.exe
PRC - [2003.09.04 15:46:02 | 000,040,960 | ---- | M] (Wistron) -- C:\Programme\Launch Manager\HotkeyApp.exe
PRC - [2003.06.25 10:53:30 | 000,204,800 | ---- | M] (Wistron) -- C:\Programme\Launch Manager\OSD.exe
PRC - [2003.05.12 14:28:50 | 000,032,768 | ---- | M] () -- C:\Programme\Launch Manager\LaunchAp.exe
PRC - [2002.11.25 19:23:20 | 000,172,032 | ---- | M] (Agere Systems) -- C:\Programme\ltmoh\ltmoh.exe
PRC - [1997.10.18 00:00:00 | 000,051,984 | ---- | M] () -- C:\Programme\Microsoft Office\Office\OSA.EXE
 
 
========== Modules (No Company Name) ==========
 
MOD - [2007.05.31 09:38:16 | 000,167,936 | ---- | M] () -- C:\WINDOWS\system32\SerialXP.dll
MOD - [2003.09.08 15:48:26 | 000,065,536 | ---- | M] () -- C:\Programme\Launch Manager\WButton.exe
MOD - [2003.05.12 14:28:50 | 000,032,768 | ---- | M] () -- C:\Programme\Launch Manager\LaunchAp.exe
MOD - [1997.10.18 00:00:00 | 003,782,416 | ---- | M] () -- C:\Programme\Microsoft Office\Office\MSO97.DLL
MOD - [1997.10.18 00:00:00 | 000,051,984 | ---- | M] () -- C:\Programme\Microsoft Office\Office\OSA.EXE
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Auto | Stopped] -- C:\WINDOWS\system32\eeufail.dll -- (mggmh)
SRV - [2012.05.06 15:42:07 | 000,257,696 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.04.21 03:16:42 | 000,129,976 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2011.12.07 15:00:34 | 000,114,000 | ---- | M] (Joosoft.com GmbH) [Auto | Running] -- C:\WINDOWS\system32\UpdSvc.dll -- (Update-Service)
SRV - [2011.08.10 13:53:16 | 002,419,592 | ---- | M] (Check Point Software Technologies LTD) [Auto | Running] -- C:\Programme\CheckPoint\ZoneAlarm\vsmon.exe -- (vsmon)
SRV - [2011.07.25 15:00:58 | 000,493,184 | ---- | M] (Check Point Software Technologies) [Auto | Running] -- C:\Programme\CheckPoint\ZAForceField\ISWSVC.exe -- (IswSvc)
SRV - [2011.07.22 09:49:26 | 000,511,920 | ---- | M] (REINER SCT) [Auto | Running] -- C:\WINDOWS\system32\cjpcsc.exe -- (cjpcsc)
SRV - [2008.07.29 19:16:38 | 000,132,096 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing)
SRV - [2008.04.14 14:00:00 | 000,114,176 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\netdde.exe -- (NetDDEdsdm)
SRV - [2008.04.14 14:00:00 | 000,114,176 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\netdde.exe -- (NetDDE)
SRV - [2008.04.14 14:00:00 | 000,053,248 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\mprdim.dll -- (RemoteAccess)
SRV - [2008.04.14 14:00:00 | 000,033,792 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\msgsvc.dll -- (Messenger)
SRV - [2008.04.14 14:00:00 | 000,017,408 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\alrsvc.dll -- (Alerter)
SRV - [2006.03.03 21:03:10 | 000,069,632 | ---- | M] (HP) [Auto | Running] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\Wbutton.sys -- (Wbutton)
DRV - File not found [Kernel | Disabled | Stopped] -- system32\DRIVERS\s24trans.sys -- (s24trans)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\23.tmp -- (MEMSWEEP2)
DRV - File not found [Kernel | System | Stopped] -- -- (mailKmd)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOKUME~1\test\LOKALE~1\Temp\catchme.sys -- (catchme)
DRV - [2011.08.10 13:31:08 | 000,525,840 | ---- | M] (Check Point Software Technologies LTD) [Kernel | System | Running] -- C:\WINDOWS\system32\vsdatant.sys -- (Vsdatant)
DRV - [2011.07.25 15:00:52 | 000,027,016 | ---- | M] (Check Point Software Technologies) [Kernel | Auto | Running] -- C:\Programme\CheckPoint\ZAForceField\ISWKL.sys -- (ISWKL)
DRV - [2011.03.29 13:08:08 | 000,028,144 | ---- | M] (REINER SCT) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\cjusb.sys -- (cjusb)
DRV - [2010.11.06 14:11:12 | 000,035,008 | ---- | M] (hxxp://libusb-win32.sourceforge.net) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\libusb0.sys -- (libusb0)
DRV - [2010.10.14 17:08:38 | 000,132,184 | ---- | M] (Kaspersky Lab ZAO) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\kl1.sys -- (KL1)
DRV - [2010.10.14 17:08:38 | 000,011,352 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\kl2.sys -- (kl2)
DRV - [2010.09.21 16:51:58 | 000,327,256 | ---- | M] (Kaspersky Lab) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\klif.sys -- (KLIF)
DRV - [2008.11.25 10:49:44 | 000,040,960 | R--- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Rts5161ccid.sys -- (USBCCID)
DRV - [2008.04.14 14:00:00 | 000,800,384 | ---- | M] (Microsoft Corp., Veritas Software) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\dmboot.sys -- (dmboot)
DRV - [2008.04.14 14:00:00 | 000,143,744 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\fastfat.sys -- (Fastfat)
DRV - [2008.04.14 14:00:00 | 000,066,048 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\udfs.sys -- (Udfs)
DRV - [2008.04.14 14:00:00 | 000,013,952 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\cbidf2k.sys -- (cbidf2k)
DRV - [2007.05.31 09:38:16 | 000,014,949 | ---- | M] (franson.biz) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\bizVSerialNT.sys -- (bizVSerial)
DRV - [2006.04.28 17:26:46 | 000,088,688 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SE27mgmt.sys -- (SE27mgmt) Sony Ericsson Device 039 USB WMC Device Management Drivers (WDM)
DRV - [2006.04.28 17:25:44 | 000,097,184 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SE27mdm.sys -- (SE27mdm)
DRV - [2006.04.28 17:25:40 | 000,009,360 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SE27mdfl.sys -- (SE27mdfl)
DRV - [2006.04.28 17:24:42 | 000,061,600 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SE27bus.sys -- (SE27bus) Sony Ericsson Device 039 Driver driver (WDM)
DRV - [2005.12.21 05:32:56 | 000,029,152 | R--- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usb2vcom.sys -- (usb2vcom)
DRV - [2005.09.19 03:07:00 | 000,035,275 | ---- | M] (SCM Microsystems Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\TwkUsb2K.sys -- (CHIPDRIVE USB SmartCardReader)
DRV - [2004.08.25 15:06:00 | 000,185,611 | ---- | M] (SCM Microsystems Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\TWKSER2K.sys -- (TWKSER2K)
DRV - [2004.01.02 20:52:00 | 001,646,720 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\w22n51.sys -- (w22n51) Intel(R)
DRV - [2003.07.15 02:33:26 | 000,111,168 | ---- | M] (Applied Drivers Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\cwawdm.sys -- (cs429x)
DRV - [2003.05.07 04:46:38 | 000,026,240 | ---- | M] (Winbond Electronics Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\wbsd.sys -- (WBSD) Winbond Secure Digital Storage (SD/MMC)
DRV - [2003.04.28 11:27:06 | 000,009,867 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\HOTKEY.sys -- (Hotkey)
DRV - [2003.04.24 02:14:00 | 000,004,828 | ---- | M] (Towitoko AG) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\TWKMS.sys -- (TwkMs)
DRV - [2003.04.16 02:04:18 | 000,030,464 | ---- | M] (Winbond Electronics Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\wbms.sys -- (WBMS) Winbond Memory Stick Storage (MS)
DRV - [2003.02.14 20:59:14 | 001,169,792 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2002.12.17 21:41:36 | 000,042,368 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\bcm4sbxp.sys -- (bcm4sbxp)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.web.de/br/ie8_startpage
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.bing.com/?PC=BNHP
IE - HKCU\..\URLSearchHook: {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Programme\ZoneAlarm-Sicherheit\prxtbZon0.dll (Conduit Ltd.)
IE - HKCU\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKCU\..\SearchScopes\{02DC2E6A-4707-456F-AE7A-CB12C4CC1787}: "URL" = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&affID=110819&tl=gbn193052&tt=050412_30b&babsrc=SP_ss&mntrId=4c9fa22b000000000000000e356ecbd5
IE - HKCU\..\SearchScopes\{1BD30256-1263-4BDE-BA34-98DBBBA3AFC4}: "URL" = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}
IE - HKCU\..\SearchScopes\{28A90140-3C17-454D-A26D-F38EC69C483F}: "URL" = hxxp://go.gmx.net/tb/ie_searchplugin/?su={searchTerms}
IE - HKCU\..\SearchScopes\{75E3E68F-CE3C-4387-9EC3-BC67702BB0FE}: "URL" = hxxp://go.web.de/br/ie8_search_amazon/?keywords={searchTerms}
IE - HKCU\..\SearchScopes\{7D3489F0-9553-4BDD-8299-CB1A8C3E85F5}: "URL" = hxxp://go.web.de/br/ie8_search_web/?su={searchTerms}
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2613550
IE - HKCU\..\SearchScopes\{BB47DE44-9AA3-4E82-AE9E-06732B7DDB4E}: "URL" = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
IE - HKCU\..\SearchScopes\{EBC4F45B-0875-4BC2-99AB-5FCDB9A8F578}: "URL" = hxxp://go.web.de/br/ie8_search_ebay/?q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Search the web (Babylon)"
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..browser.search.selectedEngine: "Bing"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.web.de/"
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.0
FF - prefs.js..extensions.enabledItems: {fd639891-5cc6-45ae-9055-a7a6abb5a7a9}:1.2.12.0
FF - prefs.js..extensions.enabledItems: {d40f5e7b-d2cf-4856-b441-cc613eeffbe3}:1.67
FF - prefs.js..keyword.URL: "hxxp://search.babylon.com/?affID=110819&tl=gbn193052&tt=050412_30b&babsrc=KW_ss&mntrId=4c9fa22b000000000000000e356ecbd5&q="
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@checkpoint.com/FFApi: C:\Programme\CheckPoint\ZAForceField\TrustChecker\bin\npFFApi.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.688: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.688: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.688: c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010.02.18 17:45:23 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Programme\CheckPoint\ZAForceField\TrustChecker [2012.05.09 14:10:56 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.05.01 15:30:17 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2012.04.12 14:00:13 | 000,000,000 | ---D | M]
 
[2010.02.12 16:27:32 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Extensions
[2010.02.12 16:27:32 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012.05.30 14:18:24 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\extensions
[2011.07.23 14:22:07 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012.05.30 14:18:24 | 000,000,000 | ---D | M] (ZoneAlarm-Sicherheit Community Toolbar) -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\extensions\{fc2b76fc-2132-4d80-a9a3-1f5c6e49066b}
[2011.12.10 10:20:04 | 000,000,000 | ---D | M] (Santander Chipcard Plugin) -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\extensions\{fd639891-5cc6-45ae-9055-a7a6abb5a7a9}
[2011.12.19 21:56:47 | 000,000,933 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\searchplugins\11-suche.xml
[2011.10.13 17:19:44 | 000,000,855 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\searchplugins\1und1-suche.xml
[2011.10.10 15:27:30 | 000,001,281 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\searchplugins\amazondotcom-de.xml
[2011.10.10 14:59:22 | 000,002,364 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\searchplugins\eBay-de.xml
[2011.12.19 21:56:47 | 000,002,419 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\searchplugins\englische-ergebnisse.xml
[2011.10.13 17:01:56 | 000,010,507 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\searchplugins\gmx-suche.xml
[2011.10.10 15:12:38 | 000,002,385 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\searchplugins\lastminute.xml
[2011.10.13 17:34:10 | 000,002,248 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\searchplugins\mailcom-search.xml
[2011.10.13 15:07:08 | 000,005,490 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\searchplugins\webde-suche.xml
[2012.05.01 15:30:13 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.05.01 15:30:14 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\distribution\extensions
[2012.05.01 15:30:14 | 000,000,000 | ---D | M] (WEB.DE Toolbar) -- C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de
[2012.01.22 17:10:05 | 000,138,614 | ---- | M] () (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\TEST\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\605JKKZ1.DEFAULT\EXTENSIONS\{D40F5E7B-D2CF-4856-B441-CC613EEFFBE3}.XPI
[2012.04.21 03:18:00 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2011.11.10 06:54:13 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll
[2008.09.15 11:52:06 | 000,376,832 | ---- | M] ( ) -- C:\Programme\mozilla firefox\plugins\npsnapfish.dll
[2007.04.11 07:17:00 | 000,954,368 | ---- | M] (PPI Financial Systems GmbH) -- C:\Programme\mozilla firefox\plugins\NP_SEBChipcardPlugin.dll
[2012.04.21 03:54:08 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.04.05 20:49:12 | 000,002,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\babylon.xml
[2012.04.21 03:54:08 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2012.04.21 03:54:08 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2012.04.21 03:54:08 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.04.21 03:54:08 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.04.21 03:54:08 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2012.01.17 22:50:18 | 000,441,479 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1    www.007guard.com
O1 - Hosts: 127.0.0.1    007guard.com
O1 - Hosts: 127.0.0.1    008i.com
O1 - Hosts: 127.0.0.1    www.008k.com
O1 - Hosts: 127.0.0.1    008k.com
O1 - Hosts: 127.0.0.1    www.00hq.com
O1 - Hosts: 127.0.0.1    00hq.com
O1 - Hosts: 127.0.0.1    010402.com
O1 - Hosts: 127.0.0.1    www.032439.com
O1 - Hosts: 127.0.0.1    032439.com
O1 - Hosts: 127.0.0.1    www.1001-search.info
O1 - Hosts: 127.0.0.1    1001-search.info
O1 - Hosts: 127.0.0.1    www.100888290cs.com
O1 - Hosts: 127.0.0.1    100888290cs.com
O1 - Hosts: 127.0.0.1    www.100sexlinks.com
O1 - Hosts: 127.0.0.1    100sexlinks.com
O1 - Hosts: 127.0.0.1    www.10sek.com
O1 - Hosts: 127.0.0.1    10sek.com
O1 - Hosts: 127.0.0.1    www.123topsearch.com
O1 - Hosts: 127.0.0.1    123topsearch.com
O1 - Hosts: 127.0.0.1    www.132.com
O1 - Hosts: 127.0.0.1    132.com
O1 - Hosts: 127.0.0.1    www.136136.net
O1 - Hosts: 127.0.0.1    136136.net
O1 - Hosts: 15212 more lines...
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (ZoneAlarm Security Engine Registrar) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Programme\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O2 - BHO: (ZoneAlarm-Sicherheit Toolbar) - {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Programme\ZoneAlarm-Sicherheit\prxtbZon0.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Programme\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O3 - HKLM\..\Toolbar: (ZoneAlarm-Sicherheit Toolbar) - {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Programme\ZoneAlarm-Sicherheit\prxtbZon0.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {C424171E-592A-415A-9EB1-DFD6D95D3530} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Programme\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O3 - HKCU\..\Toolbar\WebBrowser: (ZoneAlarm-Sicherheit Toolbar) - {FC2B76FC-2132-4D80-A9A3-1F5C6E49066B} - C:\Programme\ZoneAlarm-Sicherheit\prxtbZon0.dll (Conduit Ltd.)
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [CtrlVol] C:\Programme\Launch Manager\CtrlVol.exe (Wistron)
O4 - HKLM..\Run: [HotkeyApp] C:\Programme\Launch Manager\HotkeyApp.exe (Wistron)
O4 - HKLM..\Run: [ISW] C:\Programme\CheckPoint\ZAForceField\ForceField.exe (Check Point Software Technologies)
O4 - HKLM..\Run: [LaunchAp] C:\Programme\Launch Manager\LaunchAp.exe ()
O4 - HKLM..\Run: [LMgrOSD] C:\Programme\Launch Manager\OSD.exe (Wistron)
O4 - HKLM..\Run: [LtMoh] C:\Programme\ltmoh\ltmoh.exe (Agere Systems)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [Wbutton] C:\Programme\Launch Manager\Wbutton.exe ()
O4 - HKLM..\Run: [ZoneAlarm] C:\Programme\CheckPoint\ZoneAlarm\zatray.exe (Check Point Software Technologies LTD)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Microsoft-Indexerstellung.lnk = C:\Programme\Microsoft Office\Office\FINDFAST.EXE (Microsoft Corporation)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Office-Start.lnk = C:\Programme\Microsoft Office\Office\OSA.EXE ()
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\VR-NetWorld Auftragsprüfung.lnk = C:\Programme\VR-NetWorld\VRToolCheckOrder.exe (VR-NetWorld Software)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\WISO Mein Steuer-Sparbuch heute.lnk = C:\Programme\WISO\Steuersoftware 2012\mshaktuell.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0A88DECB-188B-4A64-80E9-CE5FEB4BB59D}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - (igfxsrvc.dll) - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.04.17 16:08:06 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.06.01 09:04:18 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\test\Desktop\OTL.exe
[2012.06.01 08:43:20 | 000,388,608 | ---- | C] (Trend Micro Inc.) -- C:\Dokumente und Einstellungen\test\Desktop\HiJackThis204.exe
[2012.06.01 07:18:38 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\test\Recent
[2012.06.01 07:01:32 | 003,862,112 | ---- | C] (Piriform Ltd) -- C:\Dokumente und Einstellungen\test\Desktop\ccsetup319.exe
[2012.05.21 20:34:49 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\test\Downloads
[2012.05.09 13:58:59 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Kaspersky SDK
[2012.05.09 13:49:00 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\test\Eigene Dateien\ForceField Shared Files
[2012.05.09 13:48:51 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\CheckPoint
[2012.05.09 13:48:35 | 000,000,000 | ---D | C] -- C:\Programme\Conduit
[2012.05.09 13:48:33 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\test\Lokale Einstellungen\Anwendungsdaten\ZoneAlarm-Sicherheit
[2012.05.09 13:48:31 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\test\Lokale Einstellungen\Anwendungsdaten\Conduit
[2012.05.09 13:48:28 | 000,000,000 | ---D | C] -- C:\Programme\ZoneAlarm-Sicherheit
[2012.05.09 13:46:03 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Check Point
[2012.05.09 13:46:01 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CheckPoint
[2012.05.09 13:45:53 | 000,000,000 | ---D | C] -- C:\Programme\CheckPoint
[2012.05.09 13:20:21 | 000,000,000 | -H-D | C] -- C:\WINDOWS\$hf_mig$
[2012.05.08 13:39:53 | 000,000,000 | -H-D | C] -- C:\Dokumente und Einstellungen\test\Desktop\Lokale Einstellungen
[2012.05.07 14:32:56 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\FastStone
[2012.05.07 14:32:52 | 000,000,000 | ---D | C] -- C:\Programme\FastStone Capture
[2012.05.07 14:32:52 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\FastStone Capture
[2012.01.23 11:35:11 | 039,401,336 | ---- | C] (Apple Inc.) -- C:\Programme\QuickTimeInstaller.exe
[2011.12.07 14:58:44 | 000,541,544 | ---- | C] (JooSoft GmbH) -- C:\Programme\7z920.exe
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.06.01 09:04:26 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\test\Desktop\OTL.exe
[2012.06.01 09:02:06 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\test\defogger_reenable
[2012.06.01 09:01:44 | 000,050,477 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Desktop\Defogger.exe
[2012.06.01 08:57:54 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.06.01 08:43:21 | 000,388,608 | ---- | M] (Trend Micro Inc.) -- C:\Dokumente und Einstellungen\test\Desktop\HiJackThis204.exe
[2012.06.01 08:40:16 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012.06.01 08:13:10 | 000,001,452 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Desktop\message-rfc822-attachment.eml
[2012.06.01 08:08:43 | 000,000,268 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1275210071-1993962763-1957994488-1003.job
[2012.06.01 08:08:23 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.06.01 08:08:19 | 000,126,912 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012.06.01 07:14:17 | 000,278,352 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Eigene Dateien\cc_20120601_071402.reg
[2012.06.01 07:04:06 | 000,000,660 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Dokumente\Desktop\CCleaner.lnk
[2012.06.01 07:02:47 | 003,862,112 | ---- | M] (Piriform Ltd) -- C:\Dokumente und Einstellungen\test\Desktop\ccsetup319.exe
[2012.05.31 08:36:04 | 000,010,726 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Eigene Dateien\VR-NetWorld.pdf
[2012.05.30 18:29:15 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1275210071-1993962763-1957994488-1003.job
[2012.05.21 20:35:27 | 000,000,022 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Desktop\ausmalbild_kostenlos.zip
[2012.05.09 19:37:24 | 000,479,376 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2012.05.09 19:37:24 | 000,433,138 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012.05.09 19:37:24 | 000,092,732 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2012.05.09 19:37:24 | 000,068,094 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012.05.09 13:57:51 | 000,415,771 | ---- | M] () -- C:\WINDOWS\System32\vsconfig.xml
[2012.05.07 14:32:52 | 000,000,728 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Dokumente\Desktop\FastStone Capture.lnk
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.06.01 09:02:06 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\test\defogger_reenable
[2012.06.01 09:01:40 | 000,050,477 | ---- | C] () -- C:\Dokumente und Einstellungen\test\Desktop\Defogger.exe
[2012.06.01 08:13:06 | 000,001,452 | ---- | C] () -- C:\Dokumente und Einstellungen\test\Desktop\message-rfc822-attachment.eml
[2012.06.01 08:08:19 | 000,126,912 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012.06.01 07:14:11 | 000,278,352 | ---- | C] () -- C:\Dokumente und Einstellungen\test\Eigene Dateien\cc_20120601_071402.reg
[2012.05.21 20:34:54 | 000,000,022 | ---- | C] () -- C:\Dokumente und Einstellungen\test\Desktop\ausmalbild_kostenlos.zip
[2012.05.09 13:49:13 | 000,415,771 | ---- | C] () -- C:\WINDOWS\System32\vsconfig.xml
[2012.05.07 14:32:52 | 000,000,728 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Dokumente\Desktop\FastStone Capture.lnk
[2012.02.15 14:11:59 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2012.01.03 11:56:09 | 000,000,595 | ---- | C] () -- C:\WINDOWS\wiso.ini
[2012.01.02 20:03:27 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2012.01.02 20:03:27 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2012.01.02 20:03:27 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2012.01.02 20:03:27 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2012.01.02 20:03:27 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2012.01.02 17:56:26 | 000,103,981 | ---- | C] () -- C:\WINDOWS\hpoins08.dat
[2012.01.02 17:56:26 | 000,004,445 | ---- | C] () -- C:\WINDOWS\hpomdl08.dat
[2011.12.21 15:02:26 | 000,000,095 | ---- | C] () -- C:\WINDOWS\ParrotFlashWiz.INI
[2011.10.29 12:58:18 | 000,167,936 | ---- | C] () -- C:\WINDOWS\System32\SerialXP.dll
[2011.10.29 12:58:18 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\win32com.dll
[2011.10.09 10:54:17 | 000,000,364 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2011.10.05 18:24:07 | 000,001,296 | ---- | C] () -- C:\WINDOWS\HBCIKRNL.INI
[2010.09.21 17:42:55 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\drivers\SymSMR130.dat
 
========== LOP Check ==========
 
[2011.12.06 22:36:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\adisoft AG
[2011.12.07 15:09:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Babylon
[2010.02.04 22:53:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\BTrieve
[2012.03.19 15:57:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Buhl Data Service GmbH
[2012.05.09 13:46:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CheckPoint
[2012.01.20 16:14:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DesktopIcons
[2012.05.09 13:58:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Kaspersky SDK
[2010.02.07 16:28:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Lexware
[2009.04.25 10:25:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Drivers HeadQuarters
[2011.10.29 12:58:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\REINER SCT
[2012.01.20 17:26:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\1&1 Mail & Media GmbH
[2009.11.24 18:46:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\ACD Systems
[2012.01.03 12:03:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Buhl Data Service
[2012.05.09 13:48:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\CheckPoint
[2011.07.07 07:05:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Image Zone Express
[2010.02.05 10:03:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Lexware
[2009.09.29 14:19:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\MyPhoneExplorer
[2010.09.18 09:16:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\OpenOffice.org
[2011.12.11 17:14:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Teleca
[2010.02.12 16:27:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Thunderbird
[2010.05.22 23:14:13 | 000,000,484 | ---- | M] () -- C:\WINDOWS\Tasks\Install.job
 
========== Purity Check ==========
 
 
 
< End of report >
--- --- ---
OTL Logfile:
Code:
OTL Extras logfile created on: 01.06.2012 09:05:00 - Run 1
OTL by OldTimer - Version 3.2.45.0 Folder = C:\Dokumente und Einstellungen\test\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,24 Gb Total Physical Memory | 0,80 Gb Available Physical Memory | 64,26% Memory free
1,83 Gb Paging File | 1,37 Gb Available in Paging File | 74,61% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 37,25 Gb Total Space | 24,82 Gb Free Space | 66,63% Space Free | Partition Type: NTFS
 
Computer Name: TEST-101EE4A811 | User Name: test | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
http [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring" = 1
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"9660:TCP" = 9660:TCP:*:Enabled:rrfhsf
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\Mozilla Firefox\firefox.exe" = C:\Programme\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation)
"C:\Program Files\Real\RealPlayer\realplay.exe" = C:\Program Files\Real\RealPlayer\realplay.exe:*:Enabled:RealPlayer -- (RealNetworks, Inc.)
"C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\WebKit2WebProcess.exe" = C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\WebKit2WebProcess.exe:*:Enabled:WebKit
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02E89EFC-7B07-4D5A-AA03-9EC0902914EE}" = VC 9.0 Runtime
"{0CC1DAFB-40C8-4903-953D-471E541477C7}" = WISO Steuer 2012
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216018FF}" = Java(TM) 6 Update 30
"{27555031-A116-4EC6-9991-7B400142A936}" = HP PSC & OfficeJet 6.1.A
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{4886533F-EA40-40DC-B1BB-B13BF22B3CD1}" = ZoneAlarm Firewall
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{66910000-8B30-4973-A159-6371345AFFA5}" = WebReg
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime
"{8777AC6D-89F9-4793-8266-DE406F343E89}" = QFolder
"{8815F011-43AF-4F50-BBD8-D78ED3D6F5B9}" = VR-NetWorld
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel(R) Extreme Graphics 2 Driver
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{AA898D01-D4E3-43C6-8E25-70CA660B9F16}" = CHIPDRIVE extern/intern/micro treiber 3.1
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.3) - Deutsch
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C4B76E93-3FC2-4E90-81EE-EE62948CFB03}" = Sony Ericsson Mobile Phone Monitor
"{C6812939-B117-48E6-A3BA-1709C14A3C8C}" = Scan
"{C8753E28-2680-49BF-BD48-DD38FD086EFE}" = AiO_Scan_CDA
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D0846526-66DD-4DC9-A02C-98F9A2806812}" = Launch Manager V1.1.0
"{ED9A325D-9622-4FD0-A731-73D23C6265F3}" = CapMan
"{F0312AC6-988B-11DA-9C49-000476F770CC}" = CIB pdf brewer 2.5.26
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F32E8EE8-83AD-4553-B2F8-CBFB3ABDC179}" = ZoneAlarm Antivirus
"{F4F4F84E-804F-4E9A-84D7-C34283F0088F}" = RealUpgrade 1.0
"{F50D4138-E662-4CFE-B297-5E8BF80A797E}" = ZoneAlarm Security
"{FC338210-F594-11D3-BA24-00001C3AB4DF}" = cyberJack Base Components
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"Agere Systems Soft Modem" = Agere Systems AC'97 Modem
"CCleaner" = CCleaner
"Excel" = Microsoft Excel 97
"FastStone Capture" = FastStone Capture 5.3
"ie8" = Windows Internet Explorer 8
"IrfanView" = IrfanView (remove only)
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox 12.0 (x86 de)" = Mozilla Firefox 12.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MPE" = MyPhoneExplorer
"Parrot Flash Update Wizard" = Parrot Software Update Tool
"Pocoyo Hot Season Screensaver" = Pocoyo Hot Season Screensaver
"RealPlayer 12.0" = RealPlayer
"Word8.0" = Microsoft Word 97
"ZoneAlarm Antivirus" = ZoneAlarm Antivirus
"ZoneAlarm Toolbar" = ZoneAlarm Toolbar
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 01.06.2012 00:36:56 | Computer Name = TEST-101EE4A811 | Source = Userenv | ID = 1090
Description = Der Sitzungsstatus des Richtlinienergebnissatzes konnte nicht protokolliert
werden. Ein Verbindungsversuch mit WMI ist fehlgeschlagen. Für diese Anwendung
der Richtlinie wird keine Richtlinienergebnissatz-Protokollierung durchgeführt.
 
Error - 01.06.2012 00:36:56 | Computer Name = TEST-101EE4A811 | Source = Userenv | ID = 1090
Description = Der Sitzungsstatus des Richtlinienergebnissatzes konnte nicht protokolliert
werden. Ein Verbindungsversuch mit WMI ist fehlgeschlagen. Für diese Anwendung
der Richtlinie wird keine Richtlinienergebnissatz-Protokollierung durchgeführt.
 
Error - 01.06.2012 00:43:22 | Computer Name = TEST-101EE4A811 | Source = Userenv | ID = 1090
Description = Der Sitzungsstatus des Richtlinienergebnissatzes konnte nicht protokolliert
werden. Ein Verbindungsversuch mit WMI ist fehlgeschlagen. Für diese Anwendung
der Richtlinie wird keine Richtlinienergebnissatz-Protokollierung durchgeführt.
 
Error - 01.06.2012 00:43:23 | Computer Name = TEST-101EE4A811 | Source = Userenv | ID = 1090
Description = Der Sitzungsstatus des Richtlinienergebnissatzes konnte nicht protokolliert
werden. Ein Verbindungsversuch mit WMI ist fehlgeschlagen. Für diese Anwendung
der Richtlinie wird keine Richtlinienergebnissatz-Protokollierung durchgeführt.
 
Error - 01.06.2012 00:55:03 | Computer Name = TEST-101EE4A811 | Source = Userenv | ID = 1090
Description = Der Sitzungsstatus des Richtlinienergebnissatzes konnte nicht protokolliert
werden. Ein Verbindungsversuch mit WMI ist fehlgeschlagen. Für diese Anwendung
der Richtlinie wird keine Richtlinienergebnissatz-Protokollierung durchgeführt.
 
Error - 01.06.2012 00:55:03 | Computer Name = TEST-101EE4A811 | Source = Userenv | ID = 1090
Description = Der Sitzungsstatus des Richtlinienergebnissatzes konnte nicht protokolliert
werden. Ein Verbindungsversuch mit WMI ist fehlgeschlagen. Für diese Anwendung
der Richtlinie wird keine Richtlinienergebnissatz-Protokollierung durchgeführt.
 
Error - 01.06.2012 02:09:11 | Computer Name = TEST-101EE4A811 | Source = Userenv | ID = 1090
Description = Der Sitzungsstatus des Richtlinienergebnissatzes konnte nicht protokolliert
werden. Ein Verbindungsversuch mit WMI ist fehlgeschlagen. Für diese Anwendung
der Richtlinie wird keine Richtlinienergebnissatz-Protokollierung durchgeführt.
 
Error - 01.06.2012 02:09:11 | Computer Name = TEST-101EE4A811 | Source = Userenv | ID = 1090
Description = Der Sitzungsstatus des Richtlinienergebnissatzes konnte nicht protokolliert
werden. Ein Verbindungsversuch mit WMI ist fehlgeschlagen. Für diese Anwendung
der Richtlinie wird keine Richtlinienergebnissatz-Protokollierung durchgeführt.
 
Error - 01.06.2012 02:13:59 | Computer Name = TEST-101EE4A811 | Source = Userenv | ID = 1090
Description = Der Sitzungsstatus des Richtlinienergebnissatzes konnte nicht protokolliert
werden. Ein Verbindungsversuch mit WMI ist fehlgeschlagen. Für diese Anwendung
der Richtlinie wird keine Richtlinienergebnissatz-Protokollierung durchgeführt.
 
Error - 01.06.2012 02:13:59 | Computer Name = TEST-101EE4A811 | Source = Userenv | ID = 1090
Description = Der Sitzungsstatus des Richtlinienergebnissatzes konnte nicht protokolliert
werden. Ein Verbindungsversuch mit WMI ist fehlgeschlagen. Für diese Anwendung
der Richtlinie wird keine Richtlinienergebnissatz-Protokollierung durchgeführt.
 
[ System Events ]
Error - 01.06.2012 00:36:34 | Computer Name = TEST-101EE4A811 | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Arbeitsstationsdienst" wurde mit folgendem Fehler beendet:
%%2
 
Error - 01.06.2012 00:36:35 | Computer Name = TEST-101EE4A811 | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Arbeitsstationsdienst"
abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%2
 
Error - 01.06.2012 00:36:35 | Computer Name = TEST-101EE4A811 | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Driver Installer" wurde mit folgendem Fehler beendet:
%%126
 
Error - 01.06.2012 00:36:58 | Computer Name = TEST-101EE4A811 | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Arbeitsstationsdienst"
abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%2
 
Error - 01.06.2012 00:36:58 | Computer Name = TEST-101EE4A811 | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Arbeitsstationsdienst" wurde mit folgendem Fehler beendet:
%%2
 
Error - 01.06.2012 02:08:51 | Computer Name = TEST-101EE4A811 | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Arbeitsstationsdienst" wurde mit folgendem Fehler beendet:
%%2
 
Error - 01.06.2012 02:08:52 | Computer Name = TEST-101EE4A811 | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Arbeitsstationsdienst"
abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%2
 
Error - 01.06.2012 02:08:52 | Computer Name = TEST-101EE4A811 | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Driver Installer" wurde mit folgendem Fehler beendet:
%%126
 
Error - 01.06.2012 02:09:18 | Computer Name = TEST-101EE4A811 | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Arbeitsstationsdienst"
abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%2
 
Error - 01.06.2012 02:09:18 | Computer Name = TEST-101EE4A811 | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Arbeitsstationsdienst" wurde mit folgendem Fehler beendet:
%%2
 
 
< End of report >
--- --- ---
GMER Logfile:
Code:
GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-06-01 13:06:59
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 TOSHIBA_MK4025GAS rev.KA100A
Running: omm346gc.exe; Driver: C:\DOKUME~1\test\LOKALE~1\Temp\kfryyaob.sys
 
 
---- System - GMER 1.0.15 ----
 
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwAdjustPrivilegesToken [0xB0F0266E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwClose [0xB0F02F02]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwConnectPort [0xB0DD02F4]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwCreateEvent [0xB0F037D0]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateFile [0xB0DCA5CA]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateKey [0xB0DE958A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwCreateMutant [0xB0F036A8]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwCreateNamedPipeFile [0xB0F02274]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreatePort [0xB0DD0A80]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateProcess [0xB0DE3E4E]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateProcessEx [0xB0DE423C]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateSection [0xB0DED6F6]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwCreateSemaphore [0xB0F03902]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwCreateSymbolicLinkObject [0xB0F0558C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwCreateThread [0xB0F02BA0]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateWaitablePort [0xB0DD0BB6]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwDebugActiveProcess [0xB0F04F36]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwDeleteFile [0xB0DCB1E0]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwDeleteKey [0xB0DEAE3C]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwDeleteValueKey [0xB0DEA7B2]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwDeviceIoControlFile [0xB0F03178]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwDuplicateObject [0xB0DE2D8A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwEnumerateKey [0xB0F01FAC]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwEnumerateValueKey [0xB0F02056]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwFsControlFile [0xB0F02F84]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwLoadDriver [0xB0DC5E88]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwLoadKey [0xB0DEB794]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwLoadKey2 [0xB0DEB99C]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwMapViewOfSection [0xB0DEDA5E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwNotifyChangeKey [0xB0F021A2]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwOpenEvent [0xB0F03872]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwOpenFile [0xB0DCADF2]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwOpenKey [0xB0F016BE]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwOpenMutant [0xB0F03740]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwOpenProcess [0xB0DE6160]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwOpenSection [0xB0F055B6]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwOpenSemaphore [0xB0F039A4]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwOpenThread [0xB0DE5D8A]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwProtectVirtualMemory [0xB0DFA090]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwQueryKey [0xB0F02100]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwQueryMultipleValueKey [0xB0F01D28]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwQuerySection [0xB0F05958]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwQueryValueKey [0xB0F01978]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwQueueApcThread [0xB0F052A6]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwRenameKey [0xB0DEC72A]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwReplaceKey [0xB0DEC060]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwReplyPort [0xB0F03D2E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwReplyWaitReceivePort [0xB0F03BF4]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwRequestWaitReplyPort [0xB0DCFEC4]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwRestoreKey [0xB0DED0FC]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwResumeThread [0xB0F05E30]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwSaveKey [0xB0F0132A]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSecureConnectPort [0xB0DD059C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwSetContextThread [0xB0F02DBE]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSetInformationFile [0xB0DCB5A4]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSetInformationObject [0xB0DF9F7C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwSetInformationToken [0xB0F04586]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSetSecurityObject [0xB0DECC6A]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSetSystemInformation [0xB0DC5648]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSetValueKey [0xB0DE9F72]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwSuspendProcess [0xB0F05B7C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwSuspendThread [0xB0F05CA4]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSystemDebugControl [0xB0DE4EA4]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwTerminateProcess [0xB0DE4C20]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwTerminateThread [0xB0F02956]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwUnloadDriver [0xB0DC629C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwUnmapViewOfSection [0xB0F0580E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwWriteVirtualMemory [0xB0F02AE0]
 
Code \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) FsRtlCheckLockForReadAccess
Code \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) IoIsOperationSynchronous
 
---- Kernel code sections - GMER 1.0.15 ----
 
.text ntoskrnl.exe!_abnormal_termination + 104 804E2770 12 Bytes [80, 0A, DD, B0, 4E, 3E, DE, ...] {OR BYTE [EDX], 0xdd; MOV AL, 0x4e; FIDIV WORD DS:[EAX-0x4f21bdc4]}
.text ntoskrnl.exe!_abnormal_termination + 114 804E2780 16 Bytes [F6, D6, DE, B0, 02, 39, F0, ...]
.text ntoskrnl.exe!_abnormal_termination + 1D0 804E283C 12 Bytes [88, 5E, DC, B0, 94, B7, DE, ...]
.text ntoskrnl.exe!_abnormal_termination + 34C 804E29B8 16 Bytes [2A, C7, DE, B0, 60, C0, DE, ...]
.text ntoskrnl.exe!_abnormal_termination + 440 804E2AAC 12 Bytes [7C, 5B, F0, B0, A4, 5C, F0, ...]
.text ntoskrnl.exe!IoIsOperationSynchronous 804E876A 5 Bytes JMP B0EF7382 \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab)
.text ntoskrnl.exe!FsRtlCheckLockForReadAccess 80512969 5 Bytes JMP B0EF6FA8 \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab)
 
---- User code sections - GMER 1.0.15 ----
 
.text C:\WINDOWS\system32\igfxtray.exe[232] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\igfxtray.exe[232] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\igfxtray.exe[232] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\igfxtray.exe[232] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\igfxtray.exe[232] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\igfxtray.exe[232] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\igfxtray.exe[232] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\igfxtray.exe[232] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\AGRSMMSG.exe[316] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\AGRSMMSG.exe[316] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\AGRSMMSG.exe[316] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\AGRSMMSG.exe[316] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\AGRSMMSG.exe[316] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\AGRSMMSG.exe[316] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\AGRSMMSG.exe[316] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\AGRSMMSG.exe[316] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[364] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[364] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[364] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[364] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[364] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[364] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[364] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[364] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[428] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[428] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[428] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[428] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[428] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[428] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[428] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[428] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\CheckPoint\ZAForceField\ForceField.exe[480] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\CheckPoint\ZAForceField\ForceField.exe[480] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\CheckPoint\ZAForceField\ForceField.exe[480] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\CheckPoint\ZAForceField\ForceField.exe[480] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\CheckPoint\ZAForceField\ForceField.exe[480] kernel32.dll!SetUnhandledExceptionFilter 7C84495D 5 Bytes JMP 209F37DD C:\Programme\CheckPoint\ZAForceField\Plugins\ISWDMP.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\CheckPoint\ZAForceField\ForceField.exe[480] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\CheckPoint\ZAForceField\ForceField.exe[480] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\CheckPoint\ZAForceField\ForceField.exe[480] USER32.dll!DefDlgProcW + 56E 7E3742A8 5 Bytes JMP 20CB9270 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\cjpcsc.exe[548] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\cjpcsc.exe[548] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\cjpcsc.exe[548] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\cjpcsc.exe[548] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\cjpcsc.exe[548] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\cjpcsc.exe[548] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\cjpcsc.exe[548] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\cjpcsc.exe[548] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\svchost.exe[632] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\svchost.exe[632] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\svchost.exe[632] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\svchost.exe[632] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\svchost.exe[632] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\svchost.exe[632] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\svchost.exe[632] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\svchost.exe[632] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\Explorer.EXE[728] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\Explorer.EXE[728] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\Explorer.EXE[728] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\Explorer.EXE[728] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\Explorer.EXE[728] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\Explorer.EXE[728] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\Explorer.EXE[728] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\Explorer.EXE[728] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\winlogon.exe[912] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\winlogon.exe[912] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\winlogon.exe[912] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\winlogon.exe[912] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\winlogon.exe[912] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\winlogon.exe[912] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\winlogon.exe[912] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\winlogon.exe[912] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\services.exe[956] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\services.exe[956] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\services.exe[956] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\services.exe[956] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\services.exe[956] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\services.exe[956] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\services.exe[956] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\services.exe[956] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\lsass.exe[968] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\lsass.exe[968] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\lsass.exe[968] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\lsass.exe[968] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\lsass.exe[968] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\lsass.exe[968] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\lsass.exe[968] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\hkcmd.exe[1092] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\hkcmd.exe[1092] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\hkcmd.exe[1092] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\hkcmd.exe[1092] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\hkcmd.exe[1092] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\hkcmd.exe[1092] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\hkcmd.exe[1092] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\hkcmd.exe[1092] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1124] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1124] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1124] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1124] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1124] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1124] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1124] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1124] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Java\jre6\bin\jqs.exe[1140] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Java\jre6\bin\jqs.exe[1140] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Java\jre6\bin\jqs.exe[1140] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Java\jre6\bin\jqs.exe[1140] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Java\jre6\bin\jqs.exe[1140] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Java\jre6\bin\jqs.exe[1140] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Java\jre6\bin\jqs.exe[1140] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Java\jre6\bin\jqs.exe[1140] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\CheckPoint\ZAForceField\IswSvc.exe[1148] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\CheckPoint\ZAForceField\IswSvc.exe[1148] USER32.dll!DefDlgProcW + 56E 7E3742A8 5 Bytes JMP 20CB9270 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1248] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1248] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1248] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1248] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1248] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1248] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1248] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1248] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\svchost.exe[1392] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\svchost.exe[1392] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\svchost.exe[1392] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\svchost.exe[1392] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\svchost.exe[1392] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\svchost.exe[1392] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\svchost.exe[1392] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\svchost.exe[1392] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\HPZipm12.exe[1428] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\HPZipm12.exe[1428] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\HPZipm12.exe[1428] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\HPZipm12.exe[1428] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\HPZipm12.exe[1428] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\HPZipm12.exe[1428] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\HPZipm12.exe[1428] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\HPZipm12.exe[1428] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\spoolsv.exe[1472] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\spoolsv.exe[1472] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\spoolsv.exe[1472] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\spoolsv.exe[1472] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\spoolsv.exe[1472] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\spoolsv.exe[1472] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\spoolsv.exe[1472] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\spoolsv.exe[1472] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1564] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1564] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1564] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1564] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1564] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1564] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1564] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1564] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1720] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1720] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1720] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1720] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1720] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1720] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1720] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1720] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\ltmoh\Ltmoh.exe[1816] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\ltmoh\Ltmoh.exe[1816] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\ltmoh\Ltmoh.exe[1816] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\ltmoh\Ltmoh.exe[1816] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\ltmoh\Ltmoh.exe[1816] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\ltmoh\Ltmoh.exe[1816] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\ltmoh\Ltmoh.exe[1816] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\ltmoh\Ltmoh.exe[1816] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\SCardSvr.exe[2032] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\SCardSvr.exe[2032] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\SCardSvr.exe[2032] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\SCardSvr.exe[2032] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\SCardSvr.exe[2032] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\SCardSvr.exe[2032] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\SCardSvr.exe[2032] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\SCardSvr.exe[2032] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[2148] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[2148] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[2148] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[2148] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[2148] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[2148] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[2148] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[2148] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\LaunchAp.exe[2200] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\LaunchAp.exe[2200] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\LaunchAp.exe[2200] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\LaunchAp.exe[2200] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\LaunchAp.exe[2200] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\LaunchAp.exe[2200] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\LaunchAp.exe[2200] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\LaunchAp.exe[2200] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\HotkeyApp.exe[2344] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\HotkeyApp.exe[2344] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\HotkeyApp.exe[2344] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\HotkeyApp.exe[2344] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\HotkeyApp.exe[2344] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\HotkeyApp.exe[2344] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\HotkeyApp.exe[2344] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\HotkeyApp.exe[2344] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\OSD.exe[2504] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\OSD.exe[2504] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\OSD.exe[2504] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\OSD.exe[2504] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\OSD.exe[2504] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\OSD.exe[2504] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\OSD.exe[2504] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\OSD.exe[2504] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\Wbutton.exe[2572] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\Wbutton.exe[2572] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\Wbutton.exe[2572] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\Wbutton.exe[2572] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\Wbutton.exe[2572] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\Wbutton.exe[2572] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\Wbutton.exe[2572] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Launch Manager\Wbutton.exe[2572] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe[2672] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe[2672] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe[2672] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe[2672] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe[2672] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe[2672] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe[2672] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe[2672] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe[2760] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe[2760] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe[2760] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe[2760] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe[2760] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe[2760] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe[2760] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe[2760] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\CheckPoint\ZoneAlarm\zatray.exe[2928] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\CheckPoint\ZoneAlarm\zatray.exe[2928] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\CheckPoint\ZoneAlarm\zatray.exe[2928] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\CheckPoint\ZoneAlarm\zatray.exe[2928] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\CheckPoint\ZoneAlarm\zatray.exe[2928] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\CheckPoint\ZoneAlarm\zatray.exe[2928] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\CheckPoint\ZoneAlarm\zatray.exe[2928] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\CheckPoint\ZoneAlarm\zatray.exe[2928] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\ctfmon.exe[2952] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\ctfmon.exe[2952] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\ctfmon.exe[2952] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\ctfmon.exe[2952] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\ctfmon.exe[2952] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\ctfmon.exe[2952] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\ctfmon.exe[2952] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\ctfmon.exe[2952] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Microsoft Office\Office\OSA.EXE[3088] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Microsoft Office\Office\OSA.EXE[3088] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Microsoft Office\Office\OSA.EXE[3088] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Microsoft Office\Office\OSA.EXE[3088] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Microsoft Office\Office\OSA.EXE[3088] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Microsoft Office\Office\OSA.EXE[3088] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Microsoft Office\Office\OSA.EXE[3088] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Microsoft Office\Office\OSA.EXE[3088] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Dokumente und Einstellungen\test\Desktop\omm346gc.exe[3432] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Dokumente und Einstellungen\test\Desktop\omm346gc.exe[3432] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Dokumente und Einstellungen\test\Desktop\omm346gc.exe[3432] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Dokumente und Einstellungen\test\Desktop\omm346gc.exe[3432] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Dokumente und Einstellungen\test\Desktop\omm346gc.exe[3432] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Dokumente und Einstellungen\test\Desktop\omm346gc.exe[3432] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Dokumente und Einstellungen\test\Desktop\omm346gc.exe[3432] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Dokumente und Einstellungen\test\Desktop\omm346gc.exe[3432] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\alg.exe[3512] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20CB8791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\alg.exe[3512] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20CB8D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\alg.exe[3512] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20CB89AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\alg.exe[3512] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20CB846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\alg.exe[3512] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20CB828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\alg.exe[3512] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20CB825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\alg.exe[3512] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20CB8E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\alg.exe[3512] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20CB9036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
 
---- Devices - GMER 1.0.15 ----
 
Device \Driver\Tcpip \Device\Ip vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
Device \Driver\Tcpip \Device\Tcp vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
Device \Driver\Tcpip \Device\Udp vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
Device \Driver\Tcpip \Device\RawIp vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
Device \Driver\Tcpip \Device\IPMULTICAST vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
 
---- EOF - GMER 1.0.15 ----
--- --- ---

Hoffe ich habe nichts vergessen. Wie mach ich weiter?

Danke im voraus

cosinus 03.06.2012 14:21
Zitat:
Hatte mir einen Trojaner eingefangen Rootkit.gen
Hatte dann auch noch worm32.
Angaben viel zu ungenau! Logs davon posten!

Zitat:
Warum hat Zone Alarm nichts gefunden?
Weil ZoneAlarm ein schwachsinniger/kontraproduktiver Paketfilter ist, den man viel zu schnell und leicht umgehen kann!
ZoneAlarm ist kontraproduktiver Müll, bitte umgehend deinstallieren und die Windows-Firewall einschalten!

28missi 04.06.2012 08:52
Hallo!

die Logs habe ich nicht mehr. Ich hatte unter Avira Rootkit.gen in Quarantäne verschoben. Durch Deinstallation und Umstellung auf Zone Alarm habe ich nichts mehr.

Zone Alarm ist Schrott? Und dafür habe ich auch noch Geld
Hatte mich vorher extra informiert, und Zone Alarm hatte bei den Firewalls zumindest angeblich gut abgeschnitten. Werde es aber jetzt deinstallieren und die Windows Firewall einschalten.

Kann man mit meinen aktuellen Logs was anfangen oder soll ich nach Deinstallation von Zone Alarm nochmal neue machen?

Danke für die Hilfe!

cosinus 04.06.2012 15:05
Zitat:
die Logs habe ich nicht mehr. Ich hatte unter Avira Rootkit.gen in Quarantäne verschoben.
Dann lässt sich auch nichts mehr richtig nachvollziehen was genau deinen Rechner befallen hat bzw. wo genau es rumlag - eine Aussage bzw. Hilfe so mit nicht oder nur sehr eingeschränkt noch möglich

Zitat:
Zone Alarm ist Schrott? Und dafür habe ich auch noch Geld
Überflüssiger Unsinn. Alles was man benötigt bringt Windows schon mit. Wieso kaufst du diesen Müll auch gleich? :balla:


Zitat:
Kann man mit meinen aktuellen Logs was anfangen oder soll ich nach Deinstallation von Zone Alarm nochmal neue machen?
Erst ZoneAlarm deinstallieren, anschließend routinemäßig einen Vollscan mit malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen!
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Außerdem müssen alle Funde entfernt werden.

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!



ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset





Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log

28missi 04.06.2012 20:08
Hallo Arne!

also Malwarebytes hat nicht gebracht. Keine infizierten Dateien gefunden.

Code:
Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.06.04.04

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
test :: TEST-101EE4A811 [Administrator]

04.06.2012 16:20:55
mbam-log-2012-06-04 (16-20-55).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 211676
Laufzeit: 30 Minute(n), 25 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
und eset hat folgende log datei

Code:
ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=5e3f66f995591c45ad126e438adb1aed
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-06-04 06:37:37
# local_time=2012-06-04 08:37:37 (+0100, Westeuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 0 0 0 0
# compatibility_mode=8192 67108863 100 0 986 986 0 0
# scanned=34592
# found=5
# cleaned=0
# scan_time=3454
C:\Dokumente und Einstellungen\test\Desktop\Handy\MyPhoneExplorer_Setup_v1.7.4.exe        Win32/Adware.ADON application (unable to clean)        00000000000000000000000000000000        I
C:\Dokumente und Einstellungen\test\Desktop\Handy\SETool2 Lite v1.11.7z        multiple threats (unable to clean)        00000000000000000000000000000000        I
C:\Programme\PDFCreator\message.exe        a variant of Win32/InstallCore.A application (unable to clean)        00000000000000000000000000000000        I
C:\System Volume Information\_restore{E71F2826-3DF9-4171-A5E1-0763559AA45D}\RP291\A0036445.dll        a variant of Win32/Mediyes.J trojan (unable to clean)        00000000000000000000000000000000        I
C:\System Volume Information\_restore{E71F2826-3DF9-4171-A5E1-0763559AA45D}\RP291\A0036452.dll        a variant of Win32/Mediyes.J trojan (unable to clean)        00000000000000000000000000000000        I
hoffe, ich hab das jetzt richtig gemacht mit dem einfügen.

Wie krieg ich den Trojaner jetzt endgültig raus?

Danke für Deine Hilfe

cosinus 04.06.2012 21:27
Hätte da mal zwei Fragen bevor es weiter geht

1.) Geht der normale Modus von Windows (wieder) uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

28missi 05.06.2012 12:58
Hallo Arne!

nein vermisse nichts, Windows fährt normal hoch und habe auch keine leeren Ordner gefunden.

Gruß
Ulrike

cosinus 05.06.2012 15:47
Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log
CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

28missi 05.06.2012 19:59
Hallo Arne

hier der Log file von OTL

Code:
OTL logfile created on: 05.06.2012 20:49:24 - Run 4
OTL by OldTimer - Version 3.2.45.0    Folder = C:\Dokumente und Einstellungen\test\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,24 Gb Total Physical Memory | 0,88 Gb Available Physical Memory | 71,25% Memory free
1,84 Gb Paging File | 1,65 Gb Available in Paging File | 89,56% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 37,25 Gb Total Space | 25,18 Gb Free Space | 67,60% Space Free | Partition Type: NTFS
 
Computer Name: TEST-101EE4A811 | User Name: test | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.06.01 09:04:26 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\test\Desktop\OTL.exe
PRC - [2011.07.22 09:49:26 | 000,511,920 | ---- | M] (REINER SCT) -- C:\WINDOWS\system32\cjpcsc.exe
PRC - [2011.06.09 14:06:06 | 000,254,696 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
PRC - [2010.02.18 17:44:15 | 000,202,256 | ---- | M] (RealNetworks, Inc.) -- C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
PRC - [2008.04.14 14:00:00 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2003.09.08 15:48:26 | 000,065,536 | ---- | M] () -- C:\Programme\Launch Manager\WButton.exe
PRC - [2003.09.04 15:46:02 | 000,040,960 | ---- | M] (Wistron) -- C:\Programme\Launch Manager\HotkeyApp.exe
PRC - [2003.06.25 10:53:30 | 000,204,800 | ---- | M] (Wistron) -- C:\Programme\Launch Manager\OSD.exe
PRC - [2003.05.12 14:28:50 | 000,032,768 | ---- | M] () -- C:\Programme\Launch Manager\LaunchAp.exe
PRC - [2002.11.25 19:23:20 | 000,172,032 | ---- | M] (Agere Systems) -- C:\Programme\ltmoh\ltmoh.exe
PRC - [1997.10.18 00:00:00 | 000,051,984 | ---- | M] () -- C:\Programme\Microsoft Office\Office\OSA.EXE
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.04.04 07:53:56 | 000,301,056 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.DEU
MOD - [2007.05.31 09:38:16 | 000,167,936 | ---- | M] () -- C:\WINDOWS\system32\SerialXP.dll
MOD - [2003.09.08 15:48:26 | 000,065,536 | ---- | M] () -- C:\Programme\Launch Manager\WButton.exe
MOD - [2003.05.12 14:28:50 | 000,032,768 | ---- | M] () -- C:\Programme\Launch Manager\LaunchAp.exe
MOD - [1997.10.18 00:00:00 | 003,782,416 | ---- | M] () -- C:\Programme\Microsoft Office\Office\MSO97.DLL
MOD - [1997.10.18 00:00:00 | 000,051,984 | ---- | M] () -- C:\Programme\Microsoft Office\Office\OSA.EXE
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Auto | Stopped] -- C:\WINDOWS\system32\eeufail.dll -- (mggmh)
SRV - [2012.06.05 13:18:01 | 000,241,664 | ---- | M] (Parental Solutions Inc.) [Auto | Running] -- C:\WINDOWS\system32\pouavgrhm.dll -- (Dnscache)
SRV - [2012.05.06 15:42:07 | 000,257,696 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.04.21 03:16:42 | 000,129,976 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2011.12.07 15:00:34 | 000,114,000 | ---- | M] (Joosoft.com GmbH) [Auto | Running] -- C:\WINDOWS\system32\UpdSvc.dll -- (Update-Service)
SRV - [2011.07.22 09:49:26 | 000,511,920 | ---- | M] (REINER SCT) [Auto | Running] -- C:\WINDOWS\system32\cjpcsc.exe -- (cjpcsc)
SRV - [2008.07.29 19:16:38 | 000,132,096 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing)
SRV - [2008.04.14 14:00:00 | 000,114,176 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\netdde.exe -- (NetDDEdsdm)
SRV - [2008.04.14 14:00:00 | 000,114,176 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\netdde.exe -- (NetDDE)
SRV - [2008.04.14 14:00:00 | 000,053,248 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\mprdim.dll -- (RemoteAccess)
SRV - [2008.04.14 14:00:00 | 000,033,792 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\msgsvc.dll -- (Messenger)
SRV - [2008.04.14 14:00:00 | 000,017,408 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\alrsvc.dll -- (Alerter)
SRV - [2006.03.03 21:03:10 | 000,069,632 | ---- | M] (HP) [Auto | Stopped] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (WDICA)
DRV - File not found [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\Wbutton.sys -- (Wbutton)
DRV - File not found [Kernel | Disabled | Stopped] -- system32\DRIVERS\s24trans.sys -- (s24trans)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] --  -- (PCIDump)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\23.tmp -- (MEMSWEEP2)
DRV - File not found [Kernel | System | Stopped] --  -- (mailKmd)
DRV - File not found [Kernel | System | Stopped] --  -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] --  -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] --  -- (Changer)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOKUME~1\test\LOKALE~1\Temp\catchme.sys -- (catchme)
DRV - [2011.03.29 13:08:08 | 000,028,144 | ---- | M] (REINER SCT) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\cjusb.sys -- (cjusb)
DRV - [2010.11.06 14:11:12 | 000,035,008 | ---- | M] (hxxp://libusb-win32.sourceforge.net) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\libusb0.sys -- (libusb0)
DRV - [2008.11.25 10:49:44 | 000,040,960 | R--- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Rts5161ccid.sys -- (USBCCID)
DRV - [2008.04.14 14:00:00 | 000,800,384 | ---- | M] (Microsoft Corp., Veritas Software) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\dmboot.sys -- (dmboot)
DRV - [2008.04.14 14:00:00 | 000,143,744 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\fastfat.sys -- (Fastfat)
DRV - [2008.04.14 14:00:00 | 000,066,048 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\udfs.sys -- (Udfs)
DRV - [2008.04.14 14:00:00 | 000,013,952 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\cbidf2k.sys -- (cbidf2k)
DRV - [2007.05.31 09:38:16 | 000,014,949 | ---- | M] (franson.biz) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\bizVSerialNT.sys -- (bizVSerial)
DRV - [2006.04.28 17:26:46 | 000,088,688 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SE27mgmt.sys -- (SE27mgmt) Sony Ericsson Device 039 USB WMC Device Management Drivers (WDM)
DRV - [2006.04.28 17:25:44 | 000,097,184 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SE27mdm.sys -- (SE27mdm)
DRV - [2006.04.28 17:25:40 | 000,009,360 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SE27mdfl.sys -- (SE27mdfl)
DRV - [2006.04.28 17:24:42 | 000,061,600 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SE27bus.sys -- (SE27bus) Sony Ericsson Device 039 Driver driver (WDM)
DRV - [2005.12.21 05:32:56 | 000,029,152 | R--- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usb2vcom.sys -- (usb2vcom)
DRV - [2005.09.19 03:07:00 | 000,035,275 | ---- | M] (SCM Microsystems Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\TwkUsb2K.sys -- (CHIPDRIVE USB SmartCardReader)
DRV - [2004.08.25 15:06:00 | 000,185,611 | ---- | M] (SCM Microsystems Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\TWKSER2K.sys -- (TWKSER2K)
DRV - [2004.01.02 20:52:00 | 001,646,720 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\w22n51.sys -- (w22n51) Intel(R)
DRV - [2003.07.15 02:33:26 | 000,111,168 | ---- | M] (Applied Drivers Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\cwawdm.sys -- (cs429x)
DRV - [2003.05.07 04:46:38 | 000,026,240 | ---- | M] (Winbond Electronics Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\wbsd.sys -- (WBSD) Winbond Secure Digital Storage (SD/MMC)
DRV - [2003.04.28 11:27:06 | 000,009,867 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\HOTKEY.sys -- (Hotkey)
DRV - [2003.04.24 02:14:00 | 000,004,828 | ---- | M] (Towitoko AG) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\TWKMS.sys -- (TwkMs)
DRV - [2003.04.16 02:04:18 | 000,030,464 | ---- | M] (Winbond Electronics Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\wbms.sys -- (WBMS) Winbond Memory Stick Storage (MS)
DRV - [2003.02.14 20:59:14 | 001,169,792 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2002.12.17 21:41:36 | 000,042,368 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\bcm4sbxp.sys -- (bcm4sbxp)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.web.de/br/ie8_startpage
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.bing.com/?PC=BNHP
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\..\SearchScopes\{02DC2E6A-4707-456F-AE7A-CB12C4CC1787}: "URL" = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&affID=110819&tl=gbn193052&tt=050412_30b&babsrc=SP_ss&mntrId=4c9fa22b000000000000000e356ecbd5
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\..\SearchScopes\{1BD30256-1263-4BDE-BA34-98DBBBA3AFC4}: "URL" = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\..\SearchScopes\{28A90140-3C17-454D-A26D-F38EC69C483F}: "URL" = hxxp://go.gmx.net/tb/ie_searchplugin/?su={searchTerms}
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\..\SearchScopes\{75E3E68F-CE3C-4387-9EC3-BC67702BB0FE}: "URL" = hxxp://go.web.de/br/ie8_search_amazon/?keywords={searchTerms}
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\..\SearchScopes\{7D3489F0-9553-4BDD-8299-CB1A8C3E85F5}: "URL" = hxxp://go.web.de/br/ie8_search_web/?su={searchTerms}
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2613550
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\..\SearchScopes\{BB47DE44-9AA3-4E82-AE9E-06732B7DDB4E}: "URL" = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\..\SearchScopes\{EBC4F45B-0875-4BC2-99AB-5FCDB9A8F578}: "URL" = hxxp://go.web.de/br/ie8_search_ebay/?q={searchTerms}
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Search the web (Babylon)"
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..browser.search.selectedEngine: "Bing"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.web.de/"
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.0
FF - prefs.js..extensions.enabledItems: {fd639891-5cc6-45ae-9055-a7a6abb5a7a9}:1.2.12.0
FF - prefs.js..extensions.enabledItems: {d40f5e7b-d2cf-4856-b441-cc613eeffbe3}:1.67
FF - prefs.js..keyword.URL: "hxxp://search.babylon.com/?affID=110819&tl=gbn193052&tt=050412_30b&babsrc=KW_ss&mntrId=4c9fa22b000000000000000e356ecbd5&q="
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@checkpoint.com/FFApi: C:\Programme\CheckPoint\ZAForceField\TrustChecker\bin\npFFApi.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.688: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.688: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.688: c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010.02.18 17:45:23 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.05.01 15:30:17 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2012.04.12 14:00:13 | 000,000,000 | ---D | M]
 
[2010.02.12 16:27:32 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Extensions
[2010.02.12 16:27:32 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012.05.30 14:18:24 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\extensions
[2011.07.23 14:22:07 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012.05.30 14:18:24 | 000,000,000 | ---D | M] (ZoneAlarm-Sicherheit Community Toolbar) -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\extensions\{fc2b76fc-2132-4d80-a9a3-1f5c6e49066b}
[2011.12.10 10:20:04 | 000,000,000 | ---D | M] (Santander Chipcard Plugin) -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\extensions\{fd639891-5cc6-45ae-9055-a7a6abb5a7a9}
[2011.12.19 21:56:47 | 000,000,933 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\searchplugins\11-suche.xml
[2011.10.13 17:19:44 | 000,000,855 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\searchplugins\1und1-suche.xml
[2011.10.10 15:27:30 | 000,001,281 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\searchplugins\amazondotcom-de.xml
[2011.10.10 14:59:22 | 000,002,364 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\searchplugins\eBay-de.xml
[2011.12.19 21:56:47 | 000,002,419 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\searchplugins\englische-ergebnisse.xml
[2011.10.13 17:01:56 | 000,010,507 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\searchplugins\gmx-suche.xml
[2011.10.10 15:12:38 | 000,002,385 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\searchplugins\lastminute.xml
[2011.10.13 17:34:10 | 000,002,248 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\searchplugins\mailcom-search.xml
[2011.10.13 15:07:08 | 000,005,490 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\searchplugins\webde-suche.xml
[2012.05.01 15:30:13 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.05.01 15:30:14 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\distribution\extensions
[2012.05.01 15:30:14 | 000,000,000 | ---D | M] (WEB.DE Toolbar) -- C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de
[2012.01.22 17:10:05 | 000,138,614 | ---- | M] () (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\TEST\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\605JKKZ1.DEFAULT\EXTENSIONS\{D40F5E7B-D2CF-4856-B441-CC613EEFFBE3}.XPI
[2012.04.21 03:18:00 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2011.11.10 06:54:13 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll
[2008.09.15 11:52:06 | 000,376,832 | ---- | M] ( ) -- C:\Programme\mozilla firefox\plugins\npsnapfish.dll
[2007.04.11 07:17:00 | 000,954,368 | ---- | M] (PPI Financial Systems GmbH) -- C:\Programme\mozilla firefox\plugins\NP_SEBChipcardPlugin.dll
[2012.04.21 03:54:08 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.04.05 20:49:12 | 000,002,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\babylon.xml
[2012.04.21 03:54:08 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2012.04.21 03:54:08 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2012.04.21 03:54:08 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.04.21 03:54:08 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.04.21 03:54:08 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2012.01.17 22:50:18 | 000,441,479 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: 127.0.0.1        www.007guard.com
O1 - Hosts: 127.0.0.1        007guard.com
O1 - Hosts: 127.0.0.1        008i.com
O1 - Hosts: 127.0.0.1        www.008k.com
O1 - Hosts: 127.0.0.1        008k.com
O1 - Hosts: 127.0.0.1        www.00hq.com
O1 - Hosts: 127.0.0.1        00hq.com
O1 - Hosts: 127.0.0.1        010402.com
O1 - Hosts: 127.0.0.1        www.032439.com
O1 - Hosts: 127.0.0.1        032439.com
O1 - Hosts: 127.0.0.1        www.1001-search.info
O1 - Hosts: 127.0.0.1        1001-search.info
O1 - Hosts: 127.0.0.1        www.100888290cs.com
O1 - Hosts: 127.0.0.1        100888290cs.com
O1 - Hosts: 127.0.0.1        www.100sexlinks.com
O1 - Hosts: 127.0.0.1        100sexlinks.com
O1 - Hosts: 127.0.0.1        www.10sek.com
O1 - Hosts: 127.0.0.1        10sek.com
O1 - Hosts: 127.0.0.1        www.123topsearch.com
O1 - Hosts: 127.0.0.1        123topsearch.com
O1 - Hosts: 127.0.0.1        www.132.com
O1 - Hosts: 127.0.0.1        132.com
O1 - Hosts: 127.0.0.1        www.136136.net
O1 - Hosts: 127.0.0.1        136136.net
O1 - Hosts: 15212 more lines...
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O3 - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\..\Toolbar\WebBrowser: (no name) - {C424171E-592A-415A-9EB1-DFD6D95D3530} - No CLSID value found.
O3 - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\..\Toolbar\WebBrowser: (no name) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - No CLSID value found.
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [CtrlVol] C:\Programme\Launch Manager\CtrlVol.exe (Wistron)
O4 - HKLM..\Run: [HotkeyApp] C:\Programme\Launch Manager\HotkeyApp.exe (Wistron)
O4 - HKLM..\Run: [LaunchAp] C:\Programme\Launch Manager\LaunchAp.exe ()
O4 - HKLM..\Run: [LMgrOSD] C:\Programme\Launch Manager\OSD.exe (Wistron)
O4 - HKLM..\Run: [LtMoh] C:\Programme\ltmoh\ltmoh.exe (Agere Systems)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [Wbutton] C:\Programme\Launch Manager\Wbutton.exe ()
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Microsoft-Indexerstellung.lnk = C:\Programme\Microsoft Office\Office\FINDFAST.EXE (Microsoft Corporation)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Office-Start.lnk = C:\Programme\Microsoft Office\Office\OSA.EXE ()
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\VR-NetWorld Auftragsprüfung.lnk = C:\Programme\VR-NetWorld\VRToolCheckOrder.exe (VR-NetWorld Software)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\WISO Mein Steuer-Sparbuch heute.lnk = C:\Programme\WISO\Steuersoftware 2012\mshaktuell.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0A88DECB-188B-4A64-80E9-CE5FEB4BB59D}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - (igfxsrvc.dll) - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.04.17 16:08:06 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
NetSvcs: 6to4 -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: mggmh - C:\WINDOWS\system32\eeufail.dll File not found
 
 
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: DnsCache - C:\WINDOWS\system32\pouavgrhm.dll (Parental Solutions Inc.)
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7
ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Sicherheitsupdate für Windows XP (KB923789)
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {ACC563BC-4266-43f0-B6ED-9D38C4202C7E} -
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
ActiveX: >{E9D28A7F-49A0-41E8-95B7-4C699B1D3A6A} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
 
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.06.05 13:18:01 | 000,241,664 | ---- | C] (Parental Solutions Inc.) -- C:\WINDOWS\System32\pouavgrhm.dll
[2012.06.04 19:23:36 | 000,000,000 | ---D | C] -- C:\Programme\ESET
[2012.06.04 16:17:19 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2012.06.04 16:14:46 | 010,063,000 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Dokumente und Einstellungen\test\Desktop\mbam-setup-1.61.0.1400.exe
[2012.06.01 09:04:18 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\test\Desktop\OTL.exe
[2012.06.01 07:18:38 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\test\Recent
[2012.05.21 20:34:49 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\test\Downloads
[2012.05.09 13:58:59 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Kaspersky SDK
[2012.05.09 13:49:00 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\test\Eigene Dateien\ForceField Shared Files
[2012.05.09 13:48:51 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\CheckPoint
[2012.05.09 13:48:35 | 000,000,000 | ---D | C] -- C:\Programme\Conduit
[2012.05.09 13:48:31 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\test\Lokale Einstellungen\Anwendungsdaten\Conduit
[2012.05.09 13:46:01 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CheckPoint
[2012.05.09 13:45:53 | 000,000,000 | ---D | C] -- C:\Programme\CheckPoint
[2012.05.09 13:20:21 | 000,000,000 | -H-D | C] -- C:\WINDOWS\$hf_mig$
[2012.05.08 13:39:53 | 000,000,000 | -H-D | C] -- C:\Dokumente und Einstellungen\test\Desktop\Lokale Einstellungen
[2012.05.07 14:32:56 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\FastStone
[2012.05.07 14:32:52 | 000,000,000 | ---D | C] -- C:\Programme\FastStone Capture
[2012.05.07 14:32:52 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\FastStone Capture
[2012.01.23 11:35:11 | 039,401,336 | ---- | C] (Apple Inc.) -- C:\Programme\QuickTimeInstaller.exe
[2011.12.07 14:58:44 | 000,541,544 | ---- | C] (JooSoft GmbH) -- C:\Programme\7z920.exe
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.06.05 20:49:19 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1275210071-1993962763-1957994488-1003.job
[2012.06.05 20:49:19 | 000,000,268 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1275210071-1993962763-1957994488-1003.job
[2012.06.05 20:40:00 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012.06.05 14:21:46 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.06.05 14:21:20 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.06.05 13:18:01 | 000,241,664 | ---- | M] (Parental Solutions Inc.) -- C:\WINDOWS\System32\pouavgrhm.dll
[2012.06.04 16:16:45 | 010,063,000 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Dokumente und Einstellungen\test\Desktop\mbam-setup-1.61.0.1400.exe
[2012.06.04 15:48:16 | 000,184,763 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Desktop\2012-06-04 xax Arbeitsvertrag UK (Entwurf).pdf
[2012.06.01 09:17:17 | 000,302,592 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Desktop\omm346gc.exe
[2012.06.01 09:04:26 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\test\Desktop\OTL.exe
[2012.06.01 09:02:06 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\test\defogger_reenable
[2012.06.01 08:13:10 | 000,001,452 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Desktop\message-rfc822-attachment.eml
[2012.06.01 08:08:19 | 000,126,912 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012.06.01 07:14:17 | 000,278,352 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Eigene Dateien\cc_20120601_071402.reg
[2012.06.01 07:04:06 | 000,000,660 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Dokumente\Desktop\CCleaner.lnk
[2012.05.31 08:36:04 | 000,010,726 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Eigene Dateien\VR-NetWorld.pdf
[2012.05.21 20:35:27 | 000,000,022 | ---- | M] () -- C:\Dokumente und Einstellungen\test\Desktop\ausmalbild_kostenlos.zip
[2012.05.09 19:37:24 | 000,479,376 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2012.05.09 19:37:24 | 000,433,138 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012.05.09 19:37:24 | 000,092,732 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2012.05.09 19:37:24 | 000,068,094 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012.05.07 14:32:52 | 000,000,728 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Dokumente\Desktop\FastStone Capture.lnk
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.06.04 15:46:50 | 000,184,763 | ---- | C] () -- C:\Dokumente und Einstellungen\test\Desktop\2012-06-04 xax Arbeitsvertrag UK (Entwurf).pdf
[2012.06.01 09:17:14 | 000,302,592 | ---- | C] () -- C:\Dokumente und Einstellungen\test\Desktop\omm346gc.exe
[2012.06.01 09:02:06 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\test\defogger_reenable
[2012.06.01 08:13:06 | 000,001,452 | ---- | C] () -- C:\Dokumente und Einstellungen\test\Desktop\message-rfc822-attachment.eml
[2012.06.01 08:08:19 | 000,126,912 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012.06.01 07:14:11 | 000,278,352 | ---- | C] () -- C:\Dokumente und Einstellungen\test\Eigene Dateien\cc_20120601_071402.reg
[2012.05.21 20:34:54 | 000,000,022 | ---- | C] () -- C:\Dokumente und Einstellungen\test\Desktop\ausmalbild_kostenlos.zip
[2012.05.07 14:32:52 | 000,000,728 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Dokumente\Desktop\FastStone Capture.lnk
[2012.02.15 14:11:59 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2012.01.03 11:56:09 | 000,000,595 | ---- | C] () -- C:\WINDOWS\wiso.ini
[2012.01.02 20:03:27 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2012.01.02 20:03:27 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2012.01.02 20:03:27 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2012.01.02 20:03:27 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2012.01.02 20:03:27 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2012.01.02 17:56:26 | 000,103,981 | ---- | C] () -- C:\WINDOWS\hpoins08.dat
[2012.01.02 17:56:26 | 000,004,445 | ---- | C] () -- C:\WINDOWS\hpomdl08.dat
[2011.12.21 15:02:26 | 000,000,095 | ---- | C] () -- C:\WINDOWS\ParrotFlashWiz.INI
[2011.10.29 12:58:18 | 000,167,936 | ---- | C] () -- C:\WINDOWS\System32\SerialXP.dll
[2011.10.29 12:58:18 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\win32com.dll
[2011.10.09 10:54:17 | 000,000,364 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2011.10.05 18:24:07 | 000,001,296 | ---- | C] () -- C:\WINDOWS\HBCIKRNL.INI
[2010.09.21 17:42:55 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\drivers\SymSMR130.dat
 
========== LOP Check ==========
 
[2011.12.06 22:36:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\adisoft AG
[2011.12.07 15:09:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Babylon
[2010.02.04 22:53:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\BTrieve
[2012.03.19 15:57:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Buhl Data Service GmbH
[2012.05.09 13:46:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CheckPoint
[2012.01.20 16:14:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DesktopIcons
[2012.05.09 13:58:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Kaspersky SDK
[2010.02.07 16:28:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Lexware
[2009.04.25 10:25:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Drivers HeadQuarters
[2011.10.29 12:58:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\REINER SCT
[2012.01.18 08:10:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Bytemobile
[2012.01.20 17:26:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\1&1 Mail & Media GmbH
[2009.11.24 18:46:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\ACD Systems
[2012.01.03 12:03:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Buhl Data Service
[2012.05.09 13:48:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\CheckPoint
[2011.07.07 07:05:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Image Zone Express
[2010.02.05 10:03:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Lexware
[2010.09.18 09:16:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\OpenOffice.org
[2011.12.11 17:14:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Teleca
[2010.02.12 16:27:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Thunderbird
[2010.05.22 23:14:13 | 000,000,484 | ---- | M] () -- C:\WINDOWS\Tasks\Install.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2012.01.20 17:26:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\1&1 Mail & Media GmbH
[2009.11.24 18:46:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\ACD Systems
[2012.01.25 10:16:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Adobe
[2010.02.26 21:32:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Ahead
[2012.01.24 09:28:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Apple Computer
[2012.01.03 12:03:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Buhl Data Service
[2012.05.09 13:48:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\CheckPoint
[2012.05.07 14:32:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\FastStone
[2009.11.27 13:11:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Help
[2009.04.19 21:00:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\HP
[2009.04.17 16:14:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Identities
[2011.07.07 07:05:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Image Zone Express
[2009.04.25 14:35:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\InstallShield
[2010.02.05 10:03:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Lexware
[2011.12.25 13:04:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Macromedia
[2012.01.17 17:28:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Malwarebytes
[2012.01.25 10:16:40 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Microsoft
[2009.04.18 15:06:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla
[2010.09.18 09:16:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\OpenOffice.org
[2010.02.18 17:48:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Real
[2009.09.28 20:37:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Sony Ericsson
[2010.02.05 10:25:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Sun
[2011.12.11 17:14:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Teleca
[2010.02.12 16:27:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Thunderbird
[2011.12.07 15:11:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\WinRAR
 
< %APPDATA%\*.exe /s >
[2011.10.05 19:18:39 | 000,045,056 | R--- | M] (InstallShield Software Corp.) -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Microsoft\Installer\{AA898D01-D4E3-43C6-8E25-70CA660B9F16}\NewShortcut2_DF0CCA89BE294B7D9A229DB872E01239.exe
[2011.10.05 19:18:39 | 000,040,960 | R--- | M] (InstallShield Software Corp.) -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Microsoft\Installer\{AA898D01-D4E3-43C6-8E25-70CA660B9F16}\NewShortcut3_DF0CCA89BE294B7D9A229DB872E01239.exe
[2011.10.05 19:18:39 | 000,040,960 | R--- | M] (InstallShield Software Corp.) -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Microsoft\Installer\{AA898D01-D4E3-43C6-8E25-70CA660B9F16}\NewShortcut8_DF0CCA89BE294B7D9A229DB872E01239.exe
 
< %SYSTEMDRIVE%\*.exe >
 
< MD5 for: AGP440.SYS  >
[2008.04.14 14:00:00 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2008.04.14 14:00:00 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008.04.14 00:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ERDNT\cache\atapi.sys
[2008.04.14 00:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\dllcache\atapi.sys
[2008.04.14 00:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2008.04.14 14:00:00 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\ReinstallBackups\0006\DriverFiles\i386\atapi.sys
 
< MD5 for: EVENTLOG.DLL  >
[2008.04.14 14:00:00 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\ERDNT\cache\eventlog.dll
[2008.04.14 14:00:00 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\dllcache\eventlog.dll
[2008.04.14 14:00:00 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll
 
< MD5 for: NETLOGON.DLL  >
[2008.04.14 14:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\ERDNT\cache\netlogon.dll
[2008.04.14 14:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\dllcache\netlogon.dll
[2008.04.14 14:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll
 
< MD5 for: SCECLI.DLL  >
[2008.04.14 14:00:00 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\ERDNT\cache\scecli.dll
[2008.04.14 14:00:00 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\dllcache\scecli.dll
[2008.04.14 14:00:00 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll
 
< MD5 for: USER32.DLL  >
[2008.04.14 14:00:00 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\ERDNT\cache\user32.dll
[2008.04.14 14:00:00 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\dllcache\user32.dll
[2008.04.14 14:00:00 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.04.14 14:00:00 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ERDNT\cache\userinit.exe
[2008.04.14 14:00:00 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\dllcache\userinit.exe
[2008.04.14 14:00:00 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2008.04.14 14:00:00 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ERDNT\cache\winlogon.exe
[2008.04.14 14:00:00 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\dllcache\winlogon.exe
[2008.04.14 14:00:00 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2008.04.14 14:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys
[2008.04.14 14:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2009.04.17 17:50:23 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav
[2009.04.17 17:50:23 | 001,089,536 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav
[2009.04.17 17:50:23 | 000,442,368 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< End of report >
Wie jetzt weiter?

Vielen Dank !!!

cosinus 05.06.2012 20:30
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
SRV - File not found [Auto | Stopped] -- C:\WINDOWS\system32\eeufail.dll -- (mggmh)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\23.tmp -- (MEMSWEEP2)
DRV - File not found [Kernel | System | Stopped] --  -- (mailKmd)
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.web.de/br/ie8_startpage
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.bing.com/?PC=BNHP
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\..\SearchScopes\{02DC2E6A-4707-456F-AE7A-CB12C4CC1787}: "URL" = http://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/?q={searchTerms}&affID=110819&tl=gbn193052&tt=050412_30b&babsrc=SP_ss&mntrId=4c9fa22b000000000000000e356ecbd5
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\..\SearchScopes\{1BD30256-1263-4BDE-BA34-98DBBBA3AFC4}: "URL" = http://go.web.de/tb/ie_searchplugin/?su={searchTerms}
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\..\SearchScopes\{28A90140-3C17-454D-A26D-F38EC69C483F}: "URL" = http://go.gmx.net/tb/ie_searchplugin/?su={searchTerms}
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\..\SearchScopes\{75E3E68F-CE3C-4387-9EC3-BC67702BB0FE}: "URL" = http://go.web.de/br/ie8_search_amazon/?keywords={searchTerms}
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\..\SearchScopes\{7D3489F0-9553-4BDD-8299-CB1A8C3E85F5}: "URL" = http://go.web.de/br/ie8_search_web/?su={searchTerms}
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2613550
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\..\SearchScopes\{BB47DE44-9AA3-4E82-AE9E-06732B7DDB4E}: "URL" = http://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
IE - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\..\SearchScopes\{EBC4F45B-0875-4BC2-99AB-5FCDB9A8F578}: "URL" = http://go.web.de/br/ie8_search_ebay/?q={searchTerms}
FF - prefs.js..browser.search.defaultenginename: "Search the web (Babylon)"
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..keyword.URL: "http://search.babylon.com/?affID=110819&tl=gbn193052&tt=050412_30b&babsrc=KW_ss&mntrId=4c9fa22b000000000000000e356ecbd5&q="
FF - HKLM\Software\MozillaPlugins\@checkpoint.com/FFApi: C:\Programme\CheckPoint\ZAForceField\TrustChecker\bin\npFFApi.dll File not found
[2011.07.23 14:22:07 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012.05.30 14:18:24 | 000,000,000 | ---D | M] (ZoneAlarm-Sicherheit Community Toolbar) -- C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\extensions\{fc2b76fc-2132-4d80-a9a3-1f5c6e49066b}
[2012.05.01 15:30:14 | 000,000,000 | ---D | M] (WEB.DE Toolbar) -- C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de
[2012.04.05 20:49:12 | 000,002,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\babylon.xml
O3 - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\..\Toolbar\WebBrowser: (no name) - {C424171E-592A-415A-9EB1-DFD6D95D3530} - No CLSID value found.
O3 - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\..\Toolbar\WebBrowser: (no name) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - No CLSID value found.
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
NetSvcs: mggmh - C:\WINDOWS\system32\eeufail.dll File not found
:Files
C:\WINDOWS\System32\pouavgrhm.dll
C:\Programme\CheckPoint
C:\Dokumente und Einstellungen\test\Anwendungsdaten\CheckPoint
C:\Programme\Conduit
C:\Dokumente und Einstellungen\test\Lokale Einstellungen\Anwendungsdaten\Conduit
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CheckPoint
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Babylon
:Commands
[purity]
[emptytemp]
[emptyflash]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

28missi 06.06.2012 20:10
Hallo Arne,

habe alles nach Deiner Anweisung durchgeführt

hier der Logfile
Code:
All processes killed
========== OTL ==========
Service mggmh stopped successfully!
Service mggmh deleted successfully!
File C:\WINDOWS\system32\eeufail.dll not found.
Service MEMSWEEP2 stopped successfully!
Service MEMSWEEP2 deleted successfully!
File C:\WINDOWS\system32\23.tmp not found.
Service mailKmd stopped successfully!
Service mailKmd deleted successfully!
HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\SOFTWARE\Microsoft\Internet Explorer\Main\\Default_Page_URL| /E : value set successfully!
HKU\S-1-5-21-1275210071-1993962763-1957994488-1003\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKEY_USERS\S-1-5-21-1275210071-1993962763-1957994488-1003\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_USERS\S-1-5-21-1275210071-1993962763-1957994488-1003\Software\Microsoft\Internet Explorer\SearchScopes\{02DC2E6A-4707-456F-AE7A-CB12C4CC1787}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02DC2E6A-4707-456F-AE7A-CB12C4CC1787}\ not found.
Registry key HKEY_USERS\S-1-5-21-1275210071-1993962763-1957994488-1003\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_USERS\S-1-5-21-1275210071-1993962763-1957994488-1003\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ not found.
Registry key HKEY_USERS\S-1-5-21-1275210071-1993962763-1957994488-1003\Software\Microsoft\Internet Explorer\SearchScopes\{1BD30256-1263-4BDE-BA34-98DBBBA3AFC4}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1BD30256-1263-4BDE-BA34-98DBBBA3AFC4}\ not found.
Registry key HKEY_USERS\S-1-5-21-1275210071-1993962763-1957994488-1003\Software\Microsoft\Internet Explorer\SearchScopes\{28A90140-3C17-454D-A26D-F38EC69C483F}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{28A90140-3C17-454D-A26D-F38EC69C483F}\ not found.
Registry key HKEY_USERS\S-1-5-21-1275210071-1993962763-1957994488-1003\Software\Microsoft\Internet Explorer\SearchScopes\{75E3E68F-CE3C-4387-9EC3-BC67702BB0FE}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75E3E68F-CE3C-4387-9EC3-BC67702BB0FE}\ not found.
Registry key HKEY_USERS\S-1-5-21-1275210071-1993962763-1957994488-1003\Software\Microsoft\Internet Explorer\SearchScopes\{7D3489F0-9553-4BDD-8299-CB1A8C3E85F5}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7D3489F0-9553-4BDD-8299-CB1A8C3E85F5}\ not found.
Registry key HKEY_USERS\S-1-5-21-1275210071-1993962763-1957994488-1003\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ not found.
Registry key HKEY_USERS\S-1-5-21-1275210071-1993962763-1957994488-1003\Software\Microsoft\Internet Explorer\SearchScopes\{BB47DE44-9AA3-4E82-AE9E-06732B7DDB4E}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BB47DE44-9AA3-4E82-AE9E-06732B7DDB4E}\ not found.
Registry key HKEY_USERS\S-1-5-21-1275210071-1993962763-1957994488-1003\Software\Microsoft\Internet Explorer\SearchScopes\{EBC4F45B-0875-4BC2-99AB-5FCDB9A8F578}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EBC4F45B-0875-4BC2-99AB-5FCDB9A8F578}\ not found.
Prefs.js: "Search the web (Babylon)" removed from browser.search.defaultenginename
Prefs.js: "Search the web (Babylon)" removed from browser.search.order.1
Prefs.js: "hxxp://search.babylon.com/?affID=110819&tl=gbn193052&tt=050412_30b&babsrc=KW_ss&mntrId=4c9fa22b000000000000000e356ecbd5&q=" removed from keyword.URL
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@checkpoint.com/FFApi\ deleted successfully.
C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}\defaults\preferences folder moved successfully.
C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}\defaults folder moved successfully.
C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}\chrome folder moved successfully.
C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} folder moved successfully.
C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\extensions\{fc2b76fc-2132-4d80-a9a3-1f5c6e49066b}\searchplugin folder moved successfully.
C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\extensions\{fc2b76fc-2132-4d80-a9a3-1f5c6e49066b}\Plugins folder moved successfully.
C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\extensions\{fc2b76fc-2132-4d80-a9a3-1f5c6e49066b}\modules folder moved successfully.
C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\extensions\{fc2b76fc-2132-4d80-a9a3-1f5c6e49066b}\META-INF folder moved successfully.
C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\extensions\{fc2b76fc-2132-4d80-a9a3-1f5c6e49066b}\defaults folder moved successfully.
C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\extensions\{fc2b76fc-2132-4d80-a9a3-1f5c6e49066b}\components folder moved successfully.
C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\extensions\{fc2b76fc-2132-4d80-a9a3-1f5c6e49066b}\chrome folder moved successfully.
C:\Dokumente und Einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\extensions\{fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\skin\webapps folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\skin\weather folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\skin\ticker folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\skin\shopping folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\skin\search folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\skin\pref folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\skin\phish folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\skin\newtab\initial-thumbs folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\skin\newtab folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\skin\neterror folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\skin\horoscope folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\skin\homebutton folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\skin\highlight folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\skin\help folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\skin\email folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\skin\ebay folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\skin\brand folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\skin folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\en-US\webapps folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\en-US\weather folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\en-US\ticker folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\en-US\shopping folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\en-US\search folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\en-US\pref folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\en-US\phish folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\en-US\newtab folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\en-US\neterror folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\en-US\main folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\en-US\horoscope folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\en-US\highlight folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\en-US\help folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\en-US\email folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\en-US\ebay folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\en-US folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\de-DE\webapps folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\de-DE\weather folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\de-DE\ticker folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\de-DE\shopping folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\de-DE\search folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\de-DE\pref folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\de-DE\phish folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\de-DE\newtab folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\de-DE\neterror folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\de-DE\main folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\de-DE\horoscope folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\de-DE\highlight folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\de-DE\help\page folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\de-DE\help folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\de-DE\email folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\de-DE\ebay folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale\de-DE folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\locale folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\defaults\preferences folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\defaults folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\content\webapps folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\content\weather folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\content\util folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\content\tracking folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\content\ticker folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\content\shopping folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\content\search\mcollect folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\content\search folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\content\pref folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\content\phish folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\content\newtab folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\content\neterror folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\content\main folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\content\hotnews folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\content\horoscope folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\content\highlight folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\content\help folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\content\email folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\content\ebay folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\content folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de\components folder moved successfully.
C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de folder moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\babylon.xml moved successfully.
Registry value HKEY_USERS\S-1-5-21-1275210071-1993962763-1957994488-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{C424171E-592A-415A-9EB1-DFD6D95D3530} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C424171E-592A-415A-9EB1-DFD6D95D3530}\ not found.
Registry value HKEY_USERS\S-1-5-21-1275210071-1993962763-1957994488-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\HonorAutoRunSetting deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveAutoRun deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDrives deleted successfully.
Registry key HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry value HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveAutoRun deleted successfully.
Registry key HKEY_USERS\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry value HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun not found.
Registry value HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveAutoRun not found.
Registry key HKEY_USERS\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry value HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry key HKEY_USERS\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry value HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry key HKEY_USERS\S-1-5-21-1275210071-1993962763-1957994488-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel\ deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1275210071-1993962763-1957994488-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1275210071-1993962763-1957994488-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveAutoRun deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1275210071-1993962763-1957994488-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDrives deleted successfully.
mggmh removed from NetSvcs value successfully!
========== FILES ==========
C:\WINDOWS\System32\pouavgrhm.dll moved successfully.
C:\Programme\CheckPoint folder moved successfully.
C:\Dokumente und Einstellungen\test\Anwendungsdaten\CheckPoint\ZoneAlarm Toolbar\TrustChecker folder moved successfully.
C:\Dokumente und Einstellungen\test\Anwendungsdaten\CheckPoint\ZoneAlarm Toolbar\PTPCACHE folder moved successfully.
C:\Dokumente und Einstellungen\test\Anwendungsdaten\CheckPoint\ZoneAlarm Toolbar folder moved successfully.
C:\Dokumente und Einstellungen\test\Anwendungsdaten\CheckPoint folder moved successfully.
C:\Programme\Conduit\Community Alerts folder moved successfully.
C:\Programme\Conduit folder moved successfully.
C:\Dokumente und Einstellungen\test\Lokale Einstellungen\Anwendungsdaten\Conduit\Community Alerts\Log folder moved successfully.
C:\Dokumente und Einstellungen\test\Lokale Einstellungen\Anwendungsdaten\Conduit\Community Alerts\LanguagePacks folder moved successfully.
C:\Dokumente und Einstellungen\test\Lokale Einstellungen\Anwendungsdaten\Conduit\Community Alerts\Feeds folder moved successfully.
C:\Dokumente und Einstellungen\test\Lokale Einstellungen\Anwendungsdaten\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\light folder moved successfully.
C:\Dokumente und Einstellungen\test\Lokale Einstellungen\Anwendungsdaten\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\dark folder moved successfully.
C:\Dokumente und Einstellungen\test\Lokale Einstellungen\Anwendungsdaten\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images folder moved successfully.
C:\Dokumente und Einstellungen\test\Lokale Einstellungen\Anwendungsdaten\Conduit\Community Alerts\Dialogs\AppNotificationDialog folder moved successfully.
C:\Dokumente und Einstellungen\test\Lokale Einstellungen\Anwendungsdaten\Conduit\Community Alerts\Dialogs folder moved successfully.
C:\Dokumente und Einstellungen\test\Lokale Einstellungen\Anwendungsdaten\Conduit\Community Alerts folder moved successfully.
C:\Dokumente und Einstellungen\test\Lokale Einstellungen\Anwendungsdaten\Conduit folder moved successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CheckPoint\ZoneAlarm\Data folder moved successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CheckPoint\ZoneAlarm folder moved successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CheckPoint folder moved successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Babylon folder moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default User
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Jens
 
User: LocalService
->Temp folder emptied: 2203640 bytes
->Temporary Internet Files folder emptied: 32969 bytes
 
User: NetworkService
->Temp folder emptied: 2136488 bytes
->Temporary Internet Files folder emptied: 32902 bytes
 
User: test
->Temp folder emptied: 7788977 bytes
->Temporary Internet Files folder emptied: 5967544 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 132488295 bytes
->Flash cache emptied: 487 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2352202 bytes
%systemroot%\System32 .tmp files removed: 2951 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1826752 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 148,00 mb
 
 
[EMPTYFLASH]
 
User: All Users
 
User: Default User
 
User: Jens
 
User: LocalService
 
User: NetworkService
 
User: test
->Flash cache emptied: 0 bytes
 
Total Flash Files Cleaned = 0,00 mb
 
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.45.0 log created on 06062012_210127

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...
Grüße - Ulrike

cosinus 07.06.2012 13:42
Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

28missi 07.06.2012 20:06
Hallo Arne

hier das Logfile von TDSS

Code:
20:57:20.0396 2708        TDSS rootkit removing tool 2.7.36.0 May 21 2012 16:40:16
20:57:21.0077 2708        ============================================================
20:57:21.0077 2708        Current date / time: 2012/06/07 20:57:21.0077
20:57:21.0077 2708        SystemInfo:
20:57:21.0077 2708       
20:57:21.0077 2708        OS Version: 5.1.2600 ServicePack: 3.0
20:57:21.0077 2708        Product type: Workstation
20:57:21.0077 2708        ComputerName: TEST-101EE4A811
20:57:21.0077 2708        UserName: test
20:57:21.0077 2708        Windows directory: C:\WINDOWS
20:57:21.0077 2708        System windows directory: C:\WINDOWS
20:57:21.0077 2708        Processor architecture: Intel x86
20:57:21.0077 2708        Number of processors: 1
20:57:21.0077 2708        Page size: 0x1000
20:57:21.0077 2708        Boot type: Normal boot
20:57:21.0077 2708        ============================================================
20:57:24.0211 2708        Drive \Device\Harddisk0\DR0 - Size: 0x950A60000 (37.26 Gb), SectorSize: 0x200, Cylinders: 0x1300, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
20:57:24.0211 2708        ============================================================
20:57:24.0211 2708        \Device\Harddisk0\DR0:
20:57:24.0211 2708        MBR partitions:
20:57:24.0211 2708        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x4A81400
20:57:24.0211 2708        ============================================================
20:57:24.0261 2708        C: <-> \Device\Harddisk0\DR0\Partition0
20:57:24.0261 2708        ============================================================
20:57:24.0261 2708        Initialize success
20:57:24.0261 2708        ============================================================
20:57:48.0806 3484        ============================================================
20:57:48.0806 3484        Scan started
20:57:48.0806 3484        Mode: Manual; SigCheck; TDLFS;
20:57:48.0806 3484        ============================================================
20:57:49.0077 3484        Abiosdsk - ok
20:57:49.0097 3484        abp480n5 - ok
20:57:49.0167 3484        ACPI            (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys
20:57:51.0290 3484        ACPI - ok
20:57:51.0340 3484        ACPIEC          (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
20:57:51.0490 3484        ACPIEC - ok
20:57:51.0631 3484        AdobeFlashPlayerUpdateSvc (76d5a3d2a50402a0b9b6ed13c4371e79) C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
20:57:51.0651 3484        AdobeFlashPlayerUpdateSvc - ok
20:57:51.0661 3484        adpu160m - ok
20:57:51.0721 3484        aec            (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
20:57:51.0871 3484        aec - ok
20:57:51.0951 3484        AFD            (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
20:57:52.0001 3484        AFD - ok
20:57:52.0151 3484        AgereSoftModem  (58041495e6d3650c02b1aec525d24089) C:\WINDOWS\system32\DRIVERS\AGRSM.sys
20:57:52.0312 3484        AgereSoftModem - ok
20:57:52.0322 3484        Aha154x - ok
20:57:52.0332 3484        aic78u2 - ok
20:57:52.0342 3484        aic78xx - ok
20:57:52.0402 3484        Alerter        (738d80cc01d7bc7584be917b7f544394) C:\WINDOWS\system32\alrsvc.dll
20:57:52.0702 3484        Alerter - ok
20:57:52.0742 3484        ALG            (190cd73d4984f94d823f9444980513e5) C:\WINDOWS\System32\alg.exe
20:57:52.0822 3484        ALG - ok
20:57:52.0832 3484        AliIde - ok
20:57:52.0842 3484        amsint - ok
20:57:52.0872 3484        AppMgmt        (d45960be52c3c610d361977057f98c54) C:\WINDOWS\System32\appmgmts.dll
20:57:52.0952 3484        AppMgmt - ok
20:57:52.0972 3484        Arp1394        (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
20:57:53.0093 3484        Arp1394 - ok
20:57:53.0103 3484        asc - ok
20:57:53.0113 3484        asc3350p - ok
20:57:53.0123 3484        asc3550 - ok
20:57:53.0243 3484        aspnet_state    (0e5e4957549056e2bf2c49f4f6b601ad) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
20:57:53.0273 3484        aspnet_state - ok
20:57:53.0293 3484        AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
20:57:53.0453 3484        AsyncMac - ok
20:57:53.0513 3484        atapi          (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
20:57:53.0643 3484        atapi - ok
20:57:53.0653 3484        Atdisk - ok
20:57:53.0704 3484        Atmarpc        (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
20:57:53.0864 3484        Atmarpc - ok
20:57:53.0914 3484        AudioSrv        (58ed0d5452df7be732193e7999c6b9a4) C:\WINDOWS\System32\audiosrv.dll
20:57:54.0084 3484        AudioSrv - ok
20:57:54.0144 3484        audstub        (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
20:57:54.0294 3484        audstub - ok
20:57:54.0354 3484        bcm4sbxp        (f5c0d3c93235a455cdd13c954adf1a80) C:\WINDOWS\system32\DRIVERS\bcm4sbxp.sys
20:57:54.0405 3484        bcm4sbxp - ok
20:57:54.0465 3484        Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
20:57:54.0615 3484        Beep - ok
20:57:54.0695 3484        BITS            (d6f603772a789bb3228f310d650b8bd1) C:\WINDOWS\system32\qmgr.dll
20:57:55.0126 3484        BITS - ok
20:57:55.0176 3484        bizVSerial      (66f655b08eed3230e059d197c8a1969b) C:\WINDOWS\system32\drivers\bizVSerialNT.sys
20:57:55.0196 3484        bizVSerial ( UnsignedFile.Multi.Generic ) - warning
20:57:55.0196 3484        bizVSerial - detected UnsignedFile.Multi.Generic (1)
20:57:55.0256 3484        Browser        (b42057f06bbb98b31876c0b3f2b54e33) C:\WINDOWS\System32\browser.dll
20:57:55.0396 3484        Browser - ok
20:57:55.0596 3484        catchme - ok
20:57:55.0636 3484        cbidf2k        (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
20:57:55.0756 3484        cbidf2k - ok
20:57:55.0767 3484        cd20xrnt - ok
20:57:55.0807 3484        Cdaudio        (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
20:57:55.0997 3484        Cdaudio - ok
20:57:56.0057 3484        Cdfs            (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
20:57:56.0257 3484        Cdfs - ok
20:57:56.0327 3484        Cdrom          (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
20:57:56.0528 3484        Cdrom - ok
20:57:56.0538 3484        Changer - ok
20:57:56.0578 3484        CHIPDRIVE USB SmartCardReader (aeee1fc75382147fe6afd2f1250b7c7c) C:\WINDOWS\system32\DRIVERS\TwkUsb2K.sys
20:57:56.0608 3484        CHIPDRIVE USB SmartCardReader ( UnsignedFile.Multi.Generic ) - warning
20:57:56.0608 3484        CHIPDRIVE USB SmartCardReader - detected UnsignedFile.Multi.Generic (1)
20:57:56.0638 3484        CiSvc          (28e3040d1f1ca2008cd6b29dfebc9a5e) C:\WINDOWS\system32\cisvc.exe
20:57:56.0818 3484        CiSvc - ok
20:57:56.0898 3484        cjpcsc          (8fee4423d682394eb436c975d0a3a994) C:\WINDOWS\system32\cjpcsc.exe
20:57:56.0988 3484        cjpcsc - ok
20:57:57.0028 3484        cjusb          (b0dfc4adb1ff150ac466f3dad323196a) C:\WINDOWS\system32\DRIVERS\cjusb.sys
20:57:57.0048 3484        cjusb - ok
20:57:57.0088 3484        ClipSrv        (778a30ed3c134eb7e406afc407e9997d) C:\WINDOWS\system32\clipsrv.exe
20:57:57.0309 3484        ClipSrv - ok
20:57:57.0409 3484        clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
20:57:57.0479 3484        clr_optimization_v2.0.50727_32 - ok
20:57:57.0539 3484        CmBatt          (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
20:57:57.0789 3484        CmBatt - ok
20:57:57.0799 3484        CmdIde - ok
20:57:57.0829 3484        Compbatt        (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
20:57:58.0130 3484        Compbatt - ok
20:57:58.0150 3484        COMSysApp - ok
20:57:58.0160 3484        Cpqarray - ok
20:57:58.0230 3484        CryptSvc        (611f824e5c703a5a899f84c5f1699e4d) C:\WINDOWS\System32\cryptsvc.dll
20:57:58.0370 3484        CryptSvc - ok
20:57:58.0430 3484        cs429x          (4f6e10a312e9b3bcd91bd3f801611c03) C:\WINDOWS\system32\drivers\cwawdm.sys
20:57:58.0470 3484        cs429x - ok
20:57:58.0470 3484        dac2w2k - ok
20:57:58.0480 3484        dac960nt - ok
20:57:58.0581 3484        DcomLaunch      (3127afbf2c1ed0ab14a1bbb7aaecb85b) C:\WINDOWS\system32\rpcss.dll
20:57:58.0701 3484        DcomLaunch - ok
20:57:58.0731 3484        Dhcp            (c29a1c9b75ba38fa37f8c44405dec360) C:\WINDOWS\System32\dhcpcsvc.dll
20:57:58.0981 3484        Dhcp - ok
20:57:59.0041 3484        Disk            (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
20:57:59.0292 3484        Disk - ok
20:57:59.0302 3484        dmadmin - ok
20:57:59.0402 3484        dmboot          (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys
20:57:59.0662 3484        dmboot - ok
20:57:59.0712 3484        dmio            (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys
20:57:59.0953 3484        dmio - ok
20:57:59.0993 3484        dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
20:58:00.0233 3484        dmload - ok
20:58:00.0263 3484        dmserver        (25c83ffbba13b554eb6d59a9b2e2ee78) C:\WINDOWS\System32\dmserver.dll
20:58:00.0483 3484        dmserver - ok
20:58:00.0553 3484        DMusic          (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
20:58:00.0704 3484        DMusic - ok
20:58:00.0704 3484        Dnscache - ok
20:58:00.0754 3484        Dot3svc        (676e36c4ff5bcea1900f44182b9723e6) C:\WINDOWS\System32\dot3svc.dll
20:58:00.0894 3484        Dot3svc - ok
20:58:00.0904 3484        dpti2o - ok
20:58:00.0924 3484        drmkaud        (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
20:58:01.0054 3484        drmkaud - ok
20:58:01.0104 3484        EapHost        (4e4f2fddab0a0736d7671134dcce91fb) C:\WINDOWS\System32\eapsvc.dll
20:58:01.0254 3484        EapHost - ok
20:58:01.0274 3484        ERSvc          (877c18558d70587aa7823a1a308ac96b) C:\WINDOWS\System32\ersvc.dll
20:58:01.0435 3484        ERSvc - ok
20:58:01.0495 3484        Eventlog        (a3edbe9053889fb24ab22492472b39dc) C:\WINDOWS\system32\services.exe
20:58:01.0535 3484        Eventlog - ok
20:58:01.0625 3484        EventSystem    (af4f6b5739d18ca7972ab53e091cbc74) C:\WINDOWS\system32\es.dll
20:58:01.0685 3484        EventSystem - ok
20:58:01.0725 3484        Fastfat        (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
20:58:01.0885 3484        Fastfat - ok
20:58:01.0945 3484        FastUserSwitchingCompatibility (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
20:58:02.0005 3484        FastUserSwitchingCompatibility - ok
20:58:02.0046 3484        Fdc            (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
20:58:02.0196 3484        Fdc - ok
20:58:02.0216 3484        Fips            (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys
20:58:02.0416 3484        Fips - ok
20:58:02.0436 3484        Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
20:58:02.0576 3484        Flpydisk - ok
20:58:02.0616 3484        FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
20:58:02.0757 3484        FltMgr - ok
20:58:02.0877 3484        FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
20:58:02.0887 3484        FontCache3.0.0.0 - ok
20:58:02.0927 3484        Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
20:58:03.0127 3484        Fs_Rec - ok
20:58:03.0137 3484        Ftdisk          (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
20:58:03.0327 3484        Ftdisk - ok
20:58:03.0357 3484        Gpc            (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
20:58:03.0558 3484        Gpc - ok
20:58:03.0628 3484        helpsvc        (cb66bf85bf599befd6c6a57c2e20357f) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
20:58:03.0808 3484        helpsvc - ok
20:58:03.0858 3484        HidServ        (b35da85e60c0103f2e4104532da2f12b) C:\WINDOWS\System32\hidserv.dll
20:58:04.0048 3484        HidServ - ok
20:58:04.0068 3484        HidUsb          (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
20:58:04.0259 3484        HidUsb - ok
20:58:04.0299 3484        hkmsvc          (ed29f14101523a6e0e808107405d452c) C:\WINDOWS\System32\kmsvc.dll
20:58:04.0479 3484        hkmsvc - ok
20:58:04.0519 3484        Hotkey          (8b566ea71d5b76157a9cdb78f25a5731) C:\WINDOWS\system32\drivers\Hotkey.sys
20:58:04.0529 3484        Hotkey ( UnsignedFile.Multi.Generic ) - warning
20:58:04.0529 3484        Hotkey - detected UnsignedFile.Multi.Generic (1)
20:58:04.0539 3484        hpn - ok
20:58:04.0599 3484        HPZid412        (30ca91e657cede2f95359d6ef186f650) C:\WINDOWS\system32\DRIVERS\HPZid412.sys
20:58:04.0830 3484        HPZid412 - ok
20:58:04.0860 3484        HPZipr12        (efd31afa752aa7c7bbb57bcbe2b01c78) C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
20:58:04.0970 3484        HPZipr12 - ok
20:58:05.0000 3484        HPZius12        (7ac43c38ca8fd7ed0b0a4466f753e06e) C:\WINDOWS\system32\DRIVERS\HPZius12.sys
20:58:05.0060 3484        HPZius12 - ok
20:58:05.0130 3484        HTTP            (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
20:58:05.0200 3484        HTTP - ok
20:58:05.0250 3484        HTTPFilter      (9e4adb854cebcfb81a4b36718feecd16) C:\WINDOWS\System32\w3ssl.dll
20:58:05.0561 3484        HTTPFilter - ok
20:58:05.0571 3484        i2omgmt - ok
20:58:05.0581 3484        i2omp - ok
20:58:05.0631 3484        i8042prt        (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
20:58:05.0771 3484        i8042prt - ok
20:58:05.0861 3484        ialm            (84651cab3cad040df1614cd2df408741) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys
20:58:05.0991 3484        ialm - ok
20:58:06.0171 3484        idsvc          (c01ac32dc5c03076cfb852cb5da5229c) c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
20:58:06.0252 3484        idsvc - ok
20:58:06.0422 3484        Imapi          (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
20:58:06.0662 3484        Imapi - ok
20:58:06.0712 3484        ImapiService    (d4b413aa210c21e46aedd2ba5b68d38e) C:\WINDOWS\system32\imapi.exe
20:58:06.0983 3484        ImapiService - ok
20:58:06.0993 3484        ini910u - ok
20:58:07.0063 3484        IntelIde        (69c4e3c9e67a1f103b94e14fdd5f3213) C:\WINDOWS\system32\DRIVERS\intelide.sys
20:58:07.0193 3484        IntelIde - ok
20:58:07.0253 3484        intelppm        (4c7d2750158ed6e7ad642d97bffae351) C:\WINDOWS\system32\DRIVERS\intelppm.sys
20:58:07.0373 3484        intelppm - ok
20:58:07.0403 3484        Ip6Fw          (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
20:58:07.0523 3484        Ip6Fw - ok
20:58:07.0594 3484        IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
20:58:07.0734 3484        IpFilterDriver - ok
20:58:07.0744 3484        IpInIp          (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
20:58:07.0874 3484        IpInIp - ok
20:58:07.0914 3484        IpNat          (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
20:58:08.0074 3484        IpNat - ok
20:58:08.0134 3484        IPSec          (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
20:58:08.0274 3484        IPSec - ok
20:58:08.0295 3484        irda            (aca5e7b54409f9cb5eed97ed0c81120e) C:\WINDOWS\system32\DRIVERS\irda.sys
20:58:08.0365 3484        irda - ok
20:58:08.0415 3484        IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
20:58:08.0485 3484        IRENUM - ok
20:58:08.0515 3484        Irmon          (2efe1db1ec58a26b0c14bfda122e246f) C:\WINDOWS\System32\irmon.dll
20:58:08.0605 3484        Irmon - ok
20:58:08.0675 3484        isapnp          (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys
20:58:08.0835 3484        isapnp - ok
20:58:08.0996 3484        JavaQuickStarterService (9aa67569d5257462e230767510b0c815) C:\Programme\Java\jre6\bin\jqs.exe
20:58:09.0026 3484        JavaQuickStarterService - ok
20:58:09.0096 3484        Kbdclass        (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
20:58:09.0326 3484        Kbdclass - ok
20:58:09.0396 3484        kbdhid          (b6d6c117d771c98130497265f26d1882) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
20:58:09.0616 3484        kbdhid - ok
20:58:09.0677 3484        kmixer          (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
20:58:09.0907 3484        kmixer - ok
20:58:09.0967 3484        KSecDD          (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
20:58:10.0107 3484        KSecDD - ok
20:58:10.0167 3484        LanmanServer    (2bbdcb79900990f0716dfcb714e72de7) C:\WINDOWS\System32\srvsvc.dll
20:58:10.0237 3484        LanmanServer - ok
20:58:10.0247 3484        lbrtfdc - ok
20:58:10.0297 3484        libusb0        (86f4c6bb7e50e178df08e747ec5c18c3) C:\WINDOWS\system32\DRIVERS\libusb0.sys
20:58:10.0337 3484        libusb0 - ok
20:58:10.0388 3484        LmHosts        (636714b7d43c8d0c80449123fd266920) C:\WINDOWS\System32\lmhsvc.dll
20:58:10.0528 3484        LmHosts - ok
20:58:10.0598 3484        Messenger      (b7550a7107281d170ce85524b1488c98) C:\WINDOWS\System32\msgsvc.dll
20:58:10.0858 3484        Messenger - ok
20:58:10.0898 3484        mnmdd          (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
20:58:11.0079 3484        mnmdd - ok
20:58:11.0129 3484        mnmsrvc        (c2f1d365fd96791b037ee504868065d3) C:\WINDOWS\system32\mnmsrvc.exe
20:58:11.0349 3484        mnmsrvc - ok
20:58:11.0389 3484        Modem          (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys
20:58:11.0629 3484        Modem - ok
20:58:11.0649 3484        Mouclass        (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys
20:58:11.0880 3484        Mouclass - ok
20:58:11.0940 3484        mouhid          (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys
20:58:12.0160 3484        mouhid - ok
20:58:12.0190 3484        MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
20:58:12.0430 3484        MountMgr - ok
20:58:12.0501 3484        MozillaMaintenance (96aa8ba23142cc8e2b30f3cae0c80254) C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe
20:58:12.0531 3484        MozillaMaintenance - ok
20:58:12.0551 3484        mraid35x - ok
20:58:12.0591 3484        MRxDAV          (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
20:58:12.0821 3484        MRxDAV - ok
20:58:12.0901 3484        MRxSmb          (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
20:58:13.0021 3484        MRxSmb - ok
20:58:13.0081 3484        MSDTC          (35a031af38c55f92d28aa03ee9f12cc9) C:\WINDOWS\system32\msdtc.exe
20:58:13.0302 3484        MSDTC - ok
20:58:13.0352 3484        Msfs            (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
20:58:13.0612 3484        Msfs - ok
20:58:13.0622 3484        MSIServer - ok
20:58:13.0712 3484        MSKSSRV        (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
20:58:13.0873 3484        MSKSSRV - ok
20:58:13.0903 3484        MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
20:58:14.0023 3484        MSPCLOCK - ok
20:58:14.0043 3484        MSPQM          (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
20:58:14.0193 3484        MSPQM - ok
20:58:14.0233 3484        mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
20:58:14.0373 3484        mssmbios - ok
20:58:14.0433 3484        Mup            (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
20:58:14.0473 3484        Mup - ok
20:58:14.0594 3484        napagent        (46bb15ae2ac7d025d6d2567b876817bd) C:\WINDOWS\System32\qagentrt.dll
20:58:14.0754 3484        napagent - ok
20:58:14.0784 3484        NDIS            (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
20:58:14.0924 3484        NDIS - ok
20:58:14.0984 3484        NdisTapi        (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
20:58:15.0044 3484        NdisTapi - ok
20:58:15.0104 3484        Ndisuio        (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
20:58:15.0295 3484        Ndisuio - ok
20:58:15.0355 3484        NdisWan        (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
20:58:15.0545 3484        NdisWan - ok
20:58:15.0635 3484        NDProxy        (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
20:58:15.0695 3484        NDProxy - ok
20:58:15.0715 3484        NetBIOS        (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
20:58:15.0936 3484        NetBIOS - ok
20:58:15.0976 3484        NetBT          (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
20:58:16.0206 3484        NetBT - ok
20:58:16.0266 3484        NetDDE          (8ace4251bffd09ce75679fe940e996cc) C:\WINDOWS\system32\netdde.exe
20:58:16.0486 3484        NetDDE - ok
20:58:16.0526 3484        NetDDEdsdm      (8ace4251bffd09ce75679fe940e996cc) C:\WINDOWS\system32\netdde.exe
20:58:16.0747 3484        NetDDEdsdm - ok
20:58:16.0787 3484        Netlogon        (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
20:58:16.0917 3484        Netlogon - ok
20:58:16.0987 3484        Netman          (e6d88f1f6745bf00b57e7855a2ab696c) C:\WINDOWS\System32\netman.dll
20:58:17.0127 3484        Netman - ok
20:58:17.0257 3484        NetTcpPortSharing (d34612c5d02d026535b3095d620626ae) c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
20:58:17.0277 3484        NetTcpPortSharing - ok
20:58:17.0307 3484        NIC1394        (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
20:58:17.0468 3484        NIC1394 - ok
20:58:17.0548 3484        Nla            (f1b67b6b0751ae0e6e964b02821206a3) C:\WINDOWS\System32\mswsock.dll
20:58:17.0688 3484        Nla - ok
20:58:17.0718 3484        Npfs            (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
20:58:17.0888 3484        Npfs - ok
20:58:17.0938 3484        NSCIRDA        (2adc0ca9945c65284b3d19bc18765974) C:\WINDOWS\system32\DRIVERS\nscirda.sys
20:58:18.0029 3484        NSCIRDA - ok
20:58:18.0119 3484        Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
20:58:18.0429 3484        Ntfs - ok
20:58:18.0439 3484        NtLmSsp        (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
20:58:18.0659 3484        NtLmSsp - ok
20:58:18.0720 3484        NtmsSvc        (56af4064996fa5bac9c449b1514b4770) C:\WINDOWS\system32\ntmssvc.dll
20:58:19.0000 3484        NtmsSvc - ok
20:58:19.0060 3484        Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
20:58:19.0290 3484        Null - ok
20:58:19.0330 3484        NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
20:58:19.0561 3484        NwlnkFlt - ok
20:58:19.0591 3484        NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
20:58:19.0831 3484        NwlnkFwd - ok
20:58:19.0901 3484        ohci1394        (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
20:58:20.0112 3484        ohci1394 - ok
20:58:20.0172 3484        Parport        (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\DRIVERS\parport.sys
20:58:20.0382 3484        Parport - ok
20:58:20.0402 3484        PartMgr        (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
20:58:20.0602 3484        PartMgr - ok
20:58:20.0652 3484        ParVdm          (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys
20:58:20.0792 3484        ParVdm - ok
20:58:20.0853 3484        PCI            (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys
20:58:20.0983 3484        PCI - ok
20:58:20.0993 3484        PCIDump - ok
20:58:21.0003 3484        PCIIde          (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\DRIVERS\pciide.sys
20:58:21.0133 3484        PCIIde - ok
20:58:21.0213 3484        Pcmcia          (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\DRIVERS\pcmcia.sys
20:58:21.0343 3484        Pcmcia - ok
20:58:21.0353 3484        PDCOMP - ok
20:58:21.0363 3484        PDFRAME - ok
20:58:21.0373 3484        PDRELI - ok
20:58:21.0373 3484        PDRFRAME - ok
20:58:21.0383 3484        perc2 - ok
20:58:21.0393 3484        perc2hib - ok
20:58:21.0453 3484        PlugPlay        (a3edbe9053889fb24ab22492472b39dc) C:\WINDOWS\system32\services.exe
20:58:21.0473 3484        PlugPlay - ok
20:58:21.0534 3484        Pml Driver HPZ12 (d31f88c5f19eefa366a415d6bc5f2abc) C:\WINDOWS\system32\HPZipm12.exe
20:58:21.0534 3484        Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
20:58:21.0534 3484        Pml Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
20:58:21.0544 3484        PolicyAgent    (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
20:58:21.0684 3484        PolicyAgent - ok
20:58:21.0724 3484        PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
20:58:21.0894 3484        PptpMiniport - ok
20:58:21.0904 3484        ProtectedStorage (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
20:58:22.0064 3484        ProtectedStorage - ok
20:58:22.0094 3484        PSched          (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
20:58:22.0265 3484        PSched - ok
20:58:22.0315 3484        Ptilink        (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
20:58:22.0475 3484        Ptilink - ok
20:58:22.0475 3484        ql1080 - ok
20:58:22.0485 3484        Ql10wnt - ok
20:58:22.0495 3484        ql12160 - ok
20:58:22.0505 3484        ql1240 - ok
20:58:22.0515 3484        ql1280 - ok
20:58:22.0525 3484        RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
20:58:22.0665 3484        RasAcd - ok
20:58:22.0685 3484        RasAuto        (f5ba6caccdb66c8f048e867563203246) C:\WINDOWS\System32\rasauto.dll
20:58:22.0835 3484        RasAuto - ok
20:58:22.0885 3484        Rasirda        (0207d26ddf796a193ccd9f83047bb5fc) C:\WINDOWS\system32\DRIVERS\rasirda.sys
20:58:22.0946 3484        Rasirda - ok
20:58:22.0966 3484        Rasl2tp        (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
20:58:23.0126 3484        Rasl2tp - ok
20:58:23.0156 3484        RasMan          (f9a7b66ea345726edb5862a46b1eccd5) C:\WINDOWS\System32\rasmans.dll
20:58:23.0286 3484        RasMan - ok
20:58:23.0316 3484        RasPppoe        (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
20:58:23.0466 3484        RasPppoe - ok
20:58:23.0476 3484        Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
20:58:23.0607 3484        Raspti - ok
20:58:23.0677 3484        Rdbss          (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
20:58:23.0797 3484        Rdbss - ok
20:58:23.0797 3484        RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
20:58:23.0927 3484        RDPCDD - ok
20:58:23.0957 3484        rdpdr          (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
20:58:24.0097 3484        rdpdr - ok
20:58:24.0167 3484        RDPWD          (5b3055daa788bd688594d2f5981f2a83) C:\WINDOWS\system32\drivers\RDPWD.sys
20:58:24.0187 3484        RDPWD - ok
20:58:24.0237 3484        RDSessMgr      (263af18af0f3db99f574c95f284ccec9) C:\WINDOWS\system32\sessmgr.exe
20:58:24.0378 3484        RDSessMgr - ok
20:58:24.0438 3484        redbook        (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys
20:58:24.0578 3484        redbook - ok
20:58:24.0648 3484        RemoteAccess    (0e97ec96d6942ceec2d188cc2eb69a01) C:\WINDOWS\System32\mprdim.dll
20:58:24.0828 3484        RemoteAccess - ok
20:58:24.0878 3484        RemoteRegistry  (e4cd1f3d84e1c2ca0b8cf7501e201593) C:\WINDOWS\system32\regsvc.dll
20:58:25.0049 3484        RemoteRegistry - ok
20:58:25.0099 3484        RpcLocator      (2a02e21867497df20b8fc95631395169) C:\WINDOWS\system32\locator.exe
20:58:25.0299 3484        RpcLocator - ok
20:58:25.0379 3484        RpcSs          (3127afbf2c1ed0ab14a1bbb7aaecb85b) C:\WINDOWS\System32\rpcss.dll
20:58:25.0479 3484        RpcSs - ok
20:58:25.0559 3484        RSVP            (4bdd71b4b521521499dfd14735c4f398) C:\WINDOWS\system32\rsvp.exe
20:58:25.0740 3484        RSVP - ok
20:58:25.0750 3484        s24trans - ok
20:58:25.0790 3484        SamSs          (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
20:58:25.0970 3484        SamSs - ok
20:58:26.0030 3484        SCardSvr        (dcec079fad95d36c8dd5cb6d779dfe32) C:\WINDOWS\System32\SCardSvr.exe
20:58:26.0260 3484        SCardSvr - ok
20:58:26.0320 3484        Schedule        (a050194a44d7fa8d7186ed2f4e8367ae) C:\WINDOWS\system32\schedsvc.dll
20:58:26.0561 3484        Schedule - ok
20:58:26.0631 3484        SE27bus        (59a9eb4073a39895af314780d0a032fa) C:\WINDOWS\system32\DRIVERS\SE27bus.sys
20:58:26.0641 3484        SE27bus ( UnsignedFile.Multi.Generic ) - warning
20:58:26.0641 3484        SE27bus - detected UnsignedFile.Multi.Generic (1)
20:58:26.0681 3484        SE27mdfl        (d53e7e53107d1796825540129f8fe89f) C:\WINDOWS\system32\DRIVERS\SE27mdfl.sys
20:58:26.0721 3484        SE27mdfl ( UnsignedFile.Multi.Generic ) - warning
20:58:26.0721 3484        SE27mdfl - detected UnsignedFile.Multi.Generic (1)
20:58:26.0751 3484        SE27mdm        (2afa2f65a6e91da5b5070e734769827e) C:\WINDOWS\system32\DRIVERS\SE27mdm.sys
20:58:26.0801 3484        SE27mdm ( UnsignedFile.Multi.Generic ) - warning
20:58:26.0801 3484        SE27mdm - detected UnsignedFile.Multi.Generic (1)
20:58:26.0841 3484        SE27mgmt        (5a33a8d7b44c7bd8abe248b4dcd1ff3c) C:\WINDOWS\system32\DRIVERS\SE27mgmt.sys
20:58:26.0851 3484        SE27mgmt ( UnsignedFile.Multi.Generic ) - warning
20:58:26.0851 3484        SE27mgmt - detected UnsignedFile.Multi.Generic (1)
20:58:26.0891 3484        Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
20:58:26.0991 3484        Secdrv - ok
20:58:27.0051 3484        seclogon        (bee4cfd1d48c23b44cf4b974b0b79b2b) C:\WINDOWS\System32\seclogon.dll
20:58:27.0362 3484        seclogon - ok
20:58:27.0392 3484        SENS            (2aac9b6ed9eddffb721d6452e34d67e3) C:\WINDOWS\system32\sens.dll
20:58:27.0532 3484        SENS - ok
20:58:27.0592 3484        Serenum        (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
20:58:27.0742 3484        Serenum - ok
20:58:27.0773 3484        Serial          (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\drivers\Serial.sys
20:58:27.0903 3484        Serial - ok
20:58:27.0973 3484        Sfloppy        (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
20:58:28.0113 3484        Sfloppy - ok
20:58:28.0183 3484        SharedAccess    (cad058d5f8b889a87ca3eb3cf624dcef) C:\WINDOWS\System32\ipnathlp.dll
20:58:28.0383 3484        SharedAccess - ok
20:58:28.0443 3484        ShellHWDetection (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
20:58:28.0464 3484        ShellHWDetection - ok
20:58:28.0474 3484        Simbad - ok
20:58:28.0494 3484        Sparrow - ok
20:58:28.0544 3484        splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
20:58:28.0724 3484        splitter - ok
20:58:28.0774 3484        Spooler        (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe
20:58:28.0814 3484        Spooler - ok
20:58:28.0864 3484        sr              (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys
20:58:28.0954 3484        sr - ok
20:58:28.0984 3484        srservice      (fe77a85495065f3ad59c5c65b6c54182) C:\WINDOWS\system32\srsvc.dll
20:58:29.0074 3484        srservice - ok
20:58:29.0144 3484        Srv            (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
20:58:29.0245 3484        Srv - ok
20:58:29.0295 3484        SSDPSRV        (4df5b05dfaec29e13e1ed6f6ee12c500) C:\WINDOWS\System32\ssdpsrv.dll
20:58:29.0385 3484        SSDPSRV - ok
20:58:29.0455 3484        stisvc          (bc2c5985611c5356b24aeb370953ded9) C:\WINDOWS\system32\wiaservc.dll
20:58:29.0765 3484        stisvc - ok
20:58:29.0805 3484        swenum          (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
20:58:29.0946 3484        swenum - ok
20:58:30.0006 3484        swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
20:58:30.0146 3484        swmidi - ok
20:58:30.0146 3484        SwPrv - ok
20:58:30.0156 3484        symc810 - ok
20:58:30.0166 3484        symc8xx - ok
20:58:30.0176 3484        sym_hi - ok
20:58:30.0186 3484        sym_u3 - ok
20:58:30.0206 3484        sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
20:58:30.0326 3484        sysaudio - ok
20:58:30.0346 3484        SysmonLog      (2903fffa2523926d6219428040dce6b9) C:\WINDOWS\system32\smlogsvc.exe
20:58:30.0496 3484        SysmonLog - ok
20:58:30.0526 3484        TapiSrv        (05903cac4b98908d55ea5774775b382e) C:\WINDOWS\System32\tapisrv.dll
20:58:30.0677 3484        TapiSrv - ok
20:58:30.0737 3484        Tcpip          (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
20:58:30.0767 3484        Tcpip - ok
20:58:30.0817 3484        TDPIPE          (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
20:58:30.0947 3484        TDPIPE - ok
20:58:30.0967 3484        TDTCP          (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
20:58:31.0117 3484        TDTCP - ok
20:58:31.0177 3484        TermDD          (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
20:58:31.0348 3484        TermDD - ok
20:58:31.0448 3484        TermService    (b7de02c863d8f5a005a7bf375375a6a4) C:\WINDOWS\System32\termsrv.dll
20:58:31.0628 3484        TermService - ok
20:58:31.0678 3484        Themes          (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
20:58:31.0698 3484        Themes - ok
20:58:31.0748 3484        TlntSvr        (03681a1ce77f51586903869a5ab1deab) C:\WINDOWS\system32\tlntsvr.exe
20:58:31.0828 3484        TlntSvr - ok
20:58:31.0838 3484        TosIde - ok
20:58:31.0888 3484        TrkWks          (626504572b175867f30f3215c04b3e2f) C:\WINDOWS\system32\trkwks.dll
20:58:32.0089 3484        TrkWks - ok
20:58:32.0139 3484        TwkMs          (8c7d0928b76dc2b8235995a01ce33037) C:\WINDOWS\system32\drivers\TwkMs.sys
20:58:32.0159 3484        TwkMs ( UnsignedFile.Multi.Generic ) - warning
20:58:32.0159 3484        TwkMs - detected UnsignedFile.Multi.Generic (1)
20:58:32.0209 3484        TWKSER2K        (be910aceab65fa3ae67ae98b19fcac4b) C:\WINDOWS\system32\DRIVERS\TWKSER2K.sys
20:58:32.0239 3484        TWKSER2K ( UnsignedFile.Multi.Generic ) - warning
20:58:32.0239 3484        TWKSER2K - detected UnsignedFile.Multi.Generic (1)
20:58:32.0269 3484        Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
20:58:32.0479 3484        Udfs - ok
20:58:32.0479 3484        ultra - ok
20:58:32.0860 3484        Update          (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
20:58:33.0160 3484        Update - ok
20:58:33.0230 3484        Update-Service  (91263b03ef2e1c42a563adb4c9a62e22) C:\WINDOWS\System32\UpdSvc.dll
20:58:33.0270 3484        Update-Service - ok
20:58:33.0331 3484        upnphost        (1dfd8975d8c89214b98d9387c1125b49) C:\WINDOWS\System32\upnphost.dll
20:58:33.0511 3484        upnphost - ok
20:58:33.0551 3484        UPS            (9b11e6118958e63e1fef129466e2bda7) C:\WINDOWS\System32\ups.exe
20:58:33.0681 3484        UPS - ok
20:58:33.0711 3484        usb2vcom        (76a5050be71eeb611e8c2c9642ca2b0f) C:\WINDOWS\system32\DRIVERS\usb2vcom.sys
20:58:33.0711 3484        usb2vcom ( UnsignedFile.Multi.Generic ) - warning
20:58:33.0711 3484        usb2vcom - detected UnsignedFile.Multi.Generic (1)
20:58:33.0771 3484        usbccgp        (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
20:58:33.0901 3484        usbccgp - ok
20:58:33.0971 3484        USBCCID        (baf8295318980e8528825082dfed85d6) C:\WINDOWS\system32\DRIVERS\Rts5161ccid.sys
20:58:34.0011 3484        USBCCID - ok
20:58:34.0062 3484        usbehci        (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
20:58:34.0202 3484        usbehci - ok
20:58:34.0232 3484        usbhub          (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
20:58:34.0402 3484        usbhub - ok
20:58:34.0432 3484        usbprint        (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
20:58:34.0602 3484        usbprint - ok
20:58:34.0652 3484        usbscan        (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
20:58:34.0803 3484        usbscan - ok
20:58:34.0853 3484        USBSTOR        (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
20:58:35.0023 3484        USBSTOR - ok
20:58:35.0053 3484        usbuhci        (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
20:58:35.0203 3484        usbuhci - ok
20:58:35.0233 3484        VgaSave        (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
20:58:35.0383 3484        VgaSave - ok
20:58:35.0393 3484        ViaIde - ok
20:58:35.0424 3484        VolSnap        (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys
20:58:35.0574 3484        VolSnap - ok
20:58:35.0814 3484        VSS            (68f106273be29e7b7ef8266977268e78) C:\WINDOWS\System32\vssvc.exe
20:58:35.0894 3484        VSS - ok
20:58:36.0044 3484        w22n51          (4c009d4352849d79bf347846b6e03bfd) C:\WINDOWS\system32\DRIVERS\w22n51.sys
20:58:36.0245 3484        w22n51 - ok
20:58:36.0445 3484        W32Time        (7b353059e665f8b7ad2bbeaef597cf45) C:\WINDOWS\system32\w32time.dll
20:58:36.0765 3484        W32Time - ok
20:58:36.0836 3484        Wanarp          (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
20:58:36.0966 3484        Wanarp - ok
20:58:37.0026 3484        WBMS            (712e3a81069e30158a4df4f5daf29dd6) C:\WINDOWS\system32\Drivers\WBMS.SYS
20:58:37.0056 3484        WBMS - ok
20:58:37.0086 3484        WBSD            (b0892439d499fd39b02e772ede714027) C:\WINDOWS\system32\Drivers\WBSD.SYS
20:58:37.0136 3484        WBSD - ok
20:58:37.0146 3484        Wbutton - ok
20:58:37.0196 3484        wceusbsh        (46a247f6617526afe38b6f12f5512120) C:\WINDOWS\system32\DRIVERS\wceusbsh.sys
20:58:37.0276 3484        wceusbsh - ok
20:58:37.0286 3484        WDICA - ok
20:58:37.0316 3484        wdmaud          (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
20:58:37.0547 3484        wdmaud - ok
20:58:37.0747 3484        WebClient      (81727c9873e3905a2ffc1ebd07265002) C:\WINDOWS\System32\webclnt.dll
20:58:37.0897 3484        WebClient - ok
20:58:38.0027 3484        winmgmt        (6f3f3973d97714cc5f906a19fe883729) C:\WINDOWS\system32\wbem\WMIsvc.dll
20:58:38.0167 3484        winmgmt - ok
20:58:38.0218 3484        WmdmPmSN        (6e18978b749f0696a774de3f2cb142dd) C:\WINDOWS\system32\mspmsnsv.dll
20:58:38.0398 3484        WmdmPmSN - ok
20:58:38.0478 3484        Wmi            (ffa4d901d46d07a5bab2d8307fbb51a6) C:\WINDOWS\System32\advapi32.dll
20:58:38.0538 3484        Wmi - ok
20:58:38.0598 3484        WmiApSrv        (93908111ba57a6e60ec2fa2de202105c) C:\WINDOWS\system32\wbem\wmiapsrv.exe
20:58:38.0808 3484        WmiApSrv - ok
20:58:38.0858 3484        wscsvc          (300b3e84faf1a5c1f791c159ba28035d) C:\WINDOWS\system32\wscsvc.dll
20:58:39.0129 3484        wscsvc - ok
20:58:39.0189 3484        wuauserv        (7b4fe05202aa6bf9f4dfd0e6a0d8a085) C:\WINDOWS\system32\wuauserv.dll
20:58:39.0339 3484        wuauserv - ok
20:58:39.0409 3484        WZCSVC          (c4f109c005f6725162d2d12ca751e4a7) C:\WINDOWS\System32\wzcsvc.dll
20:58:39.0610 3484        WZCSVC - ok
20:58:39.0650 3484        xmlprov        (0ada34871a2e1cd2caafed1237a47750) C:\WINDOWS\System32\xmlprov.dll
20:58:39.0850 3484        xmlprov - ok
20:58:39.0890 3484        MBR (0x1B8)    (72b8ce41af0de751c946802b3ed844b4) \Device\Harddisk0\DR0
20:58:40.0581 3484        \Device\Harddisk0\DR0 - ok
20:58:40.0591 3484        Boot (0x1200)  (11bb28619ecfa1286ba29737821ce7bd) \Device\Harddisk0\DR0\Partition0
20:58:40.0591 3484        \Device\Harddisk0\DR0\Partition0 - ok
20:58:40.0601 3484        ============================================================
20:58:40.0601 3484        Scan finished
20:58:40.0601 3484        ============================================================
20:58:40.0731 3440        Detected object count: 11
20:58:40.0731 3440        Actual detected object count: 11
20:59:27.0929 3440        bizVSerial ( UnsignedFile.Multi.Generic ) - skipped by user
20:59:27.0929 3440        bizVSerial ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:59:27.0939 3440        CHIPDRIVE USB SmartCardReader ( UnsignedFile.Multi.Generic ) - skipped by user
20:59:27.0939 3440        CHIPDRIVE USB SmartCardReader ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:59:27.0939 3440        Hotkey ( UnsignedFile.Multi.Generic ) - skipped by user
20:59:27.0939 3440        Hotkey ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:59:27.0939 3440        Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
20:59:27.0939 3440        Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:59:27.0939 3440        SE27bus ( UnsignedFile.Multi.Generic ) - skipped by user
20:59:27.0949 3440        SE27bus ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:59:27.0949 3440        SE27mdfl ( UnsignedFile.Multi.Generic ) - skipped by user
20:59:27.0949 3440        SE27mdfl ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:59:27.0949 3440        SE27mdm ( UnsignedFile.Multi.Generic ) - skipped by user
20:59:27.0949 3440        SE27mdm ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:59:27.0949 3440        SE27mgmt ( UnsignedFile.Multi.Generic ) - skipped by user
20:59:27.0949 3440        SE27mgmt ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:59:27.0949 3440        TwkMs ( UnsignedFile.Multi.Generic ) - skipped by user
20:59:27.0949 3440        TwkMs ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:59:27.0949 3440        TWKSER2K ( UnsignedFile.Multi.Generic ) - skipped by user
20:59:27.0949 3440        TWKSER2K ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:59:27.0959 3440        usb2vcom ( UnsignedFile.Multi.Generic ) - skipped by user
20:59:27.0959 3440        usb2vcom ( UnsignedFile.Multi.Generic ) - User select action: Skip
Ist ja erschreckend! Wie jetzt weiter?

Vielen Dank und viele Grüße
Ulrike

cosinus 07.06.2012 21:26
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

28missi 08.06.2012 20:24
Hallo Arne

hier das Logfile von Combofix

Code:
ComboFix 12-06-07.04 - test 08.06.2012  6:58.2.1 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.49.1031.18.1270.924 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\test\Desktop\ComboFix.exe
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-05-08 bis 2012-06-08  ))))))))))))))))))))))))))))))
.
.
2012-06-06 19:01 . 2012-06-06 19:01        --------        d-----w-        C:\_OTL
2012-06-04 17:23 . 2012-06-04 17:23        --------        d-----w-        c:\programme\ESET
2012-06-04 14:17 . 2012-06-04 14:17        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2012-05-21 18:34 . 2012-05-21 18:34        --------        d-----w-        c:\dokumente und einstellungen\test\Downloads
2012-05-09 11:58 . 2012-05-09 11:58        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Kaspersky SDK
2012-05-09 11:20 . 2012-06-04 11:25        --------        d--h--w-        c:\windows\$hf_mig$
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-31 13:22 . 2008-04-14 12:00        604160        ----a-w-        c:\windows\system32\crypt32.dll
2012-05-06 13:42 . 2012-04-05 07:34        419488        ----a-w-        c:\windows\system32\FlashPlayerApp.exe
2012-05-06 13:42 . 2011-05-24 12:15        70304        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2012-04-11 13:51 . 2008-04-14 07:30        2071424        ----a-w-        c:\windows\system32\ntkrnlpa.exe
2012-04-11 13:51 . 2008-04-14 12:00        1862400        ----a-w-        c:\windows\system32\win32k.sys
2012-04-11 13:51 . 2008-04-14 12:00        2194944        ----a-w-        c:\windows\system32\ntoskrnl.exe
2012-01-23 09:49 . 2012-01-23 09:35        39401336        ----a-w-        c:\programme\QuickTimeInstaller.exe
2011-12-07 12:58 . 2011-12-07 12:58        541544        ----a-w-        c:\programme\7z920.exe
2010-04-11 20:36 . 2010-04-11 19:43        152882016        ----a-w-        c:\programme\OOo_3.2.0_Win32Intel_install_de.exe
2010-02-05 08:27 . 2010-02-05 08:27        918816        ----a-w-        c:\programme\jxpiinstall(2).exe
2010-02-05 08:25 . 2010-02-05 08:25        918816        ----a-w-        c:\programme\jxpiinstall.exe
2009-04-27 13:50 . 2009-04-27 13:47        7456256        ----a-w-        c:\programme\irfanview_plugins_422_setup.exe
2009-04-27 13:45 . 2009-04-25 12:35        1345024        ----a-w-        c:\programme\iview423_setup.exe
2009-04-25 12:34 . 2009-04-25 12:27        17194560        ----a-w-        c:\programme\cibpdfbrewer.exe
2012-04-21 01:18 . 2011-10-25 12:19        97208        ----a-w-        c:\programme\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((  SnapShot@2012-01-02_18.29.35  )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-06-08 04:45 . 2012-06-08 04:45        16384              c:\windows\Temp\Perflib_Perfdata_7e4.dat
+ 2011-10-29 10:58 . 2007-05-31 07:38        27648              c:\windows\system32\win32com.dll
- 2011-10-29 10:58 . 2007-05-31 05:38        27648              c:\windows\system32\win32com.dll
+ 2009-04-17 16:12 . 2009-01-07 17:20        26144              c:\windows\system32\spupdsvc.exe
+ 2009-04-17 16:12 . 2009-01-07 17:20        18464              c:\windows\system32\spmsg.dll
+ 2012-01-23 09:01 . 2010-11-27 08:11        28144              c:\windows\system32\ReinstallBackups\0013\DriverFiles\cjusbW6X86.sys
+ 2008-04-14 12:00 . 2009-03-08 03:31        46592              c:\windows\system32\pngfilt.dll
+ 2008-04-14 12:00 . 2012-05-09 17:37        68094              c:\windows\system32\perfc009.dat
- 2008-04-14 12:00 . 2011-11-08 20:08        68094              c:\windows\system32\perfc009.dat
+ 2008-04-14 12:00 . 2012-05-09 17:37        92732              c:\windows\system32\perfc007.dat
+ 2008-04-14 12:00 . 2011-11-20 06:12        61952              c:\windows\system32\packager.exe
- 2011-10-29 10:58 . 2007-05-31 05:38        41472              c:\windows\system32\ocfpcsc1.dll
+ 2011-10-29 10:58 . 2007-05-31 07:38        41472              c:\windows\system32\ocfpcsc1.dll
- 2006-06-29 06:05 . 2006-06-29 06:05        23552              c:\windows\system32\normaliz.dll
+ 2006-06-29 06:05 . 2009-01-07 17:20        23552              c:\windows\system32\normaliz.dll
+ 2006-06-28 15:59 . 2009-01-07 17:20        24576              c:\windows\system32\nlsdl.dll
- 2006-06-28 15:59 . 2006-06-28 15:59        24576              c:\windows\system32\nlsdl.dll
+ 2008-04-14 12:00 . 2009-03-08 03:31        48128              c:\windows\system32\mshtmler.dll
- 2008-04-14 12:00 . 2007-08-13 16:01        48128              c:\windows\system32\mshtmler.dll
+ 2008-04-14 12:00 . 2012-03-01 11:00        66560              c:\windows\system32\mshtmled.dll
- 2008-04-14 12:00 . 2007-08-13 16:32        45568              c:\windows\system32\mshta.exe
+ 2008-04-14 12:00 . 2009-03-08 03:31        45568              c:\windows\system32\mshta.exe
+ 2007-08-13 16:36 . 2009-03-08 03:31        13312              c:\windows\system32\msfeedssync.exe
+ 2007-08-13 16:54 . 2012-03-01 11:00        55296              c:\windows\system32\msfeedsbs.dll
+ 2008-04-14 12:00 . 2011-10-14 14:47        23040              c:\windows\system32\mciseq.dll
- 2008-04-14 12:00 . 2008-04-14 12:00        23040              c:\windows\system32\mciseq.dll
+ 2012-02-21 13:46 . 2012-02-21 13:46        98304              c:\windows\system32\Macromed\Shockwave 10\SwOnce.dll
- 2011-11-22 15:50 . 2011-11-22 15:50        98304              c:\windows\system32\Macromed\Shockwave 10\SwOnce.dll
- 2011-11-22 15:50 . 2011-11-22 15:50        86016              c:\windows\system32\Macromed\Shockwave 10\SwMenuX.dll
+ 2012-02-21 13:46 . 2012-02-21 13:46        86016              c:\windows\system32\Macromed\Shockwave 10\SwMenuX.dll
+ 2012-02-21 13:46 . 2012-02-21 13:46        77824              c:\windows\system32\Macromed\Shockwave 10\SwInit.exe
- 2011-11-22 15:50 . 2011-11-22 15:50        77824              c:\windows\system32\Macromed\Shockwave 10\SwInit.exe
+ 2012-02-21 13:46 . 2012-02-21 13:46        73408              c:\windows\system32\Macromed\Shockwave 10\gtapi.dll
- 2011-12-25 11:03 . 2011-12-25 11:03        60344              c:\windows\system32\Macromed\Shockwave 10\gt.exe
+ 2012-02-21 13:46 . 2012-04-24 15:03        60344              c:\windows\system32\Macromed\Shockwave 10\gt.exe
- 2011-11-22 15:50 . 2011-11-22 15:50        64512              c:\windows\system32\Macromed\Shockwave 10\gcapi_dll.dll
+ 2012-02-21 13:46 . 2012-02-21 13:46        64512              c:\windows\system32\Macromed\Shockwave 10\gcapi_dll.dll
- 2011-11-22 15:50 . 2011-11-22 15:50        24576              c:\windows\system32\Macromed\Shockwave 10\DynaPlayer.dll
+ 2012-02-21 13:46 . 2012-02-21 13:46        24576              c:\windows\system32\Macromed\Shockwave 10\DynaPlayer.dll
+ 2008-04-14 12:00 . 2012-03-01 11:00        43520              c:\windows\system32\licmgr10.dll
+ 2008-04-14 12:00 . 2012-03-01 11:00        25600              c:\windows\system32\jsproxy.dll
+ 2008-04-14 12:00 . 2009-03-08 03:32        94720              c:\windows\system32\inseng.dll
+ 2008-04-14 12:00 . 2009-03-08 03:31        34816              c:\windows\system32\imgutil.dll
+ 2007-08-13 16:39 . 2009-03-08 03:32        36864              c:\windows\system32\ieudinit.exe
+ 2008-04-14 12:00 . 2009-03-08 03:32        71680              c:\windows\system32\iesetup.dll
+ 2008-04-14 12:00 . 2009-03-08 03:32        55808              c:\windows\system32\iernonce.dll
+ 2006-06-29 06:05 . 2009-01-07 17:20        26112              c:\windows\system32\idndl.dll
- 2006-06-29 06:05 . 2006-06-29 06:05        26112              c:\windows\system32\idndl.dll
+ 2007-08-13 16:36 . 2009-03-08 03:31        59904              c:\windows\system32\icardie.dll
+ 2012-01-23 09:01 . 2011-03-29 11:08        28144              c:\windows\system32\DRVSTORE\cjusbw6_4700D9DF22037BF2BDFF3EA7D5E1B6832F30954B\cjusbW6X86.sys
+ 2012-01-23 09:01 . 2011-03-29 10:50        34672              c:\windows\system32\DRVSTORE\cjusbw6_4700D9DF22037BF2BDFF3EA7D5E1B6832F30954B\cjusbW6X64.sys
- 2011-10-29 10:58 . 2010-11-27 08:11        28144              c:\windows\system32\drivers\cjusb.sys
+ 2011-10-29 10:58 . 2011-03-29 11:08        28144              c:\windows\system32\drivers\cjusb.sys
- 2011-10-29 10:58 . 2007-05-31 05:38        14949              c:\windows\system32\drivers\bizVSerialNT.sys
+ 2011-10-29 10:58 . 2007-05-31 07:38        14949              c:\windows\system32\drivers\bizVSerialNT.sys
+ 2012-01-20 14:26 . 2012-03-01 11:00        12800              c:\windows\system32\dllcache\xpshims.dll
+ 2008-04-14 12:00 . 2009-03-08 03:31        46592              c:\windows\system32\dllcache\pngfilt.dll
+ 2008-04-14 12:00 . 2011-11-20 06:12        61952              c:\windows\system32\dllcache\packager.exe
- 2008-04-14 12:00 . 2007-08-13 16:01        48128              c:\windows\system32\dllcache\mshtmler.dll
+ 2008-04-14 12:00 . 2009-03-08 03:31        48128              c:\windows\system32\dllcache\mshtmler.dll
+ 2008-04-14 12:00 . 2012-03-01 11:00        66560              c:\windows\system32\dllcache\mshtmled.dll
- 2008-04-14 12:00 . 2007-08-13 16:32        45568              c:\windows\system32\dllcache\mshta.exe
+ 2008-04-14 12:00 . 2009-03-08 03:31        45568              c:\windows\system32\dllcache\mshta.exe
+ 2009-02-20 16:49 . 2012-03-01 11:00        55296              c:\windows\system32\dllcache\msfeedsbs.dll
- 2008-04-14 12:00 . 2008-04-14 12:00        23040              c:\windows\system32\dllcache\mciseq.dll
+ 2008-04-14 12:00 . 2011-10-14 14:47        23040              c:\windows\system32\dllcache\mciseq.dll
+ 2008-04-14 12:00 . 2012-03-01 11:00        43520              c:\windows\system32\dllcache\licmgr10.dll
+ 2008-04-14 12:00 . 2012-03-01 11:00        25600              c:\windows\system32\dllcache\jsproxy.dll
+ 2008-04-14 12:00 . 2009-03-08 03:32        94720              c:\windows\system32\dllcache\inseng.dll
+ 2008-04-14 12:00 . 2009-03-08 03:31        34816              c:\windows\system32\dllcache\imgutil.dll
+ 2008-04-14 12:00 . 2009-03-08 03:32        71680              c:\windows\system32\dllcache\iesetup.dll
+ 2008-04-14 12:00 . 2009-03-08 03:32        55808              c:\windows\system32\dllcache\iernonce.dll
+ 2009-02-20 16:49 . 2009-03-08 03:31        59904              c:\windows\system32\dllcache\icardie.dll
+ 2009-04-17 14:04 . 2009-03-08 03:24        68608              c:\windows\system32\dllcache\hmmapi.dll
+ 2008-04-14 12:00 . 2009-03-08 03:33        18944              c:\windows\system32\dllcache\corpol.dll
+ 2008-04-14 12:00 . 2009-03-08 03:32        72704              c:\windows\system32\dllcache\admparse.dll
+ 2008-04-14 12:00 . 2009-03-08 03:33        18944              c:\windows\system32\corpol.dll
+ 2011-10-29 10:58 . 2007-05-31 07:38        53248              c:\windows\system32\cjtrm.dll
- 2011-10-29 10:58 . 2007-05-31 05:38        53248              c:\windows\system32\cjtrm.dll
+ 2011-10-29 10:58 . 2011-07-22 07:49        63408              c:\windows\system32\cjpcscli.exe
+ 2011-10-29 10:58 . 2011-07-22 07:49        53680              c:\windows\system32\cjKbBase.dll
+ 2010-05-22 12:55 . 2012-02-18 17:40        87942              c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
+ 2012-02-02 13:49 . 2012-02-02 13:49        86016              c:\windows\system32\Adobe\Shockwave 11\SwMenu.dll
+ 2012-02-02 13:32 . 2012-02-02 13:32        73408              c:\windows\system32\Adobe\Shockwave 11\gtapi.dll
+ 2012-02-02 13:32 . 2012-02-02 13:32        64512              c:\windows\system32\Adobe\Shockwave 11\gcapi_dll.dll
+ 2012-02-02 13:50 . 2012-02-02 13:50        12800              c:\windows\system32\Adobe\Shockwave 11\DynaPlayer.dll
+ 2008-04-14 12:00 . 2009-03-08 03:32        72704              c:\windows\system32\admparse.dll
+ 2011-12-25 02:49 . 2011-12-25 02:49        31504              c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe
+ 2012-05-09 11:49 . 2012-05-09 11:49        62464              c:\windows\Installer\90b1f.msi
+ 2012-01-05 15:58 . 2012-01-05 15:58        10134              c:\windows\Installer\{612C34C7-5E90-47D8-9B5C-0F717DD82726}\ARPPRODUCTICON.exe
+ 2011-06-06 11:55 . 2011-06-06 11:55        17304              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010\10.1.0\ViewerPS.dll
+ 2011-06-06 11:55 . 2011-06-06 11:55        35736              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010\10.1.0\reader_sl.exe
+ 2011-06-06 11:55 . 2011-06-06 11:55        88992              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010\10.1.0\PDFPrevHndlr.dll
+ 2011-06-06 11:55 . 2011-06-06 11:55        94608              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010\10.1.0\eula.exe
+ 2011-06-06 11:55 . 2011-06-06 11:55        49064              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010\10.1.0\acrotextextractor.exe
+ 2011-06-06 11:55 . 2011-06-06 11:55        17824              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010\10.1.0\AcroRd32Info.exe
+ 2011-06-06 11:55 . 2011-06-06 11:55        63912              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010\10.1.0\acroiehelpershim.dll
+ 2011-06-06 11:55 . 2011-06-06 11:55        64928              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010\10.1.0\AcroIEHelper.dll
+ 2011-06-06 11:55 . 2011-06-06 11:55        63384              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010\10.1.0\Acrofx32.dll
+ 2012-01-20 14:42 . 2009-03-08 03:33        12288              c:\windows\ie8updates\KB982381-IE8\xpshims.dll
+ 2012-01-20 14:42 . 2009-03-08 03:31        55296              c:\windows\ie8updates\KB982381-IE8\msfeedsbs.dll
+ 2012-01-20 14:42 . 2009-03-08 03:33        25600              c:\windows\ie8updates\KB982381-IE8\jsproxy.dll
+ 2012-04-12 13:43 . 2011-12-17 19:43        12800              c:\windows\ie8updates\KB2675157-IE8\xpshims.dll
+ 2012-04-12 13:43 . 2011-12-17 19:43        66560              c:\windows\ie8updates\KB2675157-IE8\mshtmled.dll
+ 2012-04-12 13:43 . 2011-12-17 19:43        55296              c:\windows\ie8updates\KB2675157-IE8\msfeedsbs.dll
+ 2012-04-12 13:43 . 2011-12-17 19:43        43520              c:\windows\ie8updates\KB2675157-IE8\licmgr10.dll
+ 2012-04-12 13:43 . 2011-12-17 19:43        25600              c:\windows\ie8updates\KB2675157-IE8\jsproxy.dll
+ 2012-02-15 13:08 . 2011-11-04 19:13        12800              c:\windows\ie8updates\KB2647516-IE8\xpshims.dll
+ 2012-02-15 13:08 . 2011-11-04 19:13        66560              c:\windows\ie8updates\KB2647516-IE8\mshtmled.dll
+ 2012-02-15 13:08 . 2011-11-04 19:13        55296              c:\windows\ie8updates\KB2647516-IE8\msfeedsbs.dll
+ 2012-02-15 13:08 . 2011-11-04 19:13        43520              c:\windows\ie8updates\KB2647516-IE8\licmgr10.dll
+ 2012-02-15 13:08 . 2011-11-04 19:13        25600              c:\windows\ie8updates\KB2647516-IE8\jsproxy.dll
+ 2012-01-20 14:43 . 2010-05-06 10:31        12800              c:\windows\ie8updates\KB2618444-IE8\xpshims.dll
+ 2012-01-20 14:43 . 2009-03-08 03:31        66560              c:\windows\ie8updates\KB2618444-IE8\mshtmled.dll
+ 2012-01-20 14:43 . 2010-05-06 10:31        55296              c:\windows\ie8updates\KB2618444-IE8\msfeedsbs.dll
+ 2012-01-20 14:43 . 2009-03-08 03:34        43008              c:\windows\ie8updates\KB2618444-IE8\licmgr10.dll
+ 2012-01-20 14:43 . 2010-05-06 10:31        25600              c:\windows\ie8updates\KB2618444-IE8\jsproxy.dll
+ 2012-01-20 14:35 . 2009-03-08 18:18        58464              c:\windows\ie8\spuninst\iecustom.dll
+ 2012-01-20 14:32 . 2011-10-31 23:36        44544              c:\windows\ie8\pngfilt.dll
+ 2012-01-20 14:32 . 2007-08-13 16:01        48128              c:\windows\ie8\mshtmler.dll
+ 2012-01-20 14:32 . 2007-08-13 16:32        45568              c:\windows\ie8\mshta.exe
+ 2012-01-20 14:32 . 2007-08-13 16:36        12288              c:\windows\ie8\msfeedssync.exe
+ 2012-01-20 14:32 . 2011-10-31 23:36        52224              c:\windows\ie8\msfeedsbs.dll
+ 2012-01-20 14:32 . 2007-08-13 16:44        40960              c:\windows\ie8\licmgr10.dll
+ 2012-01-20 14:32 . 2011-10-31 23:36        27648              c:\windows\ie8\jsproxy.dll
+ 2012-01-20 14:32 . 2007-08-13 16:39        92672              c:\windows\ie8\inseng.dll
+ 2012-01-20 14:32 . 2007-08-13 16:36        36352              c:\windows\ie8\imgutil.dll
+ 2012-01-20 14:32 . 2007-08-13 16:39        55296              c:\windows\ie8\iesetup.dll
+ 2012-01-20 14:32 . 2011-10-31 23:36        44544              c:\windows\ie8\iernonce.dll
+ 2012-01-20 14:32 . 2011-10-31 23:36        78336              c:\windows\ie8\ieencode.dll
+ 2012-01-20 14:32 . 2011-10-31 20:56        70656              c:\windows\ie8\ie4uinit.exe
+ 2012-01-20 14:32 . 2011-10-31 23:36        63488              c:\windows\ie8\icardie.dll
+ 2012-01-20 14:32 . 2007-08-13 16:18        60416              c:\windows\ie8\hmmapi.dll
+ 2012-01-20 14:32 . 2011-10-31 23:36        17408              c:\windows\ie8\corpol.dll
+ 2012-01-20 14:32 . 2007-08-13 16:39        71680              c:\windows\ie8\admparse.dll
+ 2012-05-11 12:40 . 2012-05-11 12:40        60928              c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationProvider\f121ccced1aa14badb316d8d9be5154d\UIAutomationProvider.ni.dll
+ 2012-05-11 12:48 . 2012-05-11 12:48        37888              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Pres#\316e223f2ab8c69cd6a5a06de21650ec\System.Windows.Presentation.ni.dll
+ 2012-05-11 12:47 . 2012-05-11 12:47        36864              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\7aac1fe67890463655aeeb3b8e4f2884\System.Web.DynamicData.Design.ni.dll
+ 2012-05-11 12:43 . 2012-05-11 12:43        94208              c:\windows\assembly\NativeImages_v2.0.50727_32\System.ComponentMod#\34c988dea48c291b4e648941207e83fb\System.ComponentModel.DataAnnotations.ni.dll
+ 2012-05-11 12:43 . 2012-05-11 12:43        82944              c:\windows\assembly\NativeImages_v2.0.50727_32\System.AddIn.Contra#\7bb7e51275fa19f8b4894c772bdb1e10\System.AddIn.Contract.ni.dll
+ 2012-05-09 17:40 . 2012-05-09 17:40        47104              c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\f0c4a4528f130ef2ff1ae63dd7b39075\PresentationFontCache.ni.exe
+ 2012-05-09 17:39 . 2012-05-09 17:39        39424              c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationCFFRast#\53931181e5a5e194da82605613cda6af\PresentationCFFRasterizer.ni.dll
+ 2012-05-11 12:46 . 2012-05-11 12:46        55296              c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Vsa\f2be3ad4cda6853d7959a84cec0414c5\Microsoft.Vsa.ni.dll
+ 2012-05-11 12:43 . 2012-05-11 12:43        65024              c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\8fab9cd28bbc860a34feec119512664d\Microsoft.Build.Framework.ni.dll
+ 2012-05-11 12:43 . 2012-05-11 12:43        74752              c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\0eac132c7c36f1c100ae23c956b379e7\Microsoft.Build.Framework.ni.dll
+ 2012-05-11 12:43 . 2012-05-11 12:43        14336              c:\windows\assembly\NativeImages_v2.0.50727_32\dfsvc\d66bc03eb7eae89b4dde2d09eda1414f\dfsvc.ni.exe
+ 2012-05-11 12:43 . 2012-05-11 12:43        25600              c:\windows\assembly\NativeImages_v2.0.50727_32\Accessibility\016444dfc5f7e3d11c776f2fbc7a4594\Accessibility.ni.dll
- 2011-10-16 08:17 . 2011-10-16 08:17        77824              c:\windows\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
+ 2012-05-09 17:35 . 2012-05-09 17:35        77824              c:\windows\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
- 2011-10-16 08:17 . 2011-10-16 08:17        81920              c:\windows\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
+ 2012-05-09 17:35 . 2012-05-09 17:35        81920              c:\windows\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
- 2011-10-16 08:19 . 2011-10-16 08:19        81920              c:\windows\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36        81920              c:\windows\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
+ 2012-05-09 17:35 . 2012-05-09 17:35        32768              c:\windows\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
- 2011-10-16 08:18 . 2011-10-16 08:18        32768              c:\windows\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36        12800              c:\windows\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
- 2011-10-16 08:18 . 2011-10-16 08:18        12800              c:\windows\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36        28672              c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
- 2011-10-16 08:18 . 2011-10-16 08:18        28672              c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
- 2011-10-16 08:18 . 2011-10-16 08:18        77824              c:\windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36        77824              c:\windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36        36864              c:\windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
- 2011-10-16 08:18 . 2011-10-16 08:18        36864              c:\windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
- 2011-10-16 08:18 . 2011-10-16 08:18        77824              c:\windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
+ 2012-05-09 17:35 . 2012-05-09 17:35        77824              c:\windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
- 2011-10-16 08:18 . 2011-10-16 08:18        13312              c:\windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
+ 2012-05-09 17:35 . 2012-05-09 17:35        13312              c:\windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
- 2011-10-16 08:18 . 2011-10-16 08:18        10752              c:\windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
+ 2012-05-09 17:35 . 2012-05-09 17:35        10752              c:\windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
- 2011-10-16 08:18 . 2011-10-16 08:18        72192              c:\windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36        72192              c:\windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
- 2011-10-16 08:18 . 2011-10-16 08:18        69120              c:\windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
+ 2012-05-09 17:35 . 2012-05-09 17:35        69120              c:\windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
- 2011-10-16 08:18 . 2011-10-16 08:18        8192              c:\windows\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e\IEExecRemote.dll
+ 2012-05-09 17:35 . 2012-05-09 17:35        8192              c:\windows\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e\IEExecRemote.dll
+ 2012-02-15 12:11 . 2012-01-11 19:06        3072              c:\windows\system32\iacenc.dll
+ 2012-01-20 14:26 . 2011-08-16 10:45        6144              c:\windows\system32\dllcache\iecompat.dll
+ 2012-02-15 12:11 . 2012-01-11 19:06        3072              c:\windows\system32\dllcache\iacenc.dll
+ 2012-01-20 14:43 . 2009-03-08 03:35        2048              c:\windows\ie8updates\KB2598845-IE8\iecompat.dll
+ 2012-05-09 17:35 . 2012-05-09 17:35        7168              c:\windows\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
- 2011-10-16 08:18 . 2011-10-16 08:18        7168              c:\windows\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
- 2011-10-16 08:19 . 2011-10-16 08:19        5632              c:\windows\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
+ 2012-05-09 17:36 . 2012-05-09 17:36        5632              c:\windows\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
- 2011-10-16 08:18 . 2011-10-16 08:18        6656              c:\windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
+ 2012-05-09 17:35 . 2012-05-09 17:35        6656              c:\windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
- 2011-10-16 08:18 . 2011-10-16 08:18        8192              c:\windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll
+ 2012-05-09 17:35 . 2012-05-09 17:35        8192              c:\windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36        113664              c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
- 2011-10-16 08:18 . 2011-10-16 08:18        113664              c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
- 2011-10-16 08:18 . 2011-10-16 08:18        258048              c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36        258048              c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
+ 2008-07-29 03:23 . 2008-07-29 03:23        626688              c:\windows\WinSxS\amd64_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_a17e7c1e\msvcr90.dll
+ 2008-07-29 03:23 . 2008-07-29 03:23        856576              c:\windows\WinSxS\amd64_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_a17e7c1e\msvcp90.dll
+ 2008-07-29 01:51 . 2008-07-29 01:51        245760              c:\windows\WinSxS\amd64_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_a17e7c1e\msvcm90.dll
+ 2011-10-29 10:58 . 2011-07-22 07:50        359856              c:\windows\system32\zkasigct.dll
+ 2012-04-05 21:13 . 2012-04-05 21:13        299080              c:\windows\system32\XPSViewer\XPSViewer.exe
- 2008-04-14 12:00 . 2008-04-14 12:00        121856              c:\windows\system32\xmllite.dll
+ 2008-04-14 12:00 . 2009-01-07 17:21        121856              c:\windows\system32\xmllite.dll
- 2008-04-14 12:00 . 2009-12-24 06:59        177664              c:\windows\system32\wintrust.dll
+ 2008-04-14 12:00 . 2012-02-29 14:09        177664              c:\windows\system32\wintrust.dll
- 2008-04-14 12:00 . 2011-06-20 17:44        293888              c:\windows\system32\winsrv.dll
+ 2008-04-14 12:00 . 2011-11-25 21:57        293888              c:\windows\system32\winsrv.dll
+ 2008-04-14 12:00 . 2011-10-14 14:47        178176              c:\windows\system32\winmm.dll
- 2008-04-14 12:00 . 2008-04-14 12:00        178176              c:\windows\system32\winmm.dll
+ 2008-04-14 12:00 . 2012-03-01 11:00        916992              c:\windows\system32\wininet.dll
- 2008-04-14 12:00 . 2009-08-25 09:17        354816              c:\windows\system32\winhttp.dll
+ 2008-04-14 12:00 . 2011-11-16 14:21        354816              c:\windows\system32\winhttp.dll
+ 2007-08-13 16:45 . 2009-03-08 03:34        208384              c:\windows\system32\WinFXDocObj.exe
+ 2008-04-14 12:00 . 2009-03-08 03:34        236544              c:\windows\system32\webcheck.dll
+ 2008-04-14 12:00 . 2011-03-04 06:36        420864              c:\windows\system32\vbscript.dll
+ 2008-04-14 12:00 . 2012-03-01 11:00        105984              c:\windows\system32\url.dll
- 2011-10-29 10:58 . 2007-11-07 10:20        344064              c:\windows\system32\SetupHBCI.exe
+ 2011-10-29 10:58 . 2007-11-07 12:20        344064              c:\windows\system32\SetupHBCI.exe
+ 2011-10-29 10:58 . 2007-05-31 07:38        167936              c:\windows\system32\SerialXP.dll
- 2011-10-29 10:58 . 2007-05-31 05:38        167936              c:\windows\system32\SerialXP.dll
+ 2008-04-14 12:00 . 2011-11-16 14:21        152064              c:\windows\system32\schannel.dll
+ 2011-10-29 10:58 . 2007-11-07 12:20        196608              c:\windows\system32\rsct_pnp.exe
- 2011-10-29 10:58 . 2007-11-07 10:20        196608              c:\windows\system32\rsct_pnp.exe
- 2011-10-29 10:58 . 2010-02-10 17:39        269824              c:\windows\system32\rsct_pnp.dll
+ 2011-10-29 10:58 . 2010-02-10 19:39        269824              c:\windows\system32\rsct_pnp.dll
+ 2008-04-14 12:00 . 2011-11-03 15:28        387072              c:\windows\system32\qdvd.dll
- 2008-04-14 12:00 . 2008-04-14 12:00        387072              c:\windows\system32\qdvd.dll
- 2008-04-14 12:00 . 2011-11-08 20:08        433138              c:\windows\system32\perfh009.dat
+ 2008-04-14 12:00 . 2012-05-09 17:37        433138              c:\windows\system32\perfh009.dat
+ 2008-04-14 12:00 . 2012-05-09 17:37        479376              c:\windows\system32\perfh007.dat
- 2011-10-29 10:58 . 2007-05-31 05:38        151552              c:\windows\system32\OcfCopy.exe
+ 2011-10-29 10:58 . 2007-05-31 07:38        151552              c:\windows\system32\OcfCopy.exe
+ 2008-04-14 12:00 . 2012-03-01 11:00        206848              c:\windows\system32\occache.dll
+ 2011-10-29 10:58 . 2007-05-31 07:38        434252              c:\windows\system32\MSVCRTD.DLL
- 2011-10-29 10:58 . 2007-05-31 05:38        434252              c:\windows\system32\MSVCRTD.DLL
+ 2008-04-14 12:00 . 2012-03-01 11:00        611840              c:\windows\system32\mstime.dll
+ 2008-04-14 12:00 . 2009-03-08 03:34        193536              c:\windows\system32\msrating.dll
- 2008-04-14 12:00 . 2007-08-13 16:54        156160              c:\windows\system32\msls31.dll
+ 2008-04-14 12:00 . 2009-03-08 03:22        156160              c:\windows\system32\msls31.dll
+ 2007-08-13 16:54 . 2012-03-01 11:00        602112              c:\windows\system32\msfeeds.dll
+ 2009-01-07 17:20 . 2009-01-07 17:20        265720              c:\windows\system32\msdbg2.dll
+ 2012-02-21 13:46 . 2012-02-21 13:46        279992              c:\windows\system32\Macromed\Shockwave 10\SymCCIS.dll
- 2011-11-22 15:50 . 2011-11-22 15:50        279992              c:\windows\system32\Macromed\Shockwave 10\SymCCIS.dll
- 2011-11-22 15:50 . 2011-11-22 15:50        180224              c:\windows\system32\Macromed\Shockwave 10\Proj.dll
+ 2012-02-21 13:46 . 2012-02-21 13:46        180224              c:\windows\system32\Macromed\Shockwave 10\Proj.dll
+ 2012-02-21 13:46 . 2012-02-21 13:46        475136              c:\windows\system32\Macromed\Shockwave 10\PluginPing.dll
- 2011-11-22 15:50 . 2011-11-22 15:50        475136              c:\windows\system32\Macromed\Shockwave 10\PluginPing.dll
- 2011-11-22 15:50 . 2011-11-22 15:50        339968              c:\windows\system32\Macromed\Shockwave 10\Plugin.dll
+ 2012-02-21 13:46 . 2012-02-21 13:46        339968              c:\windows\system32\Macromed\Shockwave 10\Plugin.dll
+ 2012-02-21 13:46 . 2012-02-21 13:46        606208              c:\windows\system32\Macromed\Shockwave 10\iml32X.dll
- 2011-11-22 15:50 . 2011-11-22 15:50        606208              c:\windows\system32\Macromed\Shockwave 10\iml32X.dll
+ 2012-02-21 13:46 . 2012-02-21 13:46        471040              c:\windows\system32\Macromed\Shockwave 10\Control.dll
- 2011-11-22 15:50 . 2011-11-22 15:50        471040              c:\windows\system32\Macromed\Shockwave 10\Control.dll
+ 2012-05-06 13:42 . 2012-05-06 13:42        351904              c:\windows\system32\Macromed\Flash\FlashUtil32_11_2_202_235_Plugin.exe
+ 2012-05-06 09:41 . 2012-05-06 09:41        351904              c:\windows\system32\Macromed\Flash\FlashUtil32_11_2_202_235_ActiveX.exe
+ 2012-05-06 09:41 . 2012-05-06 09:41        424096              c:\windows\system32\Macromed\Flash\FlashUtil32_11_2_202_235_ActiveX.dll
+ 2012-04-05 07:34 . 2012-05-06 13:42        257696              c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
+ 2008-04-14 12:00 . 2011-03-04 06:36        726528              c:\windows\system32\jscript.dll
+ 2012-01-23 11:13 . 2011-11-10 04:54        157472              c:\windows\system32\javaws.exe
+ 2012-01-23 11:13 . 2011-11-10 04:54        149280              c:\windows\system32\javaw.exe
+ 2012-01-23 11:13 . 2011-11-10 04:54        149280              c:\windows\system32\java.exe
+ 2008-04-14 12:00 . 2012-02-29 14:09        148480              c:\windows\system32\imagehlp.dll
+ 2007-08-13 16:54 . 2009-03-08 03:22        164352              c:\windows\system32\ieui.dll
+ 2008-04-14 12:00 . 2012-03-01 11:00        184320              c:\windows\system32\iepeers.dll
+ 2008-04-14 12:00 . 2012-03-01 11:00        387584              c:\windows\system32\iedkcs32.dll
+ 2007-07-11 10:27 . 2009-03-08 03:11        445952              c:\windows\system32\ieapfltr.dll
+ 2008-04-14 12:00 . 2009-03-08 03:32        163840              c:\windows\system32\ieakui.dll
+ 2008-04-14 12:00 . 2009-03-08 03:33        229376              c:\windows\system32\ieaksie.dll
+ 2008-04-14 12:00 . 2009-03-08 03:33        125952              c:\windows\system32\ieakeng.dll
+ 2008-04-14 12:00 . 2012-02-29 12:17        174080              c:\windows\system32\ie4uinit.exe
- 2011-10-29 10:58 . 2009-03-09 15:17        274224              c:\windows\system32\gkapi.dll
+ 2011-10-29 10:58 . 2009-03-09 17:17        274224              c:\windows\system32\gkapi.dll
- 2009-04-17 14:51 . 2011-12-14 12:16        126912              c:\windows\system32\FNTCACHE.DAT
+ 2012-06-01 06:08 . 2012-06-01 06:08        126912              c:\windows\system32\FNTCACHE.DAT
+ 2008-04-14 12:00 . 2009-03-08 03:31        216064              c:\windows\system32\dxtrans.dll
+ 2008-04-14 12:00 . 2009-03-08 03:31        348160              c:\windows\system32\dxtmsft.dll
+ 2009-04-17 14:02 . 2012-01-09 16:20        139784              c:\windows\system32\drivers\rdpwd.sys
- 2008-04-14 12:00 . 2009-12-24 06:59        177664              c:\windows\system32\dllcache\wintrust.dll
+ 2008-04-14 12:00 . 2012-02-29 14:09        177664              c:\windows\system32\dllcache\wintrust.dll
- 2008-04-14 12:00 . 2011-06-20 17:44        293888              c:\windows\system32\dllcache\winsrv.dll
+ 2008-04-14 12:00 . 2011-11-25 21:57        293888              c:\windows\system32\dllcache\winsrv.dll
- 2008-04-14 12:00 . 2008-04-14 12:00        178176              c:\windows\system32\dllcache\winmm.dll
+ 2008-04-14 12:00 . 2011-10-14 14:47        178176              c:\windows\system32\dllcache\winmm.dll
+ 2008-04-14 12:00 . 2012-03-01 11:00        916992              c:\windows\system32\dllcache\wininet.dll
+ 2008-04-14 12:00 . 2011-11-16 14:21        354816              c:\windows\system32\dllcache\winhttp.dll
- 2008-04-14 12:00 . 2009-08-25 09:17        354816              c:\windows\system32\dllcache\winhttp.dll
+ 2008-04-14 12:00 . 2009-03-08 03:34        236544              c:\windows\system32\dllcache\webcheck.dll
+ 2009-04-17 14:05 . 2011-04-30 03:01        758784              c:\windows\system32\dllcache\vgx.dll
+ 2008-04-14 12:00 . 2011-03-04 06:36        420864              c:\windows\system32\dllcache\vbscript.dll
+ 2008-04-14 12:00 . 2012-03-01 11:00        105984              c:\windows\system32\dllcache\url.dll
+ 2009-01-07 17:20 . 2009-01-07 17:20        134144              c:\windows\system32\dllcache\sqmapi.dll
+ 2008-04-14 12:00 . 2011-11-16 14:21        152064              c:\windows\system32\dllcache\schannel.dll
+ 2009-04-17 14:02 . 2012-01-09 16:20        139784              c:\windows\system32\dllcache\rdpwd.sys
+ 2008-04-14 12:00 . 2011-11-03 15:28        387072              c:\windows\system32\dllcache\qdvd.dll
- 2008-04-14 12:00 . 2008-04-14 12:00        387072              c:\windows\system32\dllcache\qdvd.dll
+ 2008-04-14 12:00 . 2012-03-01 11:00        206848              c:\windows\system32\dllcache\occache.dll
+ 2008-04-14 12:00 . 2012-03-01 11:00        611840              c:\windows\system32\dllcache\mstime.dll
+ 2008-04-14 12:00 . 2009-03-08 03:34        193536              c:\windows\system32\dllcache\msrating.dll
- 2008-04-14 12:00 . 2007-08-13 16:54        156160              c:\windows\system32\dllcache\msls31.dll
+ 2008-04-14 12:00 . 2009-03-08 03:22        156160              c:\windows\system32\dllcache\msls31.dll
+ 2009-02-20 16:49 . 2012-03-01 11:00        602112              c:\windows\system32\dllcache\msfeeds.dll
+ 2008-04-14 12:00 . 2011-03-04 06:36        726528              c:\windows\system32\dllcache\jscript.dll
+ 2008-04-14 12:00 . 2012-02-29 14:09        148480              c:\windows\system32\dllcache\imagehlp.dll
+ 2009-04-17 14:04 . 2009-03-08 13:09        638816              c:\windows\system32\dllcache\iexplore.exe
+ 2012-01-20 14:26 . 2012-03-01 11:00        247808              c:\windows\system32\dllcache\ieproxy.dll
+ 2008-04-14 12:00 . 2012-03-01 11:00        184320              c:\windows\system32\dllcache\iepeers.dll
+ 2012-01-20 14:26 . 2012-03-01 11:00        743424              c:\windows\system32\dllcache\iedvtool.dll
+ 2008-04-14 12:00 . 2012-03-01 11:00        387584              c:\windows\system32\dllcache\iedkcs32.dll
+ 2009-02-20 16:49 . 2009-03-08 03:11        445952              c:\windows\system32\dllcache\ieapfltr.dll
+ 2008-04-14 12:00 . 2009-03-08 03:32        163840              c:\windows\system32\dllcache\ieakui.dll
+ 2008-04-14 12:00 . 2009-03-08 03:33        229376              c:\windows\system32\dllcache\ieaksie.dll
+ 2008-04-14 12:00 . 2009-03-08 03:33        125952              c:\windows\system32\dllcache\ieakeng.dll
+ 2008-04-14 12:00 . 2012-02-29 12:17        174080              c:\windows\system32\dllcache\ie4uinit.exe
+ 2008-04-14 12:00 . 2009-03-08 03:31        216064              c:\windows\system32\dllcache\dxtrans.dll
+ 2008-04-14 12:00 . 2009-03-08 03:31        348160              c:\windows\system32\dllcache\dxtmsft.dll
+ 2008-04-14 12:00 . 2012-05-31 13:22        604160              c:\windows\system32\dllcache\crypt32.dll
- 2008-04-14 12:00 . 2011-09-28 07:06        604160              c:\windows\system32\dllcache\crypt32.dll
+ 2008-04-14 12:00 . 2009-03-08 03:32        128512              c:\windows\system32\dllcache\advpack.dll
+ 2012-01-23 11:13 . 2011-11-10 04:54        472808              c:\windows\system32\deployJava1.dll
- 2011-10-29 10:58 . 2010-11-28 20:03        351664              c:\windows\system32\ctrsct32.dll
+ 2011-10-29 10:58 . 2011-07-22 07:49        351664              c:\windows\system32\ctrsct32.dll
+ 2011-10-29 10:58 . 2011-07-22 07:49        208816              c:\windows\system32\cjppa32.dll
+ 2011-10-29 10:58 . 2011-07-22 07:49        713136              c:\windows\system32\cjpcscui.exe
+ 2011-10-29 10:58 . 2011-07-22 07:49        785328              c:\windows\system32\cjpcsc32.dll
+ 2011-10-29 10:58 . 2011-07-22 07:49        511920              c:\windows\system32\cjpcsc.exe
+ 2011-10-29 10:58 . 2011-07-22 07:48        212912              c:\windows\system32\cjeca32.dll
+ 2008-04-14 12:00 . 2009-03-08 03:32        128512              c:\windows\system32\advpack.dll
+ 2012-02-02 13:32 . 2012-02-02 13:32        279992              c:\windows\system32\Adobe\Shockwave 11\SymCCIS.dll
+ 2012-02-02 13:49 . 2012-02-02 13:49        114176              c:\windows\system32\Adobe\Shockwave 11\SwInit.exe
+ 2012-02-02 13:50 . 2012-02-02 13:50        434176              c:\windows\system32\Adobe\Shockwave 11\Proj.dll
+ 2012-02-02 13:49 . 2012-02-02 13:49        365056              c:\windows\system32\Adobe\Shockwave 11\Plugin.dll
+ 2012-02-02 13:36 . 2012-02-02 13:36        990208              c:\windows\system32\Adobe\Shockwave 11\iml32.dll
+ 2012-02-02 13:49 . 2012-02-02 13:49        543232              c:\windows\system32\Adobe\Shockwave 11\Control.dll
+ 2012-02-02 13:56 . 2012-02-02 13:56        113592              c:\windows\system32\Adobe\Director\SWDNLD.EXE
+ 2012-02-02 13:56 . 2012-02-02 13:56        281016              c:\windows\system32\Adobe\Director\SwDir.dll
+ 2012-02-02 13:49 . 2012-02-02 13:49        145920              c:\windows\system32\Adobe\Director\np32dsw.dll
+ 2012-04-05 21:52 . 2012-04-05 21:52        131168              c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationHostDLL.dll
+ 2011-12-25 02:49 . 2011-12-25 02:49        436496              c:\windows\Microsoft.NET\Framework\v2.0.50727\webengine.dll
+ 2012-01-31 01:38 . 2012-01-31 01:38        630784              c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Drawing.dll
+ 2011-12-25 01:50 . 2011-12-25 01:50        389888              c:\windows\Microsoft.NET\Framework\v2.0.50727\SOS.dll
+ 2011-12-25 01:50 . 2011-12-25 01:50        364816              c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
+ 2011-12-25 01:50 . 2011-12-25 01:50        989968              c:\windows\Microsoft.NET\Framework\v2.0.50727\mscordacwks.dll
+ 2012-01-23 11:18 . 2012-01-23 11:18        203776              c:\windows\Installer\654ead.msi
+ 2012-01-05 15:58 . 2012-01-05 15:58        430592              c:\windows\Installer\5ec3a.msi
+ 2012-02-02 21:56 . 2012-02-02 21:56        963584              c:\windows\Installer\5787b5.msp
+ 2011-12-25 04:40 . 2011-12-25 04:40        819200              c:\windows\Installer\551d5b.msp
+ 2011-12-22 14:50 . 2011-12-22 14:50        256000              c:\windows\Installer\132e6ff.msp
+ 2011-06-06 11:55 . 2011-06-06 11:55        249232              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010\10.1.0\sqlite.dll
+ 2011-06-06 11:55 . 2011-06-06 11:55        394136              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010\10.1.0\pdfshell.dll
+ 2011-06-06 11:55 . 2011-06-06 11:55        103848              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010\10.1.0\PDFPrevHndlrShim.exe
+ 2011-06-06 11:55 . 2011-06-06 11:55        183696              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010\10.1.0\nppdf32.dll
+ 2011-06-06 11:55 . 2011-06-06 11:55        104344              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010\10.1.0\AiodLite.dll
+ 2011-06-06 11:55 . 2011-06-06 11:55        937920              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010\10.1.0\adobearm.exe
+ 2011-06-06 11:55 . 2011-06-06 11:55        102808              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010\10.1.0\AcroRdIF.dll
+ 2011-06-06 11:55 . 2011-06-06 11:55        755088              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010\10.1.0\AcroPDF.dll
+ 2011-06-06 11:55 . 2011-06-06 11:55        296344              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010\10.1.0\acrobroker.exe
+ 2011-06-06 11:55 . 2011-06-06 11:55        205720              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010\10.1.0\a3dutils.dll
+ 2012-01-20 14:42 . 2009-03-08 03:34        914944              c:\windows\ie8updates\KB982381-IE8\wininet.dll
+ 2012-01-20 14:42 . 2010-02-22 14:22        388984              c:\windows\ie8updates\KB982381-IE8\spuninst\updspapi.dll
+ 2012-01-20 14:42 . 2008-07-08 13:00        234872              c:\windows\ie8updates\KB982381-IE8\spuninst\spuninst.exe
+ 2012-01-20 14:42 . 2009-03-08 03:34        109568              c:\windows\ie8updates\KB982381-IE8\occache.dll
+ 2012-01-20 14:42 . 2009-03-08 03:32        611840              c:\windows\ie8updates\KB982381-IE8\mstime.dll
+ 2012-01-20 14:42 . 2009-03-08 03:32        594432              c:\windows\ie8updates\KB982381-IE8\msfeeds.dll
+ 2012-01-20 14:42 . 2009-03-08 03:33        246784              c:\windows\ie8updates\KB982381-IE8\ieproxy.dll
+ 2012-01-20 14:42 . 2009-03-08 03:31        183808              c:\windows\ie8updates\KB982381-IE8\iepeers.dll
+ 2012-01-20 14:42 . 2009-03-08 03:35        742912              c:\windows\ie8updates\KB982381-IE8\iedvtool.dll
+ 2012-01-20 14:42 . 2009-03-08 13:09        391536              c:\windows\ie8updates\KB982381-IE8\iedkcs32.dll
+ 2012-01-20 14:42 . 2009-03-08 03:32        173056              c:\windows\ie8updates\KB982381-IE8\ie4uinit.exe
+ 2012-04-12 13:43 . 2011-12-17 19:43        916992              c:\windows\ie8updates\KB2675157-IE8\wininet.dll
+ 2012-04-12 13:43 . 2011-12-17 19:43        105984              c:\windows\ie8updates\KB2675157-IE8\url.dll
+ 2012-04-12 13:43 . 2010-07-05 13:14        388984              c:\windows\ie8updates\KB2675157-IE8\spuninst\updspapi.dll
+ 2012-04-12 13:43 . 2010-07-05 13:14        234872              c:\windows\ie8updates\KB2675157-IE8\spuninst\spuninst.exe
+ 2012-04-12 13:43 . 2011-12-17 19:43        206848              c:\windows\ie8updates\KB2675157-IE8\occache.dll
+ 2012-04-12 13:43 . 2011-12-17 19:43        611840              c:\windows\ie8updates\KB2675157-IE8\mstime.dll
+ 2012-04-12 13:43 . 2011-12-17 19:43        602112              c:\windows\ie8updates\KB2675157-IE8\msfeeds.dll
+ 2012-04-12 13:43 . 2011-12-17 19:43        247808              c:\windows\ie8updates\KB2675157-IE8\ieproxy.dll
+ 2012-04-12 13:43 . 2011-12-17 19:43        184320              c:\windows\ie8updates\KB2675157-IE8\iepeers.dll
+ 2012-04-12 13:43 . 2011-12-17 19:43        743424              c:\windows\ie8updates\KB2675157-IE8\iedvtool.dll
+ 2012-04-12 13:43 . 2011-12-17 19:43        387584              c:\windows\ie8updates\KB2675157-IE8\iedkcs32.dll
+ 2012-04-12 13:43 . 2011-12-16 12:23        174080              c:\windows\ie8updates\KB2675157-IE8\ie4uinit.exe
+ 2012-02-15 13:08 . 2011-11-04 19:13        105984              c:\windows\ie8updates\KB2647516-IE8\url.dll
+ 2012-02-15 13:08 . 2010-07-05 13:14        388984              c:\windows\ie8updates\KB2647516-IE8\spuninst\updspapi.dll
+ 2012-02-15 13:08 . 2010-07-05 13:14        234872              c:\windows\ie8updates\KB2647516-IE8\spuninst\spuninst.exe
+ 2012-02-15 13:08 . 2011-11-04 19:13        206848              c:\windows\ie8updates\KB2647516-IE8\occache.dll
+ 2012-02-15 13:08 . 2011-11-04 19:13        611840              c:\windows\ie8updates\KB2647516-IE8\mstime.dll
+ 2012-02-15 13:08 . 2011-11-04 19:13        602112              c:\windows\ie8updates\KB2647516-IE8\msfeeds.dll
+ 2012-02-15 13:08 . 2011-11-04 19:13        247808              c:\windows\ie8updates\KB2647516-IE8\ieproxy.dll
+ 2012-02-15 13:08 . 2011-11-04 19:13        184320              c:\windows\ie8updates\KB2647516-IE8\iepeers.dll
+ 2012-02-15 13:08 . 2011-11-04 19:13        743424              c:\windows\ie8updates\KB2647516-IE8\iedvtool.dll
+ 2012-02-15 13:08 . 2011-11-04 19:13        387584              c:\windows\ie8updates\KB2647516-IE8\iedkcs32.dll
+ 2012-02-15 13:08 . 2011-11-04 11:24        174080              c:\windows\ie8updates\KB2647516-IE8\ie4uinit.exe
+ 2012-01-20 14:43 . 2010-05-06 10:31        916480              c:\windows\ie8updates\KB2618444-IE8\wininet.dll
+ 2012-01-20 14:43 . 2009-03-08 03:34        105984              c:\windows\ie8updates\KB2618444-IE8\url.dll
+ 2012-01-20 14:44 . 2010-07-05 13:14        388984              c:\windows\ie8updates\KB2618444-IE8\spuninst\updspapi.dll
+ 2012-01-20 14:44 . 2010-07-05 13:14        234872              c:\windows\ie8updates\KB2618444-IE8\spuninst\spuninst.exe
+ 2012-01-20 14:43 . 2010-05-06 10:31        206848              c:\windows\ie8updates\KB2618444-IE8\occache.dll
+ 2012-01-20 14:43 . 2010-05-06 10:31        611840              c:\windows\ie8updates\KB2618444-IE8\mstime.dll
+ 2012-01-20 14:43 . 2010-05-06 10:31        599040              c:\windows\ie8updates\KB2618444-IE8\msfeeds.dll
+ 2012-01-20 14:43 . 2010-05-06 10:31        247808              c:\windows\ie8updates\KB2618444-IE8\ieproxy.dll
+ 2012-01-20 14:43 . 2010-05-06 10:31        184320              c:\windows\ie8updates\KB2618444-IE8\iepeers.dll
+ 2012-01-20 14:43 . 2010-05-06 10:31        743424              c:\windows\ie8updates\KB2618444-IE8\iedvtool.dll
+ 2012-01-20 14:43 . 2010-05-06 10:31        387584              c:\windows\ie8updates\KB2618444-IE8\iedkcs32.dll
+ 2012-01-20 14:43 . 2010-05-05 13:30        173056              c:\windows\ie8updates\KB2618444-IE8\ie4uinit.exe
+ 2012-01-20 14:43 . 2010-07-05 13:14        388984              c:\windows\ie8updates\KB2598845-IE8\spuninst\updspapi.dll
+ 2012-01-20 14:43 . 2010-07-05 13:14        234872              c:\windows\ie8updates\KB2598845-IE8\spuninst\spuninst.exe
+ 2012-01-22 13:20 . 2009-03-08 03:33        759296              c:\windows\ie8updates\KB2544521-IE8\vgx.dll
+ 2012-01-22 13:20 . 2010-07-05 13:14        388984              c:\windows\ie8updates\KB2544521-IE8\spuninst\updspapi.dll
+ 2012-01-22 13:20 . 2010-07-05 13:14        234872              c:\windows\ie8updates\KB2544521-IE8\spuninst\spuninst.exe
+ 2012-01-22 13:20 . 2009-03-08 03:33        420352              c:\windows\ie8updates\KB2510531-IE8\vbscript.dll
+ 2012-01-22 13:20 . 2010-07-05 13:14        388984              c:\windows\ie8updates\KB2510531-IE8\spuninst\updspapi.dll
+ 2012-01-22 13:20 . 2010-07-05 13:14        234872              c:\windows\ie8updates\KB2510531-IE8\spuninst\spuninst.exe
+ 2012-01-22 13:20 . 2009-03-08 03:33        726528              c:\windows\ie8updates\KB2510531-IE8\jscript.dll
+ 2012-01-20 14:32 . 2011-10-31 23:36        832512              c:\windows\ie8\wininet.dll
+ 2012-01-20 14:32 . 2007-08-13 16:45        206336              c:\windows\ie8\winfxdocobj.exe
+ 2012-01-20 14:32 . 2011-10-31 23:36        233472              c:\windows\ie8\webcheck.dll
+ 2012-01-20 14:32 . 2011-04-30 08:50        766464              c:\windows\ie8\vgx.dll
+ 2012-01-20 14:32 . 2011-03-04 06:44        434176              c:\windows\ie8\vbscript.dll
+ 2012-01-20 14:32 . 2011-10-31 23:36        106496              c:\windows\ie8\url.dll
+ 2012-01-20 14:35 . 2009-01-07 17:20        388640              c:\windows\ie8\spuninst\updspapi.dll
+ 2012-01-20 14:35 . 2009-01-07 17:20        235040              c:\windows\ie8\spuninst\spuninst.exe
+ 2012-01-20 14:32 . 2006-09-06 15:42        217312              c:\windows\ie8\spuninst.exe
+ 2012-01-20 14:32 . 2011-10-31 23:36        102912              c:\windows\ie8\occache.dll
+ 2012-01-20 14:32 . 2011-10-31 23:36        671232              c:\windows\ie8\mstime.dll
+ 2012-01-20 14:32 . 2011-10-31 23:36        193024              c:\windows\ie8\msrating.dll
+ 2012-01-20 14:32 . 2007-08-13 16:54        156160              c:\windows\ie8\msls31.dll
+ 2012-01-20 14:32 . 2011-10-31 23:36        478720              c:\windows\ie8\mshtmled.dll
+ 2012-01-20 14:32 . 2011-10-31 23:36        468480              c:\windows\ie8\msfeeds.dll
+ 2012-01-20 14:32 . 2011-03-04 06:44        512000              c:\windows\ie8\jscript.dll
+ 2012-01-20 14:32 . 2011-10-31 10:46        634504              c:\windows\ie8\iexplore.exe
+ 2012-01-20 14:32 . 2007-08-13 16:54        180736              c:\windows\ie8\ieui.dll
+ 2012-01-20 14:32 . 2011-10-31 23:36        268288              c:\windows\ie8\iertutil.dll
+ 2012-01-20 14:32 . 2007-08-13 16:54        287744              c:\windows\ie8\ieproxy.dll
+ 2012-01-20 14:32 . 2011-10-31 23:36        192512              c:\windows\ie8\iepeers.dll
+ 2012-01-20 14:32 . 2011-10-31 23:36        384512              c:\windows\ie8\iedkcs32.dll
+ 2012-01-20 14:32 . 2011-10-31 23:36        380928              c:\windows\ie8\ieapfltr.dll
+ 2012-01-20 14:32 . 2011-10-27 12:49        161792              c:\windows\ie8\ieakui.dll
+ 2012-01-20 14:32 . 2011-10-31 23:36        230400              c:\windows\ie8\ieaksie.dll
+ 2012-01-20 14:32 . 2011-10-31 23:36        153088              c:\windows\ie8\ieakeng.dll
+ 2012-01-20 14:32 . 2011-10-31 23:36        214528              c:\windows\ie8\dxtrans.dll
+ 2012-01-20 14:32 . 2011-10-31 23:36        347136              c:\windows\ie8\dxtmsft.dll
+ 2012-01-20 14:32 . 2011-10-31 23:36        124928              c:\windows\ie8\advpack.dll
+ 2012-05-11 12:43 . 2012-05-11 12:43        321536              c:\windows\assembly\NativeImages_v2.0.50727_32\WsatConfig\ac4fc3032c19946f9b2729468888206d\WsatConfig.ni.exe
+ 2012-05-11 12:40 . 2012-05-11 12:40        240128              c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\6198de2c5b8f7d89404c2ba39d69ae56\WindowsFormsIntegration.ni.dll
+ 2012-05-11 12:40 . 2012-05-11 12:40        187904              c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationTypes\be27ab5913cec2b292a019c2a13ec701\UIAutomationTypes.ni.dll
+ 2012-05-11 12:40 . 2012-05-11 12:40        447488              c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClient\04e5e2be34a70ee7f4c87550238095a0\UIAutomationClient.ni.dll
+ 2012-05-11 12:48 . 2012-05-11 12:48        400896              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml.Linq\1c13b08593e99d6f5bef49ae7939c78b\System.Xml.Linq.ni.dll
+ 2012-05-11 12:47 . 2012-05-11 12:47        129536              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Routing\8bffbaa5d5abe40674d0bc124dfe8622\System.Web.Routing.ni.dll
+ 2012-05-11 12:47 . 2012-05-11 12:47        202240              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\6c7765c10516d375e9ddedad2dbab848\System.Web.RegularExpressions.ni.dll
+ 2012-05-11 12:47 . 2012-05-11 12:47        859648              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\a7908debe80c209b599529685a159fa0\System.Web.Extensions.Design.ni.dll
+ 2012-05-11 12:47 . 2012-05-11 12:47        328704              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Entity\44ecb9f7be54a2ba46e6102d343e2e7e\System.Web.Entity.ni.dll
+ 2012-05-11 12:47 . 2012-05-11 12:47        301056              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Entity.D#\fee8237aa2daa36e48aec379ee642422\System.Web.Entity.Design.ni.dll
+ 2012-05-11 12:47 . 2012-05-11 12:47        547328              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\40d90d2c1484164b786067320ce778f4\System.Web.DynamicData.ni.dll
+ 2012-05-11 12:47 . 2012-05-11 12:47        141312              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Abstract#\6b4ce8cf2c3307b75ea7ebe77258bb26\System.Web.Abstractions.ni.dll
+ 2012-05-11 12:47 . 2012-05-11 12:47        627200              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\41f6f6dd0c8427d4a8e6fd3915505a6b\System.Transactions.ni.dll
+ 2012-05-11 12:47 . 2012-05-11 12:47        212992              c:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\8dc4a28c456f81ee7399da21bd9d55aa\System.ServiceProcess.ni.dll
+ 2012-05-11 12:43 . 2012-05-11 12:43        679936              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Security\129b15861e200613ff78ae15581f9093\System.Security.ni.dll
+ 2012-05-11 12:46 . 2012-05-11 12:46        311296              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\a644ec04e18202b60f9d828bc207972b\System.Runtime.Serialization.Formatters.Soap.ni.dll
+ 2012-05-11 12:46 . 2012-05-11 12:46        621056              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Net\4a9eb43005a041959ddc5c7e586ab746\System.Net.ni.dll
+ 2012-05-11 12:46 . 2012-05-11 12:46        998400              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Management\9080c8e8e7b6dfb502c1328673d636f8\System.Management.ni.dll
+ 2012-05-11 12:46 . 2012-05-11 12:46        330752              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Management.I#\3182a049ba953010dec649cf290a9e90\System.Management.Instrumentation.ni.dll
+ 2012-05-11 12:42 . 2012-05-11 12:42        381440              c:\windows\assembly\NativeImages_v2.0.50727_32\System.IO.Log\8991f21d4b3676bf6f779110db8d4ac9\System.IO.Log.ni.dll
+ 2012-05-11 12:43 . 2012-05-11 12:43        212992              c:\windows\assembly\NativeImages_v2.0.50727_32\System.IdentityMode#\cd9c60a35d4958e94d2e3dd2f778e2e9\System.IdentityModel.Selectors.ni.dll
+ 2012-05-11 12:46 . 2012-05-11 12:46        280064              c:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\29bce0113d611084a9329349e33528ac\System.EnterpriseServices.Wrapper.dll
+ 2012-05-11 12:46 . 2012-05-11 12:46        627712              c:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\29bce0113d611084a9329349e33528ac\System.EnterpriseServices.ni.dll
+ 2012-05-11 12:39 . 2012-05-11 12:39        208384              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing.Desi#\88aa4f80c7e5ac25f06f8950e42a1678\System.Drawing.Design.ni.dll
+ 2012-05-11 12:46 . 2012-05-11 12:46        455680              c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\ca484772955bc4db03b5dcb611c09423\System.DirectoryServices.Protocols.ni.dll
+ 2012-05-11 12:46 . 2012-05-11 12:46        881152              c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\8ba5e68dddfd3279a8469d39eded48f3\System.DirectoryServices.AccountManagement.ni.dll
+ 2012-05-11 12:46 . 2012-05-11 12:46        354816              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Service#\a0109fce606a3110a5e7f9a4773f517e\System.Data.Services.Design.ni.dll
+ 2012-05-11 12:46 . 2012-05-11 12:46        939008              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Service#\3a68d0441f509ffa6f8f0fb9cfcc5780\System.Data.Services.Client.ni.dll
+ 2012-05-11 12:46 . 2012-05-11 12:46        756736              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Entity.#\04440b3dd5d822da4973a525ee04b05d\System.Data.Entity.Design.ni.dll
+ 2012-05-11 12:43 . 2012-05-11 12:43        135680              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.DataSet#\7bbb5d9e3b161b4d4b968e590442d3ae\System.Data.DataSetExtensions.ni.dll
+ 2012-05-11 12:43 . 2012-05-11 12:43        971264              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\3d5b7368bde0f65aa15d9f46b498cc89\System.Configuration.ni.dll
+ 2012-05-11 12:46 . 2012-05-11 12:46        141312              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\bf7d6af03e1230ccad546a8659245ae9\System.Configuration.Install.ni.dll
+ 2012-05-11 12:43 . 2012-05-11 12:43        634368              c:\windows\assembly\NativeImages_v2.0.50727_32\System.AddIn\931a2bece4668863db4f852401c828cf\System.AddIn.ni.dll
+ 2012-05-11 12:42 . 2012-05-11 12:42        366080              c:\windows\assembly\NativeImages_v2.0.50727_32\SMSvcHost\6762f1ee780fa9c0b4ef66b285c64844\SMSvcHost.ni.exe
+ 2012-05-11 12:42 . 2012-05-11 12:42        256000              c:\windows\assembly\NativeImages_v2.0.50727_32\SMDiagnostics\660c4d6dd69ef22bc05587e1998cd135\SMDiagnostics.ni.dll
+ 2012-05-11 12:42 . 2012-05-11 12:42        320512              c:\windows\assembly\NativeImages_v2.0.50727_32\ServiceModelReg\47ed5bc9f42ea0054ce9acfde5e640b8\ServiceModelReg.ni.exe
+ 2012-05-11 12:38 . 2012-05-11 12:38        258048              c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\a4706b850df9a3483f2fc439b6abe616\PresentationFramework.Royale.ni.dll
+ 2012-05-11 12:38 . 2012-05-11 12:38        539648              c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\8b873631a0855fb6aa0ad25f1d9de7fe\PresentationFramework.Luna.ni.dll
+ 2012-05-11 12:38 . 2012-05-11 12:38        224768              c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\7416fe825e6e49a87fa8ff60c8971813\PresentationFramework.Classic.ni.dll
+ 2012-05-11 12:38 . 2012-05-11 12:38        368128              c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\186c27fbd7b38b5551889274f6fa2ccd\PresentationFramework.Aero.ni.dll
+ 2012-05-11 12:43 . 2012-05-11 12:43        133632              c:\windows\assembly\NativeImages_v2.0.50727_32\MSBuild\5a121969a115d11b6256eb960c145686\MSBuild.ni.exe
+ 2012-05-11 12:42 . 2012-05-11 12:42        386560              c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\97c613d3899b320a6765793bdf490272\Microsoft.Transactions.Bridge.Dtc.ni.dll
+ 2012-05-11 12:43 . 2012-05-11 12:43        175104              c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\dec22fb7d6b8929a41380e5359741a07\Microsoft.Build.Utilities.v3.5.ni.dll
+ 2012-05-11 12:43 . 2012-05-11 12:43        144384              c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\1009b31c86a1b798fffa9e0127cec29c\Microsoft.Build.Utilities.ni.dll
+ 2012-05-11 12:43 . 2012-05-11 12:43        839680              c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\21d88631ef629715d3eecdd08e62e0b8\Microsoft.Build.Engine.ni.dll
+ 2012-05-11 12:43 . 2012-05-11 12:43        222720              c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Con#\a0f38c6478cca8297fb160291346c1c9\Microsoft.Build.Conversion.v3.5.ni.dll
+ 2012-05-11 12:43 . 2012-05-11 12:43        220672              c:\windows\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\bb26dd100d656605c576881a1a823667\CustomMarshalers.ni.dll
+ 2012-05-11 12:42 . 2012-05-11 12:42        410112              c:\windows\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\9869c02d18825fdd32e64135a3e7246b\ComSvcConfig.ni.exe
+ 2012-05-11 12:43 . 2012-05-11 12:43        842240              c:\windows\assembly\NativeImages_v2.0.50727_32\AspNetMMCExt\e414683ec4cff1cac0c77aaefd67144e\AspNetMMCExt.ni.dll
- 2011-10-16 08:17 . 2011-10-16 08:17        839680              c:\windows\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll
+ 2012-05-09 17:35 . 2012-05-09 17:35        839680              c:\windows\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll
- 2011-10-16 08:17 . 2011-10-16 08:17        835584              c:\windows\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
+ 2012-05-09 17:35 . 2012-05-09 17:35        835584              c:\windows\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
- 2011-10-16 08:18 . 2011-10-16 08:18        114688              c:\windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
+ 2012-05-09 17:35 . 2012-05-09 17:35        114688              c:\windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
- 2011-10-16 08:18 . 2011-10-16 08:18        258048              c:\windows\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36        258048              c:\windows\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36        131072              c:\windows\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
- 2011-10-16 08:18 . 2011-10-16 08:18        131072              c:\windows\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36        303104              c:\windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
- 2011-10-16 08:18 . 2011-10-16 08:18        303104              c:\windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36        258048              c:\windows\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll
- 2011-10-16 08:18 . 2011-10-16 08:18        258048              c:\windows\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll
- 2011-10-16 08:18 . 2011-10-16 08:18        372736              c:\windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36        372736              c:\windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36        630784              c:\windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
- 2011-10-16 08:18 . 2011-10-16 08:18        401408              c:\windows\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
+ 2012-05-09 17:35 . 2012-05-09 17:35        401408              c:\windows\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
- 2011-10-16 08:18 . 2011-10-16 08:18        188416              c:\windows\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll
+ 2012-05-09 17:35 . 2012-05-09 17:35        188416              c:\windows\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36        970752              c:\windows\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
- 2011-10-16 08:19 . 2011-10-16 08:19        970752              c:\windows\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36        745472              c:\windows\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
- 2011-10-16 08:19 . 2011-10-16 08:19        745472              c:\windows\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
- 2011-10-16 08:19 . 2011-10-16 08:19        425984              c:\windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36        425984              c:\windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
- 2009-08-14 19:47 . 2009-08-14 19:47        163840              c:\windows\assembly\GAC_MSIL\System.AddIn\3.5.0.0__b77a5c561934e089\System.AddIn.dll
+ 2012-05-09 17:42 . 2012-05-09 17:42        163840              c:\windows\assembly\GAC_MSIL\System.AddIn\3.5.0.0__b77a5c561934e089\System.AddIn.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36        110592              c:\windows\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll
- 2011-10-16 08:19 . 2011-10-16 08:19        110592              c:\windows\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll
+ 2012-05-09 17:29 . 2012-05-09 17:29        532480              c:\windows\assembly\GAC_MSIL\ReachFramework\3.0.0.0__31bf3856ad364e35\ReachFramework.dll
- 2011-10-16 08:18 . 2011-10-16 08:18        659456              c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
+ 2012-05-09 17:35 . 2012-05-09 17:35        659456              c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36        372736              c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll
- 2011-10-16 08:18 . 2011-10-16 08:18        372736              c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll
- 2011-10-16 08:18 . 2011-10-16 08:18        110592              c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36        110592              c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36        749568              c:\windows\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
- 2011-10-16 08:18 . 2011-10-16 08:18        749568              c:\windows\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36        655360              c:\windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll
- 2011-10-16 08:18 . 2011-10-16 08:18        655360              c:\windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36        348160              c:\windows\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
- 2011-10-16 08:18 . 2011-10-16 08:18        348160              c:\windows\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
+ 2012-05-09 17:35 . 2012-05-09 17:35        507904              c:\windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll
- 2011-10-16 08:17 . 2011-10-16 08:17        507904              c:\windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36        261632              c:\windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
- 2011-10-16 08:18 . 2011-10-16 08:18        261632              c:\windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
+ 2012-05-09 17:29 . 2012-05-09 17:29        368640              c:\windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\System.Printing.dll
- 2009-08-14 19:46 . 2009-08-14 19:46        368640              c:\windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\System.Printing.dll
- 2011-10-16 08:18 . 2011-10-16 08:18        113664              c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36        113664              c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36        258048              c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
- 2011-10-16 08:18 . 2011-10-16 08:18        258048              c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36        486400              c:\windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
- 2011-10-16 08:19 . 2011-10-16 08:19        486400              c:\windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
+ 2012-05-09 11:51 . 2012-02-09 15:43        1748992              c:\windows\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.6002.22791_x-ww_c8dff154\GdiPlus.dll
+ 2008-04-14 12:00 . 2012-03-01 11:00        1212416              c:\windows\system32\urlmon.dll
+ 2008-04-14 12:00 . 2011-11-03 15:28        1297920              c:\windows\system32\quartz.dll
+ 2008-04-14 12:00 . 2012-03-01 11:00        5978624              c:\windows\system32\mshtml.dll
+ 2012-02-21 13:46 . 2012-02-21 13:46        1225216              c:\windows\system32\Macromed\Shockwave 10\gi.dll
- 2011-11-22 15:50 . 2011-11-22 15:50        1503232              c:\windows\system32\Macromed\Shockwave 10\dirapiX.dll
+ 2012-02-21 13:46 . 2012-02-21 13:46        1503232              c:\windows\system32\Macromed\Shockwave 10\dirapiX.dll
+ 2012-05-06 13:42 . 2012-05-06 13:42        8797856              c:\windows\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll
+ 2007-08-13 16:34 . 2012-03-01 11:00        2000384              c:\windows\system32\iertutil.dll
+ 2007-02-12 14:10 . 2009-02-06 20:07        3698584              c:\windows\system32\ieapfltr.dat
+ 2008-04-14 12:00 . 2012-04-11 13:51        1862400              c:\windows\system32\dllcache\win32k.sys
+ 2008-04-14 12:00 . 2012-03-01 11:00        1212416              c:\windows\system32\dllcache\urlmon.dll
+ 2008-04-14 12:00 . 2011-11-03 15:28        1297920              c:\windows\system32\dllcache\quartz.dll
+ 2009-04-17 16:45 . 2012-04-11 13:51        2194944              c:\windows\system32\dllcache\ntoskrnl.exe
+ 2009-04-17 16:45 . 2012-04-11 13:51        2029056              c:\windows\system32\dllcache\ntkrpamp.exe
+ 2009-02-10 17:03 . 2012-04-11 13:51        2071424              c:\windows\system32\dllcache\ntkrnlpa.exe
+ 2009-04-17 16:45 . 2012-04-11 13:51        2150912              c:\windows\system32\dllcache\ntkrnlmp.exe
+ 2008-04-14 12:00 . 2012-03-01 11:00        5978624              c:\windows\system32\dllcache\mshtml.dll
+ 2009-02-20 16:49 . 2012-03-01 11:00        2000384              c:\windows\system32\dllcache\iertutil.dll
+ 2008-07-09 14:25 . 2009-02-06 20:07        3698584              c:\windows\system32\dllcache\ieapfltr.dat
+ 2012-02-02 13:56 . 2012-02-02 13:56        1041848              c:\windows\system32\Adobe\Shockwave 11\SwHelper_1164634.exe
+ 2011-12-15 10:53 . 2011-12-15 10:53        1040824              c:\windows\system32\Adobe\Shockwave 11\SwHelper_1163633.exe
+ 2012-02-02 13:32 . 2012-02-02 13:32        1224704              c:\windows\system32\Adobe\Shockwave 11\gi.dll
+ 2012-02-02 13:38 . 2012-02-02 13:38        1742336              c:\windows\system32\Adobe\Shockwave 11\dirapi.dll
- 2011-03-25 04:15 . 2011-03-25 04:15        5025792              c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Windows.Forms.dll
+ 2011-12-25 01:50 . 2011-12-25 01:50        5025792              c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Windows.Forms.dll
+ 2011-12-25 02:50 . 2011-12-25 02:50        5246976              c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Web.dll
+ 2011-12-25 01:50 . 2011-12-25 01:50        3186688              c:\windows\Microsoft.NET\Framework\v2.0.50727\System.dll
+ 2011-12-25 01:50 . 2011-12-25 01:50        5913360              c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
- 2011-07-07 03:18 . 2011-07-07 03:18        4550656              c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll
+ 2011-12-25 01:50 . 2011-12-25 01:50        4550656              c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll
+ 2012-01-23 11:44 . 2012-01-23 11:44        2310656              c:\windows\Installer\90c2d2.msi
+ 2012-01-23 10:57 . 2012-01-23 10:57        9474048              c:\windows\Installer\654e96.msi
+ 2011-12-26 08:59 . 2011-12-26 08:59        4368896              c:\windows\Installer\551d54.msp
+ 2011-10-30 21:54 . 2011-10-30 21:54        2748416              c:\windows\Installer\3bc822.msp
+ 2011-06-06 11:55 . 2011-06-06 11:55        2215312              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010\10.1.0\rt3d.dll
+ 2011-06-06 11:55 . 2011-06-06 11:55        1189004              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010\10.1.0\JSByteCodeWin.bin
+ 2011-06-06 11:55 . 2011-06-06 11:55        6543768              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010\10.1.0\authplay.dll
+ 2011-06-06 11:55 . 2011-06-06 11:55        1240992              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010\10.1.0\AdobeCollabSync.exe
+ 2011-06-06 11:55 . 2011-06-06 11:55        1480600              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010\10.1.0\AcroRd32.exe
+ 2012-01-20 14:42 . 2009-03-08 03:34        1206784              c:\windows\ie8updates\KB982381-IE8\urlmon.dll
+ 2012-01-20 14:42 . 2009-03-08 03:41        5937152              c:\windows\ie8updates\KB982381-IE8\mshtml.dll
+ 2012-01-20 14:42 . 2009-03-08 03:32        1985024              c:\windows\ie8updates\KB982381-IE8\iertutil.dll
+ 2012-04-12 13:43 . 2011-12-17 19:43        1212416              c:\windows\ie8updates\KB2675157-IE8\urlmon.dll
+ 2012-04-12 13:43 . 2011-12-17 19:43        5979136              c:\windows\ie8updates\KB2675157-IE8\mshtml.dll
+ 2012-04-12 13:43 . 2011-12-17 19:43        2000384              c:\windows\ie8updates\KB2675157-IE8\iertutil.dll
+ 2012-02-15 13:08 . 2011-11-04 19:13        1212416              c:\windows\ie8updates\KB2647516-IE8\urlmon.dll
+ 2012-02-15 13:08 . 2011-11-04 19:13        5978112              c:\windows\ie8updates\KB2647516-IE8\mshtml.dll
+ 2012-02-15 13:08 . 2011-11-04 19:13        2000384              c:\windows\ie8updates\KB2647516-IE8\iertutil.dll
+ 2012-01-20 14:43 . 2010-05-06 10:31        1209344              c:\windows\ie8updates\KB2618444-IE8\urlmon.dll
+ 2012-01-20 14:43 . 2010-05-06 10:31        5950976              c:\windows\ie8updates\KB2618444-IE8\mshtml.dll
+ 2012-01-20 14:43 . 2010-05-06 10:31        1985536              c:\windows\ie8updates\KB2618444-IE8\iertutil.dll
+ 2012-01-20 14:32 . 2011-10-31 23:36        1168896              c:\windows\ie8\urlmon.dll
+ 2012-01-20 14:32 . 2011-11-04 15:14        3616256              c:\windows\ie8\mshtml.dll
+ 2012-01-20 14:32 . 2011-10-31 23:36        6076416              c:\windows\ie8\ieframe.dll
+ 2012-01-20 14:32 . 2009-06-29 08:33        2452872              c:\windows\ie8\ieapfltr.dat
+ 2009-04-17 16:45 . 2012-04-11 13:51        2194944              c:\windows\Driver Cache\i386\ntoskrnl.exe
+ 2009-04-17 16:45 . 2012-04-11 13:51        2029056              c:\windows\Driver Cache\i386\ntkrpamp.exe
+ 2009-02-10 17:03 . 2012-04-11 13:51        2071424              c:\windows\Driver Cache\i386\ntkrnlpa.exe
+ 2009-04-17 16:45 . 2012-04-11 13:51        2150912              c:\windows\Driver Cache\i386\ntkrnlmp.exe
+ 2012-05-09 17:39 . 2012-05-09 17:39        3325440              c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\6d8bef0d008389874e55c0308f0c18e5\WindowsBase.ni.dll
+ 2012-05-11 12:40 . 2012-05-11 12:40        1049600              c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClients#\41a81b97625c113b591ed082c95276e2\UIAutomationClientsideProviders.ni.dll
+ 2012-05-09 17:39 . 2012-05-09 17:39        7953408              c:\windows\assembly\NativeImages_v2.0.50727_32\System\e4b5afc4da43b1c576f9322f9f2e1bfe\System.ni.dll
+ 2012-05-11 12:40 . 2012-05-11 12:40        5450752              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\3bba1b8b0b5ef0be238b011cc7a0575e\System.Xml.ni.dll
+ 2012-05-11 12:48 . 2012-05-11 12:48        1356288              c:\windows\assembly\NativeImages_v2.0.50727_32\System.WorkflowServ#\33fa6a2055bf857bff2e31020279b5e9\System.WorkflowServices.ni.dll
+ 2012-05-11 12:48 . 2012-05-11 12:48        1908224              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Run#\5eccf6fef6bee8a2f93bc65ff33699bb\System.Workflow.Runtime.ni.dll
+ 2012-05-11 12:48 . 2012-05-11 12:48        4514304              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Com#\62bd2e1bf98b04ceca2102c8f54aab9d\System.Workflow.ComponentModel.ni.dll
+ 2012-05-11 12:48 . 2012-05-11 12:48        2992640              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Act#\8215548b3d4aabbaa0557ab747700778\System.Workflow.Activities.ni.dll
+ 2012-05-11 12:47 . 2012-05-11 12:47        1840640              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Services\3e11aea7d742b5eddbd0b6bd1012f7df\System.Web.Services.ni.dll
+ 2012-05-11 12:47 . 2012-05-11 12:47        2209280              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\ff995dde9cd34ff1e8ac7ab55fc92d32\System.Web.Mobile.ni.dll
+ 2012-05-11 12:47 . 2012-05-11 12:47        2405888              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\8899d1091e64a4d0b6ae69060197091a\System.Web.Extensions.ni.dll
+ 2012-05-11 12:39 . 2012-05-11 12:39        1917440              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Speech\5efb50c91f3c5e49be2079f625d933b7\System.Speech.ni.dll
+ 2012-05-11 12:47 . 2012-05-11 12:47        1706496              c:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel#\97d635f5c656ae43d94b55e67fc4ab50\System.ServiceModel.Web.ni.dll
+ 2012-05-11 12:42 . 2012-05-11 12:42        2345472              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\505e12638acd6fdb22e1fd2d4c6fc232\System.Runtime.Serialization.ni.dll
+ 2012-05-11 12:39 . 2012-05-11 12:39        1035776              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Printing\1d6707a5a9da16c1d1b88529837884d6\System.Printing.ni.dll
+ 2012-05-11 12:42 . 2012-05-11 12:42        1070080              c:\windows\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\e09496ddb2bf6f3b69707924f2e6b5ff\System.IdentityModel.ni.dll
+ 2012-05-11 12:39 . 2012-05-11 12:39        1591808              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\8ca00132a08c69697adf1cda32ebd835\System.Drawing.ni.dll
+ 2012-05-11 12:46 . 2012-05-11 12:46        1116672              c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\b55887436d2cfbe1fb32dd18d554185b\System.DirectoryServices.ni.dll
+ 2012-05-11 12:46 . 2012-05-11 12:46        1801216              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Deployment\832196527f0497078f085eaf9189265f\System.Deployment.ni.dll
+ 2012-05-11 12:39 . 2012-05-11 12:39        6616576              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data\12c6fe8d4dd78f9bddf847d3b2821c03\System.Data.ni.dll
+ 2012-05-11 12:43 . 2012-05-11 12:43        2510336              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.SqlXml\982b508698278c6ffb3d143bbe1e8bb8\System.Data.SqlXml.ni.dll
+ 2012-05-11 12:46 . 2012-05-11 12:46        1328128              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Services\2de7666b1cd0a1bc363726c9553dc39c\System.Data.Services.ni.dll
+ 2012-05-11 12:39 . 2012-05-11 12:39        2516480              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Linq\44a5fc9e7c71b1fe1e2c79b03ecc3bc7\System.Data.Linq.ni.dll
+ 2012-05-11 12:45 . 2012-05-11 12:45        9924096              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Entity\772c94f595cd87b7fa187d592ef46fcf\System.Data.Entity.ni.dll
+ 2012-05-11 12:39 . 2012-05-11 12:39        2295296              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Core\38d07a5ac34b99d94fd14f42e779f625\System.Core.ni.dll
+ 2012-05-11 12:38 . 2012-05-11 12:38        2146304              c:\windows\assembly\NativeImages_v2.0.50727_32\ReachFramework\2ecefd16184a78f19aaf0f02cc0a7e1f\ReachFramework.ni.dll
+ 2012-05-11 12:38 . 2012-05-11 12:38        1657856              c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationUI\51204805c71113e0db2103faa064b313\PresentationUI.ni.dll
+ 2012-05-09 17:39 . 2012-05-09 17:39        1451008              c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationBuildTa#\8c509044eea2ab22689ea43926b30108\PresentationBuildTasks.ni.dll
+ 2012-05-11 12:43 . 2012-05-11 12:43        1712128              c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\b49dd780ba8e3501b0adcf108b431e7b\Microsoft.VisualBasic.ni.dll
+ 2012-05-11 12:42 . 2012-05-11 12:42        1093120              c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\42145ebf75f77cabad442f0801a81c64\Microsoft.Transactions.Bridge.ni.dll
+ 2012-05-11 12:46 . 2012-05-11 12:46        2332160              c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.JScript\cfe15312373b4668398404b5822bab7d\Microsoft.JScript.ni.dll
+ 2012-05-11 12:43 . 2012-05-11 12:43        1966080              c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\f3fcd65eca42d13b746cf3f5bd993ee0\Microsoft.Build.Tasks.v3.5.ni.dll
+ 2012-05-11 12:43 . 2012-05-11 12:43        1620992              c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\2091903cd9b359e96f05ac2d6d25ef4e\Microsoft.Build.Tasks.ni.dll
+ 2012-05-11 12:43 . 2012-05-11 12:43        1888768              c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\5aa63a1cb41e3a5e1e8ed17072e60ec3\Microsoft.Build.Engine.ni.dll
- 2011-01-29 13:23 . 2011-01-29 13:23        1249280              c:\windows\assembly\GAC_MSIL\WindowsBase\3.0.0.0__31bf3856ad364e35\WindowsBase.dll
+ 2012-05-09 17:29 . 2012-05-09 17:29        1249280              c:\windows\assembly\GAC_MSIL\WindowsBase\3.0.0.0__31bf3856ad364e35\WindowsBase.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36        3186688              c:\windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
- 2011-10-16 08:19 . 2011-10-16 08:19        2048000              c:\windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36        2048000              c:\windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll
- 2011-10-16 08:17 . 2011-10-16 08:17        5025792              c:\windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
+ 2012-05-09 17:35 . 2012-05-09 17:35        5025792              c:\windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
- 2011-01-29 13:24 . 2011-01-29 13:24        1277952              c:\windows\assembly\GAC_MSIL\System.Web.Extensions\3.5.0.0__31bf3856ad364e35\System.Web.Extensions.dll
+ 2012-01-11 20:31 . 2012-01-11 20:31        1277952              c:\windows\assembly\GAC_MSIL\System.Web.Extensions\3.5.0.0__31bf3856ad364e35\System.Web.Extensions.dll
+ 2012-04-13 10:23 . 2012-04-13 10:23        5967872              c:\windows\assembly\GAC_MSIL\System.ServiceModel\3.0.0.0__b77a5c561934e089\System.ServiceModel.dll
- 2011-01-29 13:09 . 2011-01-29 13:09        5967872              c:\windows\assembly\GAC_MSIL\System.ServiceModel\3.0.0.0__b77a5c561934e089\System.ServiceModel.dll
- 2011-10-16 08:17 . 2011-10-16 08:17        5062656              c:\windows\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll
+ 2012-05-09 17:35 . 2012-05-09 17:35        5062656              c:\windows\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll
+ 2012-05-09 17:29 . 2012-05-09 17:29        5283840              c:\windows\assembly\GAC_MSIL\PresentationFramework\3.0.0.0__31bf3856ad364e35\PresentationFramework.dll
+ 2012-05-09 17:35 . 2012-05-09 17:35        5246976              c:\windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll
- 2011-10-16 08:19 . 2011-10-16 08:19        2933248              c:\windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36        2933248              c:\windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
+ 2012-05-09 17:29 . 2012-05-09 17:29        4214784              c:\windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\PresentationCore.dll
+ 2012-05-09 17:36 . 2012-05-09 17:36        4550656              c:\windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
- 2011-10-16 08:18 . 2011-10-16 08:18        4550656              c:\windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
+ 2009-04-17 16:54 . 2012-05-09 17:38        55656824              c:\windows\system32\MRT.exe
+ 2007-08-13 16:54 . 2012-03-02 04:00        11082752              c:\windows\system32\ieframe.dll
+ 2012-03-02 04:00 . 2012-03-02 04:00        11082752              c:\windows\system32\dllcache\ieframe.dll
+ 2012-01-03 17:44 . 2012-01-03 17:44        15929344              c:\windows\Installer\90c2d3.msp
+ 2012-04-04 13:32 . 2012-04-04 13:32        16613376              c:\windows\Installer\140b97.msp
+ 2012-04-06 00:12 . 2012-04-06 00:12        15709696              c:\windows\Installer\132e706.msp
+ 2012-01-04 00:25 . 2012-01-04 00:25        17751552              c:\windows\Installer\132e6f8.msp
+ 2012-04-06 01:13 . 2012-04-06 01:13        16527872              c:\windows\Installer\132e6eb.msp
+ 2011-06-06 11:55 . 2011-06-06 11:55        24731544              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010\10.1.0\AcroRd32.dll
+ 2012-01-20 14:42 . 2009-03-08 03:39        11063808              c:\windows\ie8updates\KB982381-IE8\ieframe.dll
+ 2012-04-12 13:43 . 2011-12-18 13:43        11082240              c:\windows\ie8updates\KB2675157-IE8\ieframe.dll
+ 2012-02-15 13:08 . 2011-11-04 19:13        11081728              c:\windows\ie8updates\KB2647516-IE8\ieframe.dll
+ 2012-05-09 17:33 . 2012-05-09 17:33        12218368              c:\windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP65.tmp\PresentationCore.dll
+ 2012-05-09 17:42 . 2012-05-09 17:42        14329856              c:\windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP14A.tmp\PresentationFramework.dll
+ 2012-05-11 12:39 . 2012-05-11 12:40        12430848              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\995fcf39ead2c2a53e084505c2c67d49\System.Windows.Forms.ni.dll
+ 2012-05-11 12:47 . 2012-05-11 12:47        11817472              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web\7861cd979ea5db3fb7d30ed94fb0edd2\System.Web.ni.dll
+ 2012-05-11 12:42 . 2012-05-11 12:42        17403904              c:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel\bc254d2fa26664898ae21d45643bc194\System.ServiceModel.ni.dll
+ 2012-05-11 12:39 . 2012-05-11 12:39        10683392              c:\windows\assembly\NativeImages_v2.0.50727_32\System.Design\a9256d2ad7e4be2bbb4e9b18c3997b84\System.Design.ni.dll
+ 2012-05-11 12:37 . 2012-05-11 12:37        14329856              c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\5b8ff47c1db373a2a4c638ca31988bd2\PresentationFramework.ni.dll
+ 2012-05-09 17:40 . 2012-05-09 17:40        12218368              c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\4eb3cd1f1d5a83617524a9dfb96a657d\PresentationCore.ni.dll
+ 2012-05-09 17:38 . 2012-05-09 17:38        11492352              c:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\e337c89bc9f81b69d7237aa70e935900\mscorlib.ni.dll
.
-- Snapshot auf jetziges Datum zurückgesetzt --
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-05-12 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-05-13 118784]
"AGRSMMSG"="AGRSMMSG.exe" [2003-02-14 88107]
"LtMoh"="c:\programme\ltmoh\Ltmoh.exe" [2002-11-25 172032]
"LaunchAp"="c:\programme\Launch Manager\LaunchAp.exe" [2003-05-12 32768]
"HotkeyApp"="c:\programme\Launch Manager\HotkeyApp.exe" [2003-09-04 40960]
"CtrlVol"="c:\programme\Launch Manager\CtrlVol.exe" [2003-08-22 20480]
"LMgrOSD"="c:\programme\Launch Manager\OSD.exe" [2003-06-25 204800]
"Wbutton"="c:\programme\Launch Manager\Wbutton.exe" [2003-09-08 65536]
"TkBellExe"="c:\programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" [2010-02-18 202256]
"QuickTime Task"="c:\programme\QuickTime\qttask.exe" [2011-10-24 421888]
"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2011-06-09 254696]
"Adobe ARM"="c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\
Microsoft-Indexerstellung.lnk - c:\programme\Microsoft Office\Office\FINDFAST.EXE [1997-10-18 111376]
Office-Start.lnk - c:\programme\Microsoft Office\Office\OSA.EXE [1997-10-18 51984]
VR-NetWorld Auftragsprüfung.lnk - c:\programme\VR-NetWorld\vrtoolcheckorder.exe [2011-10-26 1137152]
WISO Mein Steuer-Sparbuch heute.lnk - c:\programme\WISO\Steuersoftware 2012\mshaktuell.exe [2012-1-3 1380464]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
.
R0 TwkMs;CHIPDRIVE Mouse Adapter;c:\windows\system32\drivers\TWKMS.sys [24.04.2003 02:14 4828]
R1 bizVSerial;Franson VSerial;c:\windows\system32\drivers\bizVSerialNT.sys [29.10.2011 12:58 14949]
R2 cjpcsc;cyberJack PC/SC COM Service ;c:\windows\system32\cjpcsc.exe [29.10.2011 12:58 511920]
R2 Update-Service;Update-Service;c:\windows\System32\svchost.exe -k Update-Service [14.04.2008 14:00 14336]
R3 WBMS;Winbond Memory Stick Storage (MS) Device Driver;c:\windows\system32\drivers\wbms.sys [17.04.2009 17:56 30464]
R3 WBSD;Winbond Secure Digital Storage (SD/MMC) Device Driver;c:\windows\system32\drivers\wbsd.sys [17.04.2009 17:56 26240]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [05.04.2012 09:34 257696]
S3 CHIPDRIVE USB SmartCardReader;CHIPDRIVE USB SmartCardReader;c:\windows\system32\drivers\TwkUsb2K.sys [19.09.2005 03:07 35275]
S3 cjusb;REINER SCT cyberJack USB Driver;c:\windows\system32\drivers\cjusb.sys [29.10.2011 12:58 28144]
S3 libusb0;LibUsb-Win32 - Kernel Driver 09/17/2010, 1.2.1.0;c:\windows\system32\drivers\libusb0.sys [06.11.2010 14:11 35008]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\programme\Mozilla Maintenance Service\maintenanceservice.exe [01.05.2012 15:30 129976]
S3 TWKSER2K;CHIPDRIVE Serial SmartCardReader;c:\windows\system32\drivers\TWKSER2K.sys [25.08.2004 15:06 185611]
S3 usb2vcom;USB Data Cable;c:\windows\system32\drivers\usb2vcom.sys [28.09.2009 13:31 29152]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Update-Service-Installer-Service        REG_MULTI_SZ          Update-Service-Installer-Service
Update-Service        REG_MULTI_SZ          Update-Service
.
Inhalt des "geplante Tasks" Ordners
.
2012-06-07 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-05 13:42]
.
2010-05-22 c:\windows\Tasks\Install.job
- c:\windows\system32\Adobe\Shockwave 11\nssstub.exe [2010-05-22 21:14]
.
2012-06-08 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1275210071-1993962763-1957994488-1003.job
- c:\programme\Real\RealUpgrade\realupgrade.exe [2010-02-09 17:38]
.
2012-06-08 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1275210071-1993962763-1957994488-1003.job
- c:\programme\Real\RealUpgrade\realupgrade.exe [2010-02-09 17:38]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page =
uInternet Settings,ProxyOverride = <local>
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\dokumente und einstellungen\test\Anwendungsdaten\Mozilla\Firefox\Profiles\605jkkz1.default\
FF - prefs.js: browser.search.selectedEngine - Bing
FF - prefs.js: browser.startup.homepage - hxxp://www.web.de/
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=110819&tl=gbn193052&tt=050412_30b
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar_i.id - 4c9fa22b000000000000000e356ecbd5
FF - user.js: extensions.BabylonToolbar_i.hardId - 4c9fa22b000000000000000e356ecbd5
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15435
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1720:50
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar_i.tlbrId - tb9
FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
AddRemove-{09FF4DB8-7DE9-4D47-B7DB-915DB7D9A8CA} - c:\dokumente und einstellungen\All Users\Anwendungsdaten\{6AD8E59C-250C-4201-B5BA-56ADEF76FF46}\bm_installer.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-06-08 07:04
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'explorer.exe'(3928)
c:\windows\system32\webcheck.dll
.
Zeit der Fertigstellung: 2012-06-08  07:07:24
ComboFix-quarantined-files.txt  2012-06-08 05:07
ComboFix2.txt  2012-01-02 18:32
.
Vor Suchlauf: 13 Verzeichnis(se), 27.001.122.816 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 27.072.839.680 Bytes frei
.
- - End Of File - - EB617F35A930A81573F6FB7760309645
Viele Grüße
Ulrike


Alle Zeitangaben in WEZ +1. Es ist jetzt 23:48 Uhr.
Seite 1 von 3 1 23
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131