Hi,
nach urlaubsbedingter Pause nun ein neuer Versuch.
PC per Systemwiederherstellung 14 Tage zurück gesetzt. Zahlungsaufforderung ist weg. Scheint alles normal zu laufen.
Antivir findet 4 Dateien „Weelsof.T26“ -> Quarantäne
Malwarebytes findet anschließend nichts.
OTL durchgeführt (siehe unten)
Ist jetzt alles ok?
Danke schon im Voraus.
Kata
OTL Logfile: Code:
OTL logfile created on: 11.08.2012 23:44:41 - Run 2
OTL by OldTimer - Version 3.2.57.0 Folder = C:\Dokumente und Einstellungen\Belinea\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
1,86 Gb Total Physical Memory | 1,22 Gb Available Physical Memory | 65,45% Memory free
3,71 Gb Paging File | 3,04 Gb Available in Paging File | 81,86% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 232,88 Gb Total Space | 205,28 Gb Free Space | 88,15% Space Free | Partition Type: NTFS
Computer Name: FJ171209111702 | User Name: Belinea | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - C:\Dokumente und Einstellungen\Belinea\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\A - Eigene Programme\Seagate Festplatte\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe (Seagate Technology LLC)
PRC - C:\Programme\A - Eigene Programme\Seagate Festplatte\Seagate Dashboard 2.0\Seagate.Dashboard.DASWindowsService.exe (Seagate Technology LLC)
PRC - C:\Programme\A - Eigene Programme\Seagate Festplatte\Seagate Dashboard 2.0\DBAgent.exe (Seagate Technology LLC)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - c:\Programme\Avira\AntiVir Desktop\avcenter.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\A - Eigene Programme\Samsung Kies\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
PRC - C:\Programme\A - Eigene Programme\Samsung Kies\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
PRC - C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe (Acronis)
PRC - C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe (Acronis)
PRC - C:\Programme\A - Eigene Programme\Acronis\TrueImageMonitor.exe (Acronis)
PRC - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Virtualization Handler\CVHSVC.EXE (Microsoft Corporation)
PRC - C:\Programme\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
PRC - C:\Programme\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)
PRC - C:\Programme\Canon\Solution Menu EX\CNSEMAIN.EXE (CANON INC.)
PRC - C:\Programme\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
PRC - C:\Programme\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
PRC - C:\Programme\Fujitsu\Application Panel\QuickTouch.exe (FUJITSU LIMITED)
PRC - C:\Programme\Fujitsu\Application Panel\BtnHnd.exe (FUJITSU LIMITED)
PRC - C:\Programme\Fujitsu\Application Panel\BtnHndHkb.exe (FUJITSU LIMITED)
PRC - C:\Programme\Fujitsu\FUJ02E3\FUJ02E3.exe (FUJITSU LIMITED)
PRC - C:\Programme\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Programme\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Programme\Fujitsu\PSUtility\TrayManager.exe (FUJITSU LIMITED)
PRC - C:\Programme\Fujitsu\PSUtility\PSUService.exe (FUJITSU LIMITED)
PRC - C:\Programme\CyberLink\YouCam\YouCamTray.exe (CyberLink Corp.)
PRC - C:\Programme\Gemeinsame Dateien\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe (ABBYY)
PRC - C:\Programme\Fujitsu\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe (Fujitsu Technology Solutions)
PRC - C:\Addon\Fujitsu\WirelessSelector\WSUService.exe ()
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Canon\CAL\CALMAIN.exe (Canon Inc.)
PRC - C:\Programme\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe (FUJITSU LIMITED)
PRC - C:\WINDOWS\system32\CNAB4RPK.EXE (CANON INC.)
PRC - C:\Programme\A - Eigene Programme\USB Sharing\usbshare.exe ()
PRC - C:\WINDOWS\system32\Fast.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\TaskSwitch.exe ()
========== Modules (No Company Name) ==========
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.WorkflowServ#\17a9afd6fbe7d37c66cb396442831846\System.WorkflowServices.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceProce#\0b403482c5a31dc0cec9377c0b280917\System.ServiceProcess.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas#\2c57b6be947b1d634e01d7ca83edf764\Microsoft.VisualBasic.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\0768f273446d51e82b881fefa336b1ff\PresentationFramework.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\31e3c21587b4dea717c30f6a8284cf0e\System.Windows.Forms.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PresentationCore\111ac601dc82c1cbe471752cc89cf68a\PresentationCore.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\WindowsBase\2e1a07e19db5c4893ac1cb4f4ee9d764\WindowsBase.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Drawing\062d4fa1d5039f7c13d0b8354020e1fb\System.Drawing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\f4fcb907eac2ba328c43b16a924f592b\PresentationFramework.Luna.ni.dll ()
MOD - C:\Programme\Avira\AntiVir Desktop\sqlite3.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\58965dfe610f5b5d9a4e5827dc72d855\System.ServiceModel.Routing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\ed6033def458156a3739c490dc5ab276\System.ServiceModel.Discovery.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\9bf340a8e5c89c636e0b0c53e2e73148\System.ServiceModel.Channels.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Management\3dda5443c426708b378bed4bccd8a9b8\System.Management.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\1f9eeedcbb9596c36e860bddde96164f\System.ServiceModel.Activities.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\bdc91113911d829da2d8507fe3b9bbca\System.IdentityModel.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceModel\38bda63c19aeaf545ae43d4b9654b607\System.ServiceModel.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\2c37d10adeb8eac9e3743739888a851d\System.ServiceModel.Web.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Web.Services\dd8ab0ee8dc45623e2c28660c966621e\System.Web.Services.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\cc0e014ebf9164643ffee39f7b442ef4\System.Runtime.Remoting.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Transactions\d5430a5f8465903987644febf578089a\System.Transactions.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Runtime.Dura#\c961499c3d36ed4c19f78e073900882b\System.Runtime.DurableInstancing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\41b6973133c4e0a0b772f85682b02331\SMDiagnostics.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Runtime.Seri#\b9b013711388610ae6d7d3fe33246320\System.Runtime.Serialization.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xaml\5a9e654b223fc5ed6988b1d81e3546e3\System.Xaml.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml\5efec2a1f1c4a82f2ca8a2587ce508f2\System.Xml.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Configuration\f670f3ca08725547dd4df95c94dd9fce\System.Configuration.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\0a72692d39dc2b56b4fd5591a12762f5\System.Core.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\b0d46216b2d50e0db597634ca91eb3ad\System.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\mscorlib\e5de681ee33ae6535462d070428f4f1b\mscorlib.ni.dll ()
MOD - C:\Dokumente und Einstellungen\Belinea\Lokale Einstellungen\Temp\bd7c47bb-f5c0-417c-a180-ec348d87718a\CliSecureRT.dll ()
MOD - C:\Programme\A - Eigene Programme\Samsung Kies\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
MOD - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSPTLS.DLL ()
MOD - C:\Programme\OpenOffice.org 3\program\libxml2.dll ()
MOD - C:\Addon\Fujitsu\WirelessSelector\WSUService.exe ()
MOD - C:\Programme\A - Eigene Programme\USB Sharing\usbshare.exe ()
MOD - C:\WINDOWS\system32\pdfcmnnt.dll ()
MOD - C:\WINDOWS\system32\TaskSwitch.exe ()
========== Win32 Services (SafeList) ==========
SRV - (Seagate Dashboard Services) -- C:\Programme\A File not found
SRV - (ACDaemon) -- C:\Programme\Gemeinsame Dateien\ArcSoft\Connection Service\Bin\ACService.exe File not found
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (AcrSch2Svc) -- C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe (Acronis)
SRV - (cvhsvc) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Virtualization Handler\CVHSVC.EXE (Microsoft Corporation)
SRV - (sftvsa) -- C:\Programme\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
SRV - (sftlist) -- C:\Programme\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)
SRV - (odserv) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (osppsvc) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation)
SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (UNS) -- C:\Programme\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
SRV - (LMS) -- C:\Programme\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
SRV - (PowerSavingUtilityService) -- C:\Programme\Fujitsu\PSUtility\PSUService.exe (FUJITSU LIMITED)
SRV - (ABBYY.Licensing.FineReader.Professional.9.0) -- C:\Programme\Gemeinsame Dateien\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe (ABBYY)
SRV - (TestHandler) -- C:\Programme\Fujitsu\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe (Fujitsu Technology Solutions)
SRV - (WirelessSelectorService) -- C:\Addon\Fujitsu\WirelessSelector\WSUService.exe ()
SRV - (CCALib8) -- C:\Programme\Canon\CAL\CALMAIN.exe (Canon Inc.)
SRV - (InteractiveLogon) -- C:\WINDOWS\system32\Fast.exe (Microsoft Corporation)
========== Driver Services (SafeList) ==========
DRV - (WDICA) -- File not found
DRV - (USBCCID) -- system32\DRIVERS\Rts5161ccid.sys File not found
DRV - (Rts516xIR) -- system32\DRIVERS\Rts516xIR.sys File not found
DRV - (PDRFRAME) -- File not found
DRV - (PDRELI) -- File not found
DRV - (PDFRAME) -- File not found
DRV - (PDCOMP) -- File not found
DRV - (PCIDump) -- File not found
DRV - (lbrtfdc) -- File not found
DRV - (Changer) -- File not found
DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (timounter) -- C:\WINDOWS\system32\drivers\timntr.sys (Acronis)
DRV - (snapman) -- C:\WINDOWS\system32\drivers\snapman.sys (Acronis)
DRV - (tifsfilter) -- C:\WINDOWS\system32\drivers\tifsfilt.sys (Acronis)
DRV - (sscdmdm) -- C:\WINDOWS\system32\drivers\sscdmdm.sys (MCCI Corporation)
DRV - (sscdserd) -- C:\WINDOWS\system32\drivers\sscdserd.sys (MCCI Corporation)
DRV - (sscdbus) -- C:\WINDOWS\system32\drivers\sscdbus.sys (MCCI Corporation)
DRV - (sscdmdfl) -- C:\WINDOWS\system32\drivers\sscdmdfl.sys (MCCI Corporation)
DRV - (ssadmdm) -- C:\WINDOWS\system32\drivers\ssadmdm.sys (MCCI Corporation)
DRV - (ssadbus) -- C:\WINDOWS\system32\drivers\ssadbus.sys (MCCI Corporation)
DRV - (androidusb) -- C:\WINDOWS\system32\drivers\ssadadb.sys (Google Inc)
DRV - (ssadmdfl) -- C:\WINDOWS\system32\drivers\ssadmdfl.sys (MCCI Corporation)
DRV - (Sftvol) -- C:\WINDOWS\system32\drivers\Sftvolxp.sys (Microsoft Corporation)
DRV - (Sftredir) -- C:\WINDOWS\system32\drivers\Sftredirxp.sys (Microsoft Corporation)
DRV - (Sftplay) -- C:\WINDOWS\system32\drivers\Sftplayxp.sys (Microsoft Corporation)
DRV - (Sftfs) -- C:\WINDOWS\system32\drivers\Sftfsxp.sys (Microsoft Corporation)
DRV - (avkmgr) -- C:\WINDOWS\system32\drivers\avkmgr.sys (Avira GmbH)
DRV - (RTLE8023xp) -- C:\WINDOWS\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation )
DRV - (AR5416) -- C:\WINDOWS\system32\drivers\athw.sys (Atheros Communications, Inc.)
DRV - (HECI) -- C:\WINDOWS\system32\drivers\HECI.sys (Intel Corporation)
DRV - (IntcDAud) -- C:\WINDOWS\system32\drivers\IntcDAud.sys (Intel(R) Corporation)
DRV - (Impcd) -- C:\WINDOWS\system32\drivers\Impcd.sys (Intel Corporation)
DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (IntcAzAudAddService) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (tosrfbd) -- C:\WINDOWS\system32\drivers\tosrfbd.sys (TOSHIBA CORPORATION)
DRV - (tosrfusb) -- C:\WINDOWS\system32\drivers\tosrfusb.sys (TOSHIBA CORPORATION)
DRV - (Tosrfhid) -- C:\WINDOWS\system32\drivers\Tosrfhid.sys (TOSHIBA Corporation.)
DRV - (RSUSBSTOR) -- C:\WINDOWS\system32\drivers\RTSUCR.sys (Realtek Semiconductor Corp.)
DRV - (Ambfilt) -- C:\WINDOWS\system32\drivers\Ambfilt.sys (Creative)
DRV - (S3SavageNB) -- C:\WINDOWS\system32\drivers\s3gnbm.sys (S3 Graphics, Inc.)
DRV - (Monfilt) -- C:\WINDOWS\system32\drivers\Monfilt.sys (Creative Technology Ltd.)
DRV - (FUJ02E3) -- C:\WINDOWS\system32\drivers\fuj02e3.sys (FUJITSU LIMITED)
DRV - (FUJ02B1) -- C:\WINDOWS\system32\drivers\fuj02b1.sys (FUJITSU LIMITED)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - user.js - File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@garmin.com/GpsControl: C:\Programme\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Programme\A - Eigene Programme\VLC Player\VLC\npvlc.dll (VideoLAN)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Programme\A - Eigene Programme\Firefox\components [2012.08.11 18:53:28 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Programme\A - Eigene Programme\Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\mail@shopping-preise.de: C:\Dokumente und Einstellungen\Belinea\Anwendungsdaten\Mozilla\Firefox\Profiles\f1daiucz.default\extensions\mail@shopping-preise.de [2012.04.01 20:53:55 | 000,000,000 | ---D | M]
[2012.03.09 16:34:07 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Belinea\Anwendungsdaten\Mozilla\Extensions
[2012.07.23 22:58:06 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Belinea\Anwendungsdaten\Mozilla\Firefox\Profiles\f1daiucz.default\extensions
[2012.04.01 20:53:55 | 000,000,000 | ---D | M] (Shopping-preise.de) -- C:\Dokumente und Einstellungen\Belinea\Anwendungsdaten\Mozilla\Firefox\Profiles\f1daiucz.default\extensions\mail@shopping-preise.de
O1 HOSTS File: ([2008.04.14 14:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4 - HKLM..\Run: [Acronis Scheduler2 Service] C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe (Acronis)
O4 - HKLM..\Run: [Acronis*True*Image Monitor] C:\Programme\A - Eigene Programme\Acronis\TrueImageMonitor.exe (Acronis)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [CanonSolutionMenuEx] C:\Programme\Canon\Solution Menu EX\CNSEMAIN.EXE (CANON INC.)
O4 - HKLM..\Run: [CoolSwitch] C:\WINDOWS\system32\TaskSwitch.exe ()
O4 - HKLM..\Run: [DBAgent] C:\Programme\A - Eigene Programme\Seagate Festplatte\Seagate Dashboard 2.0\DBAgent.exe (Seagate Technology LLC)
O4 - HKLM..\Run: [FastUser] C:\WINDOWS\system32\Fast.exe (Microsoft Corporation)
O4 - HKLM..\Run: [IndicatorUtility] C:\Programme\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe (FUJITSU LIMITED)
O4 - HKLM..\Run: [KiesTrayAgent] C:\Programme\A - Eigene Programme\Samsung Kies\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKLM..\Run: [LoadBtnHnd] C:\Programme\Fujitsu\Application Panel\BtnHnd.exe (FUJITSU LIMITED)
O4 - HKLM..\Run: [LoadFUJ02E3] C:\Programme\Fujitsu\FUJ02E3\FUJ02E3.exe (FUJITSU LIMITED)
O4 - HKLM..\Run: [LoadFujitsuQuickTouch] C:\Programme\Fujitsu\Application Panel\QuickTouch.exe (FUJITSU LIMITED)
O4 - HKLM..\Run: [PSUTility] C:\Programme\Fujitsu\PSUtility\TrayManager.exe (FUJITSU LIMITED)
O4 - HKLM..\Run: [YouCam Mirror Tray icon] C:\Programme\CyberLink\YouCam\YouCamTray.exe (CyberLink Corp.)
O4 - HKCU..\Run: [KiesHelper] C:\Programme\A - Eigene Programme\Samsung Kies\Kies\KiesHelper.exe (Samsung)
O4 - HKCU..\Run: [KiesPDLR] C:\Programme\A - Eigene Programme\Samsung Kies\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
O4 - HKCU..\Run: [Uploader] C:\Programme\A - Eigene Programme\Seagate Festplatte\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe (Seagate Technology LLC)
O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware] C:\Programme\A - Eigene Programme\MalwareBytes\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\USB Sharing.lnk = C:\Programme\A - Eigene Programme\USB Sharing\usbshare.exe ()
O4 - Startup: C:\Dokumente und Einstellungen\Belinea\Startmenü\Programme\Autostart\OpenOffice.org 3.1.lnk = C:\Programme\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1326382748859 (MUWebControl Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{DE2D4E70-2B78-4B65-AE58-22C6A13B5F5A}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Belinea\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Belinea\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.01.12 21:08:07 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{5420a4c8-3a75-11e0-8c51-18f46aa5b932}\Shell\AutoRun\command - "" = E:\UpdateInstaller.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
========== Files/Folders - Created Within 30 Days ==========
[2012.08.11 23:30:22 | 000,596,992 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Belinea\Desktop\OTL.exe
[2012.08.11 23:01:49 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Belinea\Anwendungsdaten\Malwarebytes
[2012.08.11 23:01:30 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
[2012.08.11 23:01:29 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2012.08.11 23:01:28 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012.08.11 18:44:48 | 000,000,000 | ---D | C] -- C:\$WIN_NT$.~BT
[2012.08.02 12:15:02 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\blmlcnmnqetpkez
[2012.07.31 09:11:50 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Mozilla
[2012.07.28 22:48:24 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ZoomBrowser
[2012.07.28 22:47:33 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Canon Utilities
[2012.07.27 23:42:31 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Belinea\Lokale Einstellungen\Anwendungsdaten\Seagate_Technology_LLC
[2012.07.27 23:37:15 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Belinea\Anwendungsdaten\Leadertech
[2012.07.27 23:25:54 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Belinea\Anwendungsdaten\Nero
[2012.07.27 23:25:47 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Belinea\My Online Documents
[2012.07.27 23:23:49 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Seagate Dashboard 2.0
[2012.07.27 23:23:42 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Nero
[2012.07.27 23:23:30 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Nero
[2012.07.27 23:03:25 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Seagate
[2012.07.27 23:03:24 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Belinea\Anwendungsdaten\Seagate
[2012.07.26 09:42:50 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Belinea\Anwendungsdaten\Edraw Max
[2012.07.24 10:20:02 | 000,000,000 | ---D | C] -- C:\Programme\Recuva
[2012.07.20 18:22:24 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Belinea\Lokale Einstellungen\Anwendungsdaten\Paint.NET
[2012.07.19 22:14:18 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Belinea\Anwendungsdaten\vlc
[2012.07.19 13:33:06 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Belinea\Lokale Einstellungen\Anwendungsdaten\SmallBasic
[2012.07.19 13:32:13 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Belinea\Startmenü\Programme\Small Basic
[2012.07.19 13:32:13 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2012.08.11 23:30:26 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Belinea\Desktop\OTL.exe
[2012.08.11 23:01:30 | 000,001,092 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012.08.11 19:15:03 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.08.11 18:55:07 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.08.11 18:55:05 | 2001,260,544 | -HS- | M] () -- C:\hiberfil.sys
[2012.08.11 18:34:55 | 000,000,267 | RHS- | M] () -- C:\BOOT.BAK
[2012.08.09 12:45:04 | 000,536,730 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2012.08.09 12:45:04 | 000,511,488 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012.08.09 12:45:04 | 000,107,872 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2012.08.09 12:45:04 | 000,090,182 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012.08.02 12:15:03 | 000,000,051 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\edicrsksivcqfbh
[2012.07.28 22:48:24 | 000,001,196 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\ZoomBrowser EX.lnk
[2012.07.28 22:48:04 | 000,000,973 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Picture Style Editor.lnk
[2012.07.28 22:47:33 | 000,000,943 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\EOS Utility.lnk
[2012.07.28 11:10:55 | 000,000,656 | ---- | M] () -- C:\WINDOWS\tasks\Belinea.job
[2012.07.28 00:18:18 | 000,000,446 | ---- | M] () -- C:\WINDOWS\tasks\Thomas DBAgent 2 0.job
[2012.07.27 23:45:12 | 000,000,448 | ---- | M] () -- C:\WINDOWS\tasks\Belinea DBAgent 2 0.job
[2012.07.27 23:23:50 | 000,002,066 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Seagate Dashboard 2.0.lnk
[2012.07.20 18:22:41 | 000,001,039 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Paint.NET.lnk
[2012.07.19 22:14:13 | 000,003,584 | ---- | M] () -- C:\Dokumente und Einstellungen\Belinea\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.07.19 13:35:12 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2012.07.19 09:33:19 | 000,000,644 | ---- | M] () -- C:\WINDOWS\wiso.ini
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
========== Files Created - No Company Name ==========
[2012.08.11 23:01:30 | 000,001,092 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012.08.11 18:34:55 | 000,260,288 | R--- | C] () -- C:\$LDR$
[2012.08.11 18:34:55 | 000,000,267 | RHS- | C] () -- C:\BOOT.BAK
[2012.08.02 12:14:58 | 000,000,051 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\edicrsksivcqfbh
[2012.07.28 22:48:24 | 000,001,196 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\ZoomBrowser EX.lnk
[2012.07.28 22:48:04 | 000,000,973 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Picture Style Editor.lnk
[2012.07.28 22:47:33 | 000,000,943 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\EOS Utility.lnk
[2012.07.28 11:07:42 | 000,000,656 | ---- | C] () -- C:\WINDOWS\tasks\Belinea.job
[2012.07.27 23:47:42 | 000,000,446 | ---- | C] () -- C:\WINDOWS\tasks\Thomas DBAgent 2 0.job
[2012.07.27 23:25:50 | 000,000,448 | ---- | C] () -- C:\WINDOWS\tasks\Belinea DBAgent 2 0.job
[2012.07.27 23:23:50 | 000,002,066 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Seagate Dashboard 2.0.lnk
[2012.07.20 18:22:41 | 000,001,039 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Paint.NET.lnk
[2012.07.19 22:14:13 | 000,003,584 | ---- | C] () -- C:\Dokumente und Einstellungen\Belinea\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.07.19 21:20:22 | 000,163,056 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
[2012.06.14 10:59:28 | 000,000,017 | ---- | C] () -- C:\WINDOWS\System32\shortcut_ex.dat
[2012.05.31 00:26:36 | 000,870,293 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-S-1-5-21-178420970-498315890-1051114277-1006-0.dat
[2012.04.09 23:23:43 | 000,000,644 | ---- | C] () -- C:\WINDOWS\wiso.ini
[2012.04.08 00:45:26 | 000,866,797 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-S-1-5-21-178420970-498315890-1051114277-1005-0.dat
[2012.04.08 00:45:26 | 000,301,790 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-System.dat
[2012.04.07 22:16:53 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2012.04.01 20:53:54 | 000,338,432 | ---- | C] () -- C:\WINDOWS\System32\sqlite36_engine.dll
[2012.03.16 11:31:34 | 000,393,256 | ---- | C] () -- C:\WINDOWS\System32\CNQ4809N.DAT
[2012.03.11 12:45:33 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll
[2012.03.10 22:26:31 | 000,037,888 | ---- | C] () -- C:\WINDOWS\System32\setupnt.dll
[2012.03.09 15:51:25 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2012.01.31 01:15:44 | 000,030,568 | ---- | C] () -- C:\WINDOWS\MusiccityDownload.exe
[2012.01.31 01:15:42 | 000,974,848 | ---- | C] () -- C:\WINDOWS\System32\cis-2.4.dll
[2012.01.31 01:15:42 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\issacapi_bs-2.3.dll
[2012.01.31 01:15:42 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\issacapi_pe-2.3.dll
[2012.01.31 01:15:42 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\issacapi_se-2.3.dll
[2011.02.17 10:47:54 | 000,000,140 | ---- | C] () -- C:\Dokumente und Einstellungen\Belinea\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2011.02.17 10:34:24 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2011.02.17 10:33:57 | 000,080,416 | ---- | C] () -- C:\WINDOWS\System32\RtNicProp32.dll
[2011.02.17 10:32:47 | 000,127,896 | ---- | C] () -- C:\WINDOWS\System32\igcompkrng575.bin
[2011.02.17 10:32:46 | 000,874,032 | ---- | C] () -- C:\WINDOWS\System32\igkrng575.bin
[2011.02.17 10:32:46 | 000,004,096 | ---- | C] ( ) -- C:\WINDOWS\System32\IGFXDEVLib.dll
< End of report > --- --- --- |