Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Polizeivirus auf Windows Vista Home Premium (https://www.trojaner-board.de/124615-polizeivirus-windows-vista-home-premium.html)

rene07 24.09.2012 13:47
Polizeivirus auf Windows Vista Home Premium
 
Hi Leute,
nachdem ich den Polizeivirus auf meinem Notebook dank eurer Hilfe erfolgreich bekämpft habe, habe ich ihn nun auch auf meinem Stand-PC.

Könnt ihr mir wieder helfen?

Hier der Inhalt der OTL.txt:
Code:
OTL logfile created on: 24.09.2012 14:27:25 - Run 1
OTL by OldTimer - Version 3.2.66.2    Folder = J:\
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000C07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy
 
1021,82 Mb Total Physical Memory | 428,58 Mb Available Physical Memory | 41,94% Memory free
2,25 Gb Paging File | 1,47 Gb Available in Paging File | 65,37% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 290,13 Gb Total Space | 233,41 Gb Free Space | 80,45% Space Free | Partition Type: NTFS
Drive D: | 7,96 Gb Total Space | 1,01 Gb Free Space | 12,73% Space Free | Partition Type: NTFS
Drive E: | 698,43 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive J: | 971,51 Mb Total Space | 622,54 Mb Free Space | 64,08% Space Free | Partition Type: FAT32
Unable to calculate disk information.
 
Computer Name: ANJA-PC | User Name: Anja | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.09.24 03:39:26 | 000,602,112 | ---- | M] (OldTimer Tools) -- J:\OTL.exe
PRC - [2012.06.29 03:00:47 | 000,748,664 | ---- | M] (Microsoft Corporation) -- C:\Programme\Internet Explorer\iexplore.exe
PRC - [2012.01.03 17:31:34 | 001,391,272 | ---- | M] (Ask) -- C:\Programme\Ask.com\Updater\Updater.exe
PRC - [2010.07.27 14:46:08 | 000,249,136 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
PRC - [2009.11.04 17:45:32 | 000,360,448 | ---- | M] (AMD) -- C:\Windows\System32\atieclxx.exe
PRC - [2009.11.04 17:45:02 | 000,172,032 | ---- | M] (AMD) -- C:\Windows\System32\atiesrxx.exe
PRC - [2009.04.11 00:28:16 | 000,117,248 | ---- | M] () -- \\?\C:\Windows\System32\wbem\WMIADAP.EXE
PRC - [2009.04.11 00:28:04 | 001,233,920 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe
PRC - [2009.04.11 00:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008.01.19 09:38:38 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MSASCui.exe
PRC - [2007.09.26 11:53:56 | 000,554,352 | ---- | M] (Symantec Corporation) -- C:\Programme\Symantec\LiveUpdate\AluSchedulerSvc.exe
PRC - [2007.03.12 11:22:00 | 000,517,768 | ---- | M] (Symantec Corporation) -- C:\Programme\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
PRC - [2007.03.01 17:38:48 | 004,390,912 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
PRC - [2007.02.15 12:59:00 | 000,118,784 | ---- | M] (OsdMaestro) -- C:\Programme\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
PRC - [2006.09.28 15:42:24 | 000,065,536 | ---- | M] (Hewlett-Packard Company) -- C:\hp\support\hpsysdrv.exe
PRC - [2006.05.29 20:29:46 | 001,708,032 | ---- | M] () -- C:\Programme\NETGEAR\WG111v3\WG111v3.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.06.14 18:09:59 | 011,820,032 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\508b444db523c5cf20ff12c7f440837b\System.Web.ni.dll
MOD - [2012.06.14 18:04:41 | 012,433,920 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\f2691cfa7671cdc58179e56ba9227591\System.Windows.Forms.ni.dll
MOD - [2012.06.14 18:04:32 | 001,592,320 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\18f9789aa214c657113e676b3a9015aa\System.Drawing.ni.dll
MOD - [2012.05.11 17:07:20 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\846b9cf2756fdd15f704c9bab9c70b6f\System.Runtime.Remoting.ni.dll
MOD - [2012.05.11 17:07:00 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\bd76aaaa03ddc15d1840207b5a480644\System.Configuration.ni.dll
MOD - [2012.05.10 14:36:04 | 005,450,752 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\d2630342a066a7cb9056d9eb6157687a\System.Xml.ni.dll
MOD - [2012.05.10 14:34:15 | 007,953,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\28d633338fc8d29f8af31935ef7d001b\System.ni.dll
MOD - [2012.05.10 14:33:47 | 011,492,352 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\af9c9e9d7e0523cd444f8b551baa9cbf\mscorlib.ni.dll
MOD - [2009.11.30 14:25:36 | 000,011,776 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.HydraVision.Runtime\2.0.3595.17931__90ba9c70f846762e\CLI.Caste.HydraVision.Runtime.dll
MOD - [2009.11.30 14:25:36 | 000,008,704 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.HydraVision.Shared\2.0.3595.17931__90ba9c70f846762e\CLI.Caste.HydraVision.Shared.dll
MOD - [2009.11.30 14:25:36 | 000,007,680 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.HydraVision.Wizard\2.0.3595.17935__90ba9c70f846762e\CLI.Caste.HydraVision.Wizard.dll
MOD - [2009.11.30 14:25:36 | 000,007,680 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.HydraVision.Dashboard\2.0.3595.17931__90ba9c70f846762e\CLI.Caste.HydraVision.Dashboard.dll
MOD - [2009.11.30 14:25:35 | 001,695,744 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager2.Graphics.Wizard\2.0.3595.17950__90ba9c70f846762e\CLI.Aspect.DisplaysManager2.Graphics.Wizard.dll
MOD - [2009.11.30 14:25:35 | 000,368,640 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime\2.0.3595.17822__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.dll
MOD - [2009.11.30 14:25:35 | 000,204,800 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Wizard\2.0.3595.17843__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Wizard.dll
MOD - [2009.11.30 14:25:35 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard\2.0.3595.17838__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.dll
MOD - [2009.11.30 14:25:35 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Runtime\2.0.3595.17832__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Runtime.dll
MOD - [2009.11.30 14:25:33 | 000,491,520 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Wizard\2.0.3595.17918__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Wizard.dll
MOD - [2009.11.30 14:25:33 | 000,077,824 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Runtime\2.0.3595.17898__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Runtime.dll
MOD - [2009.11.30 14:25:33 | 000,073,728 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard\2.0.3595.17832__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.dll
MOD - [2009.11.30 14:25:33 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Runtime\2.0.3595.17878__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Runtime.dll
MOD - [2009.11.30 14:25:33 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Runtime\2.0.3595.17868__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Runtime.dll
MOD - [2009.11.30 14:25:32 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Welcome.Graphics.Dashboard\2.0.3595.17919__90ba9c70f846762e\CLI.Aspect.Welcome.Graphics.Dashboard.dll
MOD - [2009.11.30 14:25:31 | 000,356,352 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Dashboard\2.0.3595.17883__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Dashboard.dll
MOD - [2009.11.30 14:25:31 | 000,094,208 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Wizard\2.0.3595.17884__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Wizard.dll
MOD - [2009.11.30 14:25:31 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Runtime\2.0.3595.17883__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Runtime.dll
MOD - [2009.11.30 14:25:30 | 000,643,072 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.OverDrive5.Graphics.Dashboard\2.0.3595.17930__90ba9c70f846762e\CLI.Aspect.OverDrive5.Graphics.Dashboard.dll
MOD - [2009.11.30 14:25:30 | 000,077,824 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.OverDrive5.Graphics.Runtime\2.0.3595.17929__90ba9c70f846762e\CLI.Aspect.OverDrive5.Graphics.Runtime.dll
MOD - [2009.11.30 14:25:29 | 000,823,296 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Dashboard\2.0.3595.17871__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Dashboard.dll
MOD - [2009.11.30 14:25:29 | 000,409,600 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Wizard\2.0.3595.17892__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Wizard.dll
MOD - [2009.11.30 14:25:28 | 001,142,784 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager2.Graphics.Dashboard\2.0.3595.17946__90ba9c70f846762e\CLI.Aspect.DisplaysManager2.Graphics.Dashboard.dll
MOD - [2009.11.30 14:25:28 | 000,196,608 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Dashboard\2.0.3595.17844__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Dashboard.dll
MOD - [2009.11.30 14:25:28 | 000,094,208 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Runtime\2.0.3595.17870__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Runtime.dll
MOD - [2009.11.30 14:25:28 | 000,094,208 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Dashboard\2.0.3595.17875__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Dashboard.dll
MOD - [2009.11.30 14:25:28 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Runtime\2.0.3595.17875__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Runtime.dll
MOD - [2009.11.30 14:25:27 | 000,573,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Dashboard\2.0.3595.17844__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Dashboard.dll
MOD - [2009.11.30 14:25:26 | 000,368,640 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Dashboard\2.0.3595.17864__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Dashboard.dll
MOD - [2009.11.30 14:25:26 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Runtime\2.0.3595.17848__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Runtime.dll
MOD - [2009.11.30 14:25:26 | 000,036,864 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Runtime\2.0.3595.17877__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Runtime.dll
MOD - [2009.11.30 14:25:25 | 000,393,216 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Dashboard\2.0.3595.17869__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Dashboard.dll
MOD - [2009.11.30 14:25:25 | 000,270,336 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
MOD - [2009.11.30 14:25:25 | 000,061,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Runtime\2.0.3595.17869__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Runtime.dll
MOD - [2009.11.30 14:25:25 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Runtime\2.0.3595.17869__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Runtime.dll
MOD - [2009.11.30 14:25:24 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.Hotkeys.Shared\2.0.3586.20615__90ba9c70f846762e\AEM.Plugin.Hotkeys.Shared.dll
MOD - [2009.11.30 14:25:24 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Actions.CCAA.Shared\2.0.3586.20610__90ba9c70f846762e\AEM.Actions.CCAA.Shared.dll
MOD - [2009.11.30 14:25:24 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.WinMessages.Shared\2.0.3586.20627__90ba9c70f846762e\AEM.Plugin.WinMessages.Shared.dll
MOD - [2009.11.30 14:25:24 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.REG.Shared\2.0.3586.20645__90ba9c70f846762e\AEM.Plugin.REG.Shared.dll
MOD - [2009.11.30 14:25:24 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.GD.Shared\2.0.3586.20643__90ba9c70f846762e\AEM.Plugin.GD.Shared.dll
MOD - [2009.11.30 14:25:24 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.EEU.Shared\2.0.3586.20625__90ba9c70f846762e\AEM.Plugin.EEU.Shared.dll
MOD - [2009.11.30 14:25:24 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.DPPE.Shared\2.0.3586.20643__90ba9c70f846762e\AEM.Plugin.DPPE.Shared.dll
MOD - [2009.11.30 14:25:24 | 000,007,168 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\atixclib\1.0.0.0__90ba9c70f846762e\atixclib.dll
MOD - [2009.11.30 14:25:23 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation\2.0.3586.20597__90ba9c70f846762e\LOG.Foundation.dll
MOD - [2009.11.30 14:25:23 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\NEWAEM.Foundation\2.0.3586.20598__90ba9c70f846762e\NEWAEM.Foundation.dll
MOD - [2009.11.30 14:25:23 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0703\2.0.2651.18802__90ba9c70f846762e\DEM.Graphics.I0703.dll
MOD - [2009.11.30 14:25:23 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\MOM.Foundation\2.0.3586.20623__90ba9c70f846762e\MOM.Foundation.dll
MOD - [2009.11.30 14:25:23 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0706\2.0.2743.23304__90ba9c70f846762e\DEM.Graphics.I0706.dll
MOD - [2009.11.30 14:25:22 | 000,147,456 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Shared\2.0.3586.20608__90ba9c70f846762e\CLI.Caste.Graphics.Shared.dll
MOD - [2009.11.30 14:25:22 | 000,098,304 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Foundation\2.0.3586.20602__90ba9c70f846762e\CLI.Foundation.dll
MOD - [2009.11.30 14:25:22 | 000,057,344 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Shared\2.0.3586.20634__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Shared.dll
MOD - [2009.11.30 14:25:22 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0601\2.0.2573.17685__90ba9c70f846762e\DEM.Graphics.I0601.dll
MOD - [2009.11.30 14:25:22 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Shared\2.0.3586.20641__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Shared.dll
MOD - [2009.11.30 14:25:22 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Foundation.XManifest\2.0.3586.20661__90ba9c70f846762e\CLI.Foundation.XManifest.dll
MOD - [2009.11.30 14:25:22 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared\2.0.3586.20620__90ba9c70f846762e\CLI.Component.Dashboard.Shared.dll
MOD - [2009.11.30 14:25:22 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared\2.0.3586.20619__90ba9c70f846762e\CLI.Component.Wizard.Shared.dll
MOD - [2009.11.30 14:25:22 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Client.Shared\2.0.3586.20609__90ba9c70f846762e\CLI.Component.Client.Shared.dll
MOD - [2009.11.30 14:25:22 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics\2.0.3586.20631__90ba9c70f846762e\DEM.Graphics.dll
MOD - [2009.11.30 14:25:22 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Foundation\2.0.2573.17684__90ba9c70f846762e\DEM.Foundation.dll
MOD - [2009.11.30 14:25:22 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared\2.0.3586.20616__90ba9c70f846762e\CLI.Component.Runtime.Shared.dll
MOD - [2009.11.30 14:25:22 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard.Shared\2.0.3586.20632__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.Shared.dll
MOD - [2009.11.30 14:25:22 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard.Shared\2.0.3586.20621__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.Shared.dll
MOD - [2009.11.30 14:25:21 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Shared\2.0.3586.20634__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Shared.dll
MOD - [2009.11.30 14:25:21 | 000,061,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.OverDrive5.Graphics.Shared\2.0.3586.20644__90ba9c70f846762e\CLI.Aspect.OverDrive5.Graphics.Shared.dll
MOD - [2009.11.30 14:25:21 | 000,061,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Shared\2.0.3586.20621__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Shared.dll
MOD - [2009.11.30 14:25:21 | 000,053,248 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Shared\2.0.3586.20633__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Shared.dll
MOD - [2009.11.30 14:25:21 | 000,049,152 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Shared\2.0.3586.20623__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Shared.dll
MOD - [2009.11.30 14:25:21 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Shared\2.0.3586.20619__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Shared.dll
MOD - [2009.11.30 14:25:21 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Shared\2.0.3586.20621__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Shared.dll
MOD - [2009.11.30 14:25:21 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Shared\2.0.3586.20632__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Shared.dll
MOD - [2009.11.30 14:25:21 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Shared\2.0.3586.20631__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Shared.dll
MOD - [2009.11.30 14:25:21 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Shared\2.0.3586.20633__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Shared.dll
MOD - [2009.11.30 14:25:21 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Shared\2.0.3586.20625__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Shared.dll
MOD - [2009.11.30 14:25:20 | 000,651,264 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\ResourceManagement.Foundation.Implementation\2.0.3595.17944__90ba9c70f846762e\ResourceManagement.Foundation.Implementation.dll
MOD - [2009.11.30 14:25:20 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.Source.Kit.Server\2.0.3595.17924__90ba9c70f846762e\AEM.Plugin.Source.Kit.Server.dll
MOD - [2009.11.30 14:25:20 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CustomFormats.Graphics.Shared\2.0.3586.20614__90ba9c70f846762e\CLI.Aspect.CustomFormats.Graphics.Shared.dll
MOD - [2009.11.30 14:25:20 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\APM.Foundation\2.0.3586.20624__90ba9c70f846762e\APM.Foundation.dll
MOD - [2009.11.30 14:25:20 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Server.Shared\2.0.3586.20615__90ba9c70f846762e\AEM.Server.Shared.dll
MOD - [2009.11.30 14:25:19 | 000,106,496 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\MOM.Implementation\2.0.3595.17913__90ba9c70f846762e\MOM.Implementation.dll
MOD - [2009.11.30 14:25:19 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation\2.0.3595.17911__90ba9c70f846762e\LOG.Foundation.Implementation.dll
MOD - [2009.11.30 14:25:19 | 000,036,864 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Private\2.0.3586.20605__90ba9c70f846762e\LOG.Foundation.Private.dll
MOD - [2009.11.30 14:25:19 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\ResourceManagement.Foundation.Private\2.0.3586.20614__90ba9c70f846762e\ResourceManagement.Foundation.Private.dll
MOD - [2009.11.30 14:25:19 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation.Private\2.0.3586.20620__90ba9c70f846762e\LOG.Foundation.Implementation.Private.dll
MOD - [2009.11.30 14:25:19 | 000,007,168 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Extension.EEU\2.0.3595.17819__90ba9c70f846762e\CLI.Component.Runtime.Extension.EEU.dll
MOD - [2009.11.30 14:25:18 | 000,565,248 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Systemtray\2.0.3595.17907__90ba9c70f846762e\CLI.Component.Systemtray.dll
MOD - [2009.11.30 14:25:18 | 000,405,504 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard\2.0.3595.17837__90ba9c70f846762e\CLI.Component.Wizard.dll
MOD - [2009.11.30 14:25:18 | 000,057,344 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.SkinFactory\2.0.3595.17821__90ba9c70f846762e\CLI.Component.SkinFactory.dll
MOD - [2009.11.30 14:25:18 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared.Private\2.0.3586.20627__90ba9c70f846762e\CLI.Component.Runtime.Shared.Private.dll
MOD - [2009.11.30 14:25:18 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Foundation.Private\2.0.3586.20612__90ba9c70f846762e\CLI.Foundation.Private.dll
MOD - [2009.11.30 14:25:18 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared.Private\2.0.3586.20622__90ba9c70f846762e\CLI.Component.Wizard.Shared.Private.dll
MOD - [2009.11.30 14:25:17 | 000,057,344 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime\2.0.3595.17819__90ba9c70f846762e\CLI.Component.Runtime.dll
MOD - [2009.11.30 14:25:16 | 001,220,608 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard\2.0.3595.17828__90ba9c70f846762e\CLI.Component.Dashboard.dll
MOD - [2009.11.30 14:25:16 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared.Private\2.0.3586.20623__90ba9c70f846762e\CLI.Component.Dashboard.Shared.Private.dll
MOD - [2009.11.30 14:25:15 | 000,061,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\APM.Server\2.0.3595.17817__90ba9c70f846762e\APM.Server.dll
MOD - [2009.11.30 14:25:15 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Server\2.0.3595.17818__90ba9c70f846762e\AEM.Server.dll
MOD - [2009.11.30 14:25:15 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Client.Shared.Private\2.0.3586.20618__90ba9c70f846762e\CLI.Component.Client.Shared.Private.dll
MOD - [2009.11.30 14:25:15 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\ATICCCom\2.0.0.0__90ba9c70f846762e\ATICCCom.dll
MOD - [2009.11.30 14:25:15 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime.Shared.Private\2.0.3586.20635__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.Shared.Private.dll
MOD - [2009.11.30 14:25:15 | 000,019,456 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CCC.Implementation\2.0.3595.17912__90ba9c70f846762e\CCC.Implementation.dll
MOD - [2009.10.01 17:45:50 | 000,016,384 | R--- | M] () -- C:\Programme\ATI Technologies\ATI.ACE\Branding\Branding.dll
MOD - [2009.03.29 22:42:14 | 000,434,176 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll
MOD - [2009.03.29 22:42:12 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2006.05.29 20:29:46 | 001,708,032 | ---- | M] () -- C:\Programme\NETGEAR\WG111v3\WG111v3.exe
 
 
========== Services (SafeList) ==========
 
SRV - File not found [Auto | Stopped] -- c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe /h ccCommon -- (LiveUpdate Notice Ex)
SRV - [2010.07.27 14:46:08 | 000,249,136 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe -- (SeaPort)
SRV - [2009.11.04 17:45:02 | 000,172,032 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2008.01.19 09:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2008.01.19 09:33:39 | 000,896,512 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2007.09.26 11:53:56 | 002,999,664 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Programme\Symantec\LiveUpdate\LuComServer_3_2.EXE -- (LiveUpdate)
SRV - [2007.09.26 11:53:56 | 000,554,352 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Programme\Symantec\LiveUpdate\AluSchedulerSvc.exe -- (Automatisches LiveUpdate - Scheduler)
SRV - [2007.03.12 11:22:00 | 000,517,768 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe -- (LiveUpdate Notice Service)
SRV - [2006.10.26 19:49:34 | 000,441,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2006.10.26 14:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive)
DRV - [2009.11.04 18:16:46 | 005,079,040 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2009.05.11 11:12:20 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2008.02.26 09:17:30 | 000,493,568 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\netr73.sys -- (netr73)
DRV - [2007.04.23 14:19:24 | 000,227,328 | ---- | M] (NETGEAR Inc.                          ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\wg111v3.sys -- (RTL8187B)
DRV - [2007.03.19 15:58:50 | 000,101,672 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\nvstor32.sys -- (nvstor32)
DRV - [2007.03.15 21:52:00 | 000,049,904 | R--- | M] (Avanquest Software) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\BVRPMPR5.SYS -- (BVRPMPR5)
DRV - [2007.03.12 22:37:00 | 004,465,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2006.11.02 09:30:56 | 000,429,056 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvm60x32.sys -- (NVENETFD)
DRV - [2005.12.12 19:27:00 | 000,019,072 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\PS2.sys -- (Ps2)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_AT&c=73&bd=Pavilion&pf=desktop
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_AT&c=73&bd=Pavilion&pf=desktop
IE - HKLM\..\URLSearchHook: {48405d3d-2674-4cd8-b1ef-9a719443bd3f} - C:\Programme\Search_USA\tbSea1.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2304564
IE - HKLM\..\SearchScopes\{CD209039-1E59-41CF-8CCE-DFD53C90F569}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://search.msn.com/spbasic.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.at/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKCU\..\URLSearchHook: {48405d3d-2674-4cd8-b1ef-9a719443bd3f} - C:\Programme\Search_USA\tbSea1.dll (Conduit Ltd.)
IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=DVS2&o=1586&src=kw&q={searchTerms}&locale=de_US&apn_ptnrs=^AAA&apn_dtid=^YYYYYY^YY^AT&apn_uid=2cfab5fa-f027-4d8f-9215-8a1c39e6598c&apn_sauid=0EF93260-2059-452E-8035-82F439694B00
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.at/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7GGLL_de
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2304564
IE - HKCU\..\SearchScopes\{CD209039-1E59-41CF-8CCE-DFD53C90F569}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = :
 
 
========== FireFox ==========
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.50401.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.11.2571: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.2.2629: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.1739: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{27182e60-b5f3-411c-b545-b44205977502}: C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ [2011.09.26 15:16:26 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3252b9ae-c69a-4eaf-9502-dc9c1f6c009e}: C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DMExtension\ [2011.09.26 15:16:56 | 000,000,000 | ---D | M]
 
[2010.08.13 18:06:23 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Anja\AppData\Roaming\mozilla\Extensions
[2010.08.13 18:06:23 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Anja\AppData\Roaming\mozilla\Extensions\mozswing@mozswing.org
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - homepage: hxxp://www.google.com/
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\18.0.1025.162\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\18.0.1025.162\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\18.0.1025.162\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.220.4 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U22 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll
CHR - plugin: RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit)  (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.0.50401.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: YouTube = C:\Users\Anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google-Suche = C:\Users\Anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Google Mail = C:\Users\Anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Search USA Toolbar) - {48405d3d-2674-4cd8-b1ef-9a719443bd3f} - C:\Programme\Search_USA\tbSea1.dll (Conduit Ltd.)
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Programme\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (Bing Bar BHO) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Programme\MSN Toolbar\Platform\6.3.2291.0\npwinext.dll (Microsoft Corporation)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Search USA Toolbar) - {48405d3d-2674-4cd8-b1ef-9a719443bd3f} - C:\Programme\Search_USA\tbSea1.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (@C:\Program Files\MSN Toolbar\Platform\6.3.2291.0\npwinext.dll,-100) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Programme\MSN Toolbar\Platform\6.3.2291.0\npwinext.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKCU\..\Toolbar\WebBrowser: (Search USA Toolbar) - {48405D3D-2674-4CD8-B1EF-9A719443BD3F} - C:\Programme\Search_USA\tbSea1.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [KBD] C:\hp\KBD\KbdStub.exe ()
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvSvc] C:\Windows\System32\nvsvc.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [OsdMaestro] C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe (OsdMaestro)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\RunOnce: [Launcher] C:\Windows\SMINST\Launcher.exe (soft thinks)
O8 - Extra context menu item: Free YouTube Download - C:\Users\Anja\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Anja\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{48FCB05A-956D-4BC6-8988-EBD475D432A9}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4B211F69-C1DD-4635-AD90-31E94651FBAB}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Programme\Common Files\microsoft shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Common Files\microsoft shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Anja\AppData\Roaming\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp
O24 - Desktop BackupWallPaper: C:\Users\Anja\AppData\Roaming\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007.07.19 15:51:35 | 000,000,074 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2007.06.19 14:50:23 | 000,321,056 | R--- | M] (THQ) - E:\autorun.exe -- [ CDFS ]
O32 - AutoRun File - [2007.03.29 14:45:28 | 000,000,051 | RH-- | M] () - E:\autorun.inf -- [ CDFS ]
O33 - MountPoints2\{4651a168-3e34-11dc-a1f5-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{4651a168-3e34-11dc-a1f5-806e6f6e6963}\Shell\AutoRun\command - "" = E:\autorun.exe -- [2007.06.19 14:50:23 | 000,321,056 | R--- | M] (THQ)
O33 - MountPoints2\{802e998a-89f3-11df-ab07-90e6ba03f72d}\Shell\AutoRun\command - "" = J:\ -- File not found
O33 - MountPoints2\{802e998a-89f3-11df-ab07-90e6ba03f72d}\Shell\open\Command - "" = rundll32.exe .\\icavpi.dll,InstallM
O33 - MountPoints2\{85e88f2b-8fa4-11dd-bf09-001bfce07dbf}\Shell - "" = AutoRun
O33 - MountPoints2\{85e88f2b-8fa4-11dd-bf09-001bfce07dbf}\Shell\AutoRun\command - "" = J:\LaunchU3.exe -a
O33 - MountPoints2\K\Shell - "" = AutoRun
O33 - MountPoints2\K\Shell\AutoRun\command - "" = K:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.09.24 14:30:22 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.09.24 14:30:22 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.09.24 14:29:27 | 000,628,504 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.09.24 14:29:27 | 000,595,798 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.09.24 14:29:27 | 000,126,054 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.09.24 14:29:27 | 000,103,872 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.09.24 14:26:44 | 000,000,000 | ---- | M] () -- C:\Users\Anja\defogger_reenable
[2012.09.24 14:21:01 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.09.24 14:20:54 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.09.24 14:20:50 | 1072,226,304 | -HS- | M] () -- C:\hiberfil.sys
[2012.09.03 18:03:30 | 004,503,728 | ---- | M] () -- C:\ProgramData\nud0repor.pad
[2012.09.02 21:38:40 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.09.02 21:26:08 | 000,001,722 | ---- | M] () -- C:\Users\Anja\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.09.24 14:26:44 | 000,000,000 | ---- | C] () -- C:\Users\Anja\defogger_reenable
[2012.09.02 21:26:07 | 000,001,722 | ---- | C] () -- C:\Users\Anja\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
[2012.09.02 21:25:57 | 004,503,728 | ---- | C] () -- C:\ProgramData\nud0repor.pad
[2012.06.11 15:38:01 | 025,855,383 | ---- | C] () -- C:\Users\Anja\Horoskop Anja Unterbrunner.MP3
[2010.10.22 19:45:05 | 000,009,252 | ---- | C] () -- C:\Users\Anja\J0212957.WMF
[2009.11.25 20:16:22 | 000,001,356 | ---- | C] () -- C:\Users\Anja\AppData\Local\d3d9caps.dat
[2009.08.14 20:38:46 | 030,666,272 | ---- | C] (                                                            ) -- C:\Users\Anja\HappyFoto-Designer.exe
[2008.03.20 23:17:03 | 000,031,073 | ---- | C] () -- C:\Users\Anja\AppData\Roaming\mdbu.bin
[2008.02.29 19:28:23 | 000,000,032 | ---- | C] () -- C:\ProgramData\ezsid.dat
[2008.02.26 22:03:40 | 000,000,305 | ---- | C] () -- C:\ProgramData\addr_file.html
[2008.02.26 21:43:27 | 000,008,856 | ---- | C] () -- C:\ProgramData\LUUnInstall.LiveUpdate
[2008.02.26 20:48:04 | 000,000,000 | ---- | C] () -- C:\Users\Anja\AppData\Roaming\wklnhst.dat
[2007.12.17 14:21:56 | 000,026,112 | ---- | C] () -- C:\Users\Anja\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
 
========== ZeroAccess Check ==========
 
[2006.11.02 14:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.08 19:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.04.11 00:28:26 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== LOP Check ==========
 
[2007.12.26 15:20:24 | 000,000,000 | ---D | M] -- C:\Users\Anja\AppData\Roaming\Ace
[2011.07.27 14:19:52 | 000,000,000 | ---D | M] -- C:\Users\Anja\AppData\Roaming\DVDVideoSoft
[2011.07.27 14:17:08 | 000,000,000 | ---D | M] -- C:\Users\Anja\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.07.04 19:56:46 | 000,000,000 | ---D | M] -- C:\Users\Anja\AppData\Roaming\Image Zone Express
[2008.01.12 21:34:45 | 000,000,000 | ---D | M] -- C:\Users\Anja\AppData\Roaming\mquadr.at
[2011.05.12 18:17:48 | 000,000,000 | ---D | M] -- C:\Users\Anja\AppData\Roaming\OpenOffice.org
[2007.12.17 14:20:00 | 000,000,000 | ---D | M] -- C:\Users\Anja\AppData\Roaming\Printer Info Cache
[2008.02.26 20:48:14 | 000,000,000 | ---D | M] -- C:\Users\Anja\AppData\Roaming\Template
 
========== Purity Check ==========
 
 

< End of report >
Hier der Inhalt der Extras.txt:
Code:
OTL Extras logfile created on: 24.09.2012 14:27:25 - Run 1
OTL by OldTimer - Version 3.2.66.2    Folder = J:\
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000C07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy
 
1021,82 Mb Total Physical Memory | 428,58 Mb Available Physical Memory | 41,94% Memory free
2,25 Gb Paging File | 1,47 Gb Available in Paging File | 65,37% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 290,13 Gb Total Space | 233,41 Gb Free Space | 80,45% Space Free | Partition Type: NTFS
Drive D: | 7,96 Gb Total Space | 1,01 Gb Free Space | 12,73% Space Free | Partition Type: NTFS
Drive E: | 698,43 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive J: | 971,51 Mb Total Space | 622,54 Mb Free Space | 64,08% Space Free | Partition Type: FAT32
Unable to calculate disk information.
 
Computer Name: ANJA-PC | User Name: Anja | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~3\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"UacDisableNotify" = 1
"InternetSettingsDisableNotify" = 1
"AutoUpdateDisableNotify" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{04684C72-B7C7-461E-A21D-D1D655571ACE}" = rport=445 | protocol=6 | dir=out | app=system |
"{148A9128-3A56-4B00-8A46-E84CD55CC26C}" = rport=137 | protocol=17 | dir=out | app=system |
"{2FFE3E40-E207-4C4F-BA44-04EB3D950942}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{41CC88C1-6CF9-4B22-BA2B-679828F4BD2E}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{424B22CE-8D98-41DD-8DA4-A6D9D47C5F6C}" = lport=445 | protocol=6 | dir=in | app=system |
"{46E53EFA-B8C5-4E6D-AA3E-D202DEFECD57}" = lport=137 | protocol=17 | dir=in | app=system |
"{518897B8-AD9B-46C5-ACB5-33FAD99A747C}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{54E8E7D7-F9F1-451C-8CF9-E25AE53F639E}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{594A6153-AC94-4AB8-84F5-7CFF9E18A9D8}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{654A8E81-6504-484D-B873-5A0F8E5D62ED}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{6550272F-A7F1-408E-A361-92C5C5068F98}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{6F53E141-AEB1-4B35-B9BF-6F5A5E6B13B0}" = lport=139 | protocol=6 | dir=in | app=system |
"{76040C52-CA0A-4716-9BBC-86D0B01AAC2F}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{97422129-FA82-4FA5-966D-6BB46A3005DA}" = rport=138 | protocol=17 | dir=out | app=system |
"{A2998623-B47C-426B-92D1-62EC30A8917B}" = lport=138 | protocol=17 | dir=in | app=system |
"{C069A7AF-D9A8-42B2-B467-83C441B743A1}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{C720463C-EBD2-479D-B547-65E35D60EAB8}" = rport=139 | protocol=6 | dir=out | app=system |
"{EAB43789-A9BD-4315-A8C1-2FE243CEC7E4}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1E27A417-1998-4FA1-A406-298C58F97645}" = protocol=6 | dir=in | app=c:\program files\hp\hp deskjet 2050 j510 series\bin\usbsetup.exe |
"{2A1F50D8-988B-4058-BB40-079AC89A6B5D}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{46D1B15E-7D3E-4688-A0B9-B7C105934984}" = protocol=17 | dir=in | app=c:\users\anja\desktop\limewire\limewire.exe |
"{4CAF71CA-B876-46E0-B51C-61957C462C01}" = protocol=17 | dir=in | app=c:\program files\hp\hp deskjet 2050 j510 series\bin\usbsetup.exe |
"{4EBB992C-F76A-4BF8-B4B2-2921A7C1A219}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{51102E3D-72EC-4369-8554-4BBB94477FA3}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{62B2619B-B4BB-43FA-8870-729E4240A73E}" = protocol=17 | dir=in | app=c:\windows\temp\aoninstaller.exe |
"{87DFCC79-C1E4-41A8-BE75-47A2C3243CA9}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{8A0AFA82-1EF8-4093-A8B7-E35EA6EF093C}" = protocol=6 | dir=in | app=c:\users\anja\desktop\limewire\limewire.exe |
"{A3FE4803-532A-48CA-8E51-B455E14D3F98}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{A4E99069-0FCC-4FFA-9DBF-D27925A1D316}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{BACAB87A-8972-4FE4-B8F7-A12BA506924E}" = protocol=17 | dir=in | app=c:\program files\aon\aoncontroller\aoninstaller\aoninstaller.exe |
"{BC673D15-E8A6-4358-8836-ED5E0FA58BF1}" = protocol=6 | dir=in | app=c:\windows\temp\aoninstaller.exe |
"{BF904972-103B-4090-986C-43FCADCFA6E1}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{C9B85ACB-5386-48C8-A572-CF6BB699D00C}" = protocol=6 | dir=in | app=c:\program files\aon\aoncontroller\aoncontroller\aoncontroller.exe |
"{F4063DF3-6F15-4850-8855-B674C68DFAF8}" = protocol=17 | dir=in | app=c:\program files\aon\aoncontroller\aoncontroller\aoncontroller.exe |
"{F9FED890-0352-4558-8F44-D23433507D60}" = protocol=6 | dir=in | app=c:\program files\aon\aoncontroller\aoninstaller\aoninstaller.exe |
"TCP Query User{0FC1A352-E1AA-49AD-AC7C-4CBDE49E2305}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{390EF353-C3D5-4E5C-9360-3B765074158C}C:\games\game alarm\gamealarm.exe" = protocol=6 | dir=in | app=c:\games\game alarm\gamealarm.exe |
"TCP Query User{732BB23F-15B0-4905-B10C-EBCB7DEBCAC5}C:\program files\skype\phone\skype.exe" = protocol=6 | dir=in | app=c:\program files\skype\phone\skype.exe |
"TCP Query User{BA1E4C7A-DBD7-4C89-8711-9A0E680FDCD3}C:\program files\skype\phone\skype.exe" = protocol=6 | dir=in | app=c:\program files\skype\phone\skype.exe |
"UDP Query User{9A97A894-395A-40AD-9140-9BE220190F83}C:\games\game alarm\gamealarm.exe" = protocol=17 | dir=in | app=c:\games\game alarm\gamealarm.exe |
"UDP Query User{CE8D61C4-911A-46A6-A0C9-1A122ECB3C96}C:\program files\skype\phone\skype.exe" = protocol=17 | dir=in | app=c:\program files\skype\phone\skype.exe |
"UDP Query User{DD8904E4-28C3-43AE-A763-2DFB828B01CE}C:\program files\skype\phone\skype.exe" = protocol=17 | dir=in | app=c:\program files\skype\phone\skype.exe |
"UDP Query User{F3831E0A-9A0F-41FA-9B8F-268F9D2FB846}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0394CDC8-FABD-4ed8-B104-03393876DFDF}" = Roxio Creator Tools
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{08234a0d-cf39-4dca-99f0-0c5cb496da81}" = Bing Bar
"{0CFD3BAF-9F4D-4D70-BD0B-638EA2504C25}" = PSSWCORE
"{0D2E9DCB-9938-475E-B4DD-8851738852FF}" = AIO_Scan
"{0D397393-9B50-4c52-84D5-77E344289F87}" = Roxio Creator Data
"{10010089-120F-4B71-A245-261A11D234FF}" = Studie zur Verbesserung von HP Deskjet 2050 J510 series Produkten
"{11F93B4B-48F0-4A4E-AE77-DFA96A99664B}" = Roxio Creator EasyArchive
"{1746EA69-DCB6-4408-B5A5-E75F55439CDF}" = Scan
"{179C56A4-F57F-4561-8BBF-F911D26EB435}" = WebReg
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1C80931B-D271-A7E5-06D8-60C4D6DCCE69}" = Catalyst Control Center Graphics Previews Common
"{1CAC7A41-583B-4483-9FA5-3E5465AFF8C2}" = Microsoft Default Manager
"{1ED31028-6D65-4CFD-AD03-8E484A052FE7}" = aonUpdate
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1FCA1E50-EB4B-1722-1605-721CECC3B6D7}" = Catalyst Control Center Graphics Light
"{1FF713E1-FE5E-4AD0-9C8C-B2E877846B45}" = Catalyst Control Center - Branding
"{20C42E1C-A610-A423-C59A-432EFDFA6D97}" = ccc-utility
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{23549DB2-183A-C2F1-F12A-4B20F386129A}" = CCC Help Greek
"{24557DC0-0839-496f-82F9-C4EB72EFE4FA}" = HP Deskjet All-In-One Software 8.0
"{25DE52ED-9E51-4C50-AE16-E258836ADF83}" = HP Deskjet 2050 J510 series - Grundlegende Software für das Gerät
"{267D1BAE-B645-CC3E-468B-1E94846CB003}" = CCC Help Portuguese
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 22
"{28E82311-8616-11E1-BEB0-B8AC6F97B88E}" = Google Earth
"{2EFA4E4C-7B5F-48F7-A1C0-1AA882B7A9C3}" = HP Update
"{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}" = Roxio Activation Module
"{38E84C0B-74F8-2CD7-8401-9A9638676061}" = CCC Help Spanish
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{40F7AED3-0C7D-4582-99F6-484A515C73F2}" = HP Easy Setup - Frontend
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{4511950B-88F9-302E-77F2-C953EF8045F8}" = Catalyst Control Center HydraVision Full
"{49FDA7D8-B293-2E8B-19F3-0F10C110C4CC}" = CCC Help French
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4EA2F95F-A537-4d17-9E7F-6B3FF8D9BBE3}" = Microsoft Works
"{5396FBD8-8BD7-47F9-92AE-F62F13D5A11D}" = NETGEAR WG111v3 wireless USB 2.0 adapter
"{55979C41-7D6A-49CC-B591-64AC1BBE2C8B}" = HP Picasso Media Center Add-In
"{5E1DE2DE-71B7-5C37-A8D2-949C143C863D}" = Catalyst Control Center Graphics Previews Vista
"{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}" = Roxio Creator Copy
"{623B8278-8CAD-45C1-B844-58B687C07805}" = Bing Bar Platform
"{657F8B33-CBBB-45F4-9087-274F22C89400}" = DJ_AIO_ProductContext
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{67D3F1A0-A1F2-49b7-B9EE-011277B170CD}" = HPProductAssistant
"{6AF49698-949A-4C89-9B31-041D2CCB5FBD}" = muvee autoProducer 6.0
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{75E71ADD-042C-4F30-BFAC-A9EC42351313}" = Python 2.4.3
"{7A3DF2E2-CF13-44FB-A93E-F71D5381DB3F}" = HP Deskjet 2050 J510 series Hilfe
"{7DDEABFB-0621-4321-B385-CB86D3A6F90F}" = F4100
"{83FFCFC7-88C6-41c6-8752-958A45325C82}" = Roxio Creator Audio
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8CEA85DE-955B-4BF4-87F2-0BAA62821633}" = HP Photosmart Essential2.5
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90280407-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional mit FrontPage
"{904B64C4-49D8-4941-A2B6-D13D06C5CD8B}" = aonController
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{928B06E4-DDAA-476A-926A-641620326327}" = Microsoft Search Enhancement Pack
"{95D08F4E-DFC2-4ce3-ACB7-8C8E206217E9}" = MarketResearch
"{978C25EE-5777-46e4-8988-732C297CBDBD}" = Status
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9B1FD9CE-0776-4f0b-A6F5-C6AB7B650CDF}" = Destinations
"{9DBA770F-BF73-4D39-B1DF-6035D95268FC}" = HP Customer Feedback
"{9ECB4705-B9CB-405A-B6D4-33BDF707308E}" = DJ_AIO_Software
"{A36CD345-625C-4d6c-B3E2-76E1248CB451}" = SolutionCenter
"{A3B7C670-4A1E-4EE2-950E-C875BC1965D0}" = Copy
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB06254A-9A28-F8AD-236E-FB5C3108FE85}" = ATI Catalyst Install Manager
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AB5E289E-76BF-4251-9F3F-9B763F681AE0}" = HP Customer Experience Enhancements
"{AC76BA86-7AD7-1031-7B44-A81200000003}" = Adobe Reader 8.1.2 - Deutsch
"{ACE22C48-49D7-4531-BE20-5C3D03393AB6}" = F4100_Help
"{AD0EE5BD-B8C0-9ACB-678A-C1AD9AC0BA60}" = ccc-core-static
"{AF36CE1D-FD2C-4BA0-93FA-1196785DD610}" = Adobe Flash Player 10 Plugin
"{B2580E5E-F617-EAE5-04B2-0C49FAC1E24F}" = Catalyst Control Center Graphics Full Existing
"{B94C6815-7BCC-4124-AC39-9208A06FFFA7}" = Disney-Pixar Ratatouille
"{BE77A81F-B315-4666-9BF3-AE70C0ADB057}" = BufferChm
"{BF24E54D-77C1-CDF8-054C-133FBB71EE90}" = Catalyst Control Center Graphics Full New
"{C07A746C-E1A1-C0C3-A30C-EFB5ECE184C3}" = Catalyst Control Center Core Implementation
"{C2C60D9F-0D6E-188C-1ADE-9DC3BF6ADA93}" = CCC Help Hungarian
"{C2F9FF21-946D-8907-A45B-DF1414F43316}" = Catalyst Control Center Localization All
"{C716522C-3731-4667-8579-40B098294500}" = Toolbox
"{C849A1C0-B8CB-1BB0-62BB-362C2851FD0F}" = CCC Help German
"{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}" = Roxio Creator Basic v9
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE386A4E-D0DA-4208-8235-BCE43275C694}" = LightScribe  1.4.142.1
"{CF2C9A13-51A0-5640-0F57-76EC9A404D89}" = CCC Help Italian
"{DBA4DB9D-EE51-4944-A419-98AB1F1249C8}" = LiveUpdate Notice (Symantec Corporation)
"{DC83F417-8068-4074-BA2F-C4F8AB872556}" = DJ_AIO_Software_min
"{E06F04B9-45E6-4AC0-8083-85F7515F40F7}" = UnloadSupport
"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Codeur Windows Media Série 9
"{EB21A812-671B-4D08-B974-2A347F0D8F70}" = HP Photosmart Essential
"{EB75DE50-5754-4F6F-875D-126EDF8E4CB3}" = HPSSupply
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}" = 32 Bit HP CIO Components Installer
"{F6F8D4EB-19B5-F561-B3FA-39467F65943F}" = CCC Help English
"{F937EBB7-E475-DE6C-6CE7-46BDF5B12A4B}" = CCC Help Polish
"{FF075778-6E50-47ed-991D-3B07FD4E3250}" = TrayApp
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"aonController" = aonController
"aonUpdate" = aonUpdate
"eMule" = eMule
"Free YouTube Download 3_is1" = Free YouTube Download 3 version 3.0.10.722
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.9.40.602
"Google Chrome" = Google Chrome
"HappyFoto-Designer_is1" = HappyFoto-Designer
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"HP Imaging Device Functions" = HP Imaging Device Functions 8.0
"HP Photo Creations" = HP Photo Creations
"HP Photosmart Essential" = HP Photosmart Essential 2.0
"HP Solution Center & Imaging Support Tools" = HP Solution Center 8.0
"HPExtendedCapabilities" = HP Customer Participation Program 8.0
"InstallShield_{5396FBD8-8BD7-47F9-92AE-F62F13D5A11D}" = NETGEAR WG111v3 wireless USB 2.0 adapter
"LiveUpdate" = LiveUpdate 3.2 (Symantec Corporation)
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"NVIDIA Drivers" = NVIDIA Drivers
"OsdMaestro" = HP On-Screen Cap/Num/Scroll Lock Indicator
"PC-Doctor 5 for Windows" = Hardware Diagnose Tools
"RealPlayer 6.0" = RealPlayer
"Search_USA Toolbar" = Search_USA Toolbar
"ShockwaveFlash" = Adobe Flash Player 9 ActiveX
"Windows Media Encoder 9" = Codeur Windows Media Série 9
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{79A765E1-C399-405B-85AF-466F52E918B0}" = Ask Toolbar Updater
"sc11-DE_SEVENONE_MAIN" = Big Pizza Ski Challenge 11
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 21.08.2012 10:47:35 | Computer Name = Anja-PC | Source = System Restore | ID = 8193
Description =
 
Error - 24.08.2012 04:26:32 | Computer Name = Anja-PC | Source = System Restore | ID = 8193
Description =
 
Error - 24.08.2012 06:01:04 | Computer Name = Anja-PC | Source = Application Hang | ID = 1002
Description = Programm iexplore.exe, Version 9.0.8112.16448 arbeitet nicht mehr
mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
 "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen
über das Problem zu suchen.  Prozess-ID: 61c  Anfangszeit: 01cd81df1ef220a5  Zeitpunkt
 der Beendigung: 4337
 
Error - 28.08.2012 07:24:56 | Computer Name = Anja-PC | Source = Automatic LiveUpdate Scheduler | ID = 101
Description = Informationsebene: error  Initialisierung des COM-Subsystems fehlgeschlagen.
 Fehlercode: 0x8007041D
 
Error - 28.08.2012 07:35:46 | Computer Name = Anja-PC | Source = System Restore | ID = 8193
Description =
 
Error - 29.08.2012 03:52:47 | Computer Name = Anja-PC | Source = System Restore | ID = 8193
Description =
 
Error - 31.08.2012 06:01:13 | Computer Name = Anja-PC | Source = System Restore | ID = 8193
Description =
 
Error - 02.09.2012 04:17:16 | Computer Name = Anja-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung iexplore.exe, Version 9.0.8112.16448, Zeitstempel
 0x4fecf1b7, fehlerhaftes Modul Flash10c.ocx, Version 10.0.32.18, Zeitstempel 0x4a613d79,
 Ausnahmecode 0xc0000005, Fehleroffset 0x001579a2,  Prozess-ID 0xbdc, Anwendungsstartzeit
 01cd88e34e30dc00.
 
Error - 02.09.2012 23:33:16 | Computer Name = Anja-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung iexplore.exe, Version 9.0.8112.16448, Zeitstempel
 0x4fecf1b7, fehlerhaftes Modul USER32.dll, Version 6.0.6002.18541, Zeitstempel
0x4ec3e3d5, Ausnahmecode 0xc0000142, Fehleroffset 0x00009f5d,  Prozess-ID 0xe98, Anwendungsstartzeit
 01cd8984da8b4498.
 
Error - 03.09.2012 10:20:31 | Computer Name = Anja-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung iexplore.exe, Version 9.0.8112.16448, Zeitstempel
 0x4fecf1b7, fehlerhaftes Modul USER32.dll, Version 6.0.6002.18541, Zeitstempel
0x4ec3e3d5, Ausnahmecode 0xc0000142, Fehleroffset 0x00009f5d,  Prozess-ID 0xae4, Anwendungsstartzeit
 01cd89df45a4dc86.
 
[ Media Center Events ]
Error - 17.04.2008 05:00:35 | Computer Name = Anja-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: Download von Paket MCESpotlight
 gescheitert.
 
[ System Events ]
Error - 02.09.2012 07:28:38 | Computer Name = Anja-PC | Source = Service Control Manager | ID = 7000
Description =
 
Error - 02.09.2012 13:40:16 | Computer Name = Anja-PC | Source = Service Control Manager | ID = 7000
Description =
 
Error - 02.09.2012 15:09:40 | Computer Name = Anja-PC | Source = Service Control Manager | ID = 7000
Description =
 
Error - 02.09.2012 15:37:06 | Computer Name = Anja-PC | Source = Dhcp | ID = 1002
Description = Die IP-Adresslease 192.168.1.2 für die Netzwerkkarte mit der Netzwerkadresse
 00C0A8F64D48 wurde durch den DHCP-Server 0.0.0.0 abgelehnt (der DHCP-Server hat
 eine DHCPNACK-Meldung gesendet).
 
Error - 02.09.2012 15:38:51 | Computer Name = Anja-PC | Source = Service Control Manager | ID = 7000
Description =
 
Error - 02.09.2012 23:34:22 | Computer Name = Anja-PC | Source = Service Control Manager | ID = 7000
Description =
 
Error - 03.09.2012 10:20:52 | Computer Name = Anja-PC | Source = Service Control Manager | ID = 7000
Description =
 
Error - 03.09.2012 12:00:13 | Computer Name = Anja-PC | Source = Service Control Manager | ID = 7000
Description =
 
Error - 03.09.2012 12:03:38 | Computer Name = Anja-PC | Source = Service Control Manager | ID = 7000
Description =
 
Error - 24.09.2012 08:22:41 | Computer Name = Anja-PC | Source = Service Control Manager | ID = 7000
Description =
 
 
< End of report >
VG & Danke
Rene

cosinus 25.09.2012 10:12
Bitte erstmal routinemäßig einen Vollscan mit malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen!
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Die Funde mit Malwarebytes bitte alle entfernen, sodass sie in der Quarantäne von Malwarebytes aufgehoben werden! NICHTS voreilig aus der Quarantäne entfernen!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!



ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset




Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log

rene07 26.09.2012 07:31
OK, hier der Inhalt der Malewarebytes Log-Datei:

Code:
Malwarebytes Anti-Malware 1.65.0.1400
www.malwarebytes.org

Datenbank Version: v2012.09.25.06

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Anja :: ANJA-PC [Administrator]

25.09.2012 13:02:10
mbam-log-2012-09-25 (13-02-10).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|H:\|I:\|J:\|K:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 444868
Laufzeit: 1 Stunde(n), 40 Minute(n), 32 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 1
C:\Users\Anja\AppData\Local\Temp\roper0dun.exe (Trojan.FakeMS) -> Löschen bei Neustart.

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 2
C:\Users\Anja\AppData\Local\Temp\roper0dun.exe (Trojan.FakeMS) -> Löschen bei Neustart.
C:\Users\Anja\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk (Trojan.Ransom.Gen) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
Und hier der LOG des Eset Smart Installers:

Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=e7d909f94467e44b892b53a4b945b775
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-09-25 04:00:24
# local_time=2012-09-25 06:00:24 (+0100, Mitteleurop‰ische Sommerzeit)
# country="Austria"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=5892 16776573 100 100 86873 186110340 0 0
# compatibility_mode=8192 67108863 100 0 185 185 0 0
# scanned=134073
# found=3
# cleaned=0
# scan_time=11210
C:\Users\Anja\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BLP5PYWG\f[1].htm        JS/Kryptik.DY trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Anja\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\INY2EDRC\d98fd[1].pdf        JS/Exploit.Pdfka.PPO trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Anja\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\KSRJQNDQ\Bestattung+Lechner+Othmar+GmbH+u.+Co+KG[1].htm        HTML/ScrInject.B.Gen virus (unable to clean)        00000000000000000000000000000000        I
ESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
Can not open internet
VG & Danke
Rene

cosinus 26.09.2012 15:00
Malwarebytes erstellt bei jedem Scanvorgang genau ein Log. Hast du in der Vergangenheit schonmal mit Malwarebytes gescannt?
Wenn ja dann stehen auch alle Logs zu jedem Scanvorgang im Reiter Logdateien. Bitte alle posten, die dort sichtbar sind.

rene07 27.09.2012 14:51
Sorry, hier die zweite Log-Datei...
Habe einmal den Check abgebrochen, da er hängen geblieben ist.

Code:
Malwarebytes Anti-Malware 1.65.0.1400
www.malwarebytes.org

Datenbank Version: v2012.09.25.06

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Anja :: ANJA-PC [Administrator]

25.09.2012 13:02:10
mbam-log-2012-09-25 (14-45-36).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|H:\|I:\|J:\|K:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 444868
Laufzeit: 1 Stunde(n), 40 Minute(n), 32 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 1
C:\Users\Anja\AppData\Local\Temp\roper0dun.exe (Trojan.FakeMS) -> Keine Aktion durchgeführt.

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 2
C:\Users\Anja\AppData\Local\Temp\roper0dun.exe (Trojan.FakeMS) -> Keine Aktion durchgeführt.
C:\Users\Anja\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk (Trojan.Ransom.Gen) -> Keine Aktion durchgeführt.

(Ende)

cosinus 27.09.2012 16:33
adwCleaner - Toolbars und ungewollte Start-/Suchseiten aufspüren

Downloade Dir bitte AdwCleaner auf deinen Desktop.

Falls der adwCleaner schon mal in der runtergeladen wurde, bitte die alte adwcleaner.exe löschen und neu runterladen!!
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Suche.
  • Nach Ende des Suchlaufs öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[Rx].txt. (x=fortlaufende Nummer)

rene07 28.09.2012 10:30
Hier die Log Datei des ADWCleaners:

Code:
# AdwCleaner v2.003 - Datei am 09/28/2012 um 11:28:33 erstellt
# Aktualisiert am 23/09/2012 von Xplode
# Betriebssystem : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Benutzer : Anja - ANJA-PC
# Bootmodus : Normal
# Ausgef¸hrt unter : C:\Users\Anja\Desktop\adwcleaner.exe
# Option [Suche]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Ordner Gefunden : C:\Program Files\Ask.com
Ordner Gefunden : C:\Program Files\Conduit
Ordner Gefunden : C:\Program Files\Search_USA
Ordner Gefunden : C:\Program Files\Search_USA
Ordner Gefunden : C:\Users\Anja\AppData\Local\Temp\AskSearch
Ordner Gefunden : C:\Users\Anja\AppData\LocalLow\AskToolbar
Ordner Gefunden : C:\Users\Anja\AppData\LocalLow\Conduit
Ordner Gefunden : C:\Users\Anja\AppData\LocalLow\Search_USA
Ordner Gefunden : C:\Users\Anja\AppData\LocalLow\Search_USA
Ordner Gefunden : C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

***** [Registrierungsdatenbank] *****

Schl¸ssel Gefunden : HKCU\Software\APN
Schl¸ssel Gefunden : HKCU\Software\AppDataLow\Software\AskToolbar
Schl¸ssel Gefunden : HKCU\Software\AppDataLow\Software\Conduit
Schl¸ssel Gefunden : HKCU\Software\AppDataLow\Software\Search_USA
Schl¸ssel Gefunden : HKCU\Software\AppDataLow\Software\Search_USA
Schl¸ssel Gefunden : HKCU\Software\Ask.com
Schl¸ssel Gefunden : HKCU\Software\ImInstaller
Schl¸ssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Schl¸ssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}
Schl¸ssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Schl¸ssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{79A765E1-C399-405B-85AF-466F52E918B0}
Schl¸ssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Schl¸ssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Search_USA Toolbar
Schl¸ssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Search_USA Toolbar
Schl¸ssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{48405D3D-2674-4CD8-B1EF-9A719443BD3F}
Schl¸ssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{48405D3D-2674-4CD8-B1EF-9A719443BD3F}
Schl¸ssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{66386A01-1BFB-4B06-A79B-F9B7B284AEAB}
Schl¸ssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schl¸ssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{48405D3D-2674-4CD8-B1EF-9A719443BD3F}
Schl¸ssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{48405D3D-2674-4CD8-B1EF-9A719443BD3F}
Schl¸ssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schl¸ssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
Schl¸ssel Gefunden : HKCU\Software\Softonic
Schl¸ssel Gefunden : HKLM\Software\APN
Schl¸ssel Gefunden : HKLM\Software\AskToolbar
Schl¸ssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Schl¸ssel Gefunden : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Schl¸ssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
Schl¸ssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{48405D3D-2674-4CD8-B1EF-9A719443BD3F}
Schl¸ssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{48405D3D-2674-4CD8-B1EF-9A719443BD3F}
Schl¸ssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{66386A01-1BFB-4B06-A79B-F9B7B284AEAB}
Schl¸ssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schl¸ssel Gefunden : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd
Schl¸ssel Gefunden : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1
Schl¸ssel Gefunden : HKLM\SOFTWARE\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Schl¸ssel Gefunden : HKLM\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
Schl¸ssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schl¸ssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schl¸ssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schl¸ssel Gefunden : HKLM\SOFTWARE\Classes\S
Schl¸ssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Schl¸ssel Gefunden : HKLM\Software\Conduit
Schl¸ssel Gefunden : HKLM\Software\ImInstaller
Schl¸ssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Schl¸ssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Schl¸ssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Scheduled Update for Ask Toolbar
Schl¸ssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{48405D3D-2674-4CD8-B1EF-9A719443BD3F}
Schl¸ssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{48405D3D-2674-4CD8-B1EF-9A719443BD3F}
Schl¸ssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schl¸ssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
Schl¸ssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Schl¸ssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Search_USA Toolbar
Schl¸ssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Search_USA Toolbar
Schl¸ssel Gefunden : HKLM\Software\Search_USA
Schl¸ssel Gefunden : HKLM\Software\Search_USA
Schl¸ssel Gefunden : HKU\S-1-5-21-3424106836-3771431339-2525162909-1000\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}
Schl¸ssel Gefunden : HKU\S-1-5-21-3424106836-3771431339-2525162909-1000\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{48405D3D-2674-4CD8-B1EF-9A719443BD3F}]
Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{48405D3D-2674-4CD8-B1EF-9A719443BD3F}]
Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{00000000-6E41-4FD3-8538-502F5495E5FC}]
Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{48405D3D-2674-4CD8-B1EF-9A719443BD3F}]
Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{48405D3D-2674-4CD8-B1EF-9A719443BD3F}]
Wert Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{48405D3D-2674-4CD8-B1EF-9A719443BD3F}]
Wert Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{48405D3D-2674-4CD8-B1EF-9A719443BD3F}]
Wert Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Wert Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{48405D3D-2674-4CD8-B1EF-9A719443BD3F}]
Wert Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{48405D3D-2674-4CD8-B1EF-9A719443BD3F}]
Wert Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnUpdater]

***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Google Chrome v [Version kann nicht ermittelt werden]

Datei : C:\Users\Anja\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] Die Datei ist sauber.

*************************

AdwCleaner[R1].txt - [8100 octets] - [28/09/2012 11:28:33]

########## EOF - C:\AdwCleaner[R1].txt - [8160 octets] ##########

cosinus 28.09.2012 14:09
adwCleaner - Toolbars und ungewollte Start-/Suchseiten entfernen
  • Schließe alle offenen Programme und Browser.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Löschen.
  • Bestätige jeweils mit Ok.
  • Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[Sx].txt. (x=fortlaufende Nummer)

rene07 28.09.2012 17:20
Hier der Log:

Code:
# AdwCleaner v2.003 - Datei am 09/28/2012 um 18:15:37 erstellt
# Aktualisiert am 23/09/2012 von Xplode
# Betriebssystem : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Benutzer : Anja - ANJA-PC
# Bootmodus : Normal
# Ausgef¸hrt unter : J:\adwcleaner.exe
# Option [Lˆschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Ordner Gelˆscht : C:\Program Files\Ask.com
Ordner Gelˆscht : C:\Program Files\Conduit
Ordner Gelˆscht : C:\Program Files\Search_USA
Ordner Gelˆscht : C:\Users\Anja\AppData\Local\Temp\AskSearch
Ordner Gelˆscht : C:\Users\Anja\AppData\LocalLow\AskToolbar
Ordner Gelˆscht : C:\Users\Anja\AppData\LocalLow\Conduit
Ordner Gelˆscht : C:\Users\Anja\AppData\LocalLow\Search_USA
Ordner Gelˆscht : C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

***** [Registrierungsdatenbank] *****

Schl¸ssel Gelˆscht : HKCU\Software\APN
Schl¸ssel Gelˆscht : HKCU\Software\AppDataLow\Software\AskToolbar
Schl¸ssel Gelˆscht : HKCU\Software\AppDataLow\Software\Conduit
Schl¸ssel Gelˆscht : HKCU\Software\AppDataLow\Software\Search_USA
Schl¸ssel Gelˆscht : HKCU\Software\Ask.com
Schl¸ssel Gelˆscht : HKCU\Software\ImInstaller
Schl¸ssel Gelˆscht : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Schl¸ssel Gelˆscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}
Schl¸ssel Gelˆscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Schl¸ssel Gelˆscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{79A765E1-C399-405B-85AF-466F52E918B0}
Schl¸ssel Gelˆscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Schl¸ssel Gelˆscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Search_USA Toolbar
Schl¸ssel Gelˆscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{48405D3D-2674-4CD8-B1EF-9A719443BD3F}
Schl¸ssel Gelˆscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{66386A01-1BFB-4B06-A79B-F9B7B284AEAB}
Schl¸ssel Gelˆscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schl¸ssel Gelˆscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{48405D3D-2674-4CD8-B1EF-9A719443BD3F}
Schl¸ssel Gelˆscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schl¸ssel Gelˆscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
Schl¸ssel Gelˆscht : HKCU\Software\Softonic
Schl¸ssel Gelˆscht : HKLM\Software\APN
Schl¸ssel Gelˆscht : HKLM\Software\AskToolbar
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Classes\CLSID\{48405D3D-2674-4CD8-B1EF-9A719443BD3F}
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Classes\CLSID\{66386A01-1BFB-4B06-A79B-F9B7B284AEAB}
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Classes\S
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Schl¸ssel Gelˆscht : HKLM\Software\Conduit
Schl¸ssel Gelˆscht : HKLM\Software\ImInstaller
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{48405D3D-2674-4CD8-B1EF-9A719443BD3F}
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Search_USA Toolbar
Schl¸ssel Gelˆscht : HKLM\Software\Search_USA
Wert Gelˆscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{48405D3D-2674-4CD8-B1EF-9A719443BD3F}]
Wert Gelˆscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Wert Gelˆscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{00000000-6E41-4FD3-8538-502F5495E5FC}]
Wert Gelˆscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{48405D3D-2674-4CD8-B1EF-9A719443BD3F}]
Wert Gelˆscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{48405D3D-2674-4CD8-B1EF-9A719443BD3F}]
Wert Gelˆscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Wert Gelˆscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{48405D3D-2674-4CD8-B1EF-9A719443BD3F}]
Wert Gelˆscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnUpdater]

***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16421

Wiederhergestellt : [HKCU\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]

-\\ Google Chrome v [Version kann nicht ermittelt werden]

Datei : C:\Users\Anja\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] Die Datei ist sauber.

*************************

AdwCleaner[R1].txt - [8229 octets] - [28/09/2012 11:28:33]
AdwCleaner[S1].txt - [6776 octets] - [28/09/2012 18:15:37]

########## EOF - C:\AdwCleaner[S1].txt - [6836 octets] ##########

cosinus 28.09.2012 19:10
Hätte da mal zwei Fragen bevor es weiter geht (wir sind noch nicht fertig!)

1.) Geht der normale Modus von Windows (wieder) uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

rene07 29.09.2012 11:17
Hi Cosinus,
also mir wäre bislang nicht aufgefallen, dass Programme fehlen. Leere Ordner im Startmenü hab ich auch keine gesehen.

Das System läuft, soweit ich das beurteilen kann wieder ganz normal...

LG & Danke
rene

cosinus 01.10.2012 11:24
Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log
CustomScan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop. Falls schon vorhanden, bitte die ältere vorhandene Datei durch die neu heruntergeladene Datei ersetzen, damit du auch wirklich mit einer aktuellen Version von OTL arbeitest.
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

rene07 01.10.2012 18:22
Beim OTL Scan bekomme ich schon nach kurzer Zeit folgende Fehlermeldung:

Code:
Access violation at address CCCC0460. Read of address CCCC0460.
Was mache ich falsch? Wenn ich dann OK klicke scheint nichts mehr zu passieren...

LG & Danke
rene

cosinus 02.10.2012 13:35
OTL bitte neu runterladen, sollte jetzt hoffentlich gefixt sein

rene07 02.10.2012 19:11
Ok, hier nun der Log:

OTL Logfile:
Code:
OTL logfile created on: 02.10.2012 19:33:32 - Run 2
OTL by OldTimer - Version 3.2.70.1    Folder = C:\Users\Anja\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000C07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy
 
1021,82 Mb Total Physical Memory | 415,92 Mb Available Physical Memory | 40,70% Memory free
2,25 Gb Paging File | 1,56 Gb Available in Paging File | 69,25% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 290,13 Gb Total Space | 233,15 Gb Free Space | 80,36% Space Free | Partition Type: NTFS
Drive D: | 7,96 Gb Total Space | 1,01 Gb Free Space | 12,73% Space Free | Partition Type: NTFS
 
Computer Name: ANJA-PC | User Name: Anja | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.10.02 19:32:33 | 000,600,064 | ---- | M] (OldTimer Tools) -- C:\Users\Anja\Desktop\OTL.exe
PRC - [2010.07.27 14:46:08 | 000,249,136 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
PRC - [2009.11.04 17:45:32 | 000,360,448 | ---- | M] (AMD) -- C:\Windows\System32\atieclxx.exe
PRC - [2009.11.04 17:45:02 | 000,172,032 | ---- | M] (AMD) -- C:\Windows\System32\atiesrxx.exe
PRC - [2009.04.11 00:28:04 | 001,233,920 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe
PRC - [2009.04.11 00:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008.01.19 09:38:38 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MSASCui.exe
PRC - [2007.09.26 11:53:56 | 000,554,352 | ---- | M] (Symantec Corporation) -- C:\Programme\Symantec\LiveUpdate\AluSchedulerSvc.exe
PRC - [2007.03.12 11:22:00 | 000,517,768 | ---- | M] (Symantec Corporation) -- C:\Programme\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
PRC - [2007.03.01 17:38:48 | 004,390,912 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
PRC - [2007.02.15 12:59:00 | 000,118,784 | ---- | M] (OsdMaestro) -- C:\Programme\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
PRC - [2006.09.28 15:42:24 | 000,065,536 | ---- | M] (Hewlett-Packard Company) -- C:\hp\support\hpsysdrv.exe
PRC - [2006.05.29 20:29:46 | 001,708,032 | ---- | M] () -- C:\Programme\NETGEAR\WG111v3\WG111v3.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.06.14 18:09:59 | 011,820,032 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\508b444db523c5cf20ff12c7f440837b\System.Web.ni.dll
MOD - [2012.06.14 18:04:41 | 012,433,920 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\f2691cfa7671cdc58179e56ba9227591\System.Windows.Forms.ni.dll
MOD - [2012.06.14 18:04:32 | 001,592,320 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\18f9789aa214c657113e676b3a9015aa\System.Drawing.ni.dll
MOD - [2012.05.11 17:07:20 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\846b9cf2756fdd15f704c9bab9c70b6f\System.Runtime.Remoting.ni.dll
MOD - [2012.05.11 17:07:00 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\bd76aaaa03ddc15d1840207b5a480644\System.Configuration.ni.dll
MOD - [2012.05.10 14:36:04 | 005,450,752 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\d2630342a066a7cb9056d9eb6157687a\System.Xml.ni.dll
MOD - [2012.05.10 14:34:15 | 007,953,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\28d633338fc8d29f8af31935ef7d001b\System.ni.dll
MOD - [2012.05.10 14:33:47 | 011,492,352 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\af9c9e9d7e0523cd444f8b551baa9cbf\mscorlib.ni.dll
MOD - [2009.11.30 14:25:36 | 000,011,776 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.HydraVision.Runtime\2.0.3595.17931__90ba9c70f846762e\CLI.Caste.HydraVision.Runtime.dll
MOD - [2009.11.30 14:25:36 | 000,008,704 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.HydraVision.Shared\2.0.3595.17931__90ba9c70f846762e\CLI.Caste.HydraVision.Shared.dll
MOD - [2009.11.30 14:25:36 | 000,007,680 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.HydraVision.Wizard\2.0.3595.17935__90ba9c70f846762e\CLI.Caste.HydraVision.Wizard.dll
MOD - [2009.11.30 14:25:36 | 000,007,680 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.HydraVision.Dashboard\2.0.3595.17931__90ba9c70f846762e\CLI.Caste.HydraVision.Dashboard.dll
MOD - [2009.11.30 14:25:35 | 001,695,744 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager2.Graphics.Wizard\2.0.3595.17950__90ba9c70f846762e\CLI.Aspect.DisplaysManager2.Graphics.Wizard.dll
MOD - [2009.11.30 14:25:35 | 000,368,640 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime\2.0.3595.17822__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.dll
MOD - [2009.11.30 14:25:35 | 000,204,800 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Wizard\2.0.3595.17843__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Wizard.dll
MOD - [2009.11.30 14:25:35 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard\2.0.3595.17838__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.dll
MOD - [2009.11.30 14:25:35 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Runtime\2.0.3595.17832__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Runtime.dll
MOD - [2009.11.30 14:25:33 | 000,491,520 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Wizard\2.0.3595.17918__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Wizard.dll
MOD - [2009.11.30 14:25:33 | 000,077,824 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Runtime\2.0.3595.17898__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Runtime.dll
MOD - [2009.11.30 14:25:33 | 000,073,728 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard\2.0.3595.17832__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.dll
MOD - [2009.11.30 14:25:33 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Runtime\2.0.3595.17878__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Runtime.dll
MOD - [2009.11.30 14:25:33 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Runtime\2.0.3595.17868__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Runtime.dll
MOD - [2009.11.30 14:25:32 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Welcome.Graphics.Dashboard\2.0.3595.17919__90ba9c70f846762e\CLI.Aspect.Welcome.Graphics.Dashboard.dll
MOD - [2009.11.30 14:25:31 | 000,356,352 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Dashboard\2.0.3595.17883__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Dashboard.dll
MOD - [2009.11.30 14:25:31 | 000,094,208 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Wizard\2.0.3595.17884__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Wizard.dll
MOD - [2009.11.30 14:25:31 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Runtime\2.0.3595.17883__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Runtime.dll
MOD - [2009.11.30 14:25:30 | 000,643,072 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.OverDrive5.Graphics.Dashboard\2.0.3595.17930__90ba9c70f846762e\CLI.Aspect.OverDrive5.Graphics.Dashboard.dll
MOD - [2009.11.30 14:25:30 | 000,077,824 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.OverDrive5.Graphics.Runtime\2.0.3595.17929__90ba9c70f846762e\CLI.Aspect.OverDrive5.Graphics.Runtime.dll
MOD - [2009.11.30 14:25:29 | 000,823,296 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Dashboard\2.0.3595.17871__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Dashboard.dll
MOD - [2009.11.30 14:25:29 | 000,409,600 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Wizard\2.0.3595.17892__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Wizard.dll
MOD - [2009.11.30 14:25:28 | 001,142,784 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager2.Graphics.Dashboard\2.0.3595.17946__90ba9c70f846762e\CLI.Aspect.DisplaysManager2.Graphics.Dashboard.dll
MOD - [2009.11.30 14:25:28 | 000,196,608 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Dashboard\2.0.3595.17844__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Dashboard.dll
MOD - [2009.11.30 14:25:28 | 000,094,208 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Runtime\2.0.3595.17870__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Runtime.dll
MOD - [2009.11.30 14:25:28 | 000,094,208 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Dashboard\2.0.3595.17875__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Dashboard.dll
MOD - [2009.11.30 14:25:28 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Runtime\2.0.3595.17875__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Runtime.dll
MOD - [2009.11.30 14:25:27 | 000,573,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Dashboard\2.0.3595.17844__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Dashboard.dll
MOD - [2009.11.30 14:25:26 | 000,368,640 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Dashboard\2.0.3595.17864__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Dashboard.dll
MOD - [2009.11.30 14:25:26 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Runtime\2.0.3595.17848__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Runtime.dll
MOD - [2009.11.30 14:25:26 | 000,036,864 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Runtime\2.0.3595.17877__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Runtime.dll
MOD - [2009.11.30 14:25:25 | 000,393,216 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Dashboard\2.0.3595.17869__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Dashboard.dll
MOD - [2009.11.30 14:25:25 | 000,270,336 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
MOD - [2009.11.30 14:25:25 | 000,061,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Runtime\2.0.3595.17869__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Runtime.dll
MOD - [2009.11.30 14:25:25 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Runtime\2.0.3595.17869__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Runtime.dll
MOD - [2009.11.30 14:25:24 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.Hotkeys.Shared\2.0.3586.20615__90ba9c70f846762e\AEM.Plugin.Hotkeys.Shared.dll
MOD - [2009.11.30 14:25:24 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Actions.CCAA.Shared\2.0.3586.20610__90ba9c70f846762e\AEM.Actions.CCAA.Shared.dll
MOD - [2009.11.30 14:25:24 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.WinMessages.Shared\2.0.3586.20627__90ba9c70f846762e\AEM.Plugin.WinMessages.Shared.dll
MOD - [2009.11.30 14:25:24 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.REG.Shared\2.0.3586.20645__90ba9c70f846762e\AEM.Plugin.REG.Shared.dll
MOD - [2009.11.30 14:25:24 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.GD.Shared\2.0.3586.20643__90ba9c70f846762e\AEM.Plugin.GD.Shared.dll
MOD - [2009.11.30 14:25:24 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.EEU.Shared\2.0.3586.20625__90ba9c70f846762e\AEM.Plugin.EEU.Shared.dll
MOD - [2009.11.30 14:25:24 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.DPPE.Shared\2.0.3586.20643__90ba9c70f846762e\AEM.Plugin.DPPE.Shared.dll
MOD - [2009.11.30 14:25:24 | 000,007,168 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\atixclib\1.0.0.0__90ba9c70f846762e\atixclib.dll
MOD - [2009.11.30 14:25:23 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation\2.0.3586.20597__90ba9c70f846762e\LOG.Foundation.dll
MOD - [2009.11.30 14:25:23 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\NEWAEM.Foundation\2.0.3586.20598__90ba9c70f846762e\NEWAEM.Foundation.dll
MOD - [2009.11.30 14:25:23 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0703\2.0.2651.18802__90ba9c70f846762e\DEM.Graphics.I0703.dll
MOD - [2009.11.30 14:25:23 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\MOM.Foundation\2.0.3586.20623__90ba9c70f846762e\MOM.Foundation.dll
MOD - [2009.11.30 14:25:23 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0706\2.0.2743.23304__90ba9c70f846762e\DEM.Graphics.I0706.dll
MOD - [2009.11.30 14:25:22 | 000,147,456 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Shared\2.0.3586.20608__90ba9c70f846762e\CLI.Caste.Graphics.Shared.dll
MOD - [2009.11.30 14:25:22 | 000,098,304 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Foundation\2.0.3586.20602__90ba9c70f846762e\CLI.Foundation.dll
MOD - [2009.11.30 14:25:22 | 000,057,344 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Shared\2.0.3586.20634__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Shared.dll
MOD - [2009.11.30 14:25:22 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0601\2.0.2573.17685__90ba9c70f846762e\DEM.Graphics.I0601.dll
MOD - [2009.11.30 14:25:22 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Shared\2.0.3586.20641__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Shared.dll
MOD - [2009.11.30 14:25:22 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Foundation.XManifest\2.0.3586.20661__90ba9c70f846762e\CLI.Foundation.XManifest.dll
MOD - [2009.11.30 14:25:22 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared\2.0.3586.20620__90ba9c70f846762e\CLI.Component.Dashboard.Shared.dll
MOD - [2009.11.30 14:25:22 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared\2.0.3586.20619__90ba9c70f846762e\CLI.Component.Wizard.Shared.dll
MOD - [2009.11.30 14:25:22 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Client.Shared\2.0.3586.20609__90ba9c70f846762e\CLI.Component.Client.Shared.dll
MOD - [2009.11.30 14:25:22 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics\2.0.3586.20631__90ba9c70f846762e\DEM.Graphics.dll
MOD - [2009.11.30 14:25:22 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Foundation\2.0.2573.17684__90ba9c70f846762e\DEM.Foundation.dll
MOD - [2009.11.30 14:25:22 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared\2.0.3586.20616__90ba9c70f846762e\CLI.Component.Runtime.Shared.dll
MOD - [2009.11.30 14:25:22 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard.Shared\2.0.3586.20632__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.Shared.dll
MOD - [2009.11.30 14:25:22 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard.Shared\2.0.3586.20621__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.Shared.dll
MOD - [2009.11.30 14:25:21 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Shared\2.0.3586.20634__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Shared.dll
MOD - [2009.11.30 14:25:21 | 000,061,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.OverDrive5.Graphics.Shared\2.0.3586.20644__90ba9c70f846762e\CLI.Aspect.OverDrive5.Graphics.Shared.dll
MOD - [2009.11.30 14:25:21 | 000,061,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Shared\2.0.3586.20621__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Shared.dll
MOD - [2009.11.30 14:25:21 | 000,053,248 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Shared\2.0.3586.20633__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Shared.dll
MOD - [2009.11.30 14:25:21 | 000,049,152 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Shared\2.0.3586.20623__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Shared.dll
MOD - [2009.11.30 14:25:21 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Shared\2.0.3586.20619__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Shared.dll
MOD - [2009.11.30 14:25:21 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Shared\2.0.3586.20621__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Shared.dll
MOD - [2009.11.30 14:25:21 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Shared\2.0.3586.20632__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Shared.dll
MOD - [2009.11.30 14:25:21 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Shared\2.0.3586.20631__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Shared.dll
MOD - [2009.11.30 14:25:21 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Shared\2.0.3586.20633__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Shared.dll
MOD - [2009.11.30 14:25:21 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Shared\2.0.3586.20625__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Shared.dll
MOD - [2009.11.30 14:25:20 | 000,651,264 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\ResourceManagement.Foundation.Implementation\2.0.3595.17944__90ba9c70f846762e\ResourceManagement.Foundation.Implementation.dll
MOD - [2009.11.30 14:25:20 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.Source.Kit.Server\2.0.3595.17924__90ba9c70f846762e\AEM.Plugin.Source.Kit.Server.dll
MOD - [2009.11.30 14:25:20 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CustomFormats.Graphics.Shared\2.0.3586.20614__90ba9c70f846762e\CLI.Aspect.CustomFormats.Graphics.Shared.dll
MOD - [2009.11.30 14:25:20 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\APM.Foundation\2.0.3586.20624__90ba9c70f846762e\APM.Foundation.dll
MOD - [2009.11.30 14:25:20 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Server.Shared\2.0.3586.20615__90ba9c70f846762e\AEM.Server.Shared.dll
MOD - [2009.11.30 14:25:19 | 000,106,496 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\MOM.Implementation\2.0.3595.17913__90ba9c70f846762e\MOM.Implementation.dll
MOD - [2009.11.30 14:25:19 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation\2.0.3595.17911__90ba9c70f846762e\LOG.Foundation.Implementation.dll
MOD - [2009.11.30 14:25:19 | 000,036,864 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Private\2.0.3586.20605__90ba9c70f846762e\LOG.Foundation.Private.dll
MOD - [2009.11.30 14:25:19 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\ResourceManagement.Foundation.Private\2.0.3586.20614__90ba9c70f846762e\ResourceManagement.Foundation.Private.dll
MOD - [2009.11.30 14:25:19 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation.Private\2.0.3586.20620__90ba9c70f846762e\LOG.Foundation.Implementation.Private.dll
MOD - [2009.11.30 14:25:19 | 000,007,168 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Extension.EEU\2.0.3595.17819__90ba9c70f846762e\CLI.Component.Runtime.Extension.EEU.dll
MOD - [2009.11.30 14:25:18 | 000,565,248 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Systemtray\2.0.3595.17907__90ba9c70f846762e\CLI.Component.Systemtray.dll
MOD - [2009.11.30 14:25:18 | 000,405,504 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard\2.0.3595.17837__90ba9c70f846762e\CLI.Component.Wizard.dll
MOD - [2009.11.30 14:25:18 | 000,057,344 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.SkinFactory\2.0.3595.17821__90ba9c70f846762e\CLI.Component.SkinFactory.dll
MOD - [2009.11.30 14:25:18 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared.Private\2.0.3586.20627__90ba9c70f846762e\CLI.Component.Runtime.Shared.Private.dll
MOD - [2009.11.30 14:25:18 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Foundation.Private\2.0.3586.20612__90ba9c70f846762e\CLI.Foundation.Private.dll
MOD - [2009.11.30 14:25:18 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared.Private\2.0.3586.20622__90ba9c70f846762e\CLI.Component.Wizard.Shared.Private.dll
MOD - [2009.11.30 14:25:17 | 000,057,344 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime\2.0.3595.17819__90ba9c70f846762e\CLI.Component.Runtime.dll
MOD - [2009.11.30 14:25:16 | 001,220,608 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard\2.0.3595.17828__90ba9c70f846762e\CLI.Component.Dashboard.dll
MOD - [2009.11.30 14:25:16 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared.Private\2.0.3586.20623__90ba9c70f846762e\CLI.Component.Dashboard.Shared.Private.dll
MOD - [2009.11.30 14:25:15 | 000,061,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\APM.Server\2.0.3595.17817__90ba9c70f846762e\APM.Server.dll
MOD - [2009.11.30 14:25:15 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Server\2.0.3595.17818__90ba9c70f846762e\AEM.Server.dll
MOD - [2009.11.30 14:25:15 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Client.Shared.Private\2.0.3586.20618__90ba9c70f846762e\CLI.Component.Client.Shared.Private.dll
MOD - [2009.11.30 14:25:15 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\ATICCCom\2.0.0.0__90ba9c70f846762e\ATICCCom.dll
MOD - [2009.11.30 14:25:15 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime.Shared.Private\2.0.3586.20635__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.Shared.Private.dll
MOD - [2009.11.30 14:25:15 | 000,019,456 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CCC.Implementation\2.0.3595.17912__90ba9c70f846762e\CCC.Implementation.dll
MOD - [2009.10.01 17:45:50 | 000,016,384 | R--- | M] () -- C:\Programme\ATI Technologies\ATI.ACE\Branding\Branding.dll
MOD - [2009.03.29 22:42:14 | 000,434,176 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll
MOD - [2009.03.29 22:42:12 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2006.05.29 20:29:46 | 001,708,032 | ---- | M] () -- C:\Programme\NETGEAR\WG111v3\WG111v3.exe
 
 
========== Services (SafeList) ==========
 
SRV - File not found [Auto | Stopped] -- c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe /h ccCommon -- (LiveUpdate Notice Ex)
SRV - [2010.07.27 14:46:08 | 000,249,136 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe -- (SeaPort)
SRV - [2009.11.04 17:45:02 | 000,172,032 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2008.01.19 09:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2008.01.19 09:33:39 | 000,896,512 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2007.09.26 11:53:56 | 002,999,664 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Programme\Symantec\LiveUpdate\LuComServer_3_2.EXE -- (LiveUpdate)
SRV - [2007.09.26 11:53:56 | 000,554,352 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Programme\Symantec\LiveUpdate\AluSchedulerSvc.exe -- (Automatisches LiveUpdate - Scheduler)
SRV - [2007.03.12 11:22:00 | 000,517,768 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe -- (LiveUpdate Notice Service)
SRV - [2006.10.26 19:49:34 | 000,441,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2006.10.26 14:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive)
DRV - [2009.11.04 18:16:46 | 005,079,040 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2009.05.11 11:12:20 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2008.02.26 09:17:30 | 000,493,568 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\netr73.sys -- (netr73)
DRV - [2007.04.23 14:19:24 | 000,227,328 | ---- | M] (NETGEAR Inc.                          ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\wg111v3.sys -- (RTL8187B)
DRV - [2007.03.19 15:58:50 | 000,101,672 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\nvstor32.sys -- (nvstor32)
DRV - [2007.03.15 21:52:00 | 000,049,904 | R--- | M] (Avanquest Software) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\BVRPMPR5.SYS -- (BVRPMPR5)
DRV - [2007.03.12 22:37:00 | 004,465,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2006.11.02 09:30:56 | 000,429,056 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvm60x32.sys -- (NVENETFD)
DRV - [2005.12.12 19:27:00 | 000,019,072 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\PS2.sys -- (Ps2)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_AT&c=73&bd=Pavilion&pf=desktop
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_AT&c=73&bd=Pavilion&pf=desktop
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\..\SearchScopes\{CD209039-1E59-41CF-8CCE-DFD53C90F569}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06
 
 
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://search.msn.com/spbasic.htm
IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://securityresponse.symantec.com/avcenter/fix_homepage
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
 
IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://search.msn.com/spbasic.htm
IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://securityresponse.symantec.com/avcenter/fix_homepage
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
 
IE - HKU\S-1-5-21-3424106836-3771431339-2525162909-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://search.msn.com/spbasic.htm
IE - HKU\S-1-5-21-3424106836-3771431339-2525162909-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.at/
IE - HKU\S-1-5-21-3424106836-3771431339-2525162909-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-3424106836-3771431339-2525162909-1000\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKU\S-1-5-21-3424106836-3771431339-2525162909-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-3424106836-3771431339-2525162909-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.at/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7GGLL_de
IE - HKU\S-1-5-21-3424106836-3771431339-2525162909-1000\..\SearchScopes\{CD209039-1E59-41CF-8CCE-DFD53C90F569}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06
IE - HKU\S-1-5-21-3424106836-3771431339-2525162909-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3424106836-3771431339-2525162909-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = :
 
 
========== FireFox ==========
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.50401.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.11.2571: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.2.2629: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.1739: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{27182e60-b5f3-411c-b545-b44205977502}: C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ [2011.09.26 15:16:26 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3252b9ae-c69a-4eaf-9502-dc9c1f6c009e}: C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DMExtension\ [2011.09.26 15:16:56 | 000,000,000 | ---D | M]
 
[2010.08.13 18:06:23 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Anja\AppData\Roaming\mozilla\Extensions
[2010.08.13 18:06:23 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Anja\AppData\Roaming\mozilla\Extensions\mozswing@mozswing.org
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - homepage: hxxp://www.google.com/
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\18.0.1025.162\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\18.0.1025.162\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\18.0.1025.162\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.220.4 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U22 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll
CHR - plugin: RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit)  (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.0.50401.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: YouTube = C:\Users\Anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google-Suche = C:\Users\Anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Google Mail = C:\Users\Anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Programme\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (Bing Bar BHO) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Programme\MSN Toolbar\Platform\6.3.2291.0\npwinext.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (@C:\Program Files\MSN Toolbar\Platform\6.3.2291.0\npwinext.dll,-100) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Programme\MSN Toolbar\Platform\6.3.2291.0\npwinext.dll (Microsoft Corporation)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [KBD] C:\hp\KBD\KbdStub.exe ()
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvSvc] C:\Windows\System32\nvsvc.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [OsdMaestro] C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe (OsdMaestro)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKLM..\RunOnce: [Launcher] C:\Windows\SMINST\Launcher.exe (soft thinks)
O8 - Extra context menu item: Free YouTube Download - C:\Users\Anja\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Anja\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.138
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{48FCB05A-956D-4BC6-8988-EBD475D432A9}: DhcpNameServer = 10.0.0.138
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4B211F69-C1DD-4635-AD90-31E94651FBAB}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Programme\Common Files\microsoft shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Common Files\microsoft shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Anja\AppData\Roaming\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp
O24 - Desktop BackupWallPaper: C:\Users\Anja\AppData\Roaming\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007.07.19 15:51:35 | 000,000,074 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{802e998a-89f3-11df-ab07-90e6ba03f72d}\Shell\AutoRun\command - "" = J:\
O33 - MountPoints2\{802e998a-89f3-11df-ab07-90e6ba03f72d}\Shell\open\Command - "" = rundll32.exe .\\icavpi.dll,InstallM
O33 - MountPoints2\{85e88f2b-8fa4-11dd-bf09-001bfce07dbf}\Shell - "" = AutoRun
O33 - MountPoints2\{85e88f2b-8fa4-11dd-bf09-001bfce07dbf}\Shell\AutoRun\command - "" = J:\LaunchU3.exe -a
O33 - MountPoints2\K\Shell - "" = AutoRun
O33 - MountPoints2\K\Shell\AutoRun\command - "" = K:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
MsConfig - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk - C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe - (Hewlett-Packard Co.)
MsConfig - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Microsoft Office.lnk - C:\Programme\Microsoft Office\Office10\OSA.EXE - (Microsoft Corporation)
MsConfig - StartUpReg: swg - hkey= - key= - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
MsConfig - StartUpReg: Symantec PIF AlertEng - hkey= - key= - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe (Symantec Corporation)
MsConfig - State: "startup" - 2
 
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: WudfPf - Driver
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.10.02 19:32:33 | 000,600,064 | ---- | C] (OldTimer Tools) -- C:\Users\Anja\Desktop\OTL.exe
[2012.09.25 14:50:27 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2012.09.25 12:58:58 | 000,000,000 | ---D | C] -- C:\Users\Anja\AppData\Roaming\Malwarebytes
[2012.09.25 12:58:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.09.25 12:58:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.09.25 12:58:42 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.09.25 12:58:42 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.10.02 19:32:33 | 000,600,064 | ---- | M] (OldTimer Tools) -- C:\Users\Anja\Desktop\OTL.exe
[2012.10.02 19:30:50 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.10.02 19:30:50 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.10.02 19:30:50 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.10.02 19:30:43 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.10.02 19:30:39 | 1072,226,304 | -HS- | M] () -- C:\hiberfil.sys
[2012.09.28 11:56:00 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.09.28 11:27:32 | 000,513,501 | ---- | M] () -- C:\Users\Anja\Desktop\adwcleaner.exe
[2012.09.25 15:01:46 | 000,001,973 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2012.09.25 13:01:11 | 004,503,728 | ---- | M] () -- C:\ProgramData\nud0repor.pad
[2012.09.25 12:58:45 | 000,000,908 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.09.24 14:29:27 | 000,628,504 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.09.24 14:29:27 | 000,595,798 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.09.24 14:29:27 | 000,126,054 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.09.24 14:29:27 | 000,103,872 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.09.24 14:26:44 | 000,000,000 | ---- | M] () -- C:\Users\Anja\defogger_reenable
[2012.09.07 17:04:46 | 000,022,856 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.09.28 11:28:17 | 000,513,501 | ---- | C] () -- C:\Users\Anja\Desktop\adwcleaner.exe
[2012.09.25 12:58:45 | 000,000,908 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.09.24 14:26:44 | 000,000,000 | ---- | C] () -- C:\Users\Anja\defogger_reenable
[2012.09.02 21:25:57 | 004,503,728 | ---- | C] () -- C:\ProgramData\nud0repor.pad
[2012.06.11 15:38:01 | 025,855,383 | ---- | C] () -- C:\Users\Anja\Horoskop Anja Unterbrunner.MP3
[2010.10.22 19:45:05 | 000,009,252 | ---- | C] () -- C:\Users\Anja\J0212957.WMF
[2009.11.25 20:16:22 | 000,001,356 | ---- | C] () -- C:\Users\Anja\AppData\Local\d3d9caps.dat
[2009.08.14 20:38:46 | 030,666,272 | ---- | C] (                                                            ) -- C:\Users\Anja\HappyFoto-Designer.exe
[2008.03.20 23:17:03 | 000,031,073 | ---- | C] () -- C:\Users\Anja\AppData\Roaming\mdbu.bin
[2008.02.29 19:28:23 | 000,000,032 | ---- | C] () -- C:\ProgramData\ezsid.dat
[2008.02.26 22:03:40 | 000,000,305 | ---- | C] () -- C:\ProgramData\addr_file.html
[2008.02.26 21:43:27 | 000,008,856 | ---- | C] () -- C:\ProgramData\LUUnInstall.LiveUpdate
[2008.02.26 20:48:04 | 000,000,000 | ---- | C] () -- C:\Users\Anja\AppData\Roaming\wklnhst.dat
[2007.12.17 14:21:56 | 000,026,112 | ---- | C] () -- C:\Users\Anja\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
 
========== ZeroAccess Check ==========
 
[2006.11.02 14:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.08 19:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.04.11 00:28:20 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.04.11 00:28:26 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== LOP Check ==========
 
[2007.12.26 15:20:24 | 000,000,000 | ---D | M] -- C:\Users\Anja\AppData\Roaming\Ace
[2011.07.27 14:19:52 | 000,000,000 | ---D | M] -- C:\Users\Anja\AppData\Roaming\DVDVideoSoft
[2011.07.27 14:17:08 | 000,000,000 | ---D | M] -- C:\Users\Anja\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.07.04 19:56:46 | 000,000,000 | ---D | M] -- C:\Users\Anja\AppData\Roaming\Image Zone Express
[2008.01.12 21:34:45 | 000,000,000 | ---D | M] -- C:\Users\Anja\AppData\Roaming\mquadr.at
[2011.05.12 18:17:48 | 000,000,000 | ---D | M] -- C:\Users\Anja\AppData\Roaming\OpenOffice.org
[2007.12.17 14:20:00 | 000,000,000 | ---D | M] -- C:\Users\Anja\AppData\Roaming\Printer Info Cache
[2008.02.26 20:48:14 | 000,000,000 | ---D | M] -- C:\Users\Anja\AppData\Roaming\Template
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2007.12.26 15:20:24 | 000,000,000 | ---D | M] -- C:\Users\Anja\AppData\Roaming\Ace
[2009.09.26 07:56:10 | 000,000,000 | ---D | M] -- C:\Users\Anja\AppData\Roaming\Adobe
[2009.11.30 14:26:01 | 000,000,000 | ---D | M] -- C:\Users\Anja\AppData\Roaming\ATI
[2011.07.27 14:19:52 | 000,000,000 | ---D | M] -- C:\Users\Anja\AppData\Roaming\DVDVideoSoft
[2011.07.27 14:17:08 | 000,000,000 | ---D | M] -- C:\Users\Anja\AppData\Roaming\DVDVideoSoftIEHelpers
[2008.01.13 17:38:11 | 000,000,000 | ---D | M] -- C:\Users\Anja\AppData\Roaming\Google
[2007.12.13 11:10:22 | 000,000,000 | ---D | M] -- C:\Users\Anja\AppData\Roaming\Hewlett-Packard
[2008.03.20 21:34:00 | 000,000,000 | ---D | M] -- C:\Users\Anja\AppData\Roaming\HP
[2011.09.20 19:11:33 | 000,000,000 | ---D | M] -- C:\Users\Anja\AppData\Roaming\HpUpdate
[2007.12.13 11:16:05 | 000,000,000 | ---D | M] -- C:\Users\Anja\AppData\Roaming\Identities
[2012.07.04 19:56:46 | 000,000,000 | ---D | M] -- C:\Users\Anja\AppData\Roaming\Image Zone Express
[2008.01.12 23:13:26 | 000,000,000 | ---D | M] -- C:\Users\Anja\AppData\Roaming\InstallShield
[2007.12.13 11:11:37 | 000,000,000 | ---D | M] -- C:\Users\Anja\AppData\Roaming\Macromedia
[2012.09.25 12:58:58 | 000,000,000 | ---D | M] -- C:\Users\Anja\AppData\Roaming\Malwarebytes
[2006.11.02 14:37:34 | 000,000,000 | ---D | M] -- C:\Users\Anja\AppData\Roaming\Media Center Programs
[2011.11.21 21:20:03 | 000,000,000 | --SD | M] -- C:\Users\Anja\AppData\Roaming\Microsoft
[2010.08.13 18:06:23 | 000,000,000 | ---D | M] -- C:\Users\Anja\AppData\Roaming\Mozilla
[2008.01.12 21:34:45 | 000,000,000 | ---D | M] -- C:\Users\Anja\AppData\Roaming\mquadr.at
[2011.05.12 18:17:48 | 000,000,000 | ---D | M] -- C:\Users\Anja\AppData\Roaming\OpenOffice.org
[2007.12.17 14:20:00 | 000,000,000 | ---D | M] -- C:\Users\Anja\AppData\Roaming\Printer Info Cache
[2007.12.17 14:18:41 | 000,000,000 | ---D | M] -- C:\Users\Anja\AppData\Roaming\Real
[2010.10.04 13:26:35 | 000,000,000 | ---D | M] -- C:\Users\Anja\AppData\Roaming\Roxio
[2010.09.06 16:48:26 | 000,000,000 | ---D | M] -- C:\Users\Anja\AppData\Roaming\skypePM
[2008.02.26 20:48:14 | 000,000,000 | ---D | M] -- C:\Users\Anja\AppData\Roaming\Template
[2010.11.08 17:25:23 | 000,000,000 | ---D | M] -- C:\Users\Anja\AppData\Roaming\U3
 
< %APPDATA%\*.exe /s >
[2007.06.28 17:48:46 | 004,603,904 | ---- | M] () -- C:\Users\Anja\AppData\Roaming\U3\00001814C7700865\LaunchPad.exe
[2007.06.28 17:26:02 | 000,110,592 | ---- | M] () -- C:\Users\Anja\AppData\Roaming\U3\temp\cleanup.exe
[2007.06.28 17:21:08 | 003,096,576 | -H-- | M] (SanDisk Corporation) -- C:\Users\Anja\AppData\Roaming\U3\temp\Launchpad Removal.exe
 
< %SYSTEMDRIVE%\*.exe >
 
< MD5 for: AGP440.SYS  >
[2008.01.19 09:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys
[2008.01.19 09:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008.01.19 09:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2008.01.19 09:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\drivers\AGP440.sys
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\SoftwareDistribution\Download\cde11068f5b77b180111333ef9781925\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
[2009.04.11 00:32:28 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys
[2009.04.11 00:32:28 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
[2008.01.19 09:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008.01.19 09:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\drivers\atapi.sys
[2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2008.02.14 18:55:22 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys
[2008.02.14 18:55:22 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys
[2008.02.14 18:55:21 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: IASTORV.SYS  >
[2008.01.19 09:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008.01.19 09:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\drivers\iaStorV.sys
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2006.11.02 11:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll
[2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\SoftwareDistribution\Download\cde11068f5b77b180111333ef9781925\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll
[2009.04.11 00:28:24 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll
[2009.04.11 00:28:24 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll
[2008.01.19 09:35:36 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\drivers\nvstor.sys
[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008.01.19 09:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008.01.19 09:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys
 
< MD5 for: NVSTOR32.SYS  >
[2007.03.19 15:58:50 | 000,101,672 | ---- | M] (NVIDIA Corporation) MD5=019054D997F65358DCA63ECAE5103F97 -- C:\hp\DRIVERS\NVIDIA_Serial_ATA\nvstor32.sys
[2007.03.19 15:58:50 | 000,101,672 | ---- | M] (NVIDIA Corporation) MD5=019054D997F65358DCA63ECAE5103F97 -- C:\Windows\System32\drivers\nvstor32.sys
[2007.03.19 15:58:50 | 000,101,672 | ---- | M] (NVIDIA Corporation) MD5=019054D997F65358DCA63ECAE5103F97 -- C:\Windows\System32\DriverStore\FileRepository\nvstor32.inf_1306af02\nvstor32.sys
 
< MD5 for: SCECLI.DLL  >
[2008.01.19 09:36:19 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2006.11.02 11:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll
[2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\SoftwareDistribution\Download\cde11068f5b77b180111333ef9781925\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll
[2009.04.11 00:28:26 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll
[2009.04.11 00:28:26 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll
 
< MD5 for: USER32.DLL  >
[2007.07.19 15:24:52 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=63B4F59D7C89B1BF5277F1FFEFD491CD -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16438_none_cb39bc5b7047127e\user32.dll
[2009.04.11 08:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\SoftwareDistribution\Download\cde11068f5b77b180111333ef9781925\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll
[2007.07.19 15:24:52 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=9D9F061EDA75425FC67F0365E3467C86 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.20537_none_cbc258dc896598f1\user32.dll
[1999.05.05 23:22:00 | 000,069,632 | ---- | M] (Microsoft Corporation) MD5=B24A0AAA435674392405C770F2F45268 -- C:\AlterPC\WINDOWS\SYSTEM\USER32.DLL
[2008.01.19 09:36:46 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll
[2006.11.02 11:46:13 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=E698A5437B89A285ACA3FF022356810A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16386_none_cb01aa4570716e5e\user32.dll
[2009.04.11 00:28:26 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll
[2009.04.11 00:28:26 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.01.19 09:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.19 09:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2008.01.19 09:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe
[2008.01.19 09:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe
[1999.05.05 23:22:00 | 000,042,181 | ---- | M] () MD5=4B4201A7BE355B0648C10930E0141CA3 -- C:\AlterPC\WINDOWS\WININIT.EXE
[2006.11.02 11:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.16386_none_2ebbf6d3076595ce\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2012.09.07 17:04:42 | 000,218,696 | ---- | M] () MD5=4E0D8C9F83B7FD82393F7D8CCC27E7AE -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\SoftwareDistribution\Download\cde11068f5b77b180111333ef9781925\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2009.04.11 00:28:14 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe
[2009.04.11 00:28:14 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe
[2008.01.19 09:33:37 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2006.11.02 10:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6000.16386_none_4d4fded8cae2956d\ws2ifsl.sys
[2008.01.19 07:56:49 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2008.01.19 07:56:49 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2006.11.02 12:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2006.11.02 12:34:05 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2006.11.02 12:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006.11.02 12:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006.11.02 12:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2009.11.04 17:46:00 | 000,479,232 | ---- | M] (Advanced Micro Devices, Inc.) Unable to obtain MD5 -- C:\Windows\system32\ATIDEMGX.dll

< End of report >
--- --- ---

[/CODE]

LG & Danke
Rene

cosinus 02.10.2012 20:38
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
FF - user.js - File not found
O4 - HKLM..\Run: []  File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007.07.19 15:51:35 | 000,000,074 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{802e998a-89f3-11df-ab07-90e6ba03f72d}\Shell\AutoRun\command - "" = J:\
O33 - MountPoints2\{802e998a-89f3-11df-ab07-90e6ba03f72d}\Shell\open\Command - "" = rundll32.exe .\\icavpi.dll,InstallM
O33 - MountPoints2\{85e88f2b-8fa4-11dd-bf09-001bfce07dbf}\Shell - "" = AutoRun
O33 - MountPoints2\{85e88f2b-8fa4-11dd-bf09-001bfce07dbf}\Shell\AutoRun\command - "" = J:\LaunchU3.exe -a
O33 - MountPoints2\K\Shell - "" = AutoRun
O33 - MountPoints2\K\Shell\AutoRun\command - "" = K:\LaunchU3.exe -a
:Files
C:\ProgramData\*.pad
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

rene07 03.10.2012 20:07
Ok, hier der Log:

Code:
All processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\autoexec.bat moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{802e998a-89f3-11df-ab07-90e6ba03f72d}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{802e998a-89f3-11df-ab07-90e6ba03f72d}\ not found.
File J:\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{802e998a-89f3-11df-ab07-90e6ba03f72d}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{802e998a-89f3-11df-ab07-90e6ba03f72d}\ not found.
File rundll32.exe .\\icavpi.dll,InstallM not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{85e88f2b-8fa4-11dd-bf09-001bfce07dbf}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{85e88f2b-8fa4-11dd-bf09-001bfce07dbf}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{85e88f2b-8fa4-11dd-bf09-001bfce07dbf}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{85e88f2b-8fa4-11dd-bf09-001bfce07dbf}\ not found.
File J:\LaunchU3.exe -a not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\K\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\K\ not found.
File K:\LaunchU3.exe -a not found.
========== FILES ==========
C:\ProgramData\nud0repor.pad moved successfully.
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\Anja\Desktop\cmd.bat deleted successfully.
C:\Users\Anja\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Anja
->Temp folder emptied: 643660444 bytes
->Temporary Internet Files folder emptied: 2936018024 bytes
->Java cache emptied: 1446920 bytes
->Google Chrome cache emptied: 66630458 bytes
->Flash cache emptied: 192270 bytes
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1049349396 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 4.480,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.70.1 log created on 10032012_201227

Files\Folders moved on Reboot...

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

cosinus 03.10.2012 21:09
Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition ( meistens Laufwerk C: ) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtg4nzy0ywy5/settings_2012-09-04.png

rene07 07.10.2012 11:19
Hier der Log:

Code:
12:17:03.0216 4236  TDSS rootkit removing tool 2.8.10.0 Sep 17 2012 19:23:24
12:17:03.0481 4236  ============================================================
12:17:03.0481 4236  Current date / time: 2012/10/07 12:17:03.0481
12:17:03.0481 4236  SystemInfo:
12:17:03.0481 4236 
12:17:03.0481 4236  OS Version: 6.0.6002 ServicePack: 2.0
12:17:03.0481 4236  Product type: Workstation
12:17:03.0481 4236  ComputerName: ANJA-PC
12:17:03.0481 4236  UserName: Anja
12:17:03.0481 4236  Windows directory: C:\Windows
12:17:03.0481 4236  System windows directory: C:\Windows
12:17:03.0481 4236  Processor architecture: Intel x86
12:17:03.0481 4236  Number of processors: 2
12:17:03.0481 4236  Page size: 0x1000
12:17:03.0481 4236  Boot type: Normal boot
12:17:03.0481 4236  ============================================================
12:17:04.0760 4236  Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0xA181, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xF0, Type 'K0', Flags 0x00000050
12:17:04.0792 4236  ============================================================
12:17:04.0792 4236  \Device\Harddisk0\DR0:
12:17:04.0792 4236  MBR partitions:
12:17:04.0792 4236  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x24441DD1
12:17:04.0792 4236  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x24441E10, BlocksNum 0xFEB500
12:17:04.0792 4236  ============================================================
12:17:04.0807 4236  C: <-> \Device\Harddisk0\DR0\Partition1
12:17:05.0010 4236  D: <-> \Device\Harddisk0\DR0\Partition2
12:17:05.0010 4236  ============================================================
12:17:05.0010 4236  Initialize success
12:17:05.0010 4236  ============================================================
12:17:17.0162 4364  ============================================================
12:17:17.0162 4364  Scan started
12:17:17.0162 4364  Mode: Manual; SigCheck; TDLFS;
12:17:17.0162 4364  ============================================================
12:17:19.0424 4364  ================ Scan system memory ========================
12:17:19.0424 4364  System memory - ok
12:17:19.0424 4364  ================ Scan services =============================
12:17:20.0610 4364  [ 82B296AE1892FE3DBEE00C9CF92F8AC7 ] ACPI            C:\Windows\system32\drivers\acpi.sys
12:17:20.0782 4364  ACPI - ok
12:17:20.0891 4364  [ 2EDC5BBAC6C651ECE337BDE8ED97C9FB ] adp94xx        C:\Windows\system32\drivers\adp94xx.sys
12:17:21.0031 4364  adp94xx - ok
12:17:21.0047 4364  [ B84088CA3CDCA97DA44A984C6CE1CCAD ] adpahci        C:\Windows\system32\drivers\adpahci.sys
12:17:21.0078 4364  adpahci - ok
12:17:21.0140 4364  [ 7880C67BCCC27C86FD05AA2AFB5EA469 ] adpu160m        C:\Windows\system32\drivers\adpu160m.sys
12:17:21.0187 4364  adpu160m - ok
12:17:21.0218 4364  [ 9AE713F8E30EFC2ABCCD84904333DF4D ] adpu320        C:\Windows\system32\drivers\adpu320.sys
12:17:21.0234 4364  adpu320 - ok
12:17:21.0265 4364  [ 9D1FDA9E086BA64E3C93C9DE32461BCF ] AeLookupSvc    C:\Windows\System32\aelupsvc.dll
12:17:21.0374 4364  AeLookupSvc - ok
12:17:21.0437 4364  [ 3911B972B55FEA0478476B2E777B29FA ] AFD            C:\Windows\system32\drivers\afd.sys
12:17:21.0499 4364  AFD - ok
12:17:21.0562 4364  [ EF23439CDD587F64C2C1B8825CEAD7D8 ] agp440          C:\Windows\system32\drivers\agp440.sys
12:17:21.0577 4364  agp440 - ok
12:17:21.0640 4364  [ AE1FDF7BF7BB6C6A70F67699D880592A ] aic78xx        C:\Windows\system32\drivers\djsvs.sys
12:17:21.0655 4364  aic78xx - ok
12:17:21.0686 4364  [ A1545B731579895D8CC44FC0481C1192 ] ALG            C:\Windows\System32\alg.exe
12:17:21.0796 4364  ALG - ok
12:17:21.0827 4364  [ 90395B64600EBB4552E26E178C94B2E4 ] aliide          C:\Windows\system32\drivers\aliide.sys
12:17:21.0842 4364  aliide - ok
12:17:21.0920 4364  [ 3927CD2638CE67535A592417433A80B8 ] AMD External Events Utility C:\Windows\system32\atiesrxx.exe
12:17:21.0998 4364  AMD External Events Utility - ok
12:17:22.0045 4364  [ 2B13E304C9DFDFA5EB582F6A149FA2C7 ] amdagp          C:\Windows\system32\drivers\amdagp.sys
12:17:22.0061 4364  amdagp - ok
12:17:22.0108 4364  [ 0577DF1D323FE75A739C787893D300EA ] amdide          C:\Windows\system32\drivers\amdide.sys
12:17:22.0108 4364  amdide - ok
12:17:22.0139 4364  [ DC487885BCEF9F28EECE6FAC0E5DDFC5 ] AmdK7          C:\Windows\system32\drivers\amdk7.sys
12:17:22.0310 4364  AmdK7 - ok
12:17:22.0357 4364  [ 93AE7F7DD54AB986A6F1A1B37BE7442D ] AmdK8          C:\Windows\system32\DRIVERS\amdk8.sys
12:17:22.0451 4364  AmdK8 - ok
12:17:22.0498 4364  [ C6D704C7F0434DC791AAC37CAC4B6E14 ] Appinfo        C:\Windows\System32\appinfo.dll
12:17:22.0544 4364  Appinfo - ok
12:17:22.0591 4364  [ 5F673180268BB1FDB69C99B6619FE379 ] arc            C:\Windows\system32\drivers\arc.sys
12:17:22.0607 4364  arc - ok
12:17:22.0638 4364  [ 957F7540B5E7F602E44648C7DE5A1C05 ] arcsas          C:\Windows\system32\drivers\arcsas.sys
12:17:22.0654 4364  arcsas - ok
12:17:22.0700 4364  [ 53B202ABEE6455406254444303E87BE1 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
12:17:22.0747 4364  AsyncMac - ok
12:17:22.0778 4364  [ 4F4FCB8B6EA06784FB6D475B7EC7300F ] atapi          C:\Windows\system32\drivers\atapi.sys
12:17:22.0778 4364  atapi - ok
12:17:23.0356 4364  [ 840F85A04744FF065881333295E7FA5D ] atikmdag        C:\Windows\system32\DRIVERS\atikmdag.sys
12:17:24.0338 4364  atikmdag - ok
12:17:24.0385 4364  [ 68E2A1A0407A66CF50DA0300852424AB ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
12:17:24.0448 4364  AudioEndpointBuilder - ok
12:17:24.0510 4364  [ 68E2A1A0407A66CF50DA0300852424AB ] Audiosrv        C:\Windows\System32\Audiosrv.dll
12:17:24.0557 4364  Audiosrv - ok
12:17:24.0713 4364  [ B5D974C1FD078A68C7536C561B031D39 ] Automatisches LiveUpdate - Scheduler C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
12:17:24.0869 4364  Automatisches LiveUpdate - Scheduler - ok
12:17:24.0916 4364  [ 67E506B75BD5326A3EC7B70BD014DFB6 ] Beep            C:\Windows\system32\drivers\Beep.sys
12:17:25.0009 4364  Beep - ok
12:17:25.0056 4364  [ C789AF0F724FDA5852FB9A7D3A432381 ] BFE            C:\Windows\System32\bfe.dll
12:17:25.0212 4364  BFE - ok
12:17:25.0337 4364  [ 93952506C6D67330367F7E7934B6A02F ] BITS            C:\Windows\System32\qmgr.dll
12:17:25.0633 4364  BITS - ok
12:17:25.0649 4364  blbdrive - ok
12:17:25.0727 4364  [ 35F376253F687BDE63976CCB3F2108CA ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
12:17:25.0805 4364  bowser - ok
12:17:25.0883 4364  [ 9F9ACC7F7CCDE8A15C282D3F88B43309 ] BrFiltLo        C:\Windows\system32\drivers\brfiltlo.sys
12:17:25.0961 4364  BrFiltLo - ok
12:17:25.0992 4364  [ 56801AD62213A41F6497F96DEE83755A ] BrFiltUp        C:\Windows\system32\drivers\brfiltup.sys
12:17:26.0039 4364  BrFiltUp - ok
12:17:26.0070 4364  [ A3629A0C4226F9E9C72FAAEEBC3AD33C ] Browser        C:\Windows\System32\browser.dll
12:17:26.0148 4364  Browser - ok
12:17:26.0210 4364  [ B304E75CFF293029EDDF094246747113 ] Brserid        C:\Windows\system32\drivers\brserid.sys
12:17:26.0335 4364  Brserid - ok
12:17:26.0366 4364  [ 203F0B1E73ADADBBB7B7B1FABD901F6B ] BrSerWdm        C:\Windows\system32\drivers\brserwdm.sys
12:17:26.0460 4364  BrSerWdm - ok
12:17:26.0507 4364  [ BD456606156BA17E60A04E18016AE54B ] BrUsbMdm        C:\Windows\system32\drivers\brusbmdm.sys
12:17:26.0569 4364  BrUsbMdm - ok
12:17:26.0600 4364  [ AF72ED54503F717A43268B3CC5FAEC2E ] BrUsbSer        C:\Windows\system32\drivers\brusbser.sys
12:17:26.0678 4364  BrUsbSer - ok
12:17:26.0710 4364  [ AD07C1EC6665B8B35741AB91200C6B68 ] BTHMODEM        C:\Windows\system32\drivers\bthmodem.sys
12:17:26.0772 4364  BTHMODEM - ok
12:17:26.0819 4364  [ DA2DC84E2D14EC6DAC1132CAA286118D ] BVRPMPR5        C:\Windows\system32\drivers\BVRPMPR5.SYS
12:17:26.0834 4364  BVRPMPR5 ( UnsignedFile.Multi.Generic ) - warning
12:17:26.0834 4364  BVRPMPR5 - detected UnsignedFile.Multi.Generic (1)
12:17:26.0866 4364  [ 7ADD03E75BEB9E6DD102C3081D29840A ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
12:17:26.0944 4364  cdfs - ok
12:17:26.0990 4364  [ 6B4BFFB9BECD728097024276430DB314 ] cdrom          C:\Windows\system32\DRIVERS\cdrom.sys
12:17:27.0022 4364  cdrom - ok
12:17:27.0053 4364  [ 312EC3E37A0A1F2006534913E37B4423 ] CertPropSvc    C:\Windows\System32\certprop.dll
12:17:27.0115 4364  CertPropSvc - ok
12:17:27.0162 4364  [ DA8E0AFC7BAA226C538EF53AC2F90897 ] circlass        C:\Windows\system32\drivers\circlass.sys
12:17:27.0240 4364  circlass - ok
12:17:27.0271 4364  [ D7659D3B5B92C31E84E53C1431F35132 ] CLFS            C:\Windows\system32\CLFS.sys
12:17:27.0287 4364  CLFS - ok
12:17:27.0505 4364  [ 8EE772032E2FE80A924F3B8DD5082194 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
12:17:27.0536 4364  clr_optimization_v2.0.50727_32 - ok
12:17:27.0739 4364  [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
12:17:27.0786 4364  clr_optimization_v4.0.30319_32 - ok
12:17:27.0833 4364  [ 45201046C776FFDAF3FC8A0029C581C8 ] cmdide          C:\Windows\system32\drivers\cmdide.sys
12:17:27.0848 4364  cmdide - ok
12:17:27.0880 4364  [ 82B8C91D327CFECF76CB58716F7D4997 ] Compbatt        C:\Windows\system32\drivers\compbatt.sys
12:17:27.0895 4364  Compbatt - ok
12:17:27.0895 4364  COMSysApp - ok
12:17:27.0926 4364  [ 2A213AE086BBEC5E937553C7D9A2B22C ] crcdisk        C:\Windows\system32\drivers\crcdisk.sys
12:17:27.0942 4364  crcdisk - ok
12:17:27.0989 4364  [ 22A7F883508176489F559EE745B5BF5D ] Crusoe          C:\Windows\system32\drivers\crusoe.sys
12:17:28.0082 4364  Crusoe - ok
12:17:28.0160 4364  [ 75C6A297E364014840B48ECCD7525E30 ] CryptSvc        C:\Windows\system32\cryptsvc.dll
12:17:28.0207 4364  CryptSvc - ok
12:17:28.0270 4364  [ 3B5B4D53FEC14F7476CA29A20CC31AC9 ] DcomLaunch      C:\Windows\system32\rpcss.dll
12:17:28.0441 4364  DcomLaunch - ok
12:17:28.0472 4364  [ 622C41A07CA7E6DD91770F50D532CB6C ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
12:17:28.0519 4364  DfsC - ok
12:17:28.0909 4364  [ 2CC3DCFB533A1035B13DCAB6160AB38B ] DFSR            C:\Windows\system32\DFSR.exe
12:17:29.0346 4364  DFSR - ok
12:17:29.0393 4364  [ 9028559C132146FB75EB7ACF384B086A ] Dhcp            C:\Windows\System32\dhcpcsvc.dll
12:17:29.0455 4364  Dhcp - ok
12:17:29.0502 4364  [ 5D4AEFC3386920236A548271F8F1AF6A ] disk            C:\Windows\system32\drivers\disk.sys
12:17:29.0533 4364  disk - ok
12:17:29.0596 4364  [ 57D762F6F5974AF0DA2BE88A3349BAAA ] Dnscache        C:\Windows\System32\dnsrslvr.dll
12:17:29.0658 4364  Dnscache - ok
12:17:29.0736 4364  [ 324FD74686B1EF5E7C19A8AF49E748F6 ] dot3svc        C:\Windows\System32\dot3svc.dll
12:17:29.0798 4364  dot3svc - ok
12:17:29.0908 4364  [ 4F59C172C094E1A1D46463A8DC061CBD ] Dot4            C:\Windows\system32\DRIVERS\Dot4.sys
12:17:29.0986 4364  Dot4 - ok
12:17:30.0017 4364  [ 80BF3BA09F6F2523C8F6B7CC6DBF7BD5 ] Dot4Print      C:\Windows\system32\DRIVERS\Dot4Prt.sys
12:17:30.0095 4364  Dot4Print - ok
12:17:30.0126 4364  [ C55004CA6B419B6695970DFE849B122F ] dot4usb        C:\Windows\system32\DRIVERS\dot4usb.sys
12:17:30.0204 4364  dot4usb - ok
12:17:30.0251 4364  [ A622E888F8AA2F6B49E9BC466F0E5DEF ] DPS            C:\Windows\system32\dps.dll
12:17:30.0298 4364  DPS - ok
12:17:30.0329 4364  [ 97FEF831AB90BEE128C9AF390E243F80 ] drmkaud        C:\Windows\system32\drivers\drmkaud.sys
12:17:30.0376 4364  drmkaud - ok
12:17:30.0454 4364  [ C68AC676B0EF30CFBB1080ADCE49EB1F ] DXGKrnl        C:\Windows\System32\drivers\dxgkrnl.sys
12:17:30.0578 4364  DXGKrnl - ok
12:17:30.0610 4364  [ F88FB26547FD2CE6D0A5AF2985892C48 ] E1G60          C:\Windows\system32\DRIVERS\E1G60I32.sys
12:17:30.0719 4364  E1G60 - ok
12:17:30.0750 4364  [ C0B95E40D85CD807D614E264248A45B9 ] EapHost        C:\Windows\System32\eapsvc.dll
12:17:30.0781 4364  EapHost - ok
12:17:30.0812 4364  [ 7F64EA048DCFAC7ACF8B4D7B4E6FE371 ] Ecache          C:\Windows\system32\drivers\ecache.sys
12:17:30.0828 4364  Ecache - ok
12:17:30.0906 4364  [ 9BE3744D295A7701EB425332014F0797 ] ehRecvr        C:\Windows\ehome\ehRecvr.exe
12:17:30.0984 4364  ehRecvr - ok
12:17:31.0031 4364  [ AD1870C8E5D6DD340C829E6074BF3C3F ] ehSched        C:\Windows\ehome\ehsched.exe
12:17:31.0109 4364  ehSched - ok
12:17:31.0140 4364  [ C27C4EE8926E74AA72EFCAB24C5242C3 ] ehstart        C:\Windows\ehome\ehstart.dll
12:17:31.0234 4364  ehstart - ok
12:17:31.0280 4364  [ E8F3F21A71720C84BCF423B80028359F ] elxstor        C:\Windows\system32\drivers\elxstor.sys
12:17:31.0327 4364  elxstor - ok
12:17:31.0421 4364  [ 4E6B23DFC917EA39306B529B773950F4 ] EMDMgmt        C:\Windows\system32\emdmgmt.dll
12:17:31.0577 4364  EMDMgmt - ok
12:17:31.0639 4364  [ 67058C46504BC12D821F38CF99B7B28F ] EventSystem    C:\Windows\system32\es.dll
12:17:31.0686 4364  EventSystem - ok
12:17:31.0717 4364  [ 22B408651F9123527BCEE54B4F6C5CAE ] exfat          C:\Windows\system32\drivers\exfat.sys
12:17:31.0764 4364  exfat - ok
12:17:31.0842 4364  [ 1E9B9A70D332103C52995E957DC09EF8 ] fastfat        C:\Windows\system32\drivers\fastfat.sys
12:17:31.0889 4364  fastfat - ok
12:17:31.0936 4364  [ 63BDADA84951B9C03E641800E176898A ] fdc            C:\Windows\system32\DRIVERS\fdc.sys
12:17:32.0014 4364  fdc - ok
12:17:32.0045 4364  [ 6629B5F0E98151F4AFDD87567EA32BA3 ] fdPHost        C:\Windows\system32\fdPHost.dll
12:17:32.0092 4364  fdPHost - ok
12:17:32.0123 4364  [ 89ED56DCE8E47AF40892778A5BD31FD2 ] FDResPub        C:\Windows\system32\fdrespub.dll
12:17:32.0216 4364  FDResPub - ok
12:17:32.0232 4364  [ A8C0139A884861E3AAE9CFE73B208A9F ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
12:17:32.0248 4364  FileInfo - ok
12:17:32.0294 4364  [ 0AE429A696AECBC5970E3CF2C62635AE ] Filetrace      C:\Windows\system32\drivers\filetrace.sys
12:17:32.0326 4364  Filetrace - ok
12:17:32.0372 4364  [ 6603957EFF5EC62D25075EA8AC27DE68 ] flpydisk        C:\Windows\system32\DRIVERS\flpydisk.sys
12:17:32.0435 4364  flpydisk - ok
12:17:32.0482 4364  [ 01334F9EA68E6877C4EF05D3EA8ABB05 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
12:17:32.0497 4364  FltMgr - ok
12:17:32.0622 4364  [ 8CE364388C8ECA59B14B539179276D44 ] FontCache      C:\Windows\system32\FntCache.dll
12:17:32.0856 4364  FontCache - ok
12:17:32.0965 4364  [ C7FBDD1ED42F82BFA35167A5C9803EA3 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
12:17:32.0996 4364  FontCache3.0.0.0 - ok
12:17:33.0043 4364  [ B972A66758577E0BFD1DE0F91AAA27B5 ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
12:17:33.0090 4364  Fs_Rec - ok
12:17:33.0137 4364  [ 4E1CD0A45C50A8882616CAE5BF82F3C5 ] gagp30kx        C:\Windows\system32\drivers\gagp30kx.sys
12:17:33.0184 4364  gagp30kx - ok
12:17:33.0230 4364  [ CD5D0AEEE35DFD4E986A5AA1500A6E66 ] gpsvc          C:\Windows\System32\gpsvc.dll
12:17:33.0418 4364  gpsvc - ok
12:17:33.0496 4364  [ 8F0DE4FEF8201E306F9938B0905AC96A ] gupdate        C:\Program Files\Google\Update\GoogleUpdate.exe
12:17:33.0511 4364  gupdate - ok
12:17:33.0527 4364  [ 8F0DE4FEF8201E306F9938B0905AC96A ] gupdatem        C:\Program Files\Google\Update\GoogleUpdate.exe
12:17:33.0558 4364  gupdatem - ok
12:17:33.0620 4364  [ 5D4BC124FAAE6730AC002CDB67BF1A1C ] gusvc          C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
12:17:33.0652 4364  gusvc - ok
12:17:33.0714 4364  [ CB04C744BE0A61B1D648FAED182C3B59 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
12:17:33.0776 4364  HdAudAddService - ok
12:17:33.0854 4364  [ 062452B7FFD68C8C042A6261FE8DFF4A ] HDAudBus        C:\Windows\system32\DRIVERS\HDAudBus.sys
12:17:34.0057 4364  HDAudBus - ok
12:17:34.0088 4364  [ 1338520E78D90154ED6BE8F84DE5FCEB ] HidBth          C:\Windows\system32\drivers\hidbth.sys
12:17:34.0151 4364  HidBth - ok
12:17:34.0182 4364  [ FF3160C3A2445128C5A6D9B076DA519E ] HidIr          C:\Windows\system32\drivers\hidir.sys
12:17:34.0260 4364  HidIr - ok
12:17:34.0291 4364  [ 84067081F3318162797385E11A8F0582 ] hidserv        C:\Windows\system32\hidserv.dll
12:17:34.0322 4364  hidserv - ok
12:17:34.0338 4364  [ 3C64042B95E583B366BA4E5D2450235E ] HidUsb          C:\Windows\system32\drivers\hidusb.sys
12:17:34.0416 4364  HidUsb - ok
12:17:34.0478 4364  [ D8AD255B37DA92434C26E4876DB7D418 ] hkmsvc          C:\Windows\system32\kmsvc.dll
12:17:34.0556 4364  hkmsvc - ok
12:17:34.0572 4364  [ DF353B401001246853763C4B7AAA6F50 ] HpCISSs        C:\Windows\system32\drivers\hpcisss.sys
12:17:34.0588 4364  HpCISSs - ok
12:17:34.0744 4364  [ CC8A7D8A8DC9F357B57796583CF8B85F ] hpqcxs08        C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll
12:17:34.0759 4364  hpqcxs08 ( UnsignedFile.Multi.Generic ) - warning
12:17:34.0759 4364  hpqcxs08 - detected UnsignedFile.Multi.Generic (1)
12:17:34.0806 4364  [ 4C2CA71CAAFD2CF1A673FC8DBFD219C4 ] hpqddsvc        C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll
12:17:34.0822 4364  hpqddsvc ( UnsignedFile.Multi.Generic ) - warning
12:17:34.0822 4364  hpqddsvc - detected UnsignedFile.Multi.Generic (1)
12:17:34.0868 4364  [ F870AA3E254628EBEAFE754108D664DE ] HTTP            C:\Windows\system32\drivers\HTTP.sys
12:17:35.0024 4364  HTTP - ok
12:17:35.0087 4364  [ 324C2152FF2C61ABAE92D09F3CCA4D63 ] i2omp          C:\Windows\system32\drivers\i2omp.sys
12:17:35.0102 4364  i2omp - ok
12:17:35.0149 4364  [ 22D56C8184586B7A1F6FA60BE5F5A2BD ] i8042prt        C:\Windows\system32\DRIVERS\i8042prt.sys
12:17:35.0212 4364  i8042prt - ok
12:17:35.0258 4364  [ C957BF4B5D80B46C5017BF0101E6C906 ] iaStorV        C:\Windows\system32\drivers\iastorv.sys
12:17:35.0305 4364  iaStorV - ok
12:17:35.0383 4364  [ 6F95324909B502E2651442C1548AB12F ] IDriverT        c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
12:17:35.0414 4364  IDriverT ( UnsignedFile.Multi.Generic ) - warning
12:17:35.0414 4364  IDriverT - detected UnsignedFile.Multi.Generic (1)
12:17:35.0539 4364  [ 98477B08E61945F974ED9FDC4CB6BDAB ] idsvc          C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
12:17:35.0851 4364  idsvc - ok
12:17:35.0882 4364  [ 2D077BF86E843F901D8DB709C95B49A5 ] iirsp          C:\Windows\system32\drivers\iirsp.sys
12:17:35.0898 4364  iirsp - ok
12:17:35.0992 4364  [ 9908D8A397B76CD8D31D0D383C5773C9 ] IKEEXT          C:\Windows\System32\ikeext.dll
12:17:36.0163 4364  IKEEXT - ok
12:17:36.0288 4364  [ 4A705BF2A6F7972F2F2AD8A0D8079F95 ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHDA.sys
12:17:36.0865 4364  IntcAzAudAddService - ok
12:17:36.0896 4364  [ 97469037714070E45194ED318D636401 ] intelide        C:\Windows\system32\drivers\intelide.sys
12:17:36.0912 4364  intelide - ok
12:17:36.0943 4364  [ CE44CC04262F28216DD4341E9E36A16F ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
12:17:37.0006 4364  intelppm - ok
12:17:37.0052 4364  [ 9AC218C6E6105477484C6FDBE7D409A4 ] IPBusEnum      C:\Windows\system32\ipbusenum.dll
12:17:37.0115 4364  IPBusEnum - ok
12:17:37.0146 4364  [ 62C265C38769B864CB25B4BCF62DF6C3 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
12:17:37.0193 4364  IpFilterDriver - ok
12:17:37.0224 4364  [ 1998BD97F950680BB55F55A7244679C2 ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
12:17:37.0255 4364  iphlpsvc - ok
12:17:37.0271 4364  IpInIp - ok
12:17:37.0318 4364  [ 40F34F8ABA2A015D780E4B09138B6C17 ] IPMIDRV        C:\Windows\system32\drivers\ipmidrv.sys
12:17:37.0380 4364  IPMIDRV - ok
12:17:37.0442 4364  [ 8793643A67B42CEC66490B2A0CF92D68 ] IPNAT          C:\Windows\system32\DRIVERS\ipnat.sys
12:17:37.0489 4364  IPNAT - ok
12:17:37.0536 4364  [ 109C0DFB82C3632FBD11949B73AEEAC9 ] IRENUM          C:\Windows\system32\drivers\irenum.sys
12:17:37.0583 4364  IRENUM - ok
12:17:37.0614 4364  [ 350FCA7E73CF65BCEF43FAE1E4E91293 ] isapnp          C:\Windows\system32\drivers\isapnp.sys
12:17:37.0630 4364  isapnp - ok
12:17:37.0676 4364  [ 232FA340531D940AAC623B121A595034 ] iScsiPrt        C:\Windows\system32\DRIVERS\msiscsi.sys
12:17:37.0692 4364  iScsiPrt - ok
12:17:37.0723 4364  [ BCED60D16156E428F8DF8CF27B0DF150 ] iteatapi        C:\Windows\system32\drivers\iteatapi.sys
12:17:37.0739 4364  iteatapi - ok
12:17:37.0754 4364  [ 06FA654504A498C30ADCA8BEC4E87E7E ] iteraid        C:\Windows\system32\drivers\iteraid.sys
12:17:37.0770 4364  iteraid - ok
12:17:37.0801 4364  [ 37605E0A8CF00CBBA538E753E4344C6E ] kbdclass        C:\Windows\system32\DRIVERS\kbdclass.sys
12:17:37.0832 4364  kbdclass - ok
12:17:37.0848 4364  [ D2600CB17B7408B4A83F231DC9A11AC3 ] kbdhid          C:\Windows\system32\drivers\kbdhid.sys
12:17:37.0926 4364  kbdhid - ok
12:17:37.0957 4364  [ A3E186B4B935905B829219502557314E ] KeyIso          C:\Windows\system32\lsass.exe
12:17:37.0988 4364  KeyIso - ok
12:17:38.0051 4364  [ 4A1445EFA932A3BAF5BDB02D7131EE20 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
12:17:38.0238 4364  KSecDD - ok
12:17:38.0347 4364  [ 8078F8F8F7A79E2E6B494523A828C585 ] KtmRm          C:\Windows\system32\msdtckrm.dll
12:17:38.0519 4364  KtmRm - ok
12:17:38.0597 4364  [ 1BF5EEBFD518DD7298434D8C862F825D ] LanmanServer    C:\Windows\system32\srvsvc.dll
12:17:38.0644 4364  LanmanServer - ok
12:17:38.0690 4364  [ 1DB69705B695B987082C8BAEC0C6B34F ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
12:17:38.0737 4364  LanmanWorkstation - ok
12:17:38.0800 4364  [ 793FF718477345CD5D232C50BED1E452 ] LightScribeService c:\Program Files\Common Files\LightScribe\LSSrvc.exe
12:17:38.0831 4364  LightScribeService ( UnsignedFile.Multi.Generic ) - warning
12:17:38.0831 4364  LightScribeService - detected UnsignedFile.Multi.Generic (1)
12:17:39.0205 4364  [ A97EEB81F05BCE3D7AA6C81F04EF39A4 ] LiveUpdate      C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
12:17:40.0968 4364  LiveUpdate - ok
12:17:41.0077 4364  LiveUpdate Notice Ex - ok
12:17:41.0342 4364  [ C837D17DE0B349539AA527EE750EBE2A ] LiveUpdate Notice Service C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
12:17:41.0623 4364  LiveUpdate Notice Service - ok
12:17:41.0670 4364  [ D1C5883087A0C3F1344D9D55A44901F6 ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
12:17:41.0795 4364  lltdio - ok
12:17:41.0888 4364  [ 2D5A428872F1442631D0959A34ABFF63 ] lltdsvc        C:\Windows\System32\lltdsvc.dll
12:17:42.0029 4364  lltdsvc - ok
12:17:42.0076 4364  [ 35D40113E4A5B961B6CE5C5857702518 ] lmhosts        C:\Windows\System32\lmhsvc.dll
12:17:42.0263 4364  lmhosts - ok
12:17:42.0341 4364  [ A2262FB9F28935E862B4DB46438C80D2 ] LSI_FC          C:\Windows\system32\drivers\lsi_fc.sys
12:17:42.0419 4364  LSI_FC - ok
12:17:42.0497 4364  [ 30D73327D390F72A62F32C103DAF1D6D ] LSI_SAS        C:\Windows\system32\drivers\lsi_sas.sys
12:17:42.0575 4364  LSI_SAS - ok
12:17:42.0622 4364  [ E1E36FEFD45849A95F1AB81DE0159FE3 ] LSI_SCSI        C:\Windows\system32\drivers\lsi_scsi.sys
12:17:42.0637 4364  LSI_SCSI - ok
12:17:42.0653 4364  [ 8F5C7426567798E62A3B3614965D62CC ] luafv          C:\Windows\system32\drivers\luafv.sys
12:17:42.0700 4364  luafv - ok
12:17:42.0715 4364  [ AEF9BABB8A506BC4CE0451A64AADED46 ] Mcx2Svc        C:\Windows\system32\Mcx2Svc.dll
12:17:42.0746 4364  Mcx2Svc - ok
12:17:42.0793 4364  [ D153B14FC6598EAE8422A2037553ADCE ] megasas        C:\Windows\system32\drivers\megasas.sys
12:17:42.0809 4364  megasas - ok
12:17:42.0840 4364  [ 1076FFCFFAAE8385FD62DFCB25AC4708 ] MMCSS          C:\Windows\system32\mmcss.dll
12:17:42.0871 4364  MMCSS - ok
12:17:42.0887 4364  [ E13B5EA0F51BA5B1512EC671393D09BA ] Modem          C:\Windows\system32\drivers\modem.sys
12:17:42.0918 4364  Modem - ok
12:17:42.0965 4364  [ 0A9BB33B56E294F686ABB7C1E4E2D8A8 ] monitor        C:\Windows\system32\DRIVERS\monitor.sys
12:17:43.0012 4364  monitor - ok
12:17:43.0027 4364  [ 5BF6A1326A335C5298477754A506D263 ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys
12:17:43.0043 4364  mouclass - ok
12:17:43.0105 4364  [ A3A6DFF7E9E757DB3DF51A833BC28885 ] mouhid          C:\Windows\system32\drivers\mouhid.sys
12:17:43.0183 4364  mouhid - ok
12:17:43.0230 4364  [ BDAFC88AA6B92F7842416EA6A48E1600 ] MountMgr        C:\Windows\system32\drivers\mountmgr.sys
12:17:43.0246 4364  MountMgr - ok
12:17:43.0277 4364  [ 583A41F26278D9E0EA548163D6139397 ] mpio            C:\Windows\system32\drivers\mpio.sys
12:17:43.0292 4364  mpio - ok
12:17:43.0324 4364  [ 22241FEBA9B2DEFA669C8CB0A8DD7D2E ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
12:17:43.0355 4364  mpsdrv - ok
12:17:43.0511 4364  [ 5DE62C6E9108F14F6794060A9BDECAEC ] MpsSvc          C:\Windows\system32\mpssvc.dll
12:17:43.0651 4364  MpsSvc - ok
12:17:43.0698 4364  [ 4FBBB70D30FD20EC51F80061703B001E ] Mraid35x        C:\Windows\system32\drivers\mraid35x.sys
12:17:43.0729 4364  Mraid35x - ok
12:17:43.0760 4364  [ 82CEA0395524AACFEB58BA1448E8325C ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
12:17:43.0807 4364  MRxDAV - ok
12:17:43.0838 4364  [ 1E94971C4B446AB2290DEB71D01CF0C2 ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
12:17:43.0901 4364  mrxsmb - ok
12:17:43.0932 4364  [ 4FCCB34D793B116423209C0F8B7A3B03 ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
12:17:43.0979 4364  mrxsmb10 - ok
12:17:43.0994 4364  [ C3CB1B40AD4A0124D617A1199B0B9D7C ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
12:17:44.0026 4364  mrxsmb20 - ok
12:17:44.0072 4364  [ 742AED7939E734C36B7E8D6228CE26B7 ] msahci          C:\Windows\system32\drivers\msahci.sys
12:17:44.0088 4364  msahci - ok
12:17:44.0119 4364  [ 3FC82A2AE4CC149165A94699183D3028 ] msdsm          C:\Windows\system32\drivers\msdsm.sys
12:17:44.0135 4364  msdsm - ok
12:17:44.0213 4364  [ FD7520CC3A80C5FC8C48852BB24C6DED ] MSDTC          C:\Windows\System32\msdtc.exe
12:17:44.0291 4364  MSDTC - ok
12:17:44.0384 4364  [ A9927F4A46B816C92F461ACB90CF8515 ] Msfs            C:\Windows\system32\drivers\Msfs.sys
12:17:44.0462 4364  Msfs - ok
12:17:44.0494 4364  [ 0F400E306F385C56317357D6DEA56F62 ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
12:17:44.0494 4364  msisadrv - ok
12:17:44.0540 4364  [ 85466C0757A23D9A9AECDC0755203CB2 ] MSiSCSI        C:\Windows\system32\iscsiexe.dll
12:17:44.0572 4364  MSiSCSI - ok
12:17:44.0572 4364  msiserver - ok
12:17:44.0618 4364  [ D8C63D34D9C9E56C059E24EC7185CC07 ] MSKSSRV        C:\Windows\system32\drivers\MSKSSRV.sys
12:17:44.0665 4364  MSKSSRV - ok
12:17:44.0696 4364  [ 1D373C90D62DDB641D50E55B9E78D65E ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
12:17:44.0743 4364  MSPCLOCK - ok
12:17:44.0790 4364  [ B572DA05BF4E098D4BBA3A4734FB505B ] MSPQM          C:\Windows\system32\drivers\MSPQM.sys
12:17:44.0821 4364  MSPQM - ok
12:17:44.0852 4364  [ B49456D70555DE905C311BCDA6EC6ADB ] MsRPC          C:\Windows\system32\drivers\MsRPC.sys
12:17:44.0899 4364  MsRPC - ok
12:17:44.0946 4364  [ E384487CB84BE41D09711C30CA79646C ] mssmbios        C:\Windows\system32\DRIVERS\mssmbios.sys
12:17:45.0008 4364  mssmbios - ok
12:17:45.0055 4364  [ 7199C1EEC1E4993CAF96B8C0A26BD58A ] MSTEE          C:\Windows\system32\drivers\MSTEE.sys
12:17:45.0118 4364  MSTEE - ok
12:17:45.0149 4364  [ 6A57B5733D4CB702C8EA4542E836B96C ] Mup            C:\Windows\system32\Drivers\mup.sys
12:17:45.0180 4364  Mup - ok
12:17:45.0227 4364  [ E4EAF0C5C1B41B5C83386CF212CA9584 ] napagent        C:\Windows\system32\qagentRT.dll
12:17:45.0289 4364  napagent - ok
12:17:45.0352 4364  [ 85C44FDFF9CF7E72A40DCB7EC06A4416 ] NativeWifiP    C:\Windows\system32\DRIVERS\nwifi.sys
12:17:45.0367 4364  NativeWifiP - ok
12:17:45.0398 4364  [ 1357274D1883F68300AEADD15D7BBB42 ] NDIS            C:\Windows\system32\drivers\ndis.sys
12:17:45.0476 4364  NDIS - ok
12:17:45.0508 4364  [ 0E186E90404980569FB449BA7519AE61 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
12:17:45.0539 4364  NdisTapi - ok
12:17:45.0570 4364  [ D6973AA34C4D5D76C0430B181C3CD389 ] Ndisuio        C:\Windows\system32\DRIVERS\ndisuio.sys
12:17:45.0601 4364  Ndisuio - ok
12:17:45.0648 4364  [ 818F648618AE34F729FDB47EC68345C3 ] NdisWan        C:\Windows\system32\DRIVERS\ndiswan.sys
12:17:45.0710 4364  NdisWan - ok
12:17:45.0757 4364  [ 71DAB552B41936358F3B541AE5997FB3 ] NDProxy        C:\Windows\system32\drivers\NDProxy.sys
12:17:45.0788 4364  NDProxy - ok
12:17:46.0038 4364  [ 51C6D8BFBD4EA5B62A1BA7F4469250D3 ] Net Driver HPZ12 C:\Windows\system32\HPZinw12.dll
12:17:46.0147 4364  Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
12:17:46.0147 4364  Net Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
12:17:46.0194 4364  [ BCD093A5A6777CF626434568DC7DBA78 ] NetBIOS        C:\Windows\system32\DRIVERS\netbios.sys
12:17:46.0303 4364  NetBIOS - ok
12:17:46.0350 4364  [ ECD64230A59CBD93C85F1CD1CAB9F3F6 ] netbt          C:\Windows\system32\DRIVERS\netbt.sys
12:17:46.0412 4364  netbt - ok
12:17:46.0444 4364  [ A3E186B4B935905B829219502557314E ] Netlogon        C:\Windows\system32\lsass.exe
12:17:46.0475 4364  Netlogon - ok
12:17:46.0584 4364  [ C8052711DAECC48B982434C5116CA401 ] Netman          C:\Windows\System32\netman.dll
12:17:46.0693 4364  Netman - ok
12:17:46.0724 4364  [ 2EF3BBE22E5A5ACD1428EE387A0D0172 ] netprofm        C:\Windows\System32\netprofm.dll
12:17:46.0802 4364  netprofm - ok
12:17:46.0849 4364  [ 271AC1312EF1DDE187793183ABBFA8D0 ] netr73          C:\Windows\system32\DRIVERS\netr73.sys
12:17:47.0005 4364  netr73 - ok
12:17:47.0052 4364  [ D6C4E4A39A36029AC0813D476FBD0248 ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
12:17:47.0083 4364  NetTcpPortSharing - ok
12:17:47.0130 4364  [ 2E7FB731D4790A1BC6270ACCEFACB36E ] nfrd960        C:\Windows\system32\drivers\nfrd960.sys
12:17:47.0146 4364  nfrd960 - ok
12:17:47.0208 4364  [ 2997B15415F9BBE05B5A4C1C85E0C6A2 ] NlaSvc          C:\Windows\System32\nlasvc.dll
12:17:47.0270 4364  NlaSvc - ok
12:17:47.0348 4364  [ D36F239D7CCE1931598E8FB90A0DBC26 ] Npfs            C:\Windows\system32\drivers\Npfs.sys
12:17:47.0395 4364  Npfs - ok
12:17:47.0458 4364  [ 8BB86F0C7EEA2BDED6FE095D0B4CA9BD ] nsi            C:\Windows\system32\nsisvc.dll
12:17:47.0489 4364  nsi - ok
12:17:47.0536 4364  [ 609773E344A97410CE4EBF74A8914FCF ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
12:17:47.0582 4364  nsiproxy - ok
12:17:47.0879 4364  [ 6A4A98CEE84CF9E99564510DDA4BAA47 ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
12:17:48.0191 4364  Ntfs - ok
12:17:48.0269 4364  [ E875C093AEC0C978A90F30C9E0DFBB72 ] ntrigdigi      C:\Windows\system32\drivers\ntrigdigi.sys
12:17:48.0347 4364  ntrigdigi - ok
12:17:48.0394 4364  [ C5DBBCDA07D780BDA9B685DF333BB41E ] Null            C:\Windows\system32\drivers\Null.sys
12:17:48.0440 4364  Null - ok
12:17:48.0518 4364  [ 1657F3FBD9061526C14FF37E79306F98 ] NVENETFD        C:\Windows\system32\DRIVERS\nvm60x32.sys
12:17:48.0737 4364  NVENETFD - ok
12:17:49.0252 4364  [ 2D892BB73314ECA5549B96F783BB45E8 ] nvlddmkm        C:\Windows\system32\DRIVERS\nvlddmkm.sys
12:17:50.0188 4364  nvlddmkm - ok
12:17:50.0219 4364  [ E69E946F80C1C31C53003BFBF50CBB7C ] nvraid          C:\Windows\system32\drivers\nvraid.sys
12:17:50.0250 4364  nvraid - ok
12:17:50.0281 4364  [ 9E0BA19A28C498A6D323D065DB76DFFC ] nvstor          C:\Windows\system32\drivers\nvstor.sys
12:17:50.0297 4364  nvstor - ok
12:17:50.0344 4364  [ 019054D997F65358DCA63ECAE5103F97 ] nvstor32        C:\Windows\system32\drivers\nvstor32.sys
12:17:50.0359 4364  nvstor32 - ok
12:17:50.0390 4364  [ 07C186427EB8FCC3D8D7927187F260F7 ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
12:17:50.0406 4364  nv_agp - ok
12:17:50.0422 4364  NwlnkFlt - ok
12:17:50.0437 4364  NwlnkFwd - ok
12:17:50.0531 4364  [ 84DE1DD996B48B05ACE31AD015FA108A ] odserv          C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
12:17:50.0656 4364  odserv - ok
12:17:50.0687 4364  [ 6F310E890D46E246E0E261A63D9B36B4 ] ohci1394        C:\Windows\system32\DRIVERS\ohci1394.sys
12:17:50.0734 4364  ohci1394 - ok
12:17:50.0765 4364  [ 5A432A042DAE460ABE7199B758E8606C ] ose            C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
12:17:50.0780 4364  ose - ok
12:17:50.0843 4364  [ 0C8E8E61AD1EB0B250B846712C917506 ] p2pimsvc        C:\Windows\system32\p2psvc.dll
12:17:51.0077 4364  p2pimsvc - ok
12:17:51.0124 4364  [ 0C8E8E61AD1EB0B250B846712C917506 ] p2psvc          C:\Windows\system32\p2psvc.dll
12:17:51.0326 4364  p2psvc - ok
12:17:51.0389 4364  [ 0FA9B5055484649D63C303FE404E5F4D ] Parport        C:\Windows\system32\drivers\parport.sys
12:17:51.0529 4364  Parport - ok
12:17:51.0592 4364  [ B9C2B89F08670E159F7181891E449CD9 ] partmgr        C:\Windows\system32\drivers\partmgr.sys
12:17:51.0623 4364  partmgr - ok
12:17:51.0638 4364  [ 4F9A6A8A31413180D0FCB279AD5D8112 ] Parvdm          C:\Windows\system32\drivers\parvdm.sys
12:17:51.0716 4364  Parvdm - ok
12:17:51.0763 4364  [ C6276AD11F4BB49B58AA1ED88537F14A ] PcaSvc          C:\Windows\System32\pcasvc.dll
12:17:51.0794 4364  PcaSvc - ok
12:17:51.0841 4364  [ 941DC1D19E7E8620F40BBC206981EFDB ] pci            C:\Windows\system32\drivers\pci.sys
12:17:51.0857 4364  pci - ok
12:17:51.0872 4364  [ 3B1901E401473E03EB8C874271E50C26 ] pciide          C:\Windows\system32\drivers\pciide.sys
12:17:51.0888 4364  pciide - ok
12:17:51.0935 4364  [ E6F3FB1B86AA519E7698AD05E58B04E5 ] pcmcia          C:\Windows\system32\drivers\pcmcia.sys
12:17:51.0950 4364  pcmcia - ok
12:17:51.0997 4364  [ 6349F6ED9C623B44B52EA3C63C831A92 ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
12:17:52.0418 4364  PEAUTH - ok
12:17:52.0886 4364  [ B1689DF169143F57053F795390C99DB3 ] pla            C:\Windows\system32\pla.dll
12:17:53.0401 4364  pla - ok
12:17:53.0557 4364  [ C5E7F8A996EC0A82D508FD9064A5569E ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
12:17:53.0635 4364  PlugPlay - ok
12:17:53.0713 4364  [ 79834AA2FBF9FE81EEBB229024F6F7FC ] Pml Driver HPZ12 C:\Windows\system32\HPZipm12.dll
12:17:53.0776 4364  Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
12:17:53.0776 4364  Pml Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
12:17:54.0041 4364  [ 0C8E8E61AD1EB0B250B846712C917506 ] PNRPAutoReg    C:\Windows\system32\p2psvc.dll
12:17:54.0322 4364  PNRPAutoReg - ok
12:17:54.0524 4364  [ 0C8E8E61AD1EB0B250B846712C917506 ] PNRPsvc        C:\Windows\system32\p2psvc.dll
12:17:54.0821 4364  PNRPsvc - ok
12:17:54.0930 4364  [ D0494460421A03CD5225CCA0059AA146 ] PolicyAgent    C:\Windows\System32\ipsecsvc.dll
12:17:55.0164 4364  PolicyAgent - ok
12:17:55.0211 4364  [ ECFFFAEC0C1ECD8DBC77F39070EA1DB1 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
12:17:55.0382 4364  PptpMiniport - ok
12:17:55.0429 4364  [ 0E3CEF5D28B40CF273281D620C50700A ] Processor      C:\Windows\system32\drivers\processr.sys
12:17:55.0554 4364  Processor - ok
12:17:55.0570 4364  [ 0508FAA222D28835310B7BFCA7A77346 ] ProfSvc        C:\Windows\system32\profsvc.dll
12:17:55.0601 4364  ProfSvc - ok
12:17:55.0616 4364  [ A3E186B4B935905B829219502557314E ] ProtectedStorage C:\Windows\system32\lsass.exe
12:17:55.0632 4364  ProtectedStorage - ok
12:17:55.0679 4364  [ 390C204CED3785609AB24E9C52054A84 ] Ps2            C:\Windows\system32\DRIVERS\PS2.sys
12:17:55.0757 4364  Ps2 - ok
12:17:55.0819 4364  [ 99514FAA8DF93D34B5589187DB3AA0BA ] PSched          C:\Windows\system32\DRIVERS\pacer.sys
12:17:55.0882 4364  PSched - ok
12:17:55.0928 4364  [ D86B4A68565E444D76457F14172C875A ] PxHelp20        C:\Windows\system32\Drivers\PxHelp20.sys
12:17:55.0960 4364  PxHelp20 - ok
12:17:56.0147 4364  [ CCDAC889326317792480C0A67156A1EC ] ql2300          C:\Windows\system32\drivers\ql2300.sys
12:17:56.0615 4364  ql2300 - ok
12:17:56.0740 4364  [ 81A7E5C076E59995D54BC1ED3A16E60B ] ql40xx          C:\Windows\system32\drivers\ql40xx.sys
12:17:56.0849 4364  ql40xx - ok
12:17:57.0020 4364  [ E9ECAE663F47E6CB43962D18AB18890F ] QWAVE          C:\Windows\system32\qwave.dll
12:17:57.0130 4364  QWAVE - ok
12:17:57.0192 4364  [ 9F5E0E1926014D17486901C88ECA2DB7 ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
12:17:57.0254 4364  QWAVEdrv - ok
12:17:57.0301 4364  [ 147D7F9C556D259924351FEB0DE606C3 ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
12:17:57.0488 4364  RasAcd - ok
12:17:57.0676 4364  [ F6A452EB4CEADBB51C9E0EE6B3ECEF0F ] RasAuto        C:\Windows\System32\rasauto.dll
12:17:57.0878 4364  RasAuto - ok
12:17:58.0128 4364  [ A214ADBAF4CB47DD2728859EF31F26B0 ] Rasl2tp        C:\Windows\system32\DRIVERS\rasl2tp.sys
12:17:58.0378 4364  Rasl2tp - ok
12:17:58.0580 4364  [ 75D47445D70CA6F9F894B032FBC64FCF ] RasMan          C:\Windows\System32\rasmans.dll
12:17:58.0674 4364  RasMan - ok
12:17:58.0752 4364  [ 509A98DD18AF4375E1FC40BC175F1DEF ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
12:17:58.0814 4364  RasPppoe - ok
12:17:58.0892 4364  [ 2005F4A1E05FA09389AC85840F0A9E4D ] RasSstp        C:\Windows\system32\DRIVERS\rassstp.sys
12:17:58.0955 4364  RasSstp - ok
12:17:59.0111 4364  [ B14C9D5B9ADD2F84F70570BBBFAA7935 ] rdbss          C:\Windows\system32\DRIVERS\rdbss.sys
12:17:59.0360 4364  rdbss - ok
12:17:59.0454 4364  [ 89E59BE9A564262A3FB6C4F4F1CD9899 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
12:17:59.0548 4364  RDPCDD - ok
12:17:59.0735 4364  [ E8BD98D46F2ED77132BA927FCCB47D8B ] rdpdr          C:\Windows\system32\drivers\rdpdr.sys
12:17:59.0906 4364  rdpdr - ok
12:17:59.0969 4364  [ 9D91FE5286F748862ECFFA05F8A0710C ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
12:18:00.0078 4364  RDPENCDD - ok
12:18:00.0172 4364  [ C127EBD5AFAB31524662C48DFCEB773A ] RDPWD          C:\Windows\system32\drivers\RDPWD.sys
12:18:00.0328 4364  RDPWD - ok
12:18:00.0468 4364  [ BCDD6B4804D06B1F7EBF29E53A57ECE9 ] RemoteAccess    C:\Windows\System32\mprdim.dll
12:18:00.0546 4364  RemoteAccess - ok
12:18:00.0577 4364  [ 9E6894EA18DAFF37B63E1005F83AE4AB ] RemoteRegistry  C:\Windows\system32\regsvc.dll
12:18:00.0624 4364  RemoteRegistry - ok
12:18:00.0702 4364  [ 5123F83CBC4349D065534EEB6BBDC42B ] RpcLocator      C:\Windows\system32\locator.exe
12:18:00.0842 4364  RpcLocator - ok
12:18:01.0014 4364  [ 3B5B4D53FEC14F7476CA29A20CC31AC9 ] RpcSs          C:\Windows\system32\rpcss.dll
12:18:01.0232 4364  RpcSs - ok
12:18:01.0264 4364  [ 9C508F4074A39E8B4B31D27198146FAD ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
12:18:01.0295 4364  rspndr - ok
12:18:01.0388 4364  [ 872C4E777BEDCD7F99DC09016B5E6F39 ] RTL8187B        C:\Windows\system32\DRIVERS\wg111v3.sys
12:18:01.0498 4364  RTL8187B - ok
12:18:01.0513 4364  [ A3E186B4B935905B829219502557314E ] SamSs          C:\Windows\system32\lsass.exe
12:18:01.0529 4364  SamSs - ok
12:18:01.0607 4364  [ 3CE8F073A557E172B330109436984E30 ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
12:18:01.0622 4364  sbp2port - ok
12:18:01.0654 4364  [ 77B7A11A0C3D78D3386398FBBEA1B632 ] SCardSvr        C:\Windows\System32\SCardSvr.dll
12:18:01.0700 4364  SCardSvr - ok
12:18:01.0997 4364  [ 1A58069DB21D05EB2AB58EE5753EBE8D ] Schedule        C:\Windows\system32\schedsvc.dll
12:18:02.0262 4364  Schedule - ok
12:18:02.0278 4364  [ 312EC3E37A0A1F2006534913E37B4423 ] SCPolicySvc    C:\Windows\System32\certprop.dll
12:18:02.0324 4364  SCPolicySvc - ok
12:18:02.0387 4364  [ 716313D9F6B0529D03F726D5AAF6F191 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
12:18:02.0434 4364  SDRSVC - ok
12:18:02.0605 4364  [ 331E7BDE228914574FC9AE6CD520DAFA ] SeaPort        C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
12:18:02.0636 4364  SeaPort - ok
12:18:02.0652 4364  [ 90A3935D05B494A5A39D37E71F09A677 ] secdrv          C:\Windows\system32\drivers\secdrv.sys
12:18:02.0714 4364  secdrv - ok
12:18:02.0761 4364  [ FD5199D4D8A521005E4B5EE7FE00FA9B ] seclogon        C:\Windows\system32\seclogon.dll
12:18:02.0808 4364  seclogon - ok
12:18:02.0824 4364  [ A9BBAB5759771E523F55563D6CBE140F ] SENS            C:\Windows\System32\sens.dll
12:18:02.0886 4364  SENS - ok
12:18:02.0917 4364  [ 68E44E331D46F0FB38F0863A84CD1A31 ] Serenum        C:\Windows\system32\drivers\serenum.sys
12:18:02.0995 4364  Serenum - ok
12:18:03.0089 4364  [ C70D69A918B178D3C3B06339B40C2E1B ] Serial          C:\Windows\system32\drivers\serial.sys
12:18:03.0229 4364  Serial - ok
12:18:03.0260 4364  [ 8AF3D28A879BF75DB53A0EE7A4289624 ] sermouse        C:\Windows\system32\drivers\sermouse.sys
12:18:03.0292 4364  sermouse - ok
12:18:03.0354 4364  [ D2193326F729B163125610DBF3E17D57 ] SessionEnv      C:\Windows\system32\sessenv.dll
12:18:03.0416 4364  SessionEnv - ok
12:18:03.0479 4364  [ 103B79418DA647736EE95645F305F68A ] sffdisk        C:\Windows\system32\drivers\sffdisk.sys
12:18:03.0541 4364  sffdisk - ok
12:18:03.0588 4364  [ 8FD08A310645FE872EEEC6E08C6BF3EE ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys
12:18:03.0650 4364  sffp_mmc - ok
12:18:03.0697 4364  [ 9CFA05FCFCB7124E69CFC812B72F9614 ] sffp_sd        C:\Windows\system32\drivers\sffp_sd.sys
12:18:03.0775 4364  sffp_sd - ok
12:18:03.0791 4364  [ 46ED8E91793B2E6F848015445A0AC188 ] sfloppy        C:\Windows\system32\drivers\sfloppy.sys
12:18:03.0838 4364  sfloppy - ok
12:18:03.0900 4364  [ E1499BD0FF76B1B2FBBF1AF339D91165 ] SharedAccess    C:\Windows\System32\ipnathlp.dll
12:18:03.0962 4364  SharedAccess - ok
12:18:04.0009 4364  [ C7230FBEE14437716701C15BE02C27B8 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
12:18:04.0072 4364  ShellHWDetection - ok
12:18:04.0103 4364  [ D2A595D6EEBEEAF4334F8E50EFBC9931 ] sisagp          C:\Windows\system32\drivers\sisagp.sys
12:18:04.0118 4364  sisagp - ok
12:18:04.0134 4364  [ CEDD6F4E7D84E9F98B34B3FE988373AA ] SiSRaid2        C:\Windows\system32\drivers\sisraid2.sys
12:18:04.0150 4364  SiSRaid2 - ok
12:18:04.0181 4364  [ DF843C528C4F69D12CE41CE462E973A7 ] SiSRaid4        C:\Windows\system32\drivers\sisraid4.sys
12:18:04.0196 4364  SiSRaid4 - ok
12:18:04.0540 4364  [ 862BB4CBC05D80C5B45BE430E5EF872F ] slsvc          C:\Windows\system32\SLsvc.exe
12:18:05.0772 4364  slsvc - ok
12:18:05.0850 4364  [ 6EDC422215CD78AA8A9CDE6B30ABBD35 ] SLUINotify      C:\Windows\system32\SLUINotify.dll
12:18:05.0897 4364  SLUINotify - ok
12:18:05.0944 4364  [ 7B75299A4D201D6A6533603D6914AB04 ] Smb            C:\Windows\system32\DRIVERS\smb.sys
12:18:06.0006 4364  Smb - ok
12:18:06.0053 4364  [ 2A146A055B4401C16EE62D18B8E2A032 ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
12:18:06.0084 4364  SNMPTRAP - ok
12:18:06.0115 4364  [ 7AEBDEEF071FE28B0EEF2CDD69102BFF ] spldr          C:\Windows\system32\drivers\spldr.sys
12:18:06.0146 4364  spldr - ok
12:18:06.0178 4364  [ 8554097E5136C3BF9F69FE578A1B35F4 ] Spooler        C:\Windows\System32\spoolsv.exe
12:18:06.0224 4364  Spooler - ok
12:18:06.0271 4364  [ 41987F9FC0E61ADF54F581E15029AD91 ] srv            C:\Windows\system32\DRIVERS\srv.sys
12:18:06.0318 4364  srv - ok
12:18:06.0396 4364  [ FF33AFF99564B1AA534F58868CBE41EF ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
12:18:06.0458 4364  srv2 - ok
12:18:06.0505 4364  [ 7605C0E1D01A08F3ECD743F38B834A44 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
12:18:06.0521 4364  srvnet - ok
12:18:06.0552 4364  [ 03D50B37234967433A5EA5BA72BC0B62 ] SSDPSRV        C:\Windows\System32\ssdpsrv.dll
12:18:06.0614 4364  SSDPSRV - ok
12:18:06.0661 4364  [ 5EC550B8952882EE856B862CF648522D ] ssmdrv          C:\Windows\system32\DRIVERS\ssmdrv.sys
12:18:06.0677 4364  ssmdrv - ok
12:18:06.0708 4364  [ 6F1A32E7B7B30F004D9A20AFADB14944 ] SstpSvc        C:\Windows\system32\sstpsvc.dll
12:18:06.0739 4364  SstpSvc - ok
12:18:06.0895 4364  [ 5DE7D67E49B88F5F07F3E53C4B92A352 ] stisvc          C:\Windows\System32\wiaservc.dll
12:18:06.0989 4364  stisvc - ok
12:18:07.0067 4364  [ 4CFEB2BD9723489DA072B300940EA287 ] stllssvr        c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
12:18:07.0082 4364  stllssvr - ok
12:18:07.0098 4364  [ 7BA58ECF0C0A9A69D44B3DCA62BECF56 ] swenum          C:\Windows\system32\DRIVERS\swenum.sys
12:18:07.0114 4364  swenum - ok
12:18:07.0145 4364  [ F21FD248040681CCA1FB6C9A03AAA93D ] swprv          C:\Windows\System32\swprv.dll
12:18:07.0176 4364  swprv - ok
12:18:07.0207 4364  [ 192AA3AC01DF071B541094F251DEED10 ] Symc8xx        C:\Windows\system32\drivers\symc8xx.sys
12:18:07.0223 4364  Symc8xx - ok
12:18:07.0238 4364  [ 8C8EB8C76736EBAF3B13B633B2E64125 ] Sym_hi          C:\Windows\system32\drivers\sym_hi.sys
12:18:07.0254 4364  Sym_hi - ok
12:18:07.0285 4364  [ 8072AF52B5FD103BBBA387A1E49F62CB ] Sym_u3          C:\Windows\system32\drivers\sym_u3.sys
12:18:07.0301 4364  Sym_u3 - ok
12:18:07.0348 4364  [ 9A51B04E9886AA4EE90093586B0BA88D ] SysMain        C:\Windows\system32\sysmain.dll
12:18:07.0472 4364  SysMain - ok
12:18:07.0519 4364  [ 2DCA225EAE15F42C0933E998EE0231C3 ] TabletInputService C:\Windows\System32\TabSvc.dll
12:18:07.0535 4364  TabletInputService - ok
12:18:07.0566 4364  [ D7673E4B38CE21EE54C59EEEB65E2483 ] TapiSrv        C:\Windows\System32\tapisrv.dll
12:18:07.0613 4364  TapiSrv - ok
12:18:07.0660 4364  [ CB05822CD9CC6C688168E113C603DBE7 ] TBS            C:\Windows\System32\tbssvc.dll
12:18:07.0706 4364  TBS - ok
12:18:07.0847 4364  [ 27D470DABC77BC60D0A3B0E4DEB6CB91 ] Tcpip          C:\Windows\system32\drivers\tcpip.sys
12:18:08.0174 4364  Tcpip - ok
12:18:08.0221 4364  [ 27D470DABC77BC60D0A3B0E4DEB6CB91 ] Tcpip6          C:\Windows\system32\DRIVERS\tcpip.sys
12:18:08.0455 4364  Tcpip6 - ok
12:18:08.0486 4364  [ 608C345A255D82A6289C2D468EB41FD7 ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
12:18:08.0564 4364  tcpipreg - ok
12:18:08.0767 4364  [ 5DCF5E267BE67A1AE926F2DF77FBCC56 ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
12:18:08.0830 4364  TDPIPE - ok
12:18:08.0876 4364  [ 389C63E32B3CEFED425B61ED92D3F021 ] TDTCP          C:\Windows\system32\drivers\tdtcp.sys
12:18:08.0939 4364  TDTCP - ok
12:18:09.0001 4364  [ 76B06EB8A01FC8624D699E7045303E54 ] tdx            C:\Windows\system32\DRIVERS\tdx.sys
12:18:09.0032 4364  tdx - ok
12:18:09.0064 4364  [ 3CAD38910468EAB9A6479E2F01DB43C7 ] TermDD          C:\Windows\system32\DRIVERS\termdd.sys
12:18:09.0079 4364  TermDD - ok
12:18:09.0095 4364  [ BB95DA09BEF6E7A131BFF3BA5032090D ] TermService    C:\Windows\System32\termsrv.dll
12:18:09.0220 4364  TermService - ok
12:18:09.0266 4364  [ C7230FBEE14437716701C15BE02C27B8 ] Themes          C:\Windows\system32\shsvcs.dll
12:18:09.0313 4364  Themes - ok
12:18:09.0344 4364  [ 1076FFCFFAAE8385FD62DFCB25AC4708 ] THREADORDER    C:\Windows\system32\mmcss.dll
12:18:09.0376 4364  THREADORDER - ok
12:18:09.0391 4364  [ EC74E77D0EB004BD3A809B5F8FB8C2CE ] TrkWks          C:\Windows\System32\trkwks.dll
12:18:09.0438 4364  TrkWks - ok
12:18:09.0500 4364  [ 97D9D6A04E3AD9B6C626B9931DB78DBA ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
12:18:09.0563 4364  TrustedInstaller - ok
12:18:09.0610 4364  [ DCF0F056A2E4F52287264F5AB29CF206 ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
12:18:09.0641 4364  tssecsrv - ok
12:18:09.0672 4364  [ CAECC0120AC49E3D2F758B9169872D38 ] tunmp          C:\Windows\system32\DRIVERS\tunmp.sys
12:18:09.0719 4364  tunmp - ok
12:18:09.0766 4364  [ 300DB877AC094FEAB0BE7688C3454A9C ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
12:18:09.0797 4364  tunnel - ok
12:18:09.0828 4364  [ C3ADE15414120033A36C0F293D4A4121 ] uagp35          C:\Windows\system32\drivers\uagp35.sys
12:18:09.0844 4364  uagp35 - ok
12:18:09.0890 4364  [ D9728AF68C4C7693CB100B8441CBDEC6 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
12:18:09.0922 4364  udfs - ok
12:18:09.0968 4364  [ ECEF404F62863755951E09C802C94AD5 ] UI0Detect      C:\Windows\system32\UI0Detect.exe
12:18:10.0031 4364  UI0Detect - ok
12:18:10.0046 4364  [ 75E6890EBFCE0841D3291B02E7A8BDB0 ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
12:18:10.0093 4364  uliagpkx - ok
12:18:10.0124 4364  [ 3CD4EA35A6221B85DCC25DAA46313F8D ] uliahci        C:\Windows\system32\drivers\uliahci.sys
12:18:10.0140 4364  uliahci - ok
12:18:10.0156 4364  [ 8514D0E5CD0534467C5FC61BE94A569F ] UlSata          C:\Windows\system32\drivers\ulsata.sys
12:18:10.0171 4364  UlSata - ok
12:18:10.0202 4364  [ 38C3C6E62B157A6BC46594FADA45C62B ] ulsata2        C:\Windows\system32\drivers\ulsata2.sys
12:18:10.0218 4364  ulsata2 - ok
12:18:10.0249 4364  [ 32CFF9F809AE9AED85464492BF3E32D2 ] umbus          C:\Windows\system32\DRIVERS\umbus.sys
12:18:10.0280 4364  umbus - ok
12:18:10.0327 4364  [ 68308183F4AE0BE7BF8ECD07CB297999 ] upnphost        C:\Windows\System32\upnphost.dll
12:18:10.0374 4364  upnphost - ok
12:18:10.0436 4364  [ CAF811AE4C147FFCD5B51750C7F09142 ] usbccgp        C:\Windows\system32\DRIVERS\usbccgp.sys
12:18:10.0452 4364  usbccgp - ok
12:18:10.0514 4364  [ E9476E6C486E76BC4898074768FB7131 ] usbcir          C:\Windows\system32\drivers\usbcir.sys
12:18:10.0561 4364  usbcir - ok
12:18:10.0608 4364  [ 79E96C23A97CE7B8F14D310DA2DB0C9B ] usbehci        C:\Windows\system32\DRIVERS\usbehci.sys
12:18:10.0655 4364  usbehci - ok
12:18:10.0702 4364  [ 4673BBCB006AF60E7ABDDBE7A130BA42 ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys
12:18:10.0733 4364  usbhub - ok
12:18:10.0764 4364  [ CE697FEE0D479290D89BEC80DFE793B7 ] usbohci        C:\Windows\system32\DRIVERS\usbohci.sys
12:18:10.0795 4364  usbohci - ok
12:18:10.0826 4364  [ E75C4B5269091D15A2E7DC0B6D35F2F5 ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys
12:18:10.0889 4364  usbprint - ok
12:18:10.0920 4364  [ A508C9BD8724980512136B039BBA65E9 ] usbscan        C:\Windows\system32\DRIVERS\usbscan.sys
12:18:10.0951 4364  usbscan - ok
12:18:10.0967 4364  [ BE3DA31C191BC222D9AD503C5224F2AD ] USBSTOR        C:\Windows\system32\DRIVERS\USBSTOR.SYS
12:18:11.0014 4364  USBSTOR - ok
12:18:11.0045 4364  [ 325DBBACB8A36AF9988CCF40EAC228CC ] usbuhci        C:\Windows\system32\DRIVERS\usbuhci.sys
12:18:11.0123 4364  usbuhci - ok
12:18:11.0170 4364  [ 1509E705F3AC1D474C92454A5C2DD81F ] UxSms          C:\Windows\System32\uxsms.dll
12:18:11.0216 4364  UxSms - ok
12:18:11.0279 4364  [ CD88D1B7776DC17A119049742EC07EB4 ] vds            C:\Windows\System32\vds.exe
12:18:11.0404 4364  vds - ok
12:18:11.0466 4364  [ 87B06E1F30B749A114F74622D013F8D4 ] vga            C:\Windows\system32\DRIVERS\vgapnp.sys
12:18:11.0513 4364  vga - ok
12:18:11.0606 4364  [ 2E93AC0A1D8C79D019DB6C51F036636C ] VgaSave        C:\Windows\System32\drivers\vga.sys
12:18:11.0638 4364  VgaSave - ok
12:18:11.0700 4364  [ 045D9961E591CF0674A920B6BA3BA5CB ] viaagp          C:\Windows\system32\drivers\viaagp.sys
12:18:11.0716 4364  viaagp - ok
12:18:11.0747 4364  [ 56A4DE5F02F2E88182B0981119B4DD98 ] ViaC7          C:\Windows\system32\drivers\viac7.sys
12:18:11.0825 4364  ViaC7 - ok
12:18:11.0856 4364  [ FD2E3175FCADA350C7AB4521DCA187EC ] viaide          C:\Windows\system32\drivers\viaide.sys
12:18:11.0856 4364  viaide - ok
12:18:11.0887 4364  [ 69503668AC66C77C6CD7AF86FBDF8C43 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
12:18:11.0903 4364  volmgr - ok
12:18:11.0934 4364  [ 23E41B834759917BFD6B9A0D625D0C28 ] volmgrx        C:\Windows\system32\drivers\volmgrx.sys
12:18:11.0950 4364  volmgrx - ok
12:18:11.0965 4364  [ 147281C01FCB1DF9252DE2A10D5E7093 ] volsnap        C:\Windows\system32\drivers\volsnap.sys
12:18:11.0996 4364  volsnap - ok
12:18:12.0028 4364  [ D984439746D42B30FC65A4C3546C6829 ] vsmraid        C:\Windows\system32\drivers\vsmraid.sys
12:18:12.0043 4364  vsmraid - ok
12:18:12.0090 4364  [ DB3D19F850C6EB32BDCB9BC0836ACDDB ] VSS            C:\Windows\system32\vssvc.exe
12:18:12.0464 4364  VSS - ok
12:18:12.0496 4364  [ 96EA68B9EB310A69C25EBB0282B2B9DE ] W32Time        C:\Windows\system32\w32time.dll
12:18:12.0558 4364  W32Time - ok
12:18:12.0620 4364  [ 48DFEE8F1AF7C8235D4E626F0C4FE031 ] WacomPen        C:\Windows\system32\drivers\wacompen.sys
12:18:12.0714 4364  WacomPen - ok
12:18:12.0761 4364  [ 55201897378CCA7AF8B5EFD874374A26 ] Wanarp          C:\Windows\system32\DRIVERS\wanarp.sys
12:18:12.0792 4364  Wanarp - ok
12:18:12.0808 4364  [ 55201897378CCA7AF8B5EFD874374A26 ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
12:18:12.0823 4364  Wanarpv6 - ok
12:18:12.0870 4364  [ A3CD60FD826381B49F03832590E069AF ] wcncsvc        C:\Windows\System32\wcncsvc.dll
12:18:13.0010 4364  wcncsvc - ok
12:18:13.0042 4364  [ 11BCB7AFCDD7AADACB5746F544D3A9C7 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
12:18:13.0073 4364  WcsPlugInService - ok
12:18:13.0104 4364  [ AFC5AD65B991C1E205CF25CFDBF7A6F4 ] Wd              C:\Windows\system32\drivers\wd.sys
12:18:13.0135 4364  Wd - ok
12:18:13.0166 4364  [ B6F0A7AD6D4BD325FBCD8BAC96CD8D96 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
12:18:13.0229 4364  Wdf01000 - ok
12:18:13.0276 4364  [ ABFC76B48BB6C96E3338D8943C5D93B5 ] WdiServiceHost  C:\Windows\system32\wdi.dll
12:18:13.0322 4364  WdiServiceHost - ok
12:18:13.0322 4364  [ ABFC76B48BB6C96E3338D8943C5D93B5 ] WdiSystemHost  C:\Windows\system32\wdi.dll
12:18:13.0369 4364  WdiSystemHost - ok
12:18:13.0432 4364  [ 04C37D8107320312FBAE09926103D5E2 ] WebClient      C:\Windows\System32\webclnt.dll
12:18:13.0510 4364  WebClient - ok
12:18:13.0634 4364  [ AE3736E7E8892241C23E4EBBB7453B60 ] Wecsvc          C:\Windows\system32\wecsvc.dll
12:18:13.0697 4364  Wecsvc - ok
12:18:13.0978 4364  [ 670FF720071ED741206D69BD995EA453 ] wercplsupport  C:\Windows\System32\wercplsupport.dll
12:18:14.0056 4364  wercplsupport - ok
12:18:14.0118 4364  [ 32B88481D3B326DA6DEB07B1D03481E7 ] WerSvc          C:\Windows\System32\WerSvc.dll
12:18:14.0243 4364  WerSvc - ok
12:18:14.0305 4364  [ 4575AA12561C5648483403541D0D7F2B ] WinDefend      C:\Program Files\Windows Defender\mpsvc.dll
12:18:14.0336 4364  WinDefend - ok
12:18:14.0336 4364  WinHttpAutoProxySvc - ok
12:18:14.0399 4364  [ 6B2A1D0E80110E3D04E6863C6E62FD8A ] Winmgmt        C:\Windows\system32\wbem\WMIsvc.dll
12:18:14.0430 4364  Winmgmt - ok
12:18:14.0570 4364  [ 7CFE68BDC065E55AA5E8421607037511 ] WinRM          C:\Windows\system32\WsmSvc.dll
12:18:15.0319 4364  WinRM - ok
12:18:15.0382 4364  [ C008405E4FEEB069E30DA1D823910234 ] Wlansvc        C:\Windows\System32\wlansvc.dll
12:18:15.0569 4364  Wlansvc - ok
12:18:15.0616 4364  [ 701A9F884A294327E9141D73746EE279 ] WmiAcpi        C:\Windows\system32\drivers\wmiacpi.sys
12:18:15.0756 4364  WmiAcpi - ok
12:18:15.0834 4364  [ 43BE3875207DCB62A85C8C49970B66CC ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
12:18:15.0912 4364  wmiApSrv - ok
12:18:15.0990 4364  [ 3978704576A121A9204F8CC49A301A9B ] WMPNetworkSvc  C:\Program Files\Windows Media Player\wmpnetwk.exe
12:18:16.0224 4364  WMPNetworkSvc - ok
12:18:16.0271 4364  [ CFC5A04558F5070CEE3E3A7809F3FF52 ] WPCSvc          C:\Windows\System32\wpcsvc.dll
12:18:16.0333 4364  WPCSvc - ok
12:18:16.0364 4364  [ 801FBDB89D472B3C467EB112A0FC9246 ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
12:18:16.0427 4364  WPDBusEnum - ok
12:18:16.0458 4364  [ DE9D36F91A4DF3D911626643DEBF11EA ] WpdUsb          C:\Windows\system32\DRIVERS\wpdusb.sys
12:18:16.0474 4364  WpdUsb - ok
12:18:16.0848 4364  [ DCF3E3EDF5109EE8BC02FE6E1F045795 ] WPFFontCache_v0400 C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
12:18:17.0035 4364  WPFFontCache_v0400 - ok
12:18:17.0098 4364  [ E3A3CB253C0EC2494D4A61F5E43A389C ] ws2ifsl        C:\Windows\system32\drivers\ws2ifsl.sys
12:18:17.0191 4364  ws2ifsl - ok
12:18:17.0269 4364  [ 1CA6C40261DDC0425987980D0CD2AAAB ] wscsvc          C:\Windows\System32\wscsvc.dll
12:18:17.0332 4364  wscsvc - ok
12:18:17.0347 4364  WSearch - ok
12:18:17.0644 4364  [ FC3EC24FCE372C89423E015A2AC1A31E ] wuauserv        C:\Windows\system32\wuaueng.dll
12:18:19.0016 4364  wuauserv - ok
12:18:19.0141 4364  [ AC13CB789D93412106B0FB6C7EB2BCB6 ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
12:18:19.0250 4364  WUDFRd - ok
12:18:19.0484 4364  [ 575A4190D989F64732119E4114045A4F ] wudfsvc        C:\Windows\System32\WUDFSvc.dll
12:18:19.0594 4364  wudfsvc - ok
12:18:19.0640 4364  ================ Scan global ===============================
12:18:19.0796 4364  [ F31EEBC1A1C81FD04005489CC3DCDFE7 ] C:\Windows\system32\basesrv.dll
12:18:20.0062 4364  [ D2293B069E4B63DC17B2F08D45E71124 ] C:\Windows\system32\winsrv.dll
12:18:20.0140 4364  [ D2293B069E4B63DC17B2F08D45E71124 ] C:\Windows\system32\winsrv.dll
12:18:20.0280 4364  [ D4E6D91C1349B7BFB3599A6ADA56851B ] C:\Windows\system32\services.exe
12:18:20.0296 4364  [Global] - ok
12:18:20.0296 4364  ================ Scan MBR ==================================
12:18:20.0311 4364  [ 8913823FF508CCF109DB74B636C301DA ] \Device\Harddisk0\DR0
12:18:22.0916 4364  \Device\Harddisk0\DR0 - ok
12:18:22.0916 4364  ================ Scan VBR ==================================
12:18:22.0916 4364  [ FA2D48BA9BEB7EF57A8A88CB4C5CB9F0 ] \Device\Harddisk0\DR0\Partition1
12:18:22.0916 4364  \Device\Harddisk0\DR0\Partition1 - ok
12:18:22.0963 4364  [ 943643FD1569F06E850D37E8F6545C82 ] \Device\Harddisk0\DR0\Partition2
12:18:22.0994 4364  \Device\Harddisk0\DR0\Partition2 - ok
12:18:22.0994 4364  ============================================================
12:18:22.0994 4364  Scan finished
12:18:22.0994 4364  ============================================================
12:18:23.0026 4356  Detected object count: 7
12:18:23.0026 4356  Actual detected object count: 7
12:18:47.0642 4356  BVRPMPR5 ( UnsignedFile.Multi.Generic ) - skipped by user
12:18:47.0642 4356  BVRPMPR5 ( UnsignedFile.Multi.Generic ) - User select action: Skip
12:18:47.0658 4356  hpqcxs08 ( UnsignedFile.Multi.Generic ) - skipped by user
12:18:47.0658 4356  hpqcxs08 ( UnsignedFile.Multi.Generic ) - User select action: Skip
12:18:47.0658 4356  hpqddsvc ( UnsignedFile.Multi.Generic ) - skipped by user
12:18:47.0658 4356  hpqddsvc ( UnsignedFile.Multi.Generic ) - User select action: Skip
12:18:47.0658 4356  IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user
12:18:47.0658 4356  IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip
12:18:47.0674 4356  LightScribeService ( UnsignedFile.Multi.Generic ) - skipped by user
12:18:47.0674 4356  LightScribeService ( UnsignedFile.Multi.Generic ) - User select action: Skip
12:18:47.0674 4356  Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
12:18:47.0674 4356  Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip
12:18:47.0674 4356  Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
12:18:47.0674 4356  Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip

cosinus 07.10.2012 19:05
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

rene07 08.10.2012 18:29
Hier der Log:
Code:
Combofix Logfile:

       
Code:

       
ComboFix 12-10-08.02 - Anja 08.10.2012  18:47:59.1.2 - x86
MicrosoftÆ Windows Vistaô Home Premium   6.0.6002.2.1252.43.1031.18.1022.328 [GMT 2:00]
ausgef¸hrt von:: c:\users\Anja\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((   Dateien erstellt von 2012-09-08 bis 2012-10-08  ))))))))))))))))))))))))))))))
.
.
2012-10-08 17:08 . 2012-10-08 17:09        --------        d-----w-        c:\users\Anja\AppData\Local\temp
2012-10-08 17:08 . 2012-10-08 17:08        --------        d-----w-        c:\users\Default\AppData\Local\temp
2012-10-08 16:51 . 2012-08-30 08:17        6980552        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{4EB76354-FF2F-4756-BCEF-32AE3288AE6B}\mpengine.dll
2012-10-03 18:12 . 2012-10-03 18:12        --------        d-----w-        C:\_OTL
2012-09-25 12:50 . 2012-09-25 12:50        --------        d-----w-        c:\program files\ESET
2012-09-25 10:58 . 2012-09-25 10:58        --------        d-----w-        c:\users\Anja\AppData\Roaming\Malwarebytes
2012-09-25 10:58 . 2012-09-25 10:58        --------        d-----w-        c:\programdata\Malwarebytes
2012-09-25 10:58 . 2012-09-25 10:58        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware
2012-09-25 10:58 . 2012-09-07 15:04        22856        ----a-w-        c:\windows\system32\drivers\mbam.sys
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Eintr‰ge & legitime Standardeintr‰ge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-10 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-02-06 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2006-09-28 65536]
"KBD"="c:\hp\KBD\KbdStub.EXE" [2006-12-08 65536]
"OsdMaestro"="c:\program files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe" [2007-02-15 118784]
"RtHDVCpl"="RtHDVCpl.exe" [2007-03-01 4390912]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 49152]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-03-12 90191]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-03-12 7770112]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-03-12 81920]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-11-04 98304]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2010-05-10 439568]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2007-03-07 44168]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
NETGEAR WG111v3 Smart Wizard.lnk - c:\program files\NETGEAR\WG111v3\WG111v3.exe [2006-5-29 1708032]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-02-06 19:39        39408        ----a-w-        c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec PIF AlertEng]
2007-03-12 09:22        517768        ----a-w-        c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12        REG_MULTI_SZ           Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt        REG_MULTI_SZ           hpqcxs08 hpqddsvc
LocalServiceAndNoImpersonation        REG_MULTI_SZ           FontCache
.
Inhalt des "geplante Tasks" Ordners
.
2012-10-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-28 20:02]
.
2012-10-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-28 20:02]
.
.
------- Zus‰tzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.at/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_AT&c=73&bd=Pavilion&pf=desktop
IE: Free YouTube Download - c:\users\Anja\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Free YouTube to MP3 Converter - c:\users\Anja\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 10.0.0.138
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-10-08 19:09
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteintr‰ge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-3424106836-3771431339-2525162909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\C]
@DACL=(02 0000)
"BaseClass"="Drive"
.
[HKEY_USERS\S-1-5-21-3424106836-3771431339-2525162909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC]
@DACL=(02 0000)
.
[HKEY_USERS\S-1-5-21-3424106836-3771431339-2525162909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D]
@DACL=(02 0000)
"BaseClass"="Drive"
.
[HKEY_USERS\S-1-5-21-3424106836-3771431339-2525162909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E]
@DACL=(02 0000)
"BaseClass"="Drive"
.
[HKEY_USERS\S-1-5-21-3424106836-3771431339-2525162909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F]
@DACL=(02 0000)
"BaseClass"="Drive"
.
[HKEY_USERS\S-1-5-21-3424106836-3771431339-2525162909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G]
@DACL=(02 0000)
"BaseClass"="Drive"
.
[HKEY_USERS\S-1-5-21-3424106836-3771431339-2525162909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\H]
@DACL=(02 0000)
"BaseClass"="Drive"
.
[HKEY_USERS\S-1-5-21-3424106836-3771431339-2525162909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\I]
@DACL=(02 0000)
"BaseClass"="Drive"
.
[HKEY_USERS\S-1-5-21-3424106836-3771431339-2525162909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\J]
@DACL=(02 0000)
"BaseClass"="Drive"
.
[HKEY_USERS\S-1-5-21-3424106836-3771431339-2525162909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\L]
@DACL=(02 0000)
"BaseClass"="Drive"
.
[HKEY_USERS\S-1-5-21-3424106836-3771431339-2525162909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{03cd3b75-ddbe-11de-8090-90e6ba03f72d}]
@DACL=(02 0000)
"BaseClass"="Drive"
.
[HKEY_USERS\S-1-5-21-3424106836-3771431339-2525162909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{11388c60-92e7-11dd-aa68-001bfce07dbf}]
@DACL=(02 0000)
"BaseClass"="Drive"
.
[HKEY_USERS\S-1-5-21-3424106836-3771431339-2525162909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{244b77f7-cca5-11df-b042-90e6ba03f72d}]
@DACL=(02 0000)
"BaseClass"="Drive"
.
[HKEY_USERS\S-1-5-21-3424106836-3771431339-2525162909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{41bc3e05-0642-11e2-b771-00c0a8f64d48}]
@DACL=(02 0000)
"BaseClass"="Drive"
.
[HKEY_USERS\S-1-5-21-3424106836-3771431339-2525162909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{41bc3e08-0642-11e2-b771-00c0a8f64d48}]
@DACL=(02 0000)
"BaseClass"="Drive"
.
[HKEY_USERS\S-1-5-21-3424106836-3771431339-2525162909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{46519f38-3e34-11dc-a1f5-806e6f6e6963}]
@DACL=(02 0000)
"BaseClass"="Drive"
.
[HKEY_USERS\S-1-5-21-3424106836-3771431339-2525162909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{46519f3a-3e34-11dc-a1f5-806e6f6e6963}]
@DACL=(02 0000)
"BaseClass"="Drive"
"_CommentFromDesktopINI"=""
.
[HKEY_USERS\S-1-5-21-3424106836-3771431339-2525162909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4651a168-3e34-11dc-a1f5-806e6f6e6963}]
@DACL=(02 0000)
"BaseClass"="Drive"
.
[HKEY_USERS\S-1-5-21-3424106836-3771431339-2525162909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4651a168-3e34-11dc-a1f5-806e6f6e6963}\_Autorun]
@DACL=(02 0000)
.
[HKEY_USERS\S-1-5-21-3424106836-3771431339-2525162909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4651a16d-3e34-11dc-a1f5-806e6f6e6963}]
@DACL=(02 0000)
"BaseClass"="Drive"
.
[HKEY_USERS\S-1-5-21-3424106836-3771431339-2525162909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4651a16e-3e34-11dc-a1f5-806e6f6e6963}]
@DACL=(02 0000)
"BaseClass"="Drive"
.
[HKEY_USERS\S-1-5-21-3424106836-3771431339-2525162909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4651a16f-3e34-11dc-a1f5-806e6f6e6963}]
@DACL=(02 0000)
"BaseClass"="Drive"
.
[HKEY_USERS\S-1-5-21-3424106836-3771431339-2525162909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4651a170-3e34-11dc-a1f5-806e6f6e6963}]
@DACL=(02 0000)
"BaseClass"="Drive"
.
[HKEY_USERS\S-1-5-21-3424106836-3771431339-2525162909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{51013aa3-a968-11dc-bd8c-001bfce07dbf}]
@DACL=(02 0000)
"BaseClass"="Drive"
.
[HKEY_USERS\S-1-5-21-3424106836-3771431339-2525162909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5466fd77-df69-11df-aeda-90e6ba03f72d}]
@DACL=(02 0000)
"BaseClass"="Drive"
.
[HKEY_USERS\S-1-5-21-3424106836-3771431339-2525162909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{575e3b1f-210f-11dd-8510-001bfce07dbf}]
@DACL=(02 0000)
"BaseClass"="Drive"
.
[HKEY_USERS\S-1-5-21-3424106836-3771431339-2525162909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{77b43777-a6f2-11df-bdf3-90e6ba03f72d}]
@DACL=(02 0000)
"BaseClass"="Drive"
.
[HKEY_USERS\S-1-5-21-3424106836-3771431339-2525162909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{77b4377d-a6f2-11df-bdf3-90e6ba03f72d}]
@DACL=(02 0000)
"BaseClass"="Drive"
.
[HKEY_USERS\S-1-5-21-3424106836-3771431339-2525162909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7eb7fa60-f6ae-11dc-83c7-001bfce07dbf}]
@DACL=(02 0000)
"BaseClass"="Drive"
.
[HKEY_USERS\S-1-5-21-3424106836-3771431339-2525162909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{85e88f28-8fa4-11dd-bf09-001bfce07dbf}]
@DACL=(02 0000)
"BaseClass"="Drive"
.
[HKEY_USERS\S-1-5-21-3424106836-3771431339-2525162909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8c2e9342-d9ee-11de-a96e-806e6f6e6963}]
@DACL=(02 0000)
"BaseClass"="Drive"
.
[HKEY_USERS\S-1-5-21-3424106836-3771431339-2525162909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8c2e9343-d9ee-11de-a96e-806e6f6e6963}]
@DACL=(02 0000)
"BaseClass"="Drive"
"_CommentFromDesktopINI"=""
.
[HKEY_USERS\S-1-5-21-3424106836-3771431339-2525162909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8c2e9343-d9ee-11de-a96e-806e6f6e6963}\shell]
@DACL=(02 0000)
@="None"
.
[HKEY_USERS\S-1-5-21-3424106836-3771431339-2525162909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{902033da-dda7-11de-bf1c-806e6f6e6963}]
@DACL=(02 0000)
"BaseClass"="Drive"
.
[HKEY_USERS\S-1-5-21-3424106836-3771431339-2525162909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{902033da-dda7-11de-bf1c-806e6f6e6963}\shell]
@DACL=(02 0000)
@="None"
.
[HKEY_USERS\S-1-5-21-3424106836-3771431339-2525162909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{98d16ee8-eae8-11e1-951e-806e6f6e6963}]
@DACL=(02 0000)
"BaseClass"="Drive"
.
[HKEY_USERS\S-1-5-21-3424106836-3771431339-2525162909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9fc18777-44d8-11e0-9e76-90e6ba03f72d}]
@DACL=(02 0000)
"BaseClass"="Drive"
.
[HKEY_USERS\S-1-5-21-3424106836-3771431339-2525162909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{cb3f5880-e4a3-11dc-854b-001bfce07dbf}]
@DACL=(02 0000)
"BaseClass"="Drive"
.
[HKEY_USERS\S-1-5-21-3424106836-3771431339-2525162909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{cb3f5884-e4a3-11dc-854b-001bfce07dbf}]
@DACL=(02 0000)
"BaseClass"="Drive"
.
[HKEY_USERS\S-1-5-21-3424106836-3771431339-2525162909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d61dd00b-b3c6-11e1-a11b-90e6ba03f72d}]
@DACL=(02 0000)
"BaseClass"="Drive"
.
[HKEY_USERS\S-1-5-21-3424106836-3771431339-2525162909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e4400d4d-e493-11dc-8ba6-001bfce07dbf}]
@DACL=(02 0000)
"BaseClass"="Drive"
.
[HKEY_USERS\S-1-5-21-3424106836-3771431339-2525162909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e4400d51-e493-11dc-8ba6-001bfce07dbf}]
@DACL=(02 0000)
"BaseClass"="Drive"
.
[HKEY_USERS\S-1-5-21-3424106836-3771431339-2525162909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e4400d57-e493-11dc-8ba6-001bfce07dbf}]
@DACL=(02 0000)
"BaseClass"="Drive"
.
[HKEY_USERS\S-1-5-21-3424106836-3771431339-2525162909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e4400d74-e493-11dc-8ba6-001bfce07dbf}]
@DACL=(02 0000)
"BaseClass"="Drive"
.
[HKEY_USERS\S-1-5-21-3424106836-3771431339-2525162909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f47b8d3e-7167-11de-ab0c-001bfce07dbf}]
@DACL=(02 0000)
"BaseClass"="Drive"
.
Zeit der Fertigstellung: 2012-10-08  19:12:11
ComboFix-quarantined-files.txt  2012-10-08 17:12
.
Vor Suchlauf: 14 Verzeichnis(se), 250.405.257.216 Bytes frei
Nach Suchlauf: 19 Verzeichnis(se), 263.099.768.832 Bytes frei
.
- - End Of File - - 47B1BA138C9525054398ABD0C760EB2F

--- --- ---
Allerdings bekomme ich jetzt, wenn ich den Internet Explorer starten möchte folgende Meldung:

Code:
Es wurde versucht einen Registrierungsschlüssel einem unzulässigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

cosinus 08.10.2012 21:37
Zitat:
Allerdings bekomme ich jetzt, wenn ich den Internet Explorer starten möchte folgende Meldung:
Anleitung komplett lesen hilft!

rene07 09.10.2012 17:28
Alles klar - sorry da hab ich wohl die letzte Zeile übersehen.
Funtioniert alles perfekt!

Der Virus scheint soweit entfernt zu sein. Gibt es noch weitere Schritte?

VG & DANKE

cosinus 09.10.2012 18:59
Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).



Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

rene07 10.10.2012 19:52
Hier der Log von GMER:
Code:
GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-10-10 19:56:25
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\0000004f Hitachi_ rev.V54O
Running: s6xffw4v.exe; Driver: C:\Users\Anja\AppData\Local\Temp\kwldrpow.sys


---- Kernel code sections - GMER 1.0.15 ----

.text  C:\Windows\system32\DRIVERS\atikmdag.sys                                                                                                    section is writeable [0x89E02000, 0x2BFAE2, 0xE8000020]

---- Registry - GMER 1.0.15 ----

Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\C@BaseClass                                                            Drive
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume                                                             
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D@BaseClass                                                            Drive
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E@BaseClass                                                            Drive
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F@BaseClass                                                            Drive
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G@BaseClass                                                            Drive
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\H@BaseClass                                                            Drive
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\I@BaseClass                                                            Drive
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\J@BaseClass                                                            Drive
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\L@BaseClass                                                            Drive
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{03cd3b75-ddbe-11de-8090-90e6ba03f72d}@BaseClass                        Drive
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{03cd3b75-ddbe-11de-8090-90e6ba03f72d}\shell                           
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{03cd3b75-ddbe-11de-8090-90e6ba03f72d}\shell@                          None
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{03cd3b75-ddbe-11de-8090-90e6ba03f72d}\shell\Autoplay                 
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{03cd3b75-ddbe-11de-8090-90e6ba03f72d}\shell\Autoplay@MUIVerb          @shell32.dll,-8507
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{03cd3b75-ddbe-11de-8090-90e6ba03f72d}\shell\Autoplay\DropTarget       
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{03cd3b75-ddbe-11de-8090-90e6ba03f72d}\shell\Autoplay\DropTarget@CLSID  {F26A669A-BCBB-4E37-ABF9-7325DA15F931}
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{11388c60-92e7-11dd-aa68-001bfce07dbf}@BaseClass                        Drive
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{11388c60-92e7-11dd-aa68-001bfce07dbf}\shell                           
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{11388c60-92e7-11dd-aa68-001bfce07dbf}\shell@                          None
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{11388c60-92e7-11dd-aa68-001bfce07dbf}\shell\Autoplay                 
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{11388c60-92e7-11dd-aa68-001bfce07dbf}\shell\Autoplay@MUIVerb          @shell32.dll,-8507
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{11388c60-92e7-11dd-aa68-001bfce07dbf}\shell\Autoplay\DropTarget       
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{11388c60-92e7-11dd-aa68-001bfce07dbf}\shell\Autoplay\DropTarget@CLSID  {F26A669A-BCBB-4E37-ABF9-7325DA15F931}
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{244b77f7-cca5-11df-b042-90e6ba03f72d}@BaseClass                        Drive
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{41bc3e05-0642-11e2-b771-00c0a8f64d48}@BaseClass                        Drive
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{41bc3e05-0642-11e2-b771-00c0a8f64d48}\shell                           
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{41bc3e05-0642-11e2-b771-00c0a8f64d48}\shell@                          None
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{41bc3e05-0642-11e2-b771-00c0a8f64d48}\shell\Autoplay                 
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{41bc3e05-0642-11e2-b771-00c0a8f64d48}\shell\Autoplay@MUIVerb          @shell32.dll,-8507
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{41bc3e05-0642-11e2-b771-00c0a8f64d48}\shell\Autoplay\DropTarget       
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{41bc3e05-0642-11e2-b771-00c0a8f64d48}\shell\Autoplay\DropTarget@CLSID  {F26A669A-BCBB-4E37-ABF9-7325DA15F931}
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{41bc3e08-0642-11e2-b771-00c0a8f64d48}@BaseClass                        Drive
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{41bc3e08-0642-11e2-b771-00c0a8f64d48}\shell                           
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{41bc3e08-0642-11e2-b771-00c0a8f64d48}\shell@                          None
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{41bc3e08-0642-11e2-b771-00c0a8f64d48}\shell\Autoplay                 
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{41bc3e08-0642-11e2-b771-00c0a8f64d48}\shell\Autoplay@MUIVerb          @shell32.dll,-8507
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{41bc3e08-0642-11e2-b771-00c0a8f64d48}\shell\Autoplay\DropTarget       
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{41bc3e08-0642-11e2-b771-00c0a8f64d48}\shell\Autoplay\DropTarget@CLSID  {F26A669A-BCBB-4E37-ABF9-7325DA15F931}
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{46519f38-3e34-11dc-a1f5-806e6f6e6963}@BaseClass                        Drive
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{46519f3a-3e34-11dc-a1f5-806e6f6e6963}@BaseClass                        Drive
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{46519f3a-3e34-11dc-a1f5-806e6f6e6963}@_CommentFromDesktopINI         
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4651a168-3e34-11dc-a1f5-806e6f6e6963}@BaseClass                        Drive
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4651a168-3e34-11dc-a1f5-806e6f6e6963}\_Autorun                       
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4651a168-3e34-11dc-a1f5-806e6f6e6963}\_Autorun\DefaultIcon           
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4651a168-3e34-11dc-a1f5-806e6f6e6963}\_Autorun\DefaultIcon@            E:\autorun.exe,0
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4651a16d-3e34-11dc-a1f5-806e6f6e6963}@BaseClass                        Drive
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4651a16e-3e34-11dc-a1f5-806e6f6e6963}@BaseClass                        Drive
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4651a16f-3e34-11dc-a1f5-806e6f6e6963}@BaseClass                        Drive
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4651a170-3e34-11dc-a1f5-806e6f6e6963}@BaseClass                        Drive
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{51013aa3-a968-11dc-bd8c-001bfce07dbf}@BaseClass                        Drive
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{51013aa3-a968-11dc-bd8c-001bfce07dbf}\shell                           
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{51013aa3-a968-11dc-bd8c-001bfce07dbf}\shell@                          None
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{51013aa3-a968-11dc-bd8c-001bfce07dbf}\shell\Autoplay                 
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{51013aa3-a968-11dc-bd8c-001bfce07dbf}\shell\Autoplay@MUIVerb          @shell32.dll,-8507
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{51013aa3-a968-11dc-bd8c-001bfce07dbf}\shell\Autoplay\DropTarget       
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{51013aa3-a968-11dc-bd8c-001bfce07dbf}\shell\Autoplay\DropTarget@CLSID  {F26A669A-BCBB-4E37-ABF9-7325DA15F931}
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5466fd77-df69-11df-aeda-90e6ba03f72d}@BaseClass                        Drive
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5466fd77-df69-11df-aeda-90e6ba03f72d}\shell                           
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5466fd77-df69-11df-aeda-90e6ba03f72d}\shell@                          None
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5466fd77-df69-11df-aeda-90e6ba03f72d}\shell\Autoplay                 
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5466fd77-df69-11df-aeda-90e6ba03f72d}\shell\Autoplay@MUIVerb          @shell32.dll,-8507
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5466fd77-df69-11df-aeda-90e6ba03f72d}\shell\Autoplay\DropTarget       
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5466fd77-df69-11df-aeda-90e6ba03f72d}\shell\Autoplay\DropTarget@CLSID  {F26A669A-BCBB-4E37-ABF9-7325DA15F931}
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{575e3b1f-210f-11dd-8510-001bfce07dbf}@BaseClass                        Drive
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{575e3b1f-210f-11dd-8510-001bfce07dbf}\shell                           
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{575e3b1f-210f-11dd-8510-001bfce07dbf}\shell@                          None
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{575e3b1f-210f-11dd-8510-001bfce07dbf}\shell\Autoplay                 
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{575e3b1f-210f-11dd-8510-001bfce07dbf}\shell\Autoplay@MUIVerb          @shell32.dll,-8507
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{575e3b1f-210f-11dd-8510-001bfce07dbf}\shell\Autoplay\DropTarget       
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{575e3b1f-210f-11dd-8510-001bfce07dbf}\shell\Autoplay\DropTarget@CLSID  {F26A669A-BCBB-4E37-ABF9-7325DA15F931}
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{77b43777-a6f2-11df-bdf3-90e6ba03f72d}@BaseClass                        Drive
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{77b43777-a6f2-11df-bdf3-90e6ba03f72d}\shell                           
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{77b43777-a6f2-11df-bdf3-90e6ba03f72d}\shell@                          None
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{77b43777-a6f2-11df-bdf3-90e6ba03f72d}\shell\Autoplay                 
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{77b43777-a6f2-11df-bdf3-90e6ba03f72d}\shell\Autoplay@MUIVerb          @shell32.dll,-8507
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{77b43777-a6f2-11df-bdf3-90e6ba03f72d}\shell\Autoplay\DropTarget       
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{77b43777-a6f2-11df-bdf3-90e6ba03f72d}\shell\Autoplay\DropTarget@CLSID  {F26A669A-BCBB-4E37-ABF9-7325DA15F931}
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{77b4377d-a6f2-11df-bdf3-90e6ba03f72d}@BaseClass                        Drive
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{77b4377d-a6f2-11df-bdf3-90e6ba03f72d}\shell                           
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{77b4377d-a6f2-11df-bdf3-90e6ba03f72d}\shell@                          None
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{77b4377d-a6f2-11df-bdf3-90e6ba03f72d}\shell\Autoplay                 
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{77b4377d-a6f2-11df-bdf3-90e6ba03f72d}\shell\Autoplay@MUIVerb          @shell32.dll,-8507
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{77b4377d-a6f2-11df-bdf3-90e6ba03f72d}\shell\Autoplay\DropTarget       
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{77b4377d-a6f2-11df-bdf3-90e6ba03f72d}\shell\Autoplay\DropTarget@CLSID  {F26A669A-BCBB-4E37-ABF9-7325DA15F931}
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7eb7fa60-f6ae-11dc-83c7-001bfce07dbf}@BaseClass                        Drive
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7eb7fa60-f6ae-11dc-83c7-001bfce07dbf}\shell                           
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7eb7fa60-f6ae-11dc-83c7-001bfce07dbf}\shell@                          None
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7eb7fa60-f6ae-11dc-83c7-001bfce07dbf}\shell\Autoplay                 
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7eb7fa60-f6ae-11dc-83c7-001bfce07dbf}\shell\Autoplay@MUIVerb          @shell32.dll,-8507
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7eb7fa60-f6ae-11dc-83c7-001bfce07dbf}\shell\Autoplay\DropTarget       
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7eb7fa60-f6ae-11dc-83c7-001bfce07dbf}\shell\Autoplay\DropTarget@CLSID  {F26A669A-BCBB-4E37-ABF9-7325DA15F931}
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{85e88f28-8fa4-11dd-bf09-001bfce07dbf}@BaseClass                        Drive
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{85e88f28-8fa4-11dd-bf09-001bfce07dbf}\shell                           
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{85e88f28-8fa4-11dd-bf09-001bfce07dbf}\shell@                          None
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{85e88f28-8fa4-11dd-bf09-001bfce07dbf}\shell\Autoplay                 
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{85e88f28-8fa4-11dd-bf09-001bfce07dbf}\shell\Autoplay@MUIVerb          @shell32.dll,-8507
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{85e88f28-8fa4-11dd-bf09-001bfce07dbf}\shell\Autoplay\DropTarget       
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{85e88f28-8fa4-11dd-bf09-001bfce07dbf}\shell\Autoplay\DropTarget@CLSID  {F26A669A-BCBB-4E37-ABF9-7325DA15F931}
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8c2e9342-d9ee-11de-a96e-806e6f6e6963}@BaseClass                        Drive
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8c2e9343-d9ee-11de-a96e-806e6f6e6963}@BaseClass                        Drive
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8c2e9343-d9ee-11de-a96e-806e6f6e6963}@_CommentFromDesktopINI         
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8c2e9343-d9ee-11de-a96e-806e6f6e6963}\shell                           
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8c2e9343-d9ee-11de-a96e-806e6f6e6963}\shell@                          None
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8c2e9343-d9ee-11de-a96e-806e6f6e6963}\shell\Autoplay                 
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8c2e9343-d9ee-11de-a96e-806e6f6e6963}\shell\Autoplay@MUIVerb          @shell32.dll,-8507
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8c2e9343-d9ee-11de-a96e-806e6f6e6963}\shell\Autoplay\DropTarget       
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8c2e9343-d9ee-11de-a96e-806e6f6e6963}\shell\Autoplay\DropTarget@CLSID  {F26A669A-BCBB-4E37-ABF9-7325DA15F931}
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{902033da-dda7-11de-bf1c-806e6f6e6963}@BaseClass                        Drive
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{902033da-dda7-11de-bf1c-806e6f6e6963}\shell                           
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{902033da-dda7-11de-bf1c-806e6f6e6963}\shell@                          None
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{902033da-dda7-11de-bf1c-806e6f6e6963}\shell\Autoplay                 
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{902033da-dda7-11de-bf1c-806e6f6e6963}\shell\Autoplay@MUIVerb          @shell32.dll,-8507
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{902033da-dda7-11de-bf1c-806e6f6e6963}\shell\Autoplay\DropTarget       
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{902033da-dda7-11de-bf1c-806e6f6e6963}\shell\Autoplay\DropTarget@CLSID  {F26A669A-BCBB-4E37-ABF9-7325DA15F931}
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{98d16ee8-eae8-11e1-951e-806e6f6e6963}@BaseClass                        Drive
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9fc18777-44d8-11e0-9e76-90e6ba03f72d}@BaseClass                        Drive
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9fc18777-44d8-11e0-9e76-90e6ba03f72d}\shell                           
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9fc18777-44d8-11e0-9e76-90e6ba03f72d}\shell@                          None
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9fc18777-44d8-11e0-9e76-90e6ba03f72d}\shell\Autoplay                 
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9fc18777-44d8-11e0-9e76-90e6ba03f72d}\shell\Autoplay@MUIVerb          @shell32.dll,-8507
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9fc18777-44d8-11e0-9e76-90e6ba03f72d}\shell\Autoplay\DropTarget       
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9fc18777-44d8-11e0-9e76-90e6ba03f72d}\shell\Autoplay\DropTarget@CLSID  {F26A669A-BCBB-4E37-ABF9-7325DA15F931}
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{cb3f5880-e4a3-11dc-854b-001bfce07dbf}@BaseClass                        Drive
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{cb3f5884-e4a3-11dc-854b-001bfce07dbf}@BaseClass                        Drive
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d61dd00b-b3c6-11e1-a11b-90e6ba03f72d}@BaseClass                        Drive
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d61dd00b-b3c6-11e1-a11b-90e6ba03f72d}\shell                           
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d61dd00b-b3c6-11e1-a11b-90e6ba03f72d}\shell@                          None
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d61dd00b-b3c6-11e1-a11b-90e6ba03f72d}\shell\Autoplay                 
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d61dd00b-b3c6-11e1-a11b-90e6ba03f72d}\shell\Autoplay@MUIVerb          @shell32.dll,-8507
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d61dd00b-b3c6-11e1-a11b-90e6ba03f72d}\shell\Autoplay\DropTarget       
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d61dd00b-b3c6-11e1-a11b-90e6ba03f72d}\shell\Autoplay\DropTarget@CLSID  {F26A669A-BCBB-4E37-ABF9-7325DA15F931}
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e4400d4d-e493-11dc-8ba6-001bfce07dbf}@BaseClass                        Drive
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e4400d51-e493-11dc-8ba6-001bfce07dbf}@BaseClass                        Drive
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e4400d57-e493-11dc-8ba6-001bfce07dbf}@BaseClass                        Drive
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e4400d57-e493-11dc-8ba6-001bfce07dbf}\shell                           
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e4400d57-e493-11dc-8ba6-001bfce07dbf}\shell@                          None
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e4400d57-e493-11dc-8ba6-001bfce07dbf}\shell\Autoplay                 
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e4400d57-e493-11dc-8ba6-001bfce07dbf}\shell\Autoplay@MUIVerb          @shell32.dll,-8507
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e4400d57-e493-11dc-8ba6-001bfce07dbf}\shell\Autoplay\DropTarget       
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e4400d57-e493-11dc-8ba6-001bfce07dbf}\shell\Autoplay\DropTarget@CLSID  {F26A669A-BCBB-4E37-ABF9-7325DA15F931}
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e4400d74-e493-11dc-8ba6-001bfce07dbf}@BaseClass                        Drive
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e4400d74-e493-11dc-8ba6-001bfce07dbf}\shell                           
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e4400d74-e493-11dc-8ba6-001bfce07dbf}\shell@                          None
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e4400d74-e493-11dc-8ba6-001bfce07dbf}\shell\Autoplay                 
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e4400d74-e493-11dc-8ba6-001bfce07dbf}\shell\Autoplay@MUIVerb          @shell32.dll,-8507
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e4400d74-e493-11dc-8ba6-001bfce07dbf}\shell\Autoplay\DropTarget       
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e4400d74-e493-11dc-8ba6-001bfce07dbf}\shell\Autoplay\DropTarget@CLSID  {F26A669A-BCBB-4E37-ABF9-7325DA15F931}
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f47b8d3e-7167-11de-ab0c-001bfce07dbf}@BaseClass                        Drive
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f47b8d3e-7167-11de-ab0c-001bfce07dbf}\shell                           
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f47b8d3e-7167-11de-ab0c-001bfce07dbf}\shell@                          None
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f47b8d3e-7167-11de-ab0c-001bfce07dbf}\shell\Autoplay                 
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f47b8d3e-7167-11de-ab0c-001bfce07dbf}\shell\Autoplay@MUIVerb          @shell32.dll,-8507
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f47b8d3e-7167-11de-ab0c-001bfce07dbf}\shell\Autoplay\DropTarget       
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f47b8d3e-7167-11de-ab0c-001bfce07dbf}\shell\Autoplay\DropTarget@CLSID  {F26A669A-BCBB-4E37-ABF9-7325DA15F931}

---- EOF - GMER 1.0.15 ----
Hier der Log von OSAM:

Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 20:01:34 on 10.10.2012

OS: Windows Vista Home Premium Edition Service Pack 2 (Build 6002), 32-bit
Default Browser: Microsoft Corporation Internet Explorer 9.00.8112.16421

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"BVRPMPR5 NDIS Protocol Driver" (BVRPMPR5) - "Avanquest Software" - C:\Windows\system32\drivers\BVRPMPR5.SYS
"catchme" (catchme) - ? - C:\Users\Anja\AppData\Local\Temp\catchme.sys  (File not found)
"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)
"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)
"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)
"kwldrpow" (kwldrpow) - ? - C:\Users\Anja\AppData\Local\Temp\kwldrpow.sys  (Hidden registry entry, rootkit activity | File not found)
"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\Windows\System32\Drivers\PxHelp20.sys
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{3D9F03FA-7A94-11D3-BE81-0050048385D1} "Data Page Pluggable Protocol mso-offdap Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll
{CD00020A-8B95-11D1-82DB-00C04FB1625D} "Microsoft PKM KnowledgePluggable Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -  (File not found | COM-object registry key not found)
{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -  (File not found | COM-object registry key not found)
{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -  (File not found | COM-object registry key not found)
{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -  (File not found | COM-object registry key not found)
{872A9397-E0D6-4e28-B64D-52B8D0A7EA35} "DisplayCplExt Class" - "Advanced Micro Devices, Inc." - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiamaxx.dll
{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -  (File not found | COM-object registry key not found)
{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -  (File not found | COM-object registry key not found)
{00020d75-0000-0000-c000-000000000046} "lnkfile" - ? -  (File not found | COM-object registry key not found)
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office10\msohev.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\ONFILTER.DLL
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{AE424E85-F6DF-4910-A6A9-438797986431} "OpenOffice.org Property Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\propertyhdl.dll
{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} "RealOne Player Context Menu Class" - "RealNetworks, Inc." - C:\Program Files\Real\RealPlayer\rpshell.dll
{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -  (File not found | COM-object registry key not found)
{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -  (File not found | COM-object registry key not found)
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - ? -  (File not found | COM-object registry key not found)
{7F67036B-66F1-411A-AD85-759FB9C5B0DB} "ShellViewRTF" - "XSS" - C:\Windows\System32\ShellvRTF.dll
{5E2121EE-0300-11D4-8D3B-444553540000} "SimpleShlExt Class" - "Advanced Micro Devices, Inc." - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -  (File not found | COM-object registry key not found)

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "Google Toolbar" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
ITBar7Height "ITBar7Height" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_22.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
<binary data> "@C:\Program Files\MSN Toolbar\Platform\6.3.2291.0\npwinext.dll,-100" - "Microsoft Corporation" - C:\Program Files\MSN Toolbar\Platform\6.3.2291.0\npwinext.dll
<binary data> "Google Toolbar" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
{d2ce3e00-f94a-4740-988e-03dc2f38c34f} "Bing Bar BHO" - "Microsoft Corporation" - C:\Program Files\MSN Toolbar\Platform\6.3.2291.0\npwinext.dll
{AA58ED58-01DD-4d91-8333-CF10577473F7} "Google Toolbar Helper" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll
{6EBF7485-159F-4bff-A14F-B9E3AAC4465B} "Search Helper" - "Microsoft Corporation" - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\Anja\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"NETGEAR WG111v3 Smart Wizard.lnk" - ? - C:\Program Files\NETGEAR\WG111v3\WG111v3.exe  (Shortcut exists | File exists)
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"swg" - "Google Inc." - "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
"HP Software Update" - "Hewlett-Packard Co." - C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
"hpsysdrv" - "Hewlett-Packard Company" - c:\hp\support\hpsysdrv.exe
"KBD" - ? - C:\HP\KBD\KbdStub.EXE  (File found, but it contains no detailed information)
"Microsoft Default Manager" - "Microsoft Corporation" - "C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
"OsdMaestro" - "OsdMaestro" - "C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe"
"StartCCC" - "Advanced Micro Devices, Inc." - "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce )-----
"Launcher" - "soft thinks" - %WINDIR%\SMINST\launcher.exe

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"LIDIL hpzll4v2" - "Hewlett-Packard Company" - C:\Windows\system32\hpzll4v2.dll
"Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\Windows\system32\msonpmon.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"@c:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
"Automatisches LiveUpdate - Scheduler" (Automatisches LiveUpdate - Scheduler) - "Symantec Corporation" - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
"Google Software Updater" (gusvc) - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"HP CUE DeviceDiscovery Service" (hpqddsvc) - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll
"hpqcxs08" (hpqcxs08) - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll
"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
"LightScribeService Direct Disc Labeling Service" (LightScribeService) - "Hewlett-Packard Company" - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
"LiveUpdate" (LiveUpdate) - "Symantec Corporation" - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
"LiveUpdate Notice Service" (LiveUpdate Notice Service) - "Symantec Corporation" - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
"LiveUpdate Notice Service Ex" (LiveUpdate Notice Ex) - ? - "c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon  (File not found)
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
"Net Driver HPZ12" (Net Driver HPZ12) - "Hewlett-Packard" - C:\Windows\system32\HPZinw12.dll
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"Pml Driver HPZ12" (Pml Driver HPZ12) - "Hewlett-Packard" - C:\Windows\system32\HPZipm12.dll
"SeaPort" (SeaPort) - "Microsoft Corporation" - C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
"stllssvr" (stllssvr) - "MicroVision Development, Inc." - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe

===[ Logfile end ]=========================================[ Logfile end ]===

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru
Hier der Log von aswMBR:

Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-10-10 20:04:05
-----------------------------
20:04:05.166    OS Version: Windows 6.0.6002 Service Pack 2
20:04:05.166    Number of processors: 2 586 0x6B01
20:04:05.166    ComputerName: ANJA-PC  UserName: Anja
20:04:06.086    Initialize success
20:07:25.038    AVAST engine defs: 12101000
20:08:25.925    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\0000004f
20:08:25.925    Disk 0 Vendor: Hitachi_ V54O Size: 305245MB BusType: 6
20:08:26.066    Disk 0 MBR read successfully
20:08:26.066    Disk 0 MBR scan
20:08:26.253    Disk 0 unknown MBR code
20:08:26.300    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS      297091 MB offset 63
20:08:26.346    Disk 0 Partition 2 00    07    HPFS/NTFS NTFS        8150 MB offset 608443920
20:08:26.440    Disk 0 scanning sectors +625136400
20:08:26.752    Disk 0 scanning C:\Windows\system32\drivers
20:09:30.821    Service scanning
20:10:07.044    Modules scanning
20:11:10.131    Disk 0 trace - called modules:
20:11:10.162    ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll storport.sys nvstor32.sys
20:11:10.178    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x84eb3528]
20:11:10.193    3 CLASSPNP.SYS[863ab8b3] -> nt!IofCallDriver -> [0x83b63150]
20:11:10.209    5 acpi.sys[8060e6bc] -> nt!IofCallDriver -> \Device\0000004f[0x83b759c0]
20:11:11.597    AVAST engine scan C:\Windows
20:12:18.646    AVAST engine scan C:\Windows\system32
20:19:35.678    AVAST engine scan C:\Windows\system32\drivers
20:20:04.007    AVAST engine scan C:\Users\Anja
20:31:00.533    AVAST engine scan C:\ProgramData
20:33:05.739    Scan finished successfully
20:51:51.843    Disk 0 MBR has been saved successfully to "C:\Users\Anja\Desktop\MBR.dat"
20:51:51.843    The log file has been saved successfully to "C:\Users\Anja\Desktop\aswMBR.txt"

cosinus 11.10.2012 12:48
Wir sollten den MBR fixen, sichere für den Fall der Fälle ALLE wichtigen Daten, auch wenn meistens alles glatt geht.

Hinweis: Mach bitte NICHT den MBR-Fix, wenn du noch andere Betriebssysteme wie zB Ubuntu installiert hast, ein MBR-Fix mit Windows-Tools macht ein parallel installiertes (Dualboot) Linux unbootbar.
Mach den Fix auch dann nicht, wenn du zB mit TrueCrypt oder anderen Verschlüsselungsprogrammen eine Vollverschlüsselung der Windowspartition bzw. gesamten Festplatte hast

Starte nach der Datensicherung aswmbr erneut und klick auf den Button FIXMBR.

Hinweis: Bitte den Virenscanner abstellen bevor du aswMBR ausführst, denn v.a. Avira meldet darin oft einen Fehalalrm!

Anschließend Windows neu starten und ein neues Log mit aswMBR machen.

rene07 11.10.2012 19:05
Hier der Log:
Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-10-11 18:58:08
-----------------------------
18:58:08.889    OS Version: Windows 6.0.6002 Service Pack 2
18:58:08.889    Number of processors: 2 586 0x6B01
18:58:08.905    ComputerName: ANJA-PC  UserName: Anja
18:59:12.132    Initialize success
18:59:31.944    AVAST engine defs: 12101000
18:59:48.309    Verifying
18:59:58.325    Disk 0 Windows 600 MBR fixed successfully
19:23:39.596    Verifying
19:23:49.627    Disk 0 Windows 600 MBR fixed successfully
20:03:48.049    Disk 0 MBR has been saved successfully to "C:\Users\Anja\Desktop\MBR.dat"
20:03:48.064    The log file has been saved successfully to "C:\Users\Anja\Desktop\aswMBR.txt"
Bin mir aber nicht sicher ob es funktioniert hat? hat nämlich nicht lange gedauert. Habe daraufhin nochmal neu gestartet...

cosinus 12.10.2012 10:03
Du soltest auch einen neuen Scan mit aswMBR nach dem Reboot machen

rene07 12.10.2012 16:22
Hier der Log:

Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-10-12 16:38:43
-----------------------------
16:38:43.578    OS Version: Windows 6.0.6002 Service Pack 2
16:38:43.578    Number of processors: 2 586 0x6B01
16:38:43.578    ComputerName: ANJA-PC  UserName: Anja
16:39:24.356    Initialize success
16:42:26.320    AVAST engine defs: 12101200
16:42:41.998    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\0000004f
16:42:41.998    Disk 0 Vendor: Hitachi_ V54O Size: 305245MB BusType: 6
16:42:42.201    Disk 0 MBR read successfully
16:42:42.295    Disk 0 MBR scan
16:42:43.121    Disk 0 Windows VISTA default MBR code
16:42:43.168    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS      297091 MB offset 63
16:42:43.621    Disk 0 Partition 2 00    07    HPFS/NTFS NTFS        8150 MB offset 608443920
16:42:43.714    Disk 0 scanning sectors +625136400
16:42:45.071    Disk 0 scanning C:\Windows\system32\drivers
16:45:16.064    Service scanning
16:50:53.429    Modules scanning
16:51:39.933    Disk 0 trace - called modules:
16:51:39.964    ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll storport.sys nvstor32.sys
16:51:40.385    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x84eb2370]
16:51:40.385    3 CLASSPNP.SYS[8639e8b3] -> nt!IofCallDriver -> [0x83b51748]
16:51:40.401    5 acpi.sys[8060a6bc] -> nt!IofCallDriver -> \Device\0000004f[0x83b51b88]
16:51:44.207    AVAST engine scan C:\Windows
16:52:10.322    AVAST engine scan C:\Windows\system32
17:05:54.236    AVAST engine scan C:\Windows\system32\drivers
17:07:36.730    AVAST engine scan C:\Users\Anja
17:18:33.973    AVAST engine scan C:\ProgramData
17:20:52.299    Scan finished successfully
17:21:27.133    Disk 0 MBR has been saved successfully to "C:\Users\Anja\Desktop\MBR.dat"
17:21:27.211    The log file has been saved successfully to "C:\Users\Anja\Desktop\aswMBR.txt"

cosinus 12.10.2012 19:04
Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

rene07 13.10.2012 16:26
Hier der Malwarebytes Log:
Code:
Malwarebytes Anti-Malware 1.65.0.1400
www.malwarebytes.org

Datenbank Version: v2012.10.13.05

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Anja :: ANJA-PC [Administrator]

13.10.2012 13:58:05
mbam-log-2012-10-13 (13-58-05).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 368578
Laufzeit: 1 Stunde(n), 23 Minute(n), 54 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
Hier der Log von SuperAntiSpyware:

Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 10/13/2012 at 05:25 PM

Application Version : 5.6.1010

Core Rules Database Version : 9400
Trace Rules Database Version: 7212

Scan type      : Complete Scan
Total Scan Time : 01:57:10

Operating System Information
Windows Vista Home Premium 32-bit, Service Pack 2 (Build 6.00.6002)
UAC On - Administrator

Memory items scanned      : 710
Memory threats detected  : 0
Registry items scanned    : 37728
Registry threats detected : 0
File items scanned        : 164187
File threats detected    : 270

Adware.Tracking Cookie
        C:\Users\Anja\AppData\Roaming\Microsoft\Windows\Cookies\HKQSMM47.txt [ /at.atwola.com ]
        C:\Users\Anja\AppData\Roaming\Microsoft\Windows\Cookies\CVDJG3GE.txt [ /tacoda.net ]
        C:\Users\Anja\AppData\Roaming\Microsoft\Windows\Cookies\UPC786S8.txt [ /ad.adc-serv.net ]
        C:\Users\Anja\AppData\Roaming\Microsoft\Windows\Cookies\1USXH2C2.txt [ /kontera.com ]
        C:\Users\Anja\AppData\Roaming\Microsoft\Windows\Cookies\A2AREVIU.txt [ /tacoda.at.atwola.com ]
        C:\Users\Anja\AppData\Roaming\Microsoft\Windows\Cookies\DTFMQ9PP.txt [ /advertising.com ]
        C:\Users\Anja\AppData\Roaming\Microsoft\Windows\Cookies\NFMBIGJS.txt [ /partypoker.com ]
        C:\Users\Anja\AppData\Roaming\Microsoft\Windows\Cookies\WYSOCXB4.txt [ /doubleclick.net ]
        C:\Users\Anja\AppData\Roaming\Microsoft\Windows\Cookies\JXKVA8T6.txt [ /ar.atwola.com ]
        C:\Users\Anja\AppData\Roaming\Microsoft\Windows\Cookies\G5TTC6XA.txt [ /webmasterplan.com ]
        C:\Users\Anja\AppData\Roaming\Microsoft\Windows\Cookies\3XJDNFW6.txt [ /freeyouporn.tv ]
        C:\Users\Anja\AppData\Roaming\Microsoft\Windows\Cookies\0TIX54JX.txt [ /atwola.com ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\KXIAQ3WD.txt [ Cookie:anja@e-2dj6whlowgdjogp.stats.esomniture.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\DN71URJD.txt [ Cookie:anja@ad.dyntracker.de/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\8DZA142Q.txt [ Cookie:anja@2o7.net/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\4ZOJNYV0.txt [ Cookie:anja@atdmt.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\MANGI33D.txt [ Cookie:anja@www.pornhub.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\3KFN1HR8.txt [ Cookie:anja@eas4.emediate.eu/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\H3LSHRDH.txt [ Cookie:anja@tracking.eduscho.at/265328718441342/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\Y0K0ZWH4.txt [ Cookie:anja@ad.yieldmanager.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\L0JRIBTG.txt [ Cookie:anja@e-2dj6wfkysocjebo.stats.esomniture.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\TGN7JF6P.txt [ Cookie:anja@www.aktionsfinder.at/maerkte/supermaerkte/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\E0452T4K.txt [ Cookie:anja@xiti.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\03XQKHAC.txt [ Cookie:anja@fastclick.net/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\98IZQ2HS.txt [ Cookie:anja@pornosexday.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\I8UMSTK9.txt [ Cookie:anja@adxpansion.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\KFGHGHUI.txt [ Cookie:anja@exoclick.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\KJ1OGZS8.txt [ Cookie:anja@ww251.smartadserver.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\FJUO9F6Z.txt [ Cookie:anja@media6degrees.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\7J9LQLGT.txt [ Cookie:anja@mm.chitika.net/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\0QRB8FRM.txt [ Cookie:anja@ad.zanox.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\02Y77G1Z.txt [ Cookie:anja@partypoker.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\T4EUG0HE.txt [ Cookie:anja@rts.pgmediaserve.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\WV10LRDD.txt [ Cookie:anja@doubleclick.net/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\018MNW54.txt [ Cookie:anja@mediaplex.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\JHGAWHRE.txt [ Cookie:anja@m1.webstats.motigo.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\395IBXJI.txt [ Cookie:anja@www.googleadservices.com/pagead/conversion/996533944/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\NXIPJJ48.txt [ Cookie:anja@www.zanox-affiliate.de/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\3XKWBV5I.txt [ Cookie:anja@www.mediamarkt.at/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\AQ9IOS00.txt [ Cookie:anja@in.getclicky.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\B1YZ1LQU.txt [ Cookie:anja@smartadserver.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\JFYPHJSJ.txt [ Cookie:anja@amazon-adsystem.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\PM44S9JO.txt [ Cookie:anja@www.xxxlutz.at/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\ISHCYOUQ.txt [ Cookie:anja@ad2.adfarm1.adition.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\OKLETQOV.txt [ Cookie:anja@invitemedia.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\QP11SMRP.txt [ Cookie:anja@statcounter.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\59U9G0JR.txt [ Cookie:anja@crazyhomesex.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\MGKEW416.txt [ Cookie:anja@track.effiliation.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\S6GYSA4H.txt [ Cookie:anja@quartermedia.de/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\ED1CZTUO.txt [ Cookie:anja@track.shop2market.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\277C118P.txt [ Cookie:anja@apmebf.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\X5G1Q6TA.txt [ Cookie:anja@e-2dj6wdl4socpogp.stats.esomniture.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\R5HHSN69.txt [ Cookie:anja@aimfar.solution.weborama.fr/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\YNLC23JI.txt [ Cookie:anja@track.adform.net/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\6DS89YG4.txt [ Cookie:anja@ad4.adfarm1.adition.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\JRYLLZAM.txt [ Cookie:anja@stat.aldi.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\U66BWOS6.txt [ Cookie:anja@zedo.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\AVF7A41X.txt [ Cookie:anja@toplist.cz/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\4R2DQOF1.txt [ Cookie:anja@secmedia.de/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\FFHFLKJ5.txt [ Cookie:anja@e-2dj6wjlyaic5ibp.stats.esomniture.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\1J5U18OV.txt [ Cookie:anja@ad3.adfarm1.adition.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\2RJS5NTQ.txt [ Cookie:anja@webmasterplan.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\HYOPIFST.txt [ Cookie:anja@track.effiliation.com/servlet/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\IECRXT1Z.txt [ Cookie:anja@www.googleadservices.com/pagead/conversion/969756784/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\XG2AA30N.txt [ Cookie:anja@adfarm1.adition.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\4IBXCF3J.txt [ Cookie:anja@de.pornhub.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\039376B9.txt [ Cookie:anja@adviva.net/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\4UB5PNGA.txt [ Cookie:anja@e-2dj6wjkywpdpwhp.stats.esomniture.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\9J0QL1MZ.txt [ Cookie:anja@zanox.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\N49A4K59.txt [ Cookie:anja@e-2dj6wfkywgcpalq.stats.esomniture.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\X7QKSTYO.txt [ Cookie:anja@estat.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\SQJIM8TN.txt [ Cookie:anja@casalemedia.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\0Q39IWTR.txt [ Cookie:anja@clicks.pangora.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\2JWG8J73.txt [ Cookie:anja@ero-advertising.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\KF31S9HA.txt [ Cookie:anja@openx.sexsearch.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\FGBERWTB.txt [ Cookie:anja@ad.adnet.de/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\7FGRDCPZ.txt [ Cookie:anja@tradedoubler.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\UVADTSS9.txt [ Cookie:anja@partydiscount24.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\O920TRHL.txt [ Cookie:anja@e-2dj6afkiondjodp.stats.esomniture.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\5PDNJQUM.txt [ Cookie:anja@de.partypoker.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\E3SRNJ9U.txt [ Cookie:anja@aktionsfinder.at/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\BO9MZPT4.txt [ Cookie:anja@www.etracker.de/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\1NDM048C.txt [ Cookie:anja@www.googleadservices.com/pagead/conversion/1012032002/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\24PPGPAC.txt [ Cookie:anja@ad1.adfarm1.adition.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\ZSO309SM.txt [ Cookie:anja@stat.dealtime.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\QHOZBJHJ.txt [ Cookie:anja@adnet.de/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\BMQRFP60.txt [ Cookie:anja@pornhubgold.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\3UN8K9OL.txt [ Cookie:anja@pornhubpremium.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\E2WDGQ69.txt [ Cookie:anja@basco.122.2o7.net/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\S1FND2OP.txt [ Cookie:anja@unister-adservices.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\446VZKUD.txt [ Cookie:anja@www.pornhubgold.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\I5B72BTU.txt [ Cookie:anja@e-2dj6wnkogmajslp.stats.esomniture.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\KAG30M7H.txt [ Cookie:anja@bs.serving-sys.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\OEL40XBW.txt [ Cookie:anja@e-2dj6wfkiwpcjolo.stats.esomniture.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\9V8P0ET1.txt [ Cookie:anja@www.partydiscount24.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\45CBH7QF.txt [ Cookie:anja@adform.net/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\W26LRGJR.txt [ Cookie:anja@advertising.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\2N3P0N5G.txt [ Cookie:anja@www.aktionsfinder.at/maerkte/baumaerkte/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\5QP3N02Z.txt [ Cookie:anja@server.adform.net/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\NPDHSZ24.txt [ Cookie:anja@www.googleadservices.com/pagead/conversion/1071935479/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\G1J69871.txt [ Cookie:anja@edsa.122.2o7.net/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\39KYYZ3Q.txt [ Cookie:anja@e-2dj6wbliwgd5olo.stats.esomniture.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\703YD2IH.txt [ Cookie:anja@questionmarket.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\MYW0YL9T.txt [ Cookie:anja@delivery.trafficjunky.net/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\Y4GN8MRO.txt [ Cookie:anja@skywork-media.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\KFNML8W0.txt [ Cookie:anja@tracking.mobile.de/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\BBLNWBB6.txt [ Cookie:anja@netgear.122.2o7.net/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\FUZIZZAF.txt [ Cookie:anja@e-2dj6wjlislczklo.stats.esomniture.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\BA87EFXL.txt [ Cookie:anja@accounts.google.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\43XKADRO.txt [ Cookie:anja@dealtime.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\9649DPYW.txt [ Cookie:anja@www.googleadservices.com/pagead/conversion/1036186187/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\JEAR8K9Z.txt [ Cookie:anja@adultfriendfinder.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\IY2BY70C.txt [ Cookie:anja@tomtailor.dyntracker.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\CMIDMT9E.txt [ Cookie:anja@observare.de/tracking/track.php/52/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\10BPD2TW.txt [ Cookie:anja@hdpornmobile.xxx/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\Z3TC8ERO.txt [ Cookie:anja@clickfuse.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\K91NSMT4.txt [ Cookie:anja@observare.de/tracking/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\WV1RT74N.txt [ Cookie:anja@e-2dj6wnmywldzglp.stats.esomniture.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\TBELI0BG.txt [ Cookie:anja@eas.apm.emediate.eu/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\9T3BTUFF.txt [ Cookie:anja@ads.trafficjunky.net/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\I7D3VEVV.txt [ Cookie:anja@www.googleadservices.com/pagead/conversion/1052407190/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\4VVL0KRM.txt [ Cookie:anja@weboramapublishertrackinguk2.solution.weborama.fr/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\1KEAC0W2.txt [ Cookie:anja@www.googleadservices.com/pagead/conversion/1039901093/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\DG12Q8CY.txt [ Cookie:anja@banner.testberichte.de/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\H479TXPL.txt [ Cookie:anja@adxpose.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\XLN6QASN.txt [ Cookie:anja@e-2dj6aemyqgazibp.stats.esomniture.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\0D2M7GAH.txt [ Cookie:anja@www.googleadservices.com/pagead/conversion/1059657297/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\J7WGO1SU.txt [ Cookie:anja@autoscout24.112.2o7.net/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\FRSD6SSB.txt [ Cookie:anja@specificclick.net/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\DVU2Z83Y.txt [ Cookie:anja@pornhub4u.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\TYZHWZVZ.txt [ Cookie:anja@e-2dj6wnk4akdzgco.stats.esomniture.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\V5FHHEPP.txt [ Cookie:anja@imrworldwide.com/cgi-bin ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\ZYUR7NWK.txt [ Cookie:anja@counter2.sexmoney.com/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\18HCIXT6.txt [ Cookie:anja@freeyouporn.tv/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\5BY16LN6.txt [ Cookie:anja@www.googleadservices.com/pagead/conversion/1071905890/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\EBDYEQV9.txt [ Cookie:anja@weborama.fr/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\4YSGRKJE.txt [ Cookie:anja@tracking.mindshare.de/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\E3UW11GR.txt [ Cookie:anja@de.sitestat.com/sportscheck/ ]
        C:\USERS\ANJA\AppData\Roaming\Microsoft\Windows\Cookies\Low\Z4OUALL2.txt [ Cookie:anja@www.googleadservices.com/pagead/conversion/1067847409/ ]
        C:\USERS\ANJA\Cookies\1USXH2C2.txt [ Cookie:anja@kontera.com/ ]
        C:\USERS\ANJA\Cookies\A2AREVIU.txt [ Cookie:anja@tacoda.at.atwola.com/ ]
        C:\USERS\ANJA\Cookies\DTFMQ9PP.txt [ Cookie:anja@advertising.com/ ]
        C:\USERS\ANJA\Cookies\NFMBIGJS.txt [ Cookie:anja@partypoker.com/ ]
        C:\USERS\ANJA\Cookies\WYSOCXB4.txt [ Cookie:anja@doubleclick.net/ ]
        C:\USERS\ANJA\Cookies\JXKVA8T6.txt [ Cookie:anja@ar.atwola.com/ ]
        C:\USERS\ANJA\Cookies\G5TTC6XA.txt [ Cookie:anja@webmasterplan.com/ ]
        C:\USERS\ANJA\Cookies\3XJDNFW6.txt [ Cookie:anja@freeyouporn.tv/ ]
        C:\USERS\ANJA\Cookies\0TIX54JX.txt [ Cookie:anja@atwola.com/ ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@FIND.REAL[1].TXT [ /FIND.REAL ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@ATDMT[1].TXT [ /ATDMT ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@2O7[2].TXT [ /2O7 ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@VALUECLICK[1].TXT [ /VALUECLICK ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@VALUECLICK[2].TXT [ /VALUECLICK ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@VALUECLICK[3].TXT [ /VALUECLICK ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@BFAST[2].TXT [ /BFAST ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@BFAST[1].TXT [ /BFAST ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@BFAST[3].TXT [ /BFAST ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@W111.HITBOX[1].TXT [ /W111.HITBOX ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@OVERTURE[1].TXT [ /OVERTURE ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@ADSERVER.PREDL[1].TXT [ /ADSERVER.PREDL ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@ADTECH[2].TXT [ /ADTECH ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@HG1.HITBOX[1].TXT [ /HG1.HITBOX ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@REALMEDIA[1].TXT [ /REALMEDIA ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@HG1.HITBOX[2].TXT [ /HG1.HITBOX ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@COUNTER[1].TXT [ /COUNTER ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@FASTCLICK[1].TXT [ /FASTCLICK ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@WWW.GET-TRAFFIC[1].TXT [ /WWW.GET-TRAFFIC ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@ADS.MONSTER[2].TXT [ /ADS.MONSTER ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@PHG.HITBOX[1].TXT [ /PHG.HITBOX ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@ADVERTISING[1].TXT [ /ADVERTISING ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@ADVERTISING[2].TXT [ /ADVERTISING ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@TRIPOD[1].TXT [ /TRIPOD ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@DOUBLECLICK[2].TXT [ /DOUBLECLICK ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@DOUBLECLICK[1].TXT [ /DOUBLECLICK ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@SEXTRACKER[1].TXT [ /SEXTRACKER ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@WWW.SEXAMANSGUIDE[1].TXT [ /WWW.SEXAMANSGUIDE ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@SEXTRACKER[3].TXT [ /SEXTRACKER ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@ADULTREVENUESERVICE[2].TXT [ /ADULTREVENUESERVICE ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@ADULTREVENUESERVICE[1].TXT [ /ADULTREVENUESERVICE ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@XXXCOUNTER[1].TXT [ /XXXCOUNTER ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@STATS.CASHRING[1].TXT [ /STATS.CASHRING ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@TRACKER[1].TXT [ /TRACKER ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@PARTNERS.WEBMASTERPLAN[1].TXT [ /PARTNERS.WEBMASTERPLAN ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@WWW.STATS4YOU[1].TXT [ /WWW.STATS4YOU ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@COUNTER16.SEXTRACKER[2].TXT [ /COUNTER16.SEXTRACKER ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@COUNTER13.SEXTRACKER[1].TXT [ /COUNTER13.SEXTRACKER ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@COUNTER15.SEXTRACKER[1].TXT [ /COUNTER15.SEXTRACKER ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@COUNTER11.SEXTRACKER[1].TXT [ /COUNTER11.SEXTRACKER ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@CLIT12.SEXTRACKER[1].TXT [ /CLIT12.SEXTRACKER ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@XXXCOUNTER[2].TXT [ /XXXCOUNTER ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@COUNTER12.SEXTRACKER[1].TXT [ /COUNTER12.SEXTRACKER ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@COUNTER16.SEXTRACKER[1].TXT [ /COUNTER16.SEXTRACKER ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@5ISEX[1].TXT [ /5ISEX ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@WWW.CASHCOUNT[1].TXT [ /WWW.CASHCOUNT ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@WWW.XXX-XXX-XXX[2].TXT [ /WWW.XXX-XXX-XXX ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@COUNTER3.SEXTRACKER[1].TXT [ /COUNTER3.SEXTRACKER ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@COUNTER3.SEXTRACKER[2].TXT [ /COUNTER3.SEXTRACKER ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@COUNTER2.SEXTRACKER[1].TXT [ /COUNTER2.SEXTRACKER ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@AS1.FALKAG[1].TXT [ /AS1.FALKAG ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@YADRO[2].TXT [ /YADRO ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@XXX-XXX-XXX[1].TXT [ /XXX-XXX-XXX ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@SERVEDBY.ADVERTISING[2].TXT [ /SERVEDBY.ADVERTISING ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@CLIT16.SEXTRACKER[1].TXT [ /CLIT16.SEXTRACKER ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@CLIT15.SEXTRACKER[1].TXT [ /CLIT15.SEXTRACKER ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@SERVEDBY.ADVERTISING[3].TXT [ /SERVEDBY.ADVERTISING ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@XITI[1].TXT [ /XITI ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@ADS.LINK4ADS[2].TXT [ /ADS.LINK4ADS ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@SEXLIST[3].TXT [ /SEXLIST ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@SEXLIST[2].TXT [ /SEXLIST ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@WWW.SETSOFSEXYGIRLS[1].TXT [ /WWW.SETSOFSEXYGIRLS ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@ADS.LINK4ADS[3].TXT [ /ADS.LINK4ADS ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@ADBUREAU[1].TXT [ /ADBUREAU ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@ADBUREAU[2].TXT [ /ADBUREAU ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@ADS.IAC-ONLINE[1].TXT [ /ADS.IAC-ONLINE ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@ADS.TRIPOD.LYCOS[1].TXT [ /ADS.TRIPOD.LYCOS ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@ADVERTISEIRELAND[1].TXT [ /ADVERTISEIRELAND ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@ARSCOUNTER[1].TXT [ /ARSCOUNTER ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@BLUESTREAK[2].TXT [ /BLUESTREAK ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@C2.GOSTATS[2].TXT [ /C2.GOSTATS ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@CLIT2.SEXTRACKER[1].TXT [ /CLIT2.SEXTRACKER ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@COUNTER8.SEXTRACKER[1].TXT [ /COUNTER8.SEXTRACKER ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@COUNTER8.SEXTRACKER[3].TXT [ /COUNTER8.SEXTRACKER ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@CZ3.CLICKZS[1].TXT [ /CZ3.CLICKZS ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@CZ4.CLICKZS[2].TXT [ /CZ4.CLICKZS ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@CZ6.CLICKZS[1].TXT [ /CZ6.CLICKZS ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@CZ9.CLICKZS[2].TXT [ /CZ9.CLICKZS ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@EHG-CAREERBUILDER.HITBOX[2].TXT [ /EHG-CAREERBUILDER.HITBOX ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@HITBOX[1].TXT [ /HITBOX ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@HITBOX[2].TXT [ /HITBOX ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@HITBOX[4].TXT [ /HITBOX ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@MEDIAPLEX[1].TXT [ /MEDIAPLEX ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@MEDIAPLEX[2].TXT [ /MEDIAPLEX ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@MEDIAPLEX[3].TXT [ /MEDIAPLEX ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@PATHFINDER[1].TXT [ /PATHFINDER ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@STATS3.PORNTRACK[1].TXT [ /STATS3.PORNTRACK ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@SEXHOUND[2].TXT [ /SEXHOUND ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@TRACKREPORT[1].TXT [ /TRACKREPORT ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@TRAFFIC.EROTIK-PORTAL[1].TXT [ /TRAFFIC.EROTIK-PORTAL ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@TRIBALFUSION[1].TXT [ /TRIBALFUSION ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@WEBPOWER[2].TXT [ /WEBPOWER ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@WWW.COMMISSION-JUNCTION[1].TXT [ /WWW.COMMISSION-JUNCTION ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@WWW.FEMALE-NUDE-MODELS[1].TXT [ /WWW.FEMALE-NUDE-MODELS ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@WWW.TRACKREPORT[2].TXT [ /WWW.TRACKREPORT ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@WWW.ZANOX-AFFILIATE[1].TXT [ /WWW.ZANOX-AFFILIATE ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@WWW.ZANOX-AFFILIATE[3].TXT [ /WWW.ZANOX-AFFILIATE ]
        C:\ALTERPC\WINDOWS\COOKIES\STANDARD@Z1.ADSERVER[1].TXT [ /Z1.ADSERVER ]
        .doubleclick.net [ C:\USERS\ANJA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .atdmt.com [ C:\USERS\ANJA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .atdmt.com [ C:\USERS\ANJA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .fastclick.net [ C:\USERS\ANJA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad.yieldmanager.com [ C:\USERS\ANJA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        www.googleadservices.com [ C:\USERS\ANJA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .smartadserver.com [ C:\USERS\ANJA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        www.googleadservices.com [ C:\USERS\ANJA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .apmebf.com [ C:\USERS\ANJA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .mediaplex.com [ C:\USERS\ANJA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .mediaplex.com [ C:\USERS\ANJA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .tradedoubler.com [ C:\USERS\ANJA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .tradedoubler.com [ C:\USERS\ANJA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .tradedoubler.com [ C:\USERS\ANJA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad2.adfarm1.adition.com [ C:\USERS\ANJA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ww251.smartadserver.com [ C:\USERS\ANJA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .fastclick.net [ C:\USERS\ANJA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad.yieldmanager.com [ C:\USERS\ANJA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adfarm1.adition.com [ C:\USERS\ANJA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adfarm1.adition.com [ C:\USERS\ANJA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad.adserver01.de [ C:\USERS\ANJA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .tracking.quisma.com [ C:\USERS\ANJA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        C:\USERS\ANJA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\ANJA@SERVING-SYS[1].TXT [ /SERVING-SYS ]

Adware.Vundo/Variant-X32[Header]
        C:\ALTERPC\CFGSAFE\DEACS32.DLL

cosinus 13.10.2012 18:55
Sieht ok aus, da wurden nur Cookies und ein altes Überbleibsel gefunden, die können alle weg.
Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )


Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller http://filepony.de/download-cookie_culler/
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ich halte es so, dass ich zum "wilden Surfen" den Opera-Browser oder Chromium unter meinem Linux verwende. Mein Hauptbrowser (Firefox) speichert nur die Cookies von den Sites die ich auch will, alles andere lehne ich manuell ab (der FF fragt mich immer) - die anderen Browser nehmen alles an Cookies zwar an, aber spätestens beim nächsten Start von Opera oder Chromium sind keine Cookies mehr da.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

rene07 13.10.2012 18:57
Hi cosinus,
danke für deine Hilfe! Läuft soweit alles wieder perfekt!

Dann lösche ich jetzt einfach noch die Funde und schau mir das mit den Cookies an...

VG & Danke
Rene

cosinus 13.10.2012 21:23
Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. Mit Hilfe von OTL kannst du auch viele Tools entfernen:

Starte bitte OTL und klicke auf Bereinigung.
Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen.


Malwarebytes zu behalten ist zu empfehlen. Kannst ja 1x im Monat damit einen Vollscan machen, aber immer vorher ans Update denken.


Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update


PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:
Prüfen => Adobe - Flash Player
Downloadlinks => Adobe Flash Player Distribution | Adobe

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.


Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.


Alle Zeitangaben in WEZ +1. Es ist jetzt 21:24 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131