Trojaner-Board - PUP.VShareRedir

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - PUP.VShareRedir (https://www.trojaner-board.de/125597-pup-vshareredir.html)

Hallo zusammen,

habe mir anscheinend vorgestern Abend was eingefangen. Zumindest kam eine Meldung von Avira. Habe die Funde daraufhin erst in Quarantäne verschoben und dann auch in meiner Unwissenheit gelöscht. :(
Danach lief der PC vollkommen normal. Auch gestern morgen konnte ich nichts entdecken. Erst am Nachmittag traten Probleme auf. Plötzlich reagierte der der PC bei einem Linksklick nur wie bei einem Rechtsklick...beim Klicken der rechten Maustaste passierte hingegen gar nix. Auch der Bildschirmschoner aktivierte sich nicht.
Nach einem Neustart dauerte das Laden der Benutzereinstellungen relativ lange. Ebenfalls war der Bildschirmhintergrund auf einmal blau. Sonst schien zunächst alles normal. Habe mir dann mal Malwarebytes runtergeladen. Als ich es starten wollte musst ich wieder feststellen, dass das Problem mit der Maus zurückgekehrt ist. Komischerweise existiert dies Problem aber nicht im Browser sondern soweit ich es bisher feststellen konnte nur auf dem Desktop oder im Startmenü ( nicht unter alle Programme; hier ist alles normal). Hoffe ihr könnt mir helfen. Das Logfile von Malwarebytes pack ich mal hinten dran.

Gruß Steffen

Code:

Malwarebytes Anti-Malware 1.65.0.1400

www.malwarebytes.org
 

Datenbank Version: v2012.10.12.03
 

Windows XP Service Pack 3 x86 NTFS

Internet Explorer 6.0.2900.5512

Steffen :: PC1 [Administrator]
 

12.10.2012 15:50:21

mbam-log-2012-10-12 (15-50-21).txt
 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|Z:\|)

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 480448

Laufzeit: 1 Stunde(n), 32 Minute(n), 30 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 13

HKCR\CLSID\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} (PUP.VShareRedir) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\TypeLib\{BB7256DD-EBA9-480B-8441-A00388C2BEC3} (PUP.VShareRedir) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\Interface\{3D782BB2-F2A5-11D3-BF4C-000000000000} (PUP.VShareRedir) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\MyNewsBarLauncher.IE5BarLauncherBHO.1 (PUP.VShareRedir) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\MyNewsBarLauncher.IE5BarLauncherBHO (PUP.VShareRedir) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} (PUP.VShareRedir) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} (PUP.VShareRedir) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} (PUP.VShareRedir) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\CLSID\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\MyNewsBarLauncher.IE5BarLauncher.1 (PUP.VShareRedir) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\MyNewsBarLauncher.IE5BarLauncher (PUP.VShareRedir) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

Infizierte Registrierungswerte: 4

HKCU\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser|{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Daten: ;áÃzÊ;XA³0öm»Áµ -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar|{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Daten: VShareTB -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCU\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Daten:  -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Daten:  -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)

Malwarebytes erstellt bei jedem Scanvorgang genau ein Log. Hast du in der Vergangenheit schonmal mit Malwarebytes gescannt?
Wenn ja dann stehen auch alle Logs zu jedem Scanvorgang im Reiter Logdateien. Bitte alle posten, die dort sichtbar sind.

Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

Hallo Cosinus,
nein, hatte mir malwarebytes extra heruntergeladen, also keine weiteren Logs vorhanden.

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=c7f0ad9b797b5141a7d8fa0f3d81eaa5

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2012-10-15 07:52:01

# local_time=2012-10-15 09:52:01 (+0100, Westeuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=5.1.2600 NT Service Pack 3

# compatibility_mode=1792 16777175 100 0 182635885 182635885 0 0

# compatibility_mode=8192 67108863 100 0 386 386 0 0

# scanned=246661

# found=2

# cleaned=0

# scan_time=10936

C:\Programme\PDFCreator\Toolbar\pdfforge Toolbar_setup.exe        Win32/Toolbar.Widgi application (unable to clean)        00000000000000000000000000000000        I

Z:\Eigene Dateien\Downloads\PDFCreator-1_2_3_setup.exe        Win32/Toolbar.Widgi application (unable to clean)        00000000000000000000000000000000        I

adwCleaner - Toolbars und ungewollte Start-/Suchseiten aufspüren

Downloade Dir bitte AdwCleaner auf deinen Desktop.

Falls der adwCleaner schon mal in der runtergeladen wurde, bitte die alte adwcleaner.exe löschen und neu runterladen!!

Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Suche.
Nach Ende des Suchlaufs öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[Rx].txt. (x=fortlaufende Nummer)

Code:

# AdwCleaner v2.005 - Datei am 16/10/2012 um 17:00:54 erstellt

# Aktualisiert am 14/10/2012 von Xplode

# Betriebssystem : Microsoft Windows XP Service Pack 3 (32 bits)

# Benutzer : Steffen - PC1

# Bootmodus : Normal

# Ausgeführt unter : C:\Dokumente und Einstellungen\Steffen\Desktop\adwcleaner.exe

# Option [Suche]
 
 

**** [Dienste] ****
 
 

***** [Dateien / Ordner] *****
 

Datei Gefunden : C:\Programme\Mozilla Firefox\Plugins\npvsharetvplg.dll

Datei Gefunden : C:\WINDOWS\system32\conduitEngine.tmp

Ordner Gefunden : C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ICQ\ICQToolbar

Ordner Gefunden : C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Trymedia

Ordner Gefunden : C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\pdfforge

Ordner Gefunden : C:\Programme\Conduit

Ordner Gefunden : C:\Programme\ICQ6Toolbar

Ordner Gefunden : C:\Programme\softonic-de5

Ordner Gefunden : C:\Programme\vShare.tv plugin
 

***** [Registrierungsdatenbank] *****
 

Schlüssel Gefunden : HKCU\Software\Conduit

Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}

Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD}

Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5}

Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8F97BFF8-488B-4107-BCEE-B161AB4E4183}

Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{855F3B16-6D32-4FE6-8A56-BBB695989046}

Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{855F3B16-6D32-4FE6-8A56-BBB695989046}

Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E63C8A0D-44E1-4987-8B57-6A0D71757F1B}

Schlüssel Gefunden : HKCU\Software\SmartBar

Schlüssel Gefunden : HKCU\Software\Softonic

Schlüssel Gefunden : HKCU\Software\softonic-de5

Schlüssel Gefunden : HKCU\Software\StartSearch

Schlüssel Gefunden : HKCU\Toolbar

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{82CF904F-28D9-4EB3-BD7D-EFACBE35F5E2}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{8F97BFF8-488B-4107-BCEE-B161AB4E4183}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{9E41CC51-A9DD-4AA2-8D47-0D99A9E14F16}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{A1B48071-416D-474E-A13B-BE5456E7FC31}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{E63C8A0D-44E1-4987-8B57-6A0D71757F1B}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Conduit.Engine

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Toolbar.CT2433018

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{79D60450-56C5-4A8C-9321-6D5BC2A81E5A}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{99C22A61-21BA-4F81-85FF-CDC9EB5DB10B}

Schlüssel Gefunden : HKLM\Software\Conduit

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{86BA16C1-CD25-4AA0-8945-E4B932AB0AC9}

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FA217646-6423-4E77-A6E8-B730B712AD2E}

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\softonic-de5 Toolbar

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E63C8A0D-44E1-4987-8B57-6A0D71757F1B}

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8F97BFF8-488B-4107-BCEE-B161AB4E4183}

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9E41CC51-A9DD-4AA2-8D47-0D99A9E14F16}

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A1B48071-416D-474E-A13B-BE5456E7FC31}

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\softonic-de5 Toolbar

Schlüssel Gefunden : HKLM\Software\softonic-de5

Schlüssel Gefunden : HKU\S-1-5-21-1078081533-1563985344-682003330-1004\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}

Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{E63C8A0D-44E1-4987-8B57-6A0D71757F1B}]

Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{E63C8A0D-44E1-4987-8B57-6A0D71757F1B}]

Wert Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{E63C8A0D-44E1-4987-8B57-6A0D71757F1B}]
 

***** [Internet Browser] *****
 

-\\ Internet Explorer v6.0.2900.5512
 

[HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://start.icq.com/

[HKCU\Software\Microsoft\Internet Explorer\Main - ICQ Search] = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
 

*************************
 

AdwCleaner[R1].txt - [4855 octets] - [16/10/2012 17:00:54]
 

########## EOF - C:\AdwCleaner[R1].txt - [4915 octets] ##########

adwCleaner - Toolbars und ungewollte Start-/Suchseiten entfernen

Schließe alle offenen Programme und Browser.
Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Löschen.
Bestätige jeweils mit Ok.
Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[Sx].txt. (x=fortlaufende Nummer)

Code:

# AdwCleaner v2.005 - Datei am 17/10/2012 um 23:24:05 erstellt

# Aktualisiert am 14/10/2012 von Xplode

# Betriebssystem : Microsoft Windows XP Service Pack 3 (32 bits)

# Benutzer : Steffen - PC1

# Bootmodus : Normal

# Ausgeführt unter : C:\Dokumente und Einstellungen\Steffen\Desktop\adwcleaner.exe

# Option [Löschen]
 
 

**** [Dienste] ****
 
 

***** [Dateien / Ordner] *****
 

Datei Gelöscht : C:\Programme\Mozilla Firefox\Plugins\npvsharetvplg.dll

Datei Gelöscht : C:\WINDOWS\system32\conduitEngine.tmp

Ordner Gelöscht : C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ICQ\ICQToolbar

Ordner Gelöscht : C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Trymedia

Ordner Gelöscht : C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\pdfforge

Ordner Gelöscht : C:\Programme\Conduit

Ordner Gelöscht : C:\Programme\ICQ6Toolbar

Ordner Gelöscht : C:\Programme\softonic-de5

Ordner Gelöscht : C:\Programme\vShare.tv plugin
 

***** [Registrierungsdatenbank] *****
 

Schlüssel Gelöscht : HKCU\Software\Conduit

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8F97BFF8-488B-4107-BCEE-B161AB4E4183}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{855F3B16-6D32-4FE6-8A56-BBB695989046}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{855F3B16-6D32-4FE6-8A56-BBB695989046}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E63C8A0D-44E1-4987-8B57-6A0D71757F1B}

Schlüssel Gelöscht : HKCU\Software\SmartBar

Schlüssel Gelöscht : HKCU\Software\Softonic

Schlüssel Gelöscht : HKCU\Software\softonic-de5

Schlüssel Gelöscht : HKCU\Software\StartSearch

Schlüssel Gelöscht : HKCU\Toolbar

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{82CF904F-28D9-4EB3-BD7D-EFACBE35F5E2}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{8F97BFF8-488B-4107-BCEE-B161AB4E4183}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{9E41CC51-A9DD-4AA2-8D47-0D99A9E14F16}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A1B48071-416D-474E-A13B-BE5456E7FC31}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E63C8A0D-44E1-4987-8B57-6A0D71757F1B}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Conduit.Engine

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT2433018

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{79D60450-56C5-4A8C-9321-6D5BC2A81E5A}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{99C22A61-21BA-4F81-85FF-CDC9EB5DB10B}

Schlüssel Gelöscht : HKLM\Software\Conduit

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{86BA16C1-CD25-4AA0-8945-E4B932AB0AC9}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FA217646-6423-4E77-A6E8-B730B712AD2E}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\softonic-de5 Toolbar

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E63C8A0D-44E1-4987-8B57-6A0D71757F1B}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8F97BFF8-488B-4107-BCEE-B161AB4E4183}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9E41CC51-A9DD-4AA2-8D47-0D99A9E14F16}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A1B48071-416D-474E-A13B-BE5456E7FC31}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\softonic-de5 Toolbar

Schlüssel Gelöscht : HKLM\Software\softonic-de5

Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{E63C8A0D-44E1-4987-8B57-6A0D71757F1B}]

Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{E63C8A0D-44E1-4987-8B57-6A0D71757F1B}]

Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{E63C8A0D-44E1-4987-8B57-6A0D71757F1B}]
 

***** [Internet Browser] *****
 

-\\ Internet Explorer v6.0.2900.5512
 

Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://start.icq.com/ --> hxxp://www.google.com

Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Main - ICQ Search] = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd --> hxxp://www.google.com
 

*************************
 

AdwCleaner[R1].txt - [4984 octets] - [16/10/2012 17:00:54]

AdwCleaner[S1].txt - [4828 octets] - [17/10/2012 23:24:05]
 

########## EOF - C:\AdwCleaner[S1].txt - [4888 octets] ##########

Hätte da mal zwei Fragen bevor es weiter geht (wir sind noch nicht fertig!)

1.) Geht der normale Modus von Windows (wieder) uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

1. Naja...das Laden der Benutzereinstellungen läuft wieder normal.
Das Problem mit der Maus ist noch vorhanden. Ich vermute momentan auch, dass hier nen Problem mit der rechten Maustaste vorliegt, da die rechte Maustaste sogut wie gar nciht mehr funktioniert und der Test mit einer anderen Maus erfolgreich war.
Gelegentlich hab ich aber das Problem, dass ich zwar innerhalb des Browsers normal arbeiten kann, diesen aber weder schließen noch kann ich über die Taskleiste zu einem anderem Programm wechelsn. Bisher hab ich dann immer dne Task Manager aufgemacht...dann ging es wieder

2. Dürfte alles da sein

Mach bitte einen CustomScan mit OTL . Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop. Falls schon vorhanden, bitte die ältere vorhandene Datei durch die neu heruntergeladene Datei ersetzen, damit du auch wirklich mit einer aktuellen Version von OTL arbeitest.

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Setze oben mittig den Haken bei Scanne alle Benutzer
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox von OTL - wenn OTL auf deutsch ist wird sie mit http://larusso.trojaner-board.de/Images/otlfix.jpg beschriftet

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

/md5start

wininit.exe

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Code:

OTL logfile created on: 18.10.2012 21:12:51 - Run 1

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Dokumente und Einstellungen\Steffen\Desktop

Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 6.0.2900.5512)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

2,00 Gb Total Physical Memory | 1,32 Gb Available Physical Memory | 66,02% Memory free

3,85 Gb Paging File | 3,17 Gb Available in Paging File | 82,51% Paging File free

Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme

Drive C: | 100,00 Gb Total Space | 52,12 Gb Free Space | 52,12% Space Free | Partition Type: NTFS

Drive R: | 6,80 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF

Drive Z: | 198,09 Gb Total Space | 58,30 Gb Free Space | 29,43% Space Free | Partition Type: NTFS

 

Computer Name: PC1 | User Name: Steffen | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.10.18 20:45:10 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Steffen\Desktop\OTL.exe

PRC - [2012.08.29 12:03:38 | 001,996,200 | ---- | M] (LogMeIn Inc.) -- C:\Programme\LogMeIn Hamachi\hamachi-2-ui.exe

PRC - [2012.08.29 12:03:36 | 001,385,896 | ---- | M] (LogMeIn Inc.) -- C:\Programme\LogMeIn Hamachi\hamachi-2.exe

PRC - [2012.08.08 18:47:57 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe

PRC - [2012.08.04 11:59:06 | 001,353,080 | ---- | M] (Valve Corporation) -- Z:\Spiele\EMpire\steam.exe

PRC - [2012.07.13 13:33:24 | 017,418,928 | R--- | M] (Skype Technologies S.A.) -- C:\Dokumente und Einstellungen\Steffen\Desktop\Phone\Skype.exe

PRC - [2012.05.09 20:07:11 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe

PRC - [2012.05.09 20:07:10 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe

PRC - [2012.05.09 20:07:10 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe

PRC - [2012.01.18 14:02:04 | 000,254,696 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe

PRC - [2011.12.20 11:28:12 | 000,196,904 | ---- | M] (Nitro PDF Software) -- C:\Programme\Nitro PDF\Reader 2\NitroPDFReaderDriverService2.exe

PRC - [2010.01.09 21:37:50 | 004,640,000 | ---- | M] (Microsoft Corporation) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

PRC - [2009.12.01 15:55:10 | 000,389,120 | ---- | M] (tzuk) -- C:\Programme\Sandboxie\SbieCtrl.exe

PRC - [2009.12.01 15:55:10 | 000,066,560 | ---- | M] (tzuk) -- C:\Programme\Sandboxie\SbieSvc.exe

PRC - [2008.07.10 16:34:46 | 002,177,576 | ---- | M] (Gainward Co.) -- C:\Programme\EXPERTool\TBPANEL.exe

PRC - [2008.04.14 08:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2008.03.17 19:07:02 | 000,073,728 | ---- | M] (Hewlett-Packard Company) -- C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe

PRC - [2008.03.14 21:49:28 | 001,241,088 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Sun\StarOffice 8\program\soffice.bin

PRC - [2008.03.14 21:49:28 | 001,019,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Sun\StarOffice 8\program\soffice.exe

PRC - [2007.12.04 13:03:14 | 000,585,774 | ---- | M] (Cherry, Auerbach Germany, www.cherry.de) -- C:\Programme\Cherry\CDI\cdi.exe

PRC - [2007.11.28 16:32:06 | 000,237,620 | ---- | M] (Cherry GmbH) -- C:\Programme\Cherry\KeyMan\KeyMan.exe

PRC - [2007.08.03 13:51:18 | 001,422,632 | ---- | M] (Nero AG) -- C:\Programme\Gemeinsame Dateien\Nero\Lib\NMIndexStoreSvr.exe

PRC - [2007.08.03 13:51:18 | 000,382,248 | ---- | M] (Nero AG) -- C:\Programme\Gemeinsame Dateien\Nero\Lib\NMIndexingService.exe

PRC - [2007.08.03 13:51:06 | 000,202,024 | ---- | M] (Nero AG) -- C:\Programme\Gemeinsame Dateien\Nero\Lib\NMBgMonitor.exe

PRC - [2004.03.04 04:00:00 | 000,098,304 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FATI9BE.EXE

PRC - [2003.06.20 00:25:00 | 000,322,120 | ---- | M] (Microsoft Corporation) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2012.10.05 07:54:42 | 020,317,008 | ---- | M] () -- Z:\Spiele\EMpire\bin\libcef.dll

MOD - [2012.10.05 07:54:24 | 001,099,616 | ---- | M] () -- Z:\Spiele\EMpire\bin\avcodec-53.dll

MOD - [2012.10.05 07:54:24 | 000,902,480 | ---- | M] () -- Z:\Spiele\EMpire\bin\chromehtml.dll

MOD - [2012.10.05 07:54:24 | 000,190,816 | ---- | M] () -- Z:\Spiele\EMpire\bin\avformat-53.dll

MOD - [2012.10.05 07:54:24 | 000,123,232 | ---- | M] () -- Z:\Spiele\EMpire\bin\avutil-51.dll

MOD - [2012.07.27 22:51:38 | 000,301,056 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.DEU

MOD - [2012.05.09 20:07:11 | 000,398,288 | ---- | M] () -- C:\Programme\Avira\AntiVir Desktop\sqlite3.dll

MOD - [2011.03.17 00:11:16 | 004,297,568 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF

MOD - [2008.10.07 14:33:00 | 000,466,944 | ---- | M] () -- C:\WINDOWS\system32\nvshell.dll

MOD - [2008.04.14 08:52:18 | 000,014,336 | ---- | M] () -- C:\WINDOWS\system32\msdmo.dll

MOD - [2007.12.19 15:04:24 | 000,828,416 | ---- | M] () -- C:\Programme\Sun\StarOffice 8\program\libxml2.dll

MOD - [2007.09.20 19:34:58 | 000,129,024 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll

MOD - [2007.03.13 12:28:36 | 000,823,296 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Nero\Lib\log4cxx.dll

MOD - [2007.01.31 11:56:56 | 000,032,768 | ---- | M] () -- C:\Programme\EXPERTool\TBPanelExt.dll

MOD - [2006.02.22 15:47:44 | 000,073,728 | R--- | M] () -- C:\Programme\Cherry\KeyMan\zlib1.dll

MOD - [2006.02.22 15:47:16 | 000,114,688 | R--- | M] () -- C:\Programme\Cherry\KeyMan\libpng13.dll

MOD - [2001.10.28 18:42:30 | 000,116,224 | ---- | M] () -- C:\WINDOWS\system32\pdfcmnnt.dll

MOD - [1998.10.31 11:55:56 | 000,005,120 | ---- | M] () -- C:\Programme\EXPERTool\TBMANAGE.DLL

 

 
 ========== Services (SafeList) ==========

 

SRV - [2012.10.13 14:16:19 | 000,115,168 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)

SRV - [2012.08.29 12:03:36 | 001,385,896 | ---- | M] (LogMeIn Inc.) [Auto | Running] -- C:\Programme\LogMeIn Hamachi\hamachi-2.exe -- (Hamachi2Svc)

SRV - [2012.06.07 19:12:14 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Dokumente und Einstellungen\Steffen\Desktop\Updater\Updater.exe -- (SkypeUpdate)

SRV - [2012.05.09 20:07:11 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2012.05.09 20:07:10 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2011.12.20 11:28:12 | 000,196,904 | ---- | M] (Nitro PDF Software) [Auto | Running] -- C:\Programme\Nitro PDF\Reader 2\NitroPDFReaderDriverService2.exe -- (NitroReaderDriverReadSpool2)

SRV - [2011.06.12 11:15:00 | 031,125,880 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Microsoft Office\Office14\GROOVE.EXE -- (Microsoft SharePoint Workspace Audit Service)

SRV - [2010.01.09 21:37:50 | 004,640,000 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)

SRV - [2010.01.09 21:18:00 | 000,149,352 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)

SRV - [2009.12.01 15:55:10 | 000,066,560 | ---- | M] (tzuk) [Auto | Running] -- C:\Programme\Sandboxie\SbieSvc.exe -- (SbieSvc)

SRV - [2008.03.17 19:07:02 | 000,073,728 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe -- (LightScribeService)

SRV - [2007.12.04 13:03:14 | 000,585,774 | ---- | M] (Cherry, Auerbach Germany, www.cherry.de) [On_Demand | Running] -- C:\Programme\Cherry\CDI\cdi.exe -- (Cherry Device Interface)

SRV - [2007.08.03 13:51:18 | 000,382,248 | ---- | M] (Nero AG) [On_Demand | Running] -- C:\Programme\Gemeinsame Dateien\Nero\Lib\NMIndexingService.exe -- (NMIndexingService)

SRV - [2003.06.20 00:25:00 | 000,322,120 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE -- (MDM)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - File not found [Kernel | On_Demand | Stopped] --  -- (WDICA)

DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRFRAME)

DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRELI)

DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDFRAME)

DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDCOMP)

DRV - File not found [Kernel | System | Stopped] --  -- (PCIDump)

DRV - File not found [Kernel | System | Stopped] --  -- (lbrtfdc)

DRV - File not found [Kernel | System | Stopped] --  -- (i2omgmt)

DRV - File not found [Kernel | System | Stopped] --  -- (Changer)

DRV - File not found [Kernel | On_Demand | Unknown] --  -- (abjivpi7)

DRV - File not found [Kernel | On_Demand | Unknown] --  -- (a1ya0lxb)

DRV - [2012.06.10 23:28:51 | 000,477,240 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sptd.sys -- (sptd)

DRV - [2012.05.09 20:07:11 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)

DRV - [2012.05.09 20:07:11 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2011.09.16 17:08:07 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avkmgr.sys -- (avkmgr)

DRV - [2011.03.18 18:08:54 | 000,025,240 | ---- | M] (Almico Software) [Kernel | Boot | Running] -- C:\WINDOWS\system32\speedfan.sys -- (speedfan)

DRV - [2009.12.01 15:55:10 | 000,119,296 | ---- | M] (tzuk) [Kernel | On_Demand | Running] -- C:\Programme\Sandboxie\SbieDrv.sys -- (SbieDrv)

DRV - [2009.10.08 17:55:33 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2009.07.23 12:16:22 | 000,271,360 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\atksgt.sys -- (atksgt)

DRV - [2009.07.23 12:16:21 | 000,018,048 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\lirsgt.sys -- (lirsgt)

DRV - [2009.03.18 17:35:40 | 000,026,176 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hamachi.sys -- (hamachi)

DRV - [2008.07.30 07:51:30 | 000,277,736 | ---- | M] (Protect Software GmbH) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\acedrv11.sys -- (acedrv11)

DRV - [2008.01.24 10:41:34 | 000,130,560 | ---- | M] (Cherry GmbH) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Ch2kPS2.sys -- (Ch2kPS2)

DRV - [2007.10.16 19:38:30 | 004,615,168 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService)

DRV - [2007.03.16 11:11:38 | 000,012,256 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\TBPanel.sys -- (TBPanel)

DRV - [2007.03.16 11:11:38 | 000,012,256 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\TBPanel.sys -- (Cardex)

DRV - [2006.12.14 17:44:06 | 000,085,120 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtnicxp.sys -- (RTL8023xp)

DRV - [2006.04.13 15:33:28 | 000,008,192 | ---- | M] (BIOSTAR Group) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\BS_I2cIo.sys -- (BS_I2cIo)

DRV - [2005.03.16 08:23:54 | 000,013,696 | R--- | M] (BIOSTAR Group) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\BIOS.sys -- (BIOS)

DRV - [2001.08.17 14:57:46 | 000,065,664 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s3legacy.sys -- (s3legacy)

DRV - [2001.08.17 14:53:32 | 000,003,328 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\qv2kux.sys -- (QV2KUX)

DRV - [1996.04.03 21:33:26 | 000,005,248 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\system32\giveio.sys -- (giveio)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie

IE - HKLM\..\SearchScopes,DefaultScope = 

 

 

IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = 

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = 

 

IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = 

 

IE - HKU\S-1-5-21-1078081533-1563985344-682003330-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie

IE - HKU\S-1-5-21-1078081533-1563985344-682003330-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie

IE - HKU\S-1-5-21-1078081533-1563985344-682003330-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com

IE - HKU\S-1-5-21-1078081533-1563985344-682003330-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com

IE - HKU\S-1-5-21-1078081533-1563985344-682003330-1004\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie

IE - HKU\S-1-5-21-1078081533-1563985344-682003330-1004\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie

IE - HKU\S-1-5-21-1078081533-1563985344-682003330-1004\..\URLSearchHook:  - No CLSID value found

IE - HKU\S-1-5-21-1078081533-1563985344-682003330-1004\..\SearchScopes,DefaultScope = 

IE - HKU\S-1-5-21-1078081533-1563985344-682003330-1004\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={sear

IE - HKU\S-1-5-21-1078081533-1563985344-682003330-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1078081533-1563985344-682003330-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "AutoConfigURL" = 192.168.2.1

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultenginename: "ICQ Search"

FF - prefs.js..browser.search.defaulturl: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.2.9&q="

FF - prefs.js..browser.search.selectedEngine: "Google"

FF - prefs.js..browser.startup.homepage: "hxxp://google.de/"

FF - prefs.js..extensions.enabledAddons: battlefieldplay4free@ea.com:1.0.66.2

FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22

FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.7

FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.2.9&q="

FF - user.js - File not found

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_262.dll ()

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_35: C:\WINDOWS\system32\npdeployJava1.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Programme\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Dokumente und Einstellungen\Steffen\Lokale Einstellungen\Anwendungsdaten\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF - HKCU\Software\MozillaPlugins\@www.flatcast.com/FlatViewer 5.2: C:\PROGRA~1\MOZILL~1\plugins\NpFv522.dll (1 mal 1 Software GmbH)

FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Programme\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.10.13 14:16:19 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2012.10.17 23:24:06 | 000,000,000 | ---D | M]

 

[2009.07.24 11:10:24 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Mozilla\Extensions

[2012.05.02 21:56:31 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Mozilla\Firefox\Profiles\1pwc4e03.default\extensions

[2010.06.23 23:30:29 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Mozilla\Firefox\Profiles\1pwc4e03.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}

[2011.10.20 20:25:49 | 000,000,000 | ---D | M] (Battlefield Play4Free) -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Mozilla\Firefox\Profiles\1pwc4e03.default\extensions\battlefieldplay4free@ea.com

[2012.10.17 18:14:06 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Mozilla\Firefox\Profiles\1pwc4e03.default\searchplugins\icqplugin-1.xml

[2011.05.07 22:42:44 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Mozilla\Firefox\Profiles\1pwc4e03.default\searchplugins\icqplugin-2.xml

[2011.06.23 22:29:33 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Mozilla\Firefox\Profiles\1pwc4e03.default\searchplugins\icqplugin-3.xml

[2011.07.04 09:34:56 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Mozilla\Firefox\Profiles\1pwc4e03.default\searchplugins\icqplugin-4.xml

[2011.08.18 16:51:05 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Mozilla\Firefox\Profiles\1pwc4e03.default\searchplugins\icqplugin-5.xml

[2011.03.30 15:14:34 | 000,001,042 | ---- | M] () -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Mozilla\Firefox\Profiles\1pwc4e03.default\searchplugins\icqplugin.xml

[2012.10.13 14:16:13 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions

[2012.10.13 14:16:13 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}

[2012.10.13 14:16:13 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}

[2012.10.13 14:16:19 | 000,261,600 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll

[2009.09.21 11:00:44 | 001,447,328 | ---- | M] (1 mal 1 Software GmbH) -- C:\Programme\mozilla firefox\plugins\NpFv522.dll

[2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml

[2012.08.30 19:13:56 | 000,002,465 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml

[2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml

[2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml

[2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml

[2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml

 
 ========== Chrome  ==========

 

CHR - default_search_provider: ICQ Search (Enabled)

CHR - default_search_provider: search_url = hxxp://search.icq.com/search/results.php?ch_id=osd&q={searchTerms}&icid=chrome

CHR - default_search_provider: suggest_url = 

CHR - homepage: hxxp://start.icq.com/

CHR - plugin: Shockwave Flash (Enabled) = C:\Dokumente und Einstellungen\Steffen\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\10.0.648.204\gcswf32.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll

CHR - plugin: Java Deployment Toolkit 6.0.220.4 (Enabled) = C:\Programme\Java\jre6\bin\new_plugin\npdeployJava1.dll

CHR - plugin: Java(TM) Platform SE 6 U22 (Enabled) = C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll

CHR - plugin: Adobe Acrobat (Disabled) = C:\Programme\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll

CHR - plugin: Shockwave for Director (Enabled) = C:\WINDOWS\system32\Adobe\Director\np32dsw.dll

CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Programme\Windows Media Player\npdsplay.dll

CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Dokumente und Einstellungen\Steffen\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\10.0.648.204\pdf.dll

CHR - plugin: Google Gears 0.5.33.0 (Enabled) = C:\Dokumente und Einstellungen\Steffen\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\10.0.648.204\gears.dll

CHR - plugin: Microsoft\\u00AE DRM (Enabled) = C:\Programme\Windows Media Player\npdrmv2.dll

CHR - plugin: Microsoft\\u00AE DRM (Enabled) = C:\Programme\Windows Media Player\npwmsdrm.dll

CHR - plugin: Google Update (Enabled) = C:\Programme\Google\Update\1.2.183.39\npGoogleOneClick8.dll

CHR - plugin: Pando Web Plugin (Enabled) = C:\Programme\Pando Networks\Media Booster\npPandoWebPlugin.dll

CHR - plugin: Windows Presentation Foundation (Enabled) = C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

CHR - plugin: Default Plug-in (Enabled) = default_plugin

CHR - Extension: vshare plugin = C:\Dokumente und Einstellungen\Steffen\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\kpionmjnkbpcdpcflammlgllecmejgjj\1.3_0\

 

O1 HOSTS File: ([2004.08.04 14:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Dokumente und Einstellungen\Steffen\Desktop\Toolbars\Internet Explorer\skypeieplugin.dll File not found

O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)

O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKLM..\Run: [BCSSync] C:\Programme\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)

O4 - HKLM..\Run: [CherryKeyMan] C:\Programme\Cherry\KeyMan\KeyMan.exe (Cherry GmbH)

O4 - HKLM..\Run: [EPSON Stylus CX3600 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE (SEIKO EPSON CORPORATION)

O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found

O4 - HKLM..\Run: [LogMeIn Hamachi Ui] C:\Programme\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)

O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Gemeinsame Dateien\Nero\Lib\NeroCheck.exe (Nero AG)

O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()

O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)

O4 - HKLM..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe File not found

O4 - HKU\S-1-5-21-1078081533-1563985344-682003330-1004..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Programme\Gemeinsame Dateien\Nero\Lib\NMBgMonitor.exe (Nero AG)

O4 - HKU\S-1-5-21-1078081533-1563985344-682003330-1004..\Run: [DAEMON Tools Lite] C:\Programme\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)

O4 - HKU\S-1-5-21-1078081533-1563985344-682003330-1004..\Run: [EPSON Stylus CX3600 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE (SEIKO EPSON CORPORATION)

O4 - HKU\S-1-5-21-1078081533-1563985344-682003330-1004..\Run: [GAINWARD] C:\Programme\EXPERTool\TBPanel.exe (Gainward Co.)

O4 - HKU\S-1-5-21-1078081533-1563985344-682003330-1004..\Run: [SandboxieControl] C:\Programme\Sandboxie\SbieCtrl.exe (tzuk)

O4 - HKU\S-1-5-21-1078081533-1563985344-682003330-1004..\Run: [Steam] z:\spiele\empire\steam.exe (Valve Corporation)

O4 - Startup: C:\Dokumente und Einstellungen\Steffen\Startmenü\Programme\Autostart\StarOffice 8.lnk = C:\Programme\Sun\StarOffice 8\program\quickstart.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-1078081533-1563985344-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O8 - Extra context menu item: An OneNote s&enden - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

O8 - Extra context menu item: Google Sidewiki... - res://C:\Programme\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html File not found

O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 File not found

O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)

O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)

O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)

O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)

O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Dokumente und Einstellungen\Steffen\Desktop\Toolbars\Internet Explorer\skypeieplugin.dll File not found

O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Dokumente und Einstellungen\Steffen\Desktop\Toolbars\Internet Explorer\skypeieplugin.dll File not found

O9 - Extra Button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Programme\PokerStars.NET\PokerStarsUpdate.exe (PokerStars)

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1225396019156 (WUWebControl Class)

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1350079657312 (MUWebControl Class)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab (Java Plug-in 1.6.0_35)

O16 - DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_04-windows-i586.cab (Java Plug-in 1.6.0_04)

O16 - DPF: {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab (Java Plug-in 1.6.0_35)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab (Java Plug-in 1.6.0_35)

O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} hxxp://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab (Oberon Flash Game Host)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B609E8BE-0B04-454C-96A5-365B594E0528}: DhcpNameServer = 192.168.2.1

O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)

O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Dokumente und Einstellungen\Steffen\Desktop\Toolbars\Internet Explorer\skypeieplugin.dll File not found

O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)

O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home

O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Steffen\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp

O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Steffen\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp

O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2008.10.29 21:54:42 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O32 - AutoRun File - [2012.05.09 16:01:32 | 000,000,081 | R--- | M] () - R:\Autorun.inf -- [ UDF ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

 

NetSvcs: 6to4 -  File not found

NetSvcs: Ias -  File not found

NetSvcs: Iprip -  File not found

NetSvcs: Irmon -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: WmdmPmSp -  File not found

 

 

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: sermouse.sys - Driver

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: vds - Service

SafeBootMin: vga.sys - Driver

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

 

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: Hamachi2Svc - C:\Programme\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.)

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: sermouse.sys - Driver

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: vga.sys - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

 

ActiveX: {0213C6AF-5562-4D09-884C-2ADCFC8C2F35} - Microsoft .NET Framework 1.1 Security Update (KB2656353)

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)

ActiveX: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Programme\Gemeinsame Dateien\LightScribe\LSRunOnce.exe"

ActiveX: {1897C549-AE52-4571-8996-44854F5612B2} - Microsoft .NET Framework 1.1 Security Update (KB2656370)

ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4

ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offlinebrowsingpaket

ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe

ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)

ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT

ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015C} - Microsoft DirectX

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer-Hilfe

ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Sicherheitsupdate für Windows XP (KB923789)

ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser

ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsererweiterungen

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - Zugang zu MSN Site

ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework

ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Web Folders

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

ActiveX: {8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - %SystemRoot%\system32\ie4uinit.exe

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML-Datenbindung

ActiveX: {B508B3F1-A24A-32C0-B310-85786919EF28} - .NET Framework

ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework

ActiveX: {C3C986D6-06B1-43BF-90DD-BE30756C00DE} - RevokedRootsUpdate

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer-Hauptschriftarten

ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework

ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner

ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1

ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML-Hilfe

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

 

Drivers32: msacm.ac3filter - C:\WINDOWS\System32\ac3filter.acm ()

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)

Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)

Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)

Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)

Drivers32: VIDC.FFDS - C:\WINDOWS\System32\ffdshow.ax ()

Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()

Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()

Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)

Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

Drivers32: vidc.VP60 - C:\WINDOWS\system32\vp6vfw.dll (On2.com)

Drivers32: vidc.VP61 - C:\WINDOWS\system32\vp6vfw.dll (On2.com)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

File not found -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Neue Funktion 1

[2012.10.18 21:11:53 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Steffen\Desktop\OTL.exe

[2012.10.15 18:43:21 | 000,000,000 | ---D | C] -- C:\Programme\ESET

[2012.10.15 18:43:02 | 002,322,184 | ---- | C] (ESET) -- C:\Dokumente und Einstellungen\Steffen\Desktop\esetsmartinstaller_enu.exe

[2012.10.13 18:58:25 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Steffen\Desktop\League of Legends

[2012.10.13 14:16:12 | 000,000,000 | ---D | C] -- C:\Programme\Mozilla Firefox

[2012.10.12 15:35:03 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Malwarebytes

[2012.10.12 15:34:54 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware

[2012.10.12 15:34:54 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes

[2012.10.12 15:34:53 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys

[2012.10.12 15:34:53 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware

[2012.10.12 15:24:02 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\Steffen\Recent

[2012.10.11 16:20:05 | 000,000,000 | -HSD | C] -- C:\Config.Msi

[2012.08.26 23:26:12 | 001,178,624 | ---- | C] (CPUID) -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\siw_sdk.dll

[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.10.18 21:18:00 | 000,001,090 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

[2012.10.18 20:45:10 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Steffen\Desktop\OTL.exe

[2012.10.18 17:18:30 | 000,200,819 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml

[2012.10.18 17:18:28 | 000,001,086 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job

[2012.10.18 17:18:18 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2012.10.18 17:18:16 | 2145,898,496 | -HS- | M] () -- C:\hiberfil.sys

[2012.10.16 17:00:39 | 000,538,941 | ---- | M] () -- C:\Dokumente und Einstellungen\Steffen\Desktop\adwcleaner.exe

[2012.10.15 18:42:52 | 002,322,184 | ---- | M] (ESET) -- C:\Dokumente und Einstellungen\Steffen\Desktop\esetsmartinstaller_enu.exe

[2012.10.14 22:15:55 | 000,001,623 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\League of Legends spielen .lnk

[2012.10.14 21:46:11 | 000,777,494 | ---- | M] () -- C:\Dokumente und Einstellungen\Steffen\Desktop\Ausschreibung.pdf

[2012.10.14 19:06:46 | 000,002,260 | ---- | M] () -- C:\WINDOWS\Sandboxie.ini

[2012.10.14 19:06:13 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2012.10.13 12:12:39 | 000,054,156 | -H-- | M] () -- C:\WINDOWS\QTFont.qfn

[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2012.10.16 17:00:50 | 000,538,941 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffen\Desktop\adwcleaner.exe

[2012.10.14 22:15:55 | 000,001,623 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\League of Legends spielen .lnk

[2012.10.14 21:46:11 | 000,777,494 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffen\Desktop\Ausschreibung.pdf

[2012.10.12 14:07:13 | 2145,898,496 | -HS- | C] () -- C:\hiberfil.sys

[2012.06.05 21:40:28 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffen\initdebug.nfo

[2012.02.16 17:56:34 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll

[2012.01.03 18:10:42 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll

[2011.09.14 22:06:11 | 000,354,816 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll

[2011.09.13 15:20:59 | 000,000,866 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffen\.recently-used.xbel

[2011.05.28 16:16:30 | 000,000,038 | ---- | C] () -- C:\WINDOWS\AviSplitter.INI

[2011.05.15 13:33:35 | 000,695,578 | ---- | C] () -- C:\WINDOWS\unins000.exe

[2011.05.15 13:33:35 | 000,000,906 | ---- | C] () -- C:\WINDOWS\unins000.dat

[2011.04.09 01:55:38 | 000,069,632 | R--- | C] () -- C:\WINDOWS\System32\xmltok.dll

[2011.04.09 01:55:38 | 000,036,864 | R--- | C] () -- C:\WINDOWS\System32\xmlparse.dll

[2011.01.09 01:05:58 | 000,000,469 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffen\.dsa4.properties

[2010.11.04 18:07:28 | 000,000,140 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffen\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat

[2010.10.03 12:17:11 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffen\sssss

[2010.10.03 12:16:11 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffen\ssss

[2010.10.03 12:14:07 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffen\Spiegel

[2010.10.03 12:13:18 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffen\Speigel-Artikel

[2010.09.24 15:43:50 | 000,479,918 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\mdbu.bin

[2009.02.05 20:04:40 | 000,061,952 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffen\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

 
 ========== ZeroAccess Check ==========

 

[2008.10.29 23:23:25 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shdocvw.dll -- [2012.08.30 22:28:07 | 001,510,400 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009.02.09 12:51:44 | 000,473,600 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

"" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008.04.14 08:52:34 | 000,273,920 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

 
 ========== LOP Check ==========

 

[2010.01.24 17:41:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ChessBase

[2012.06.10 23:44:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DAEMON Tools Lite

[2010.10.07 19:38:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Electronic Arts

[2012.10.17 23:24:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ICQ

[2008.10.29 23:34:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\LightScribe

[2012.01.09 22:45:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Nitro PDF

[2012.06.07 17:54:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Obsidian Entertainment

[2012.10.17 23:20:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PMB Files

[2010.09.24 14:59:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Rossmann Fotoservice

[2008.12.06 17:51:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ScreenSeven

[2012.03.14 08:27:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\tmp

[2012.04.21 16:47:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Ubisoft

[2008.11.09 10:22:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\UDL

[2011.08.16 21:53:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\.minecraft

[2010.02.20 13:05:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Ankh - Heart of Osiris

[2012.03.13 21:24:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Call Graph

[2008.11.09 10:50:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Cherry

[2010.01.24 17:38:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\ChessBase

[2008.10.29 22:43:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\DAEMON Tools

[2012.10.12 15:24:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\DAEMON Tools Lite

[2008.11.14 16:53:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Das Fussball Studio

[2012.01.09 22:45:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Downloaded Installations

[2008.11.09 10:37:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\EPSON

[2012.10.12 15:24:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\FileZilla

[2011.05.15 13:33:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Flatcast

[2010.11.13 16:49:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\gtk-2.0

[2011.10.30 23:10:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\ICQ

[2010.07.09 18:57:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Imperium Romanum

[2011.03.30 23:12:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\LolClient

[2012.05.24 22:44:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\LolClient2

[2010.10.07 21:32:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Need for Speed World

[2012.01.09 22:45:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Nitro PDF

[2012.06.07 17:54:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Obsidian Entertainment

[2011.06.17 10:14:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\phonostar GmbH

[2011.08.08 19:14:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\ProtectDisc

[2011.07.15 00:22:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\runic games

[2011.05.01 00:28:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Sedna Wireless

[2008.11.11 18:03:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Smart Panel

[2012.10.18 17:18:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\StarOffice8

[2012.08.02 04:30:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Summer Challenge

[2008.10.29 23:22:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\TeamViewer

[2011.03.26 13:59:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\The Creative Assembly

[2012.10.12 15:24:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\TS3Client

[2012.04.21 17:09:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Ubisoft

[2011.11.22 22:19:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Unity

[2010.10.31 01:31:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Wildlife Park 2

[2011.11.26 01:38:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Wildlife Park 2 - Crazy Zoo

[2011.11.26 01:44:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Wildlife Park 2 - Marine World

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2011.08.16 21:53:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\.minecraft

[2012.09.01 15:07:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Adobe

[2010.02.20 13:05:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Ankh - Heart of Osiris

[2007.01.01 23:44:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Avira

[2012.03.13 21:24:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Call Graph

[2008.11.09 10:50:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Cherry

[2010.01.24 17:38:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\ChessBase

[2009.06.17 17:58:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\CyberLink

[2008.10.29 22:43:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\DAEMON Tools

[2012.10.12 15:24:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\DAEMON Tools Lite

[2008.11.14 16:53:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Das Fussball Studio

[2012.01.09 22:45:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Downloaded Installations

[2008.11.09 10:37:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\EPSON

[2012.10.12 15:24:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\FileZilla

[2011.05.15 13:33:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Flatcast

[2009.10.29 20:25:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Google

[2010.11.13 16:49:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\gtk-2.0

[2010.03.17 20:12:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Hamachi

[2010.02.05 17:46:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Help

[2011.10.30 23:10:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\ICQ

[2008.10.29 22:04:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Identities

[2010.07.09 18:57:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Imperium Romanum

[2008.10.29 22:08:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\InstallShield

[2011.03.30 23:12:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\LolClient

[2012.05.24 22:44:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\LolClient2

[2008.11.01 18:11:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Macromedia

[2012.10.12 15:35:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Malwarebytes

[2008.12.29 20:09:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Media Player Classic

[2012.09.01 15:07:26 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Microsoft

[2009.12.13 14:11:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Microsoft Games

[2010.11.04 20:23:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Mozilla

[2010.10.07 21:32:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Need for Speed World

[2008.10.30 21:44:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Nero

[2012.01.09 22:45:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Nitro PDF

[2012.06.07 17:54:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Obsidian Entertainment

[2011.06.17 10:14:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\phonostar GmbH

[2011.08.08 19:14:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\ProtectDisc

[2011.07.15 00:22:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\runic games

[2010.12.23 19:34:23 | 000,000,000 | RH-D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\SecuROM

[2011.05.01 00:28:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Sedna Wireless

[2012.10.18 21:13:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Skype

[2011.07.12 22:13:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\skypePM

[2008.11.11 18:03:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Smart Panel

[2012.10.18 17:18:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\StarOffice8

[2012.08.02 04:30:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Summer Challenge

[2009.01.13 20:45:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Sun

[2008.10.29 23:22:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\TeamViewer

[2011.03.26 13:59:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\The Creative Assembly

[2012.10.12 15:24:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\TS3Client

[2012.04.21 17:09:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Ubisoft

[2011.11.22 22:19:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Unity

[2010.10.31 01:31:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Wildlife Park 2

[2011.11.26 01:38:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Wildlife Park 2 - Crazy Zoo

[2011.11.26 01:44:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Wildlife Park 2 - Marine World

[2012.10.12 15:24:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Winamp

[2008.10.30 21:44:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\WinRAR

 
 < %APPDATA%\*.exe /s >

[2008.11.01 18:11:38 | 001,887,176 | ---- | M] (Adobe Systems Incorporated) -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe

[2011.09.03 00:20:19 | 000,009,662 | R--- | M] () -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Microsoft\Installer\{447D1817-D8B2-4FCA-A7FC-53BC17694DB0}\_12db153c.exe

[2011.09.03 00:20:19 | 000,009,662 | R--- | M] () -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Microsoft\Installer\{447D1817-D8B2-4FCA-A7FC-53BC17694DB0}\_bb32ea6.exe

[2009.06.14 15:04:25 | 000,003,638 | R--- | M] () -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Microsoft\Installer\{73FD7424-15CA-489F-B586-117D34FCBB18}\ARPPRODUCTICON.exe

[2009.06.14 15:04:25 | 000,045,056 | R--- | M] (InstallShield Software Corp.) -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Microsoft\Installer\{73FD7424-15CA-489F-B586-117D34FCBB18}\WPC2.exe1_EABB7AE615DB4E6284E8B0C6F7913861.exe

[2009.06.14 15:04:25 | 000,045,056 | R--- | M] (InstallShield Software Corp.) -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Microsoft\Installer\{73FD7424-15CA-489F-B586-117D34FCBB18}\WPC2.exe_EABB7AE615DB4E6284E8B0C6F7913861.exe

[2011.07.31 20:22:57 | 000,021,630 | R--- | M] () -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Microsoft\Installer\{93CF9FA6-2A5E-4F8E-923E-F7D8741CB312}\_6FEFF9B68218417F98F549.exe

[2011.07.31 20:22:57 | 000,006,462 | R--- | M] () -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Microsoft\Installer\{93CF9FA6-2A5E-4F8E-923E-F7D8741CB312}\_7128E1F9F222A8E24D3CAA.exe

[2011.07.31 20:22:57 | 000,021,630 | R--- | M] () -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Microsoft\Installer\{93CF9FA6-2A5E-4F8E-923E-F7D8741CB312}\_CFD6D42B6B589B419C4C1C.exe

[2011.07.31 20:22:57 | 000,021,630 | R--- | M] () -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Microsoft\Installer\{93CF9FA6-2A5E-4F8E-923E-F7D8741CB312}\_ED5A694DDDFCA3353724A2.exe

[2010.02.19 18:42:12 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Microsoft\Installer\{EDEA8AB7-7683-4ED2-AA19-E6C078064C0D}\ARPPRODUCTICON.exe

[2010.02.19 18:42:12 | 000,001,078 | R--- | M] () -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Microsoft\Installer\{EDEA8AB7-7683-4ED2-AA19-E6C078064C0D}\DocumentationShortcu_EDEA8AB776834ED2AA19E6C078064C0D.exe

[2011.09.23 14:07:18 | 001,005,512 | ---- | M] (EA Digital Illusions CE AB) -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Mozilla\Firefox\Profiles\1pwc4e03.default\extensions\battlefieldplay4free@ea.com\plugins\BP4FUpdater.exe

[2011.10.19 06:21:31 | 000,909,088 | ---- | M] (Sun Microsystems, Inc.) -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Sun\Java\JRERunOnce.exe

 
 < %SYSTEMDRIVE%\*.exe >

 
 < MD5 for: AGP440.SYS  >

[2004.08.04 14:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys

[2008.04.14 09:03:54 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys

[2008.04.14 09:03:54 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys

[2008.04.14 01:06:40 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys

[2008.04.14 01:06:40 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys

 
 < MD5 for: ATAPI.SYS  >

[2004.08.04 14:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys

[2008.04.14 09:03:54 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys

[2008.04.14 09:03:54 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys

[2008.04.14 01:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys

[2008.04.14 01:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys

[2004.08.03 23:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys

[2004.08.04 14:00:00 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0004\DriverFiles\i386\atapi.sys

[2004.08.03 23:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0005\DriverFiles\i386\atapi.sys

 
 < MD5 for: EVENTLOG.DLL  >

[2008.04.14 08:52:12 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll

[2008.04.14 08:52:12 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll

[2004.08.04 14:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

 
 < MD5 for: NETLOGON.DLL  >

[2008.04.14 08:52:20 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll

[2008.04.14 08:52:20 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll

[2004.08.04 14:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D27395EDCD3416AFD125A9370DCB585C -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

[2009.02.06 20:46:10 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=ED4BBAD725A21632FB205452749FC8F5 -- C:\WINDOWS\$hf_mig$\KB968389\SP2QFE\netlogon.dll

[2009.02.06 20:46:10 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=ED4BBAD725A21632FB205452749FC8F5 -- C:\WINDOWS\$hf_mig$\KB975467\SP2QFE\netlogon.dll

 
 < MD5 for: SCECLI.DLL  >

[2008.04.14 08:52:24 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll

[2008.04.14 08:52:24 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll

[2004.08.04 14:00:00 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2005.03.02 20:09:46 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=3751D7CF0E0A113D84414992146BCE6A -- C:\WINDOWS\$NtUninstallKB925902$\user32.dll

[2007.03.08 17:36:30 | 000,579,072 | ---- | M] (Microsoft Corporation) MD5=492E166CFD26A50FB9160DB536FF7D2B -- C:\WINDOWS\$NtServicePackUninstall$\user32.dll

[2005.03.02 20:19:56 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=4C90159A69A5FD3EB39C71411F28FCFF -- C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll

[2004.08.04 14:00:00 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=56785FD5236D7B22CF471A6DA9DB46D8 -- C:\WINDOWS\$NtUninstallKB890859$\user32.dll

[2007.03.08 17:48:39 | 000,579,584 | ---- | M] (Microsoft Corporation) MD5=78785EFF8CB90CEC1862A4CCFD9A3C3A -- C:\WINDOWS\$hf_mig$\KB925902\SP2QFE\user32.dll

[2008.04.14 08:52:32 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\ServicePackFiles\i386\user32.dll

[2008.04.14 08:52:32 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2008.04.14 08:53:04 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe

[2008.04.14 08:53:04 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe

[2004.08.04 14:00:00 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2004.08.04 14:00:00 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe

[2012.09.07 17:04:42 | 000,218,696 | ---- | M] () MD5=4E0D8C9F83B7FD82393F7D8CCC27E7AE -- C:\Programme\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

[2008.04.14 08:53:06 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe

[2008.04.14 08:53:06 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2004.08.04 14:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys

[2004.08.04 14:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

[2008.10.29 22:46:19 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav

[2008.10.29 22:46:19 | 000,638,976 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav

[2008.10.29 22:46:19 | 000,442,368 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >

[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

 
 ========== Alternate Data Streams ==========

 

@Alternate Data Stream - 85 bytes -> C:\Dokumente und Einstellungen\All Users\Desktop:$SS_DESCRIPTOR_NBVUV6PKDVBGTLPHJKBUK1R0WTPLY2LB3W2PHDEX6J5T4BW9V4DLNNH2V1UY71VU5VVVVVJVTVVJVT
 

< End of report >

edit: und noch extra.txt

Code:

OTL Extras logfile created on: 18.10.2012 21:12:51 - Run 1

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Dokumente und Einstellungen\Steffen\Desktop

Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 6.0.2900.5512)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

2,00 Gb Total Physical Memory | 1,32 Gb Available Physical Memory | 66,02% Memory free

3,85 Gb Paging File | 3,17 Gb Available in Paging File | 82,51% Paging File free

Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme

Drive C: | 100,00 Gb Total Space | 52,12 Gb Free Space | 52,12% Space Free | Partition Type: NTFS

Drive R: | 6,80 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF

Drive Z: | 198,09 Gb Total Space | 58,30 Gb Free Space | 29,43% Space Free | Partition Type: NTFS

 

Computer Name: PC1 | User Name: Steffen | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*

.url [@ = InternetShortcut] -- rundll32.exe shdocvw.dll,OpenURL %l

 

[HKEY_USERS\S-1-5-21-1078081533-1563985344-682003330-1004\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 
 ========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*

exefile [open] -- "%1" %*

htmlfile [edit] -- "C:\Programme\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)

htmlfile [print] -- "C:\Programme\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)

InternetShortcut [open] -- rundll32.exe shdocvw.dll,OpenURL %l

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [CEWE FOTOSCHAU] -- "C:\Programme\SCHLECKER\SCHLECKER Foto Digital Service\CEWE FOTOSCHAU.exe" -d "%1" ()

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [SCHLECKER Foto Digital Service] -- "C:\Programme\SCHLECKER\SCHLECKER Foto Digital Service\SCHLECKER Foto Digital Service.exe" "%1" ()

Directory [Winamp.Bookmark] -- "C:\Programme\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)

Directory [Winamp.Enqueue] -- "C:\Programme\Winamp\winamp.exe" /ADD "%1" (Nullsoft)

Directory [Winamp.Play] -- "C:\Programme\Winamp\winamp.exe" "%1" (Nullsoft)

Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"FirstRunDisabled" = 1

"AntiVirusDisableNotify" = 0

"FirewallDisableNotify" = 0

"UpdatesDisableNotify" = 0

"AntiVirusOverride" = 0

"FirewallOverride" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

 
 ========== System Restore Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]

"DisableSR" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]

"Start" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]

"Start" = 2

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

"1723:TCP" = 1723:TCP:*:Enabled:@xpsp2res.dll,-22015

"1701:UDP" = 1701:UDP:*:Enabled:@xpsp2res.dll,-22016

"500:UDP" = 500:UDP:*:Enabled:@xpsp2res.dll,-22017

"58931:TCP" = 58931:TCP:*:Enabled:Pando Media Booster

"58931:UDP" = 58931:UDP:*:Enabled:Pando Media Booster

"58797:TCP" = 58797:TCP:*:Enabled:Pando Media Booster

"58797:UDP" = 58797:UDP:*:Enabled:Pando Media Booster

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

"DoNotAllowExceptions" = 0

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007

"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

"58282:TCP" = 58282:TCP:*:Enabled:Em4

"12345:UDP" = 12345:UDP:*:Enabled:Em4

"54321:UDP" = 54321:UDP:*:Enabled:Em4

"1723:TCP" = 1723:TCP:*:Enabled:@xpsp2res.dll,-22015

"1701:UDP" = 1701:UDP:*:Enabled:@xpsp2res.dll,-22016

"500:UDP" = 500:UDP:*:Enabled:@xpsp2res.dll,-22017

"58931:TCP" = 58931:TCP:*:Enabled:Pando Media Booster

"58931:UDP" = 58931:UDP:*:Enabled:Pando Media Booster

"8396:TCP" = 8396:TCP:*:Enabled:League of Legends Launcher

"8396:UDP" = 8396:UDP:*:Enabled:League of Legends Launcher

"6907:TCP" = 6907:TCP:*:Enabled:League of Legends Launcher

"6907:UDP" = 6907:UDP:*:Enabled:League of Legends Launcher

"6969:TCP" = 6969:TCP:*:Enabled:League of Legends Launcher

"6969:UDP" = 6969:UDP:*:Enabled:League of Legends Launcher

"6911:TCP" = 6911:TCP:*:Enabled:League of Legends Launcher

"6911:UDP" = 6911:UDP:*:Enabled:League of Legends Launcher

"6941:TCP" = 6941:TCP:*:Enabled:League of Legends Launcher

"6941:UDP" = 6941:UDP:*:Enabled:League of Legends Launcher

"8397:TCP" = 8397:TCP:*:Enabled:League of Legends Launcher

"8397:UDP" = 8397:UDP:*:Enabled:League of Legends Launcher

"6908:TCP" = 6908:TCP:*:Enabled:League of Legends Launcher

"6908:UDP" = 6908:UDP:*:Enabled:League of Legends Launcher

"6937:TCP" = 6937:TCP:*:Enabled:League of Legends Launcher

"6937:UDP" = 6937:UDP:*:Enabled:League of Legends Launcher

"6896:TCP" = 6896:TCP:*:Enabled:League of Legends Launcher

"6896:UDP" = 6896:UDP:*:Enabled:League of Legends Launcher

"6992:TCP" = 6992:TCP:*:Enabled:League of Legends Launcher

"6992:UDP" = 6992:UDP:*:Enabled:League of Legends Launcher

"6968:TCP" = 6968:TCP:*:Enabled:League of Legends Launcher

"6968:UDP" = 6968:UDP:*:Enabled:League of Legends Launcher

"6947:TCP" = 6947:TCP:*:Enabled:League of Legends Launcher

"6947:UDP" = 6947:UDP:*:Enabled:League of Legends Launcher

"8398:TCP" = 8398:TCP:*:Enabled:League of Legends Launcher

"8398:UDP" = 8398:UDP:*:Enabled:League of Legends Launcher

"8393:TCP" = 8393:TCP:*:Enabled:League of Legends Lobby

"8393:UDP" = 8393:UDP:*:Enabled:League of Legends Lobby

"8390:TCP" = 8390:TCP:*:Enabled:League of Legends Game Client

"8390:UDP" = 8390:UDP:*:Enabled:League of Legends Game Client

"58797:TCP" = 58797:TCP:*:Enabled:Pando Media Booster

"58797:UDP" = 58797:UDP:*:Enabled:Pando Media Booster

 
 ========== Authorized Applications List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)

"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)

"C:\Programme\ICQ7.5\ICQ.exe" = C:\Programme\ICQ7.5\ICQ.exe:*:Enabled:ICQ7.5 -- (ICQ, LLC.)

"C:\Programme\Pando Networks\Media Booster\PMB.exe" = C:\Programme\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster -- ()

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)

"C:\Programme\TeamViewer3\TeamViewer.exe" = C:\Programme\TeamViewer3\TeamViewer.exe:*:Enabled:TeamViewer Remote Control Application -- (TeamViewer GmbH)

"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)

"C:\Programme\ICQ6.5\ICQ.exe" = C:\Programme\ICQ6.5\ICQ.exe:*:Enabled:ICQ6

"Z:\Spiele\Emergency 4\Em4.exe" = Z:\Spiele\Emergency 4\Em4.exe:*:Enabled:Em4

"C:\Dokumente und Einstellungen\Steffen\Desktop\Empire Earth I\Empire Earth.exe" = C:\Dokumente und Einstellungen\Steffen\Desktop\Empire Earth I\Empire Earth.exe:*:Enabled:Empire Earth

"C:\Dokumente und Einstellungen\Steffen\Desktop\Plugin Manager\skypePM.exe" = C:\Dokumente und Einstellungen\Steffen\Desktop\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager

"Z:\Spiele\Rise of Nations\nations.exe" = Z:\Spiele\Rise of Nations\nations.exe:*:Enabled:Rise of Nations

"Z:\Spiele\Rise of Nations\thrones.exe" = Z:\Spiele\Rise of Nations\thrones.exe:*:Disabled:Rise of Nations

"Z:\Spiele\Rise of Nations\patriots.exe" = Z:\Spiele\Rise of Nations\patriots.exe:*:Enabled:Rise of Nations

"Z:\Spiele\Battlefront 2\GameData\BattlefrontII.exe" = Z:\Spiele\Battlefront 2\GameData\BattlefrontII.exe:*:Enabled:BattlefrontII -- ()

"C:\Programme\LogMeIn Hamachi\hamachi-2-ui.exe" = C:\Programme\LogMeIn Hamachi\hamachi-2-ui.exe:*:Enabled:LogMeIn Hamachi -- (LogMeIn Inc.)

"C:\Programme\Electronic Arts\Die Schlacht um Mittelerde II\game.dat" = C:\Programme\Electronic Arts\Die Schlacht um Mittelerde II\game.dat:*:Enabled:Die Schlacht um Mittelerde™ II

"C:\Programme\LittleFighter2\LF2_v2.0a\lf2.exe" = C:\Programme\LittleFighter2\LF2_v2.0a\lf2.exe:*:Enabled:lf2

"Z:\Spiele\Anno 1602\ANNO1602\1602.EXE" = Z:\Spiele\Anno 1602\ANNO1602\1602.EXE:*:Enabled:1602 -- (MAX DESIGN)

"C:\WINDOWS\system32\dplaysvr.exe" = C:\WINDOWS\system32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper -- (Microsoft Corporation)

"Z:\Spiele\Sparta-Ancient Wars\AWE.exe" = Z:\Spiele\Sparta-Ancient Wars\AWE.exe:*:Enabled:AWE

"Z:\Spiele\Stronghold\Stronghold.exe" = Z:\Spiele\Stronghold\Stronghold.exe:*:Enabled:Stronghold -- ()

"C:\Riot Games\League of Legends\air\LolClient.exe" = C:\Riot Games\League of Legends\air\LolClient.exe:*:Enabled:League of Legends Lobby

"C:\Riot Games\League of Legends\game\League of Legends.exe" = C:\Riot Games\League of Legends\game\League of Legends.exe:*:Enabled:League of Legends Game Client

"C:\Programme\Call Graph\CallGraph.exe" = C:\Programme\Call Graph\CallGraph.exe:*:Enabled:Call Graph -- (Sedna Wireless Pvt. Ltd.)

"C:\Dokumente und Einstellungen\Steffen\Desktop\Skype.exe" = C:\Dokumente und Einstellungen\Steffen\Desktop\Skype.exe:*:Enabled:Skype

"C:\Riot Games\League of Legends\lol.launcher.exe" = C:\Riot Games\League of Legends\lol.launcher.exe:*:Enabled:League of Legends Launcher -- ()

"C:\Programme\Mozilla Firefox\plugin-container.exe" = C:\Programme\Mozilla Firefox\plugin-container.exe:*:Enabled:Plugin Container for Firefox -- (Mozilla Corporation)

"C:\Programme\ICQ7.5\ICQ.exe" = C:\Programme\ICQ7.5\ICQ.exe:*:Enabled:ICQ7.5 -- (ICQ, LLC.)

"C:\Programme\TmNationsForever\TmForever.exe" = C:\Programme\TmNationsForever\TmForever.exe:*:Enabled:TmForever

"Z:\Spiele\EMpire\SteamApps\common\empire total war\Empire.exe" = Z:\Spiele\EMpire\SteamApps\common\empire total war\Empire.exe:*:Enabled:Empire: Total War -- (The Creative Assembly Ltd)

"Z:\Spiele\Assassins Creed\AssassinsCreed_Dx9.exe" = Z:\Spiele\Assassins Creed\AssassinsCreed_Dx9.exe:*:Enabled:Assassin's Creed Dx9 -- (Ubisoft)

"Z:\Spiele\Assassins Creed\AssassinsCreed_Dx10.exe" = Z:\Spiele\Assassins Creed\AssassinsCreed_Dx10.exe:*:Enabled:Assassin's Creed Dx10 -- (Ubisoft)

"Z:\Spiele\Assassins Creed\AssassinsCreed_Launcher.exe" = Z:\Spiele\Assassins Creed\AssassinsCreed_Launcher.exe:*:Enabled:Assassin's Creed Update -- (Ubisoft)

"C:\Programme\Microsoft Office\Office14\GROOVE.EXE" = C:\Programme\Microsoft Office\Office14\GROOVE.EXE:*:Enabled:Microsoft SharePoint Workspace -- (Microsoft Corporation)

"C:\Programme\Microsoft Office\Office14\ONENOTE.EXE" = C:\Programme\Microsoft Office\Office14\ONENOTE.EXE:*:Enabled:Microsoft OneNote -- (Microsoft Corporation)

"C:\Programme\Microsoft Office\Office14\OUTLOOK.EXE" = C:\Programme\Microsoft Office\Office14\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook -- (Microsoft Corporation)

"C:\Dokumente und Einstellungen\Steffen\Desktop\Phone\Skype.exe" = C:\Dokumente und Einstellungen\Steffen\Desktop\Phone\Skype.exe:*:Enabled:Skype -- (Skype Technologies S.A.)

"Z:\Spiele\EMpire\SteamApps\common\total war shogun 2\Shogun2.exe" = Z:\Spiele\EMpire\SteamApps\common\total war shogun 2\Shogun2.exe:*:Enabled:Total War: SHOGUN 2 -- (The Creative Assembly Ltd)

"Z:\Spiele\EMpire\SteamApps\common\total war shogun 2\data\encyclopedia\how_to_play.html" = Z:\Spiele\EMpire\SteamApps\common\total war shogun 2\data\encyclopedia\how_to_play.html:*:Enabled:Total War: SHOGUN 2 -- ()

"Z:\Spiele\EMpire\SteamApps\common\total war shogun 2\benchmarks\benchmark_current_settings.bat" = Z:\Spiele\EMpire\SteamApps\common\total war shogun 2\benchmarks\benchmark_current_settings.bat:*:Enabled:Total War: SHOGUN 2 -- ()

"Z:\Spiele\EMpire\SteamApps\common\total war shogun 2\benchmarks\benchmark_specify_properties.bat" = Z:\Spiele\EMpire\SteamApps\common\total war shogun 2\benchmarks\benchmark_specify_properties.bat:*:Enabled:Total War: SHOGUN 2 -- ()

"C:\Programme\Pando Networks\Media Booster\PMB.exe" = C:\Programme\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster -- ()

 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator

"{004C5DA2-2051-4D25-94BA-51CF810C91EB}" = LightScribe System Software  1.12.37.1

"{0138F525-6C8A-333F-A105-14AE030B9A54}" = Visual C++ 9.0 CRT (x86) WinSXS MSM

"{01501EBA-EC35-4F9F-8889-3BE346E5DA13}" = MSXML4 Parser

"{02A10468-2F1C-447C-AD8E-4DEDDEA25AE2}" = Medieval II Total War : Kingdoms : Crusades

"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam

"{109D28C7-FB38-483A-9C91-001CB59E2699}" = EPSON CardMonitor

"{1BE3C987-1C9D-46F0-8470-08F0213EFD11}" = Ski Racing 2006 Patch1

"{23B59ED4-C360-11D7-875B-0090CC005647}" = EPSON PRINT Image Framer Tool2.1

"{2447500B-22D7-47BD-9B13-1A927F43A267}" = Empire Earth

"{26A24AE4-039D-4CA4-87B4-2F83216035FF}" = Java(TM) 6 Update 35

"{2E97F7E8-ABDE-4E0D-B0AD-B6B4BAD89E24}" = Rome - Total War - Gold Edition

"{3248F0A8-6813-11D6-A77B-00B0D0160040}" = Java(TM) 6 Update 4

"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP

"{3D374523-CFDE-461A-827E-2A102E2AB365}" = Star Wars Battlefront II

"{3F5C371F-8EA2-4F25-9D3D-D0B4526E3AEA}" = NVIDIA PhysX

"{4020558F-6186-4A9B-BE59-B1D190D4E368}" = Wildlife Park 2 Platinum

"{447D1817-D8B2-4FCA-A7FC-53BC17694DB0}" = Chess Position Trainer 3.2

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{4C23837C-993E-11D4-9DE0-0060085C158A}" = KODAK Picture CD

"{4F4182DA-3D58-41E3-913D-480F8DA5C863}" = Fritz 12

"{4F64A46D-67F7-4497-AEA2-313D4305A5F6}" = Torchlight

"{5C52CED3-D45C-4DA9-932F-B91BD44BB461}" = Adabas D 13.01.00

"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM

"{65F5B7AF-3363-11D7-BB6B-00018021113F}" = EPSON PhotoQuicker3.5

"{6756C033-2983-42BC-B8EF-DEAD30871B52}" = Apple QuickTime-Installationsprogramm

"{67EDD823-135A-4D59-87BD-950616D6E857}" = EPSON Copy Utility 3

"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD

"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729

"{6C11D561-620B-47DA-A693-4C597F3CDF40}" = EPSON Smart Panel

"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable

"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable

"{73FD7424-15CA-489F-B586-117D34FCBB18}" = World Poker Championship 2

"{7578ADEA-D65F-4C89-A249-B1C88B6FFC20}" = ICQ7.5

"{75983B66-804C-40D1-BA13-64DAF652A6F1}" = Medieval II Total War : Kingdoms : Americas

"{7AEE1963-7001-4C37-BC20-2FAEB74AA41C}" = Medieval II Total War : Kingdoms : Teutonic

"{7B2CC3DF-64FA-44AE-8F57-B0F915147E4F}_is1" = Need For Speed™ World

"{7BF68B83-5057-4D4B-0093-28285EEB9EE3}" = Harry Potter II

"{7D0AEAD8-07FA-4C4D-9347-E7FBC5534B73}" = Sacred 2 - Fallen Angel

"{8047C1BD-BB4D-4C64-A8EF-A34A45D71F04}" = Xpand Rally Xtreme

"{84F7CAD9-2316-4701-B5CA-E90FD60029E9}" = ANNO 1602

"{8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38}" = Microsoft .NET Framework 2.0 Language Pack - DEU

"{8AEA4BE2-2B52-41C0-BB7D-9F2D17AF1031}" = Nero 8

"{8C453F13-6877-4D34-8816-009ABDE306DB}" = Prince of Persia The Sands of Time

"{8CFA9151-6404-409A-AF22-4632D04582FD}" = Assassin's Creed

"{8FA7E81D-6D99-4788-8BE4-D898B346AB2E}" = IndustrieGigant 2

"{90140000-0010-0407-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders  (German) 14

"{90140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010

"{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010

"{90140000-0015-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010

"{90140000-0016-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010

"{90140000-0018-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010

"{90140000-0019-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010

"{90140000-001A-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010

"{90140000-001B-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010

"{90140000-001F-0407-0000-0000000FF1CE}_Office14.PROPLUS_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010

"{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUS_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010

"{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUS_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010

"{90140000-001F-0410-0000-0000000FF1CE}_Office14.PROPLUS_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010

"{90140000-002C-0407-0000-0000000FF1CE}_Office14.PROPLUS_{4275FB46-ABDF-4456-876C-17CF64294D9A}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2010

"{90140000-0044-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010

"{90140000-006E-0407-0000-0000000FF1CE}_Office14.PROPLUS_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010

"{90140000-00A1-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010

"{90140000-00BA-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{91244C78-951F-457C-B7E5-1447A3F79238}_is1" = ANSTOSS 4 Edition 03-04 1.7

"{92606477-9366-4D3B-8AE3-6BE4B29727AB}" = League of Legends

"{93CF9FA6-2A5E-4F8E-923E-F7D8741CB312}" = BabasChess

"{97DDA53A-8346-467A-880C-655E847CC7D3}" = Ski Racing 2006

"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

"{9FB2CE8C-E86C-4368-B3C9-F472898F926E}" = Desert Storm

"{A2433A63-5F5D-40E5-B529-9123C2B3E734}" = Anno 1701

"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2

"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper

"{AA14583F-BD72-4F05-A445-3D7EC7BB8052}" = Nitro PDF Reader 2

"{AB67580-257C-45FF-B8F4-C8C30682091A}_is1" = SIW version 2011.10.29

"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.4) - Deutsch

"{ACCA20B0-C4D1-4BF5-BF21-0A0EB5EF9730}" = REALTEK GbE & FE Ethernet PCI NIC Driver

"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call

"{B8ABD8C7-991E-4A70-B5A3-20C6FC680680}" = LogMeIn Hamachi

"{C0698BDA-0D29-40EE-8570-A31106DF9AB1}" = Medieval II Total War

"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2

"{C48817E7-AA05-4151-A99D-1E1E550CE801}" = EPSON PhotoStarter3.1

"{C917BA70-28A3-4C74-B163-41FD8C8E1A5A}" = Stronghold

"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1

"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1

"{CEA20FED-A903-46A2-B197-789B4456B508}" = HW Monitor

"{CECB5CA0-6908-45EA-B18E-64C61B11DA99}" = Family Tree Maker 2008

"{CEDDEE73-3D36-41C2-AA40-29355D9FBD63}" = Medieval II Total War : Kingdoms : Britannia

"{D24DB8B9-BB6C-4334-9619-BA1C650E13D3}" = Microsoft Primary Interoperability Assemblies 2005

"{D6330700-4083-48DD-A03C-E209674E7836}" = ChessBase Reader

"{D7D50E0C-27DD-4999-BC05-E026B580F93A}" = Electronic Arts Product Registration

"{D9AA99DB-259F-4961-BCAB-08F81856DC39}" = StarOffice 8

"{DC627AE5-A2B1-4D16-AF56-178D10EC3E81}" = KeyMan V3.5 Build 1

"{E11A7A62-FBD9-4575-B874-B482DF213467}" = Fritz9 Computer Bild Spiele

"{EBAE381B-60A6-4863-AA9F-FCAB755BC9E5}" = ScanToWeb

"{EDEA8AB7-7683-4ED2-AA19-E6C078064C0D}" = Microsoft WSE 3.0

"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10

"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219

"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver

"{F6CCD38C-8298-4F7B-91C5-C8DED0B24E5A}" = Fritz 12

"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin

"Adobe Shockwave Player" = Adobe Shockwave Player 11.6

"Autobahn Raser - World Challenge" = Autobahn Raser - World Challenge

"Avira AntiVir Desktop" = Avira Free Antivirus

"Call Graph" = Call Graph

"cayahooantispy" = CA Yahoo! Anti-Spy (remove only)

"CCleaner" = CCleaner

"Clickster16342" = Clickster

"Covert Operations" = Covert Operations

"DAEMON Tools Lite" = DAEMON Tools Lite

"Drakensang_is1" = Drakensang

"EPSON Printer and Utilities" = EPSON-Drucker-Software

"EPSON Scanner" = EPSON Scan

"ESCX3600 Referenzhandbuch" = ESCX3600 Referenzhandbuch

"ESCX3600 Softwarehandbuch" = ESCX3600 Softwarehandbuch

"ESET Online Scanner" = ESET Online Scanner v3

"EXPERTool_is1" = EXPERTool 6.4

"ffdshow_is1" = ffdshow [rev 1738] [2008-01-01]

"FileZilla Client" = FileZilla Client 3.5.1

"Flatcast_is1" = Flatcast Viewer Plugin 5.2.2.454

"Gadwin PrintScreen" = Gadwin PrintScreen

"Highway Pursuit_is1" = Highway Pursuit

"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs

"Imperium Romanum" = Imperium Romanum 1.04 Gold Edition

"InstallShield_{8047C1BD-BB4D-4C64-A8EF-A34A45D71F04}" = Xpand Rally Xtreme

"InstallShield_{CECB5CA0-6908-45EA-B18E-64C61B11DA99}" = Family Tree Maker 2008

"InstallShield_{D7D50E0C-27DD-4999-BC05-E026B580F93A}" = Electronic Arts Product Registration

"Jacked" = Jacked

"Jardinains!" = Jardinains!

"KaM - The Peasants Rebellion" = KaM - The Peasants Rebellion

"LogMeIn Hamachi" = LogMeIn Hamachi

"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.65.0.1400

"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1

"Microsoft .NET Framework 2.0 Language Pack - DEU" = Microsoft .NET Framework 2.0 Language Pack - DEU

"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1

"Mozilla Firefox 16.0.1 (x86 de)" = Mozilla Firefox 16.0.1 (x86 de)

"MozillaMaintenanceService" = Mozilla Maintenance Service

"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs

"NVIDIA Drivers" = NVIDIA Drivers

"Office14.PROPLUS" = Microsoft Office Professional Plus 2010

"PokerStars.net" = PokerStars.net

"ProtectDisc Driver 11" = ProtectDisc Driver, Version 11

"QuickTime" = QuickTime

"RegSupreme_is1" = RegSupreme 1.2

"Reise nach Nordland" = Reise nach Nordland

"RiseofNationsExpansion 1.0" = Rise of Nations Thrones and Patriots

"Rossmann Fotoservice_is1" = Rossmann Fotoservice

"S2TNG" = Die Siedler II - Die nächste Generation

"Sacred_is1" = Sacred

"Sandboxie" = Sandboxie 3.42

"SCHLECKER Foto Digital Service" = SCHLECKER Foto Digital Service

"Scid_is1" = Scid 4.2.2

"SpeedFan" = SpeedFan (remove only)

"SSC Service Utility_is1" = SSC Service Utility v4.30

"Steam App 10500" = Empire: Total War

"Steam App 34330" = Total War: SHOGUN 2

"Summer Challenge_is1" = Summer Challenge

"Swiss-Chess für Windows Demo" = Swiss-Chess für Windows Demo

"TeamSpeak 3 Client" = TeamSpeak 3 Client

"TeamViewer 3" = TeamViewer 3

"Tomb Raider: Underworld" = Tomb Raider: Underworld 1.1

"vShare.tv plugin" = vShare.tv plugin 1.3

"WIC" = Windows Imaging Component

"Winamp" = Winamp

"Windows Media Format Runtime" = Windows Media Format Runtime

"Windows XP Service Pack" = Windows XP Service Pack 3

"WinGimp-2.0_is1" = GIMP 2.6.11

"WinRAR archiver" = WinRAR

"World Racing 2 Spec" = World Racing 2 Spec

"XP Codec Pack" = XP Codec Pack

 
 ========== HKEY_USERS Uninstall List ==========

 

[HKEY_USERS\S-1-5-21-1078081533-1563985344-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"Google Chrome" = Google Chrome

"sc11-DE_SEVENONE_MAIN" = Big Pizza Ski Challenge 11

"tc08-DE_SEVENONE_MAIN" = IKK Direkt Mountainbike Challenge 08

"UnityWebPlayer" = Unity Web Player

 
 ========== Last 20 Event Log Errors ==========

 

[ Application Events ]

Error - 11.10.2012 14:49:19 | Computer Name = PC1 | Source = WmiAdapter | ID = 4099

Description = Dienst konnte nicht geöffnet werden.

 

[ System Events ]

Error - 18.10.2012 11:19:17 | Computer Name = PC1 | Source = Disk | ID = 262151

Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\D.

 

Error - 18.10.2012 11:19:18 | Computer Name = PC1 | Source = Disk | ID = 262151

Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\D.

 

Error - 18.10.2012 15:13:17 | Computer Name = PC1 | Source = Disk | ID = 262151

Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\D.

 

Error - 18.10.2012 15:13:18 | Computer Name = PC1 | Source = Disk | ID = 262151

Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\D.

 

Error - 18.10.2012 15:13:19 | Computer Name = PC1 | Source = Disk | ID = 262151

Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\D.

 

Error - 18.10.2012 15:13:20 | Computer Name = PC1 | Source = Disk | ID = 262151

Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\D.

 

Error - 18.10.2012 15:17:17 | Computer Name = PC1 | Source = Disk | ID = 262151

Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\D.

 

Error - 18.10.2012 15:17:18 | Computer Name = PC1 | Source = Disk | ID = 262151

Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\D.

 

Error - 18.10.2012 15:17:19 | Computer Name = PC1 | Source = Disk | ID = 262151

Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\D.

 

Error - 18.10.2012 15:17:20 | Computer Name = PC1 | Source = Disk | ID = 262151

Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\D.

 

 

< End of report >

Beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

:OTL

FF - prefs.js..browser.search.defaultenginename: "ICQ Search"

FF - prefs.js..browser.search.defaulturl: "http://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.2.9&q="

FF - prefs.js..keyword.URL: "http://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.2.9&q="

FF - user.js - File not found

[2012.10.17 18:14:06 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Mozilla\Firefox\Profiles\1pwc4e03.default\searchplugins\icqplugin-1.xml

[2011.05.07 22:42:44 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Mozilla\Firefox\Profiles\1pwc4e03.default\searchplugins\icqplugin-2.xml

[2011.06.23 22:29:33 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Mozilla\Firefox\Profiles\1pwc4e03.default\searchplugins\icqplugin-3.xml

[2011.07.04 09:34:56 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Mozilla\Firefox\Profiles\1pwc4e03.default\searchplugins\icqplugin-4.xml

[2011.08.18 16:51:05 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Mozilla\Firefox\Profiles\1pwc4e03.default\searchplugins\icqplugin-5.xml

[2011.03.30 15:14:34 | 000,001,042 | ---- | M] () -- C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Mozilla\Firefox\Profiles\1pwc4e03.default\searchplugins\icqplugin.xml

CHR - default_search_provider: ICQ Search (Enabled)

CHR - default_search_provider: search_url = http://search.icq.com/search/results.php?ch_id=osd&q={searchTerms}&icid=chrome

CHR - homepage: http://start.icq.com/

O4 - HKLM..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe File not found

[2010.10.03 12:17:11 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffen\sssss

[2010.10.03 12:16:11 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffen\ssss

@Alternate Data Stream - 85 bytes -> C:\Dokumente und Einstellungen\All Users\Desktop:$SS_DESCRIPTOR_NBVUV6PKDVBGTLPHJKBUK1R0WTPLY2LB3W2PHDEX6J5T4BW9V4DLNNH2V1UY71VU5VVVVVJVTVVJVT

:Files

ipconfig /flushdns /c

:Commands

[purity]

[emptytemp]

[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Code:

 All processes killed

========== OTL ==========

Prefs.js: "ICQ Search" removed from browser.search.defaultenginename

Prefs.js: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.2.9&q=" removed from browser.search.defaulturl

Prefs.js: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.2.9&q=" removed from keyword.URL

C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Mozilla\Firefox\Profiles\1pwc4e03.default\searchplugins\icqplugin-1.xml moved successfully.

C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Mozilla\Firefox\Profiles\1pwc4e03.default\searchplugins\icqplugin-2.xml moved successfully.

C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Mozilla\Firefox\Profiles\1pwc4e03.default\searchplugins\icqplugin-3.xml moved successfully.

C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Mozilla\Firefox\Profiles\1pwc4e03.default\searchplugins\icqplugin-4.xml moved successfully.

C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Mozilla\Firefox\Profiles\1pwc4e03.default\searchplugins\icqplugin-5.xml moved successfully.

C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Mozilla\Firefox\Profiles\1pwc4e03.default\searchplugins\icqplugin.xml moved successfully.

Use Chrome's Settings page to remove the default_search_provider items.

Use Chrome's Settings page to remove the default_search_provider items.

Use Chrome's Settings page to change the HomePage.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\WinampAgent deleted successfully.

C:\Dokumente und Einstellungen\Steffen\sssss moved successfully.

C:\Dokumente und Einstellungen\Steffen\ssss moved successfully.

ADS C:\Dokumente und Einstellungen\All Users\Desktop:$SS_DESCRIPTOR_NBVUV6PKDVBGTLPHJKBUK1R0WTPLY2LB3W2PHDEX6J5T4BW9V4DLNNH2V1UY71VU5VVVVVJVTVVJVT deleted successfully.

========== FILES ==========
 < ipconfig /flushdns /c >

Windows-IP-Konfiguration

Der DNS-Auflösungscache wurde geleert.

C:\Dokumente und Einstellungen\Steffen\Desktop\cmd.bat deleted successfully.

C:\Dokumente und Einstellungen\Steffen\Desktop\cmd.txt deleted successfully.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: Administrator

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

 

User: All Users

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

 

User: LocalService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 6847716 bytes

 

User: NetworkService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

 

User: Steffen

->Temp folder emptied: 1118213314 bytes

->Temporary Internet Files folder emptied: 17866425 bytes

->Java cache emptied: 79608063 bytes

->FireFox cache emptied: 90604900 bytes

->Google Chrome cache emptied: 0 bytes

->Flash cache emptied: 1971530 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 194786 bytes

%systemroot%\System32 .tmp files removed: 2951 bytes

%systemroot%\System32\dllcache .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 4214408 bytes

RecycleBin emptied: 777494 bytes

 

Total Files Cleaned = 1.259,00 mb

 

C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

 

OTL by OldTimer - Version 3.2.69.0 log created on 10192012_153106
 

Files\Folders moved on Reboot...
 

PendingFileRenameOperations files...
 

Registry entries deleted on Reboot...

Rechte Maustaste scheint wieder zu funktionieren...

Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition ( meistens Laufwerk C: ) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtg4nzy0ywy5/settings_2012-09-04.png

Code:

13:12:20.0078 3056  TDSS rootkit removing tool 2.8.13.0 Oct 12 2012 17:26:47

13:12:20.0875 3056  ============================================================

13:12:20.0875 3056  Current date / time: 2012/10/21 13:12:20.0875

13:12:20.0875 3056  SystemInfo:

13:12:20.0875 3056  

13:12:20.0875 3056  OS Version: 5.1.2600 ServicePack: 3.0

13:12:20.0875 3056  Product type: Workstation

13:12:20.0875 3056  ComputerName: PC1

13:12:20.0875 3056  UserName: Steffen

13:12:20.0875 3056  Windows directory: C:\WINDOWS

13:12:20.0875 3056  System windows directory: C:\WINDOWS

13:12:20.0875 3056  Processor architecture: Intel x86

13:12:20.0875 3056  Number of processors: 2

13:12:20.0875 3056  Page size: 0x1000

13:12:20.0875 3056  Boot type: Normal boot

13:12:20.0875 3056  ============================================================

13:12:21.0765 3056  Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054

13:12:21.0765 3056  ============================================================

13:12:21.0765 3056  \Device\Harddisk0\DR0:

13:12:21.0781 3056  MBR partitions:

13:12:21.0781 3056  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0xC7FF53F

13:12:21.0781 3056  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0xC7FF57E, BlocksNum 0x18C2E143

13:12:21.0781 3056  ============================================================

13:12:21.0796 3056  C: <-> \Device\Harddisk0\DR0\Partition1

13:12:21.0843 3056  Z: <-> \Device\Harddisk0\DR0\Partition2

13:12:21.0843 3056  ============================================================

13:12:21.0843 3056  Initialize success

13:12:21.0843 3056  ============================================================

13:13:13.0390 2524  ============================================================

13:13:13.0390 2524  Scan started

13:13:13.0390 2524  Mode: Manual; SigCheck; TDLFS; 

13:13:13.0390 2524  ============================================================

13:13:13.0953 2524  ================ Scan system memory ========================

13:13:13.0953 2524  System memory - ok

13:13:13.0953 2524  ================ Scan services =============================

13:13:14.0031 2524  Abiosdsk - ok

13:13:14.0031 2524  abp480n5 - ok

13:13:14.0046 2524  [ 27F954120BABB8A00F8745D8F5BC9B82 ] acedrv11        C:\WINDOWS\system32\drivers\acedrv11.sys

13:13:14.0156 2524  acedrv11 - ok

13:13:14.0171 2524  [ AC407F1A62C3A300B4F2B5A9F1D55B2C ] ACPI            C:\WINDOWS\system32\DRIVERS\ACPI.sys

13:13:14.0796 2524  ACPI - ok

13:13:14.0812 2524  [ 9E1CA3160DAFB159CA14F83B1E317F75 ] ACPIEC          C:\WINDOWS\system32\drivers\ACPIEC.sys

13:13:14.0875 2524  ACPIEC - ok

13:13:14.0890 2524  adpu160m - ok

13:13:14.0906 2524  [ 8BED39E3C35D6A489438B8141717A557 ] aec             C:\WINDOWS\system32\drivers\aec.sys

13:13:14.0984 2524  aec - ok

13:13:15.0015 2524  [ 1E44BC1E83D8FD2305F8D452DB109CF9 ] AFD             C:\WINDOWS\System32\drivers\afd.sys

13:13:15.0046 2524  AFD - ok

13:13:15.0046 2524  Aha154x - ok

13:13:15.0062 2524  aic78u2 - ok

13:13:15.0062 2524  aic78xx - ok

13:13:15.0078 2524  [ 738D80CC01D7BC7584BE917B7F544394 ] Alerter         C:\WINDOWS\system32\alrsvc.dll

13:13:15.0156 2524  Alerter - ok

13:13:15.0187 2524  [ 190CD73D4984F94D823F9444980513E5 ] ALG             C:\WINDOWS\System32\alg.exe

13:13:15.0250 2524  ALG - ok

13:13:15.0250 2524  AliIde - ok

13:13:15.0250 2524  amsint - ok

13:13:15.0406 2524  [ 466A0D95960DAD3222C896D2CEA99993 ] AntiVirSchedulerService C:\Programme\Avira\AntiVir Desktop\sched.exe

13:13:15.0406 2524  AntiVirSchedulerService - ok

13:13:15.0437 2524  [ A489BE6BB0AA1FF406B488B60542314B ] AntiVirService  C:\Programme\Avira\AntiVir Desktop\avguard.exe

13:13:15.0453 2524  AntiVirService - ok

13:13:15.0453 2524  asc - ok

13:13:15.0453 2524  asc3350p - ok

13:13:15.0453 2524  asc3550 - ok

13:13:15.0515 2524  [ 0E5E4957549056E2BF2C49F4F6B601AD ] aspnet_state    C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe

13:13:15.0546 2524  aspnet_state - ok

13:13:15.0562 2524  [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac        C:\WINDOWS\system32\DRIVERS\asyncmac.sys

13:13:15.0625 2524  AsyncMac - ok

13:13:15.0656 2524  [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi           C:\WINDOWS\system32\DRIVERS\atapi.sys

13:13:15.0718 2524  atapi - ok

13:13:15.0718 2524  Atdisk - ok

13:13:15.0750 2524  [ 6E996CF8459A2594E0E9609D0E34D41F ] atksgt          C:\WINDOWS\system32\DRIVERS\atksgt.sys

13:13:15.0750 2524  atksgt ( UnsignedFile.Multi.Generic ) - warning

13:13:15.0750 2524  atksgt - detected UnsignedFile.Multi.Generic (1)

13:13:15.0765 2524  [ 9916C1225104BA14794209CFA8012159 ] Atmarpc         C:\WINDOWS\system32\DRIVERS\atmarpc.sys

13:13:15.0828 2524  Atmarpc - ok

13:13:15.0859 2524  [ 58ED0D5452DF7BE732193E7999C6B9A4 ] AudioSrv        C:\WINDOWS\System32\audiosrv.dll

13:13:15.0937 2524  AudioSrv - ok

13:13:15.0953 2524  [ D9F724AA26C010A217C97606B160ED68 ] audstub         C:\WINDOWS\system32\DRIVERS\audstub.sys

13:13:16.0015 2524  audstub - ok

13:13:16.0015 2524  [ D5541F0AFB767E85FC412FC609D96A74 ] avgntflt        C:\WINDOWS\system32\DRIVERS\avgntflt.sys

13:13:16.0031 2524  avgntflt - ok

13:13:16.0046 2524  [ 7D967A682D4694DF7FA57D63A2DB01FE ] avipbb          C:\WINDOWS\system32\DRIVERS\avipbb.sys

13:13:16.0046 2524  avipbb - ok

13:13:16.0062 2524  [ 271CFD1A989209B1964E24D969552BF7 ] avkmgr          C:\WINDOWS\system32\DRIVERS\avkmgr.sys

13:13:16.0062 2524  avkmgr - ok

13:13:16.0093 2524  [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep            C:\WINDOWS\system32\drivers\Beep.sys

13:13:16.0156 2524  Beep - ok

13:13:16.0171 2524  [ BE5D50529799B9BAB6BE879EC768B6CF ] BIOS            C:\WINDOWS\system32\drivers\BIOS.sys

13:13:16.0171 2524  BIOS ( UnsignedFile.Multi.Generic ) - warning

13:13:16.0171 2524  BIOS - detected UnsignedFile.Multi.Generic (1)

13:13:16.0203 2524  [ D6F603772A789BB3228F310D650B8BD1 ] BITS            C:\WINDOWS\system32\qmgr.dll

13:13:16.0296 2524  BITS - ok

13:13:16.0328 2524  [ B71549F23736ADF83A571061C47777FD ] Browser         C:\WINDOWS\System32\browser.dll

13:13:16.0359 2524  Browser - ok

13:13:16.0359 2524  [ 9383FFA2AAD55F6CA4831ADDD0EDF230 ] BS_I2cIo        C:\WINDOWS\system32\drivers\BS_I2cIo.sys

13:13:16.0375 2524  BS_I2cIo ( UnsignedFile.Multi.Generic ) - warning

13:13:16.0375 2524  BS_I2cIo - detected UnsignedFile.Multi.Generic (1)

13:13:16.0406 2524  [ 04E1C782CF14B7282EBC633B0FD3ED16 ] Cardex          C:\WINDOWS\system32\drivers\TBPANEL.SYS

13:13:16.0406 2524  Cardex - ok

13:13:16.0421 2524  [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k         C:\WINDOWS\system32\drivers\cbidf2k.sys

13:13:16.0500 2524  cbidf2k - ok

13:13:16.0515 2524  cd20xrnt - ok

13:13:16.0531 2524  [ C1B486A7658353D33A10CC15211A873B ] Cdaudio         C:\WINDOWS\system32\drivers\Cdaudio.sys

13:13:16.0593 2524  Cdaudio - ok

13:13:16.0625 2524  [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs            C:\WINDOWS\system32\drivers\Cdfs.sys

13:13:16.0703 2524  Cdfs - ok

13:13:16.0718 2524  [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom           C:\WINDOWS\system32\DRIVERS\cdrom.sys

13:13:16.0781 2524  Cdrom - ok

13:13:16.0781 2524  [ 970DDDEBAA177AD1F738A24C8D9C0735 ] Ch2kPS2         C:\WINDOWS\system32\DRIVERS\Ch2kPS2.sys

13:13:16.0828 2524  Ch2kPS2 - ok

13:13:16.0828 2524  Changer - ok

13:13:16.0859 2524  [ BB116887D46A2B106846F02E226071BB ] Cherry Device Interface C:\Programme\Cherry\CDI\cdi.exe

13:13:16.0875 2524  Cherry Device Interface ( UnsignedFile.Multi.Generic ) - warning

13:13:16.0875 2524  Cherry Device Interface - detected UnsignedFile.Multi.Generic (1)

13:13:16.0890 2524  [ 28E3040D1F1CA2008CD6B29DFEBC9A5E ] CiSvc           C:\WINDOWS\system32\cisvc.exe

13:13:16.0953 2524  CiSvc - ok

13:13:16.0984 2524  [ 778A30ED3C134EB7E406AFC407E9997D ] ClipSrv         C:\WINDOWS\system32\clipsrv.exe

13:13:17.0062 2524  ClipSrv - ok

13:13:17.0093 2524  [ D87ACAED61E417BBA546CED5E7E36D9C ] clr_optimization_v2.0.50727_32 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

13:13:17.0140 2524  clr_optimization_v2.0.50727_32 - ok

13:13:17.0140 2524  CmdIde - ok

13:13:17.0156 2524  COMSysApp - ok

13:13:17.0156 2524  Cpqarray - ok

13:13:17.0171 2524  [ 611F824E5C703A5A899F84C5F1699E4D ] CryptSvc        C:\WINDOWS\System32\cryptsvc.dll

13:13:17.0250 2524  CryptSvc - ok

13:13:17.0250 2524  dac2w2k - ok

13:13:17.0250 2524  dac960nt - ok

13:13:17.0281 2524  [ 3127AFBF2C1ED0AB14A1BBB7AAECB85B ] DcomLaunch      C:\WINDOWS\system32\rpcss.dll

13:13:17.0343 2524  DcomLaunch - ok

13:13:17.0375 2524  [ C29A1C9B75BA38FA37F8C44405DEC360 ] Dhcp            C:\WINDOWS\System32\dhcpcsvc.dll

13:13:17.0453 2524  Dhcp - ok

13:13:17.0468 2524  [ 044452051F3E02E7963599FC8F4F3E25 ] Disk            C:\WINDOWS\system32\DRIVERS\disk.sys

13:13:17.0546 2524  Disk - ok

13:13:17.0546 2524  dmadmin - ok

13:13:17.0562 2524  [ 0DCFC8395A99FECBB1EF771CEC7FE4EA ] dmboot          C:\WINDOWS\system32\drivers\dmboot.sys

13:13:17.0656 2524  dmboot - ok

13:13:17.0671 2524  [ 53720AB12B48719D00E327DA470A619A ] dmio            C:\WINDOWS\system32\drivers\dmio.sys

13:13:17.0750 2524  dmio - ok

13:13:17.0765 2524  [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload          C:\WINDOWS\system32\drivers\dmload.sys

13:13:17.0828 2524  dmload - ok

13:13:17.0859 2524  [ 25C83FFBBA13B554EB6D59A9B2E2EE78 ] dmserver        C:\WINDOWS\System32\dmserver.dll

13:13:17.0921 2524  dmserver - ok

13:13:17.0937 2524  [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic          C:\WINDOWS\system32\drivers\DMusic.sys

13:13:18.0015 2524  DMusic - ok

13:13:18.0031 2524  [ 407F3227AC618FD1CA54B335B083DE07 ] Dnscache        C:\WINDOWS\System32\dnsrslvr.dll

13:13:18.0109 2524  Dnscache - ok

13:13:18.0140 2524  [ 676E36C4FF5BCEA1900F44182B9723E6 ] Dot3svc         C:\WINDOWS\System32\dot3svc.dll

13:13:18.0218 2524  Dot3svc - ok

13:13:18.0218 2524  dpti2o - ok

13:13:18.0234 2524  [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud         C:\WINDOWS\system32\drivers\drmkaud.sys

13:13:18.0312 2524  drmkaud - ok

13:13:18.0328 2524  [ 4E4F2FDDAB0A0736D7671134DCCE91FB ] EapHost         C:\WINDOWS\System32\eapsvc.dll

13:13:18.0390 2524  EapHost - ok

13:13:18.0406 2524  [ 877C18558D70587AA7823A1A308AC96B ] ERSvc           C:\WINDOWS\System32\ersvc.dll

13:13:18.0484 2524  ERSvc - ok

13:13:18.0500 2524  [ A3EDBE9053889FB24AB22492472B39DC ] Eventlog        C:\WINDOWS\system32\services.exe

13:13:18.0515 2524  Eventlog - ok

13:13:18.0546 2524  [ AF4F6B5739D18CA7972AB53E091CBC74 ] EventSystem     C:\WINDOWS\system32\es.dll

13:13:18.0578 2524  EventSystem - ok

13:13:18.0609 2524  [ 38D332A6D56AF32635675F132548343E ] Fastfat         C:\WINDOWS\system32\drivers\Fastfat.sys

13:13:18.0718 2524  Fastfat - ok

13:13:18.0734 2524  [ 2DB7D303C36DDD055215052F118E8E75 ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll

13:13:18.0765 2524  FastUserSwitchingCompatibility - ok

13:13:18.0781 2524  [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc             C:\WINDOWS\system32\DRIVERS\fdc.sys

13:13:18.0843 2524  Fdc - ok

13:13:18.0859 2524  [ B0678A548587C5F1967B0D70BACAD6C1 ] Fips            C:\WINDOWS\system32\drivers\Fips.sys

13:13:18.0921 2524  Fips - ok

13:13:18.0921 2524  [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk        C:\WINDOWS\system32\DRIVERS\flpydisk.sys

13:13:19.0000 2524  Flpydisk - ok

13:13:19.0015 2524  [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr          C:\WINDOWS\system32\drivers\fltmgr.sys

13:13:19.0078 2524  FltMgr - ok

13:13:19.0140 2524  [ 8BA7C024070F2B7FDD98ED8A4BA41789 ] FontCache3.0.0.0 C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe

13:13:19.0140 2524  FontCache3.0.0.0 - ok

13:13:19.0156 2524  [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec          C:\WINDOWS\system32\drivers\Fs_Rec.sys

13:13:19.0218 2524  Fs_Rec - ok

13:13:19.0234 2524  [ 8F1955CE42E1484714B542F341647778 ] Ftdisk          C:\WINDOWS\system32\DRIVERS\ftdisk.sys

13:13:19.0296 2524  Ftdisk - ok

13:13:19.0328 2524  [ 77EBF3E9386DAA51551AF429052D88D0 ] giveio          C:\WINDOWS\system32\giveio.sys

13:13:19.0343 2524  giveio ( UnsignedFile.Multi.Generic ) - warning

13:13:19.0343 2524  giveio - detected UnsignedFile.Multi.Generic (1)

13:13:19.0359 2524  [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc             C:\WINDOWS\system32\DRIVERS\msgpc.sys

13:13:19.0421 2524  Gpc - ok

13:13:19.0468 2524  [ 8F0DE4FEF8201E306F9938B0905AC96A ] gupdate         C:\Programme\Google\Update\GoogleUpdate.exe

13:13:19.0484 2524  gupdate - ok

13:13:19.0484 2524  [ 8F0DE4FEF8201E306F9938B0905AC96A ] gupdatem        C:\Programme\Google\Update\GoogleUpdate.exe

13:13:19.0500 2524  gupdatem - ok

13:13:19.0515 2524  [ 833051C6C6C42117191935F734CFBD97 ] hamachi         C:\WINDOWS\system32\DRIVERS\hamachi.sys

13:13:19.0515 2524  hamachi - ok

13:13:19.0593 2524  [ DA1B48FDE74125128D0D846A3701D344 ] Hamachi2Svc     C:\Programme\LogMeIn Hamachi\hamachi-2.exe

13:13:19.0640 2524  Hamachi2Svc - ok

13:13:19.0656 2524  [ 573C7D0A32852B48F3058CFD8026F511 ] HDAudBus        C:\WINDOWS\system32\DRIVERS\HDAudBus.sys

13:13:19.0734 2524  HDAudBus - ok

13:13:19.0765 2524  [ CB66BF85BF599BEFD6C6A57C2E20357F ] helpsvc         C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll

13:13:19.0828 2524  helpsvc - ok

13:13:19.0859 2524  [ CCF82C5EC8A7326C3066DE870C06DAF1 ] HidUsb          C:\WINDOWS\system32\DRIVERS\hidusb.sys

13:13:19.0921 2524  HidUsb - ok

13:13:19.0968 2524  [ ED29F14101523A6E0E808107405D452C ] hkmsvc          C:\WINDOWS\System32\kmsvc.dll

13:13:20.0031 2524  hkmsvc - ok

13:13:20.0031 2524  hpn - ok

13:13:20.0062 2524  [ F80A415EF82CD06FFAF0D971528EAD38 ] HTTP            C:\WINDOWS\system32\Drivers\HTTP.sys

13:13:20.0109 2524  HTTP - ok

13:13:20.0125 2524  [ 9E4ADB854CEBCFB81A4B36718FEECD16 ] HTTPFilter      C:\WINDOWS\System32\w3ssl.dll

13:13:20.0187 2524  HTTPFilter - ok

13:13:20.0203 2524  i2omgmt - ok

13:13:20.0203 2524  i2omp - ok

13:13:20.0218 2524  [ E283B97CFBEB86C1D86BAED5F7846A92 ] i8042prt        C:\WINDOWS\system32\DRIVERS\i8042prt.sys

13:13:20.0281 2524  i8042prt - ok

13:13:20.0343 2524  [ C01AC32DC5C03076CFB852CB5DA5229C ] idsvc           C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe

13:13:20.0390 2524  idsvc - ok

13:13:20.0406 2524  [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi           C:\WINDOWS\system32\DRIVERS\imapi.sys

13:13:20.0468 2524  Imapi - ok

13:13:20.0500 2524  [ D4B413AA210C21E46AEDD2BA5B68D38E ] ImapiService    C:\WINDOWS\system32\imapi.exe

13:13:20.0578 2524  ImapiService - ok

13:13:20.0578 2524  ini910u - ok

13:13:20.0671 2524  [ C464CF7A58C011A70188602B55C64E99 ] IntcAzAudAddService C:\WINDOWS\system32\drivers\RtkHDAud.sys

13:13:20.0828 2524  IntcAzAudAddService - ok

13:13:20.0828 2524  IntelIde - ok

13:13:20.0843 2524  [ 4C7D2750158ED6E7AD642D97BFFAE351 ] intelppm        C:\WINDOWS\system32\DRIVERS\intelppm.sys

13:13:20.0921 2524  intelppm - ok

13:13:20.0937 2524  [ 3BB22519A194418D5FEC05D800A19AD0 ] Ip6Fw           C:\WINDOWS\system32\drivers\ip6fw.sys

13:13:21.0000 2524  Ip6Fw - ok

13:13:21.0015 2524  [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver  C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys

13:13:21.0078 2524  IpFilterDriver - ok

13:13:21.0109 2524  [ B87AB476DCF76E72010632B5550955F5 ] IpInIp          C:\WINDOWS\system32\DRIVERS\ipinip.sys

13:13:21.0171 2524  IpInIp - ok

13:13:21.0187 2524  [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat           C:\WINDOWS\system32\DRIVERS\ipnat.sys

13:13:21.0250 2524  IpNat - ok

13:13:21.0265 2524  [ 23C74D75E36E7158768DD63D92789A91 ] IPSec           C:\WINDOWS\system32\DRIVERS\ipsec.sys

13:13:21.0328 2524  IPSec - ok

13:13:21.0343 2524  [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM          C:\WINDOWS\system32\DRIVERS\irenum.sys

13:13:21.0421 2524  IRENUM - ok

13:13:21.0437 2524  [ 6DFB88F64135C525433E87648BDA30DE ] isapnp          C:\WINDOWS\system32\DRIVERS\isapnp.sys

13:13:21.0500 2524  isapnp - ok

13:13:21.0578 2524  [ 0E410EDC8D0527801B899CF29E60597C ] JavaQuickStarterService C:\Programme\Java\jre6\bin\jqs.exe

13:13:21.0593 2524  JavaQuickStarterService - ok

13:13:21.0609 2524  [ 1704D8C4C8807B889E43C649B478A452 ] Kbdclass        C:\WINDOWS\system32\DRIVERS\kbdclass.sys

13:13:21.0687 2524  Kbdclass - ok

13:13:21.0718 2524  [ 692BCF44383D056AED41B045A323D378 ] kmixer          C:\WINDOWS\system32\drivers\kmixer.sys

13:13:21.0796 2524  kmixer - ok

13:13:21.0812 2524  [ B467646C54CC746128904E1654C750C1 ] KSecDD          C:\WINDOWS\system32\drivers\KSecDD.sys

13:13:21.0843 2524  KSecDD - ok

13:13:21.0859 2524  [ 2BBDCB79900990F0716DFCB714E72DE7 ] lanmanserver    C:\WINDOWS\System32\srvsvc.dll

13:13:21.0890 2524  lanmanserver - ok

13:13:21.0906 2524  [ 1869B14B06B44B44AF70548E1EA3303F ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll

13:13:21.0921 2524  lanmanworkstation - ok

13:13:21.0921 2524  lbrtfdc - ok

13:13:21.0968 2524  [ C215E09622118383B236DD56C2065183 ] LightScribeService C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe

13:13:21.0968 2524  LightScribeService ( UnsignedFile.Multi.Generic ) - warning

13:13:21.0968 2524  LightScribeService - detected UnsignedFile.Multi.Generic (1)

13:13:21.0984 2524  [ 975B6CF65F44E95883F3855BAE8CECAF ] lirsgt          C:\WINDOWS\system32\DRIVERS\lirsgt.sys

13:13:22.0000 2524  lirsgt ( UnsignedFile.Multi.Generic ) - warning

13:13:22.0000 2524  lirsgt - detected UnsignedFile.Multi.Generic (1)

13:13:22.0015 2524  [ 636714B7D43C8D0C80449123FD266920 ] LmHosts         C:\WINDOWS\System32\lmhsvc.dll

13:13:22.0078 2524  LmHosts - ok

13:13:22.0109 2524  [ 11F714F85530A2BD134074DC30E99FCA ] MDM             C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE

13:13:22.0109 2524  MDM - ok

13:13:22.0125 2524  [ B7550A7107281D170CE85524B1488C98 ] Messenger       C:\WINDOWS\System32\msgsvc.dll

13:13:22.0203 2524  Messenger - ok

13:13:22.0250 2524  Microsoft SharePoint Workspace Audit Service - ok

13:13:22.0265 2524  [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd           C:\WINDOWS\system32\drivers\mnmdd.sys

13:13:22.0328 2524  mnmdd - ok

13:13:22.0359 2524  [ C2F1D365FD96791B037EE504868065D3 ] mnmsrvc         C:\WINDOWS\system32\mnmsrvc.exe

13:13:22.0421 2524  mnmsrvc - ok

13:13:22.0437 2524  [ 6FB74EBD4EC57A6F1781DE3852CC3362 ] Modem           C:\WINDOWS\system32\drivers\Modem.sys

13:13:22.0515 2524  Modem - ok

13:13:22.0531 2524  [ B24CE8005DEAB254C0251E15CB71D802 ] Mouclass        C:\WINDOWS\system32\DRIVERS\mouclass.sys

13:13:22.0593 2524  Mouclass - ok

13:13:22.0625 2524  [ 66A6F73C74E1791464160A7065CE711A ] mouhid          C:\WINDOWS\system32\DRIVERS\mouhid.sys

13:13:22.0703 2524  mouhid - ok

13:13:22.0703 2524  [ A80B9A0BAD1B73637DBCBBA7DF72D3FD ] MountMgr        C:\WINDOWS\system32\drivers\MountMgr.sys

13:13:22.0765 2524  MountMgr - ok

13:13:22.0812 2524  [ 4D7F2682D29B92A6251B17957AA0B985 ] MozillaMaintenance C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe

13:13:22.0828 2524  MozillaMaintenance - ok

13:13:22.0828 2524  mraid35x - ok

13:13:22.0843 2524  [ 11D42BB6206F33FBB3BA0288D3EF81BD ] MRxDAV          C:\WINDOWS\system32\DRIVERS\mrxdav.sys

13:13:22.0921 2524  MRxDAV - ok

13:13:22.0953 2524  [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0 ] MRxSmb          C:\WINDOWS\system32\DRIVERS\mrxsmb.sys

13:13:22.0984 2524  MRxSmb - ok

13:13:23.0015 2524  [ 35A031AF38C55F92D28AA03EE9F12CC9 ] MSDTC           C:\WINDOWS\system32\msdtc.exe

13:13:23.0078 2524  MSDTC - ok

13:13:23.0078 2524  [ C941EA2454BA8350021D774DAF0F1027 ] Msfs            C:\WINDOWS\system32\drivers\Msfs.sys

13:13:23.0156 2524  Msfs - ok

13:13:23.0156 2524  MSIServer - ok

13:13:23.0171 2524  [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV         C:\WINDOWS\system32\drivers\MSKSSRV.sys

13:13:23.0234 2524  MSKSSRV - ok

13:13:23.0234 2524  [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK        C:\WINDOWS\system32\drivers\MSPCLOCK.sys

13:13:23.0296 2524  MSPCLOCK - ok

13:13:23.0312 2524  [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM           C:\WINDOWS\system32\drivers\MSPQM.sys

13:13:23.0390 2524  MSPQM - ok

13:13:23.0406 2524  [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios        C:\WINDOWS\system32\DRIVERS\mssmbios.sys

13:13:23.0468 2524  mssmbios - ok

13:13:23.0500 2524  [ DE6A75F5C270E756C5508D94B6CF68F5 ] Mup             C:\WINDOWS\system32\drivers\Mup.sys

13:13:23.0515 2524  Mup - ok

13:13:23.0546 2524  [ 46BB15AE2AC7D025D6D2567B876817BD ] napagent        C:\WINDOWS\System32\qagentrt.dll

13:13:23.0625 2524  napagent - ok

13:13:23.0625 2524  [ 1DF7F42665C94B825322FAE71721130D ] NDIS            C:\WINDOWS\system32\drivers\NDIS.sys

13:13:23.0703 2524  NDIS - ok

13:13:23.0718 2524  [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi        C:\WINDOWS\system32\DRIVERS\ndistapi.sys

13:13:23.0734 2524  NdisTapi - ok

13:13:23.0750 2524  [ F927A4434C5028758A842943EF1A3849 ] Ndisuio         C:\WINDOWS\system32\DRIVERS\ndisuio.sys

13:13:23.0812 2524  Ndisuio - ok

13:13:23.0828 2524  [ EDC1531A49C80614B2CFDA43CA8659AB ] NdisWan         C:\WINDOWS\system32\DRIVERS\ndiswan.sys

13:13:23.0906 2524  NdisWan - ok

13:13:23.0921 2524  [ 9282BD12DFB069D3889EB3FCC1000A9B ] NDProxy         C:\WINDOWS\system32\drivers\NDProxy.sys

13:13:23.0953 2524  NDProxy - ok

13:13:23.0968 2524  [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS         C:\WINDOWS\system32\DRIVERS\netbios.sys

13:13:24.0031 2524  NetBIOS - ok

13:13:24.0031 2524  [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT           C:\WINDOWS\system32\DRIVERS\netbt.sys

13:13:24.0109 2524  NetBT - ok

13:13:24.0125 2524  [ 8ACE4251BFFD09CE75679FE940E996CC ] NetDDE          C:\WINDOWS\system32\netdde.exe

13:13:24.0203 2524  NetDDE - ok

13:13:24.0203 2524  [ 8ACE4251BFFD09CE75679FE940E996CC ] NetDDEdsdm      C:\WINDOWS\system32\netdde.exe

13:13:24.0265 2524  NetDDEdsdm - ok

13:13:24.0281 2524  [ AFB8261B56CBA0D86AEB6DF682AF9785 ] Netlogon        C:\WINDOWS\system32\lsass.exe

13:13:24.0343 2524  Netlogon - ok

13:13:24.0343 2524  [ E6D88F1F6745BF00B57E7855A2AB696C ] Netman          C:\WINDOWS\System32\netman.dll

13:13:24.0421 2524  Netman - ok

13:13:24.0437 2524  [ D34612C5D02D026535B3095D620626AE ] NetTcpPortSharing C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe

13:13:24.0453 2524  NetTcpPortSharing - ok

13:13:24.0515 2524  [ 0A4B790EB15F813A66D1A48AB2C96471 ] NitroReaderDriverReadSpool2 C:\Programme\Nitro PDF\Reader 2\NitroPDFReaderDriverService2.exe

13:13:24.0515 2524  NitroReaderDriverReadSpool2 - ok

13:13:24.0546 2524  [ F1B67B6B0751AE0E6E964B02821206A3 ] Nla             C:\WINDOWS\System32\mswsock.dll

13:13:24.0578 2524  Nla - ok

13:13:24.0640 2524  [ 6EF0506CE1F553E9BD085645933C8686 ] NMIndexingService C:\Programme\Gemeinsame Dateien\Nero\Lib\NMIndexingService.exe

13:13:24.0671 2524  NMIndexingService - ok

13:13:24.0687 2524  [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs            C:\WINDOWS\system32\drivers\Npfs.sys

13:13:24.0750 2524  Npfs - ok

13:13:24.0781 2524  [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs            C:\WINDOWS\system32\drivers\Ntfs.sys

13:13:24.0875 2524  Ntfs - ok

13:13:24.0875 2524  [ AFB8261B56CBA0D86AEB6DF682AF9785 ] NtLmSsp         C:\WINDOWS\system32\lsass.exe

13:13:24.0937 2524  NtLmSsp - ok

13:13:24.0968 2524  [ 56AF4064996FA5BAC9C449B1514B4770 ] NtmsSvc         C:\WINDOWS\system32\ntmssvc.dll

13:13:25.0062 2524  NtmsSvc - ok

13:13:25.0078 2524  [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null            C:\WINDOWS\system32\drivers\Null.sys

13:13:25.0140 2524  Null - ok

13:13:25.0265 2524  [ 83780F3A86D2804912F22F6E37CD2254 ] nv              C:\WINDOWS\system32\DRIVERS\nv4_mini.sys

13:13:25.0437 2524  nv - ok

13:13:25.0453 2524  [ 42321AC5448078131903B272E6C49024 ] NVSvc           C:\WINDOWS\system32\nvsvc32.exe

13:13:25.0484 2524  NVSvc - ok

13:13:25.0500 2524  [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt        C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys

13:13:25.0578 2524  NwlnkFlt - ok

13:13:25.0578 2524  [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd        C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys

13:13:25.0656 2524  NwlnkFwd - ok

13:13:25.0703 2524  [ 9D10F99A6712E28F8ACD5641E3A7EA6B ] ose             C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE

13:13:25.0703 2524  ose - ok

13:13:25.0812 2524  [ 358A9CCA612C68EB2F07DDAD4CE1D8D7 ] osppsvc         C:\Programme\Gemeinsame Dateien\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

13:13:25.0953 2524  osppsvc - ok

13:13:25.0984 2524  [ F84785660305B9B903FB3BCA8BA29837 ] Parport         C:\WINDOWS\system32\DRIVERS\parport.sys

13:13:26.0046 2524  Parport - ok

13:13:26.0046 2524  [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr         C:\WINDOWS\system32\drivers\PartMgr.sys

13:13:26.0125 2524  PartMgr - ok

13:13:26.0140 2524  [ C2BF987829099A3EAA2CA6A0A90ECB4F ] ParVdm          C:\WINDOWS\system32\drivers\ParVdm.sys

13:13:26.0218 2524  ParVdm - ok

13:13:26.0234 2524  [ 387E8DEDC343AA2D1EFBC30580273ACD ] PCI             C:\WINDOWS\system32\DRIVERS\pci.sys

13:13:26.0312 2524  PCI - ok

13:13:26.0312 2524  PCIDump - ok

13:13:26.0328 2524  [ 59BA86D9A61CBCF4DF8E598C331F5B82 ] PCIIde          C:\WINDOWS\system32\DRIVERS\pciide.sys

13:13:26.0390 2524  PCIIde - ok

13:13:26.0406 2524  [ A2A966B77D61847D61A3051DF87C8C97 ] Pcmcia          C:\WINDOWS\system32\drivers\Pcmcia.sys

13:13:26.0468 2524  Pcmcia - ok

13:13:26.0468 2524  PDCOMP - ok

13:13:26.0484 2524  PDFRAME - ok

13:13:26.0484 2524  PDRELI - ok

13:13:26.0484 2524  PDRFRAME - ok

13:13:26.0484 2524  perc2 - ok

13:13:26.0484 2524  perc2hib - ok

13:13:26.0500 2524  [ A3EDBE9053889FB24AB22492472B39DC ] PlugPlay        C:\WINDOWS\system32\services.exe

13:13:26.0531 2524  PlugPlay - ok

13:13:26.0546 2524  [ AFB8261B56CBA0D86AEB6DF682AF9785 ] PolicyAgent     C:\WINDOWS\system32\lsass.exe

13:13:26.0593 2524  PolicyAgent - ok

13:13:26.0640 2524  [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport    C:\WINDOWS\system32\DRIVERS\raspptp.sys

13:13:26.0703 2524  PptpMiniport - ok

13:13:26.0703 2524  [ AFB8261B56CBA0D86AEB6DF682AF9785 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe

13:13:26.0765 2524  ProtectedStorage - ok

13:13:26.0765 2524  [ 09298EC810B07E5D582CB3A3F9255424 ] PSched          C:\WINDOWS\system32\DRIVERS\psched.sys

13:13:26.0843 2524  PSched - ok

13:13:26.0859 2524  [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink         C:\WINDOWS\system32\DRIVERS\ptilink.sys

13:13:26.0937 2524  Ptilink - ok

13:13:26.0953 2524  [ D86B4A68565E444D76457F14172C875A ] PxHelp20        C:\WINDOWS\system32\Drivers\PxHelp20.sys

13:13:26.0968 2524  PxHelp20 - ok

13:13:26.0968 2524  ql1080 - ok

13:13:26.0968 2524  Ql10wnt - ok

13:13:26.0968 2524  ql12160 - ok

13:13:26.0984 2524  ql1240 - ok

13:13:26.0984 2524  ql1280 - ok

13:13:27.0000 2524  [ 0087F01D35A65B32393CC8BBA46EE4A6 ] QV2KUX          C:\WINDOWS\system32\DRIVERS\qv2kux.sys

13:13:27.0062 2524  QV2KUX - ok

13:13:27.0093 2524  [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd          C:\WINDOWS\system32\DRIVERS\rasacd.sys

13:13:27.0281 2524  RasAcd - ok

13:13:27.0296 2524  [ F5BA6CACCDB66C8F048E867563203246 ] RasAuto         C:\WINDOWS\System32\rasauto.dll

13:13:27.0375 2524  RasAuto - ok

13:13:27.0375 2524  [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp         C:\WINDOWS\system32\DRIVERS\rasl2tp.sys

13:13:27.0437 2524  Rasl2tp - ok

13:13:27.0468 2524  [ F9A7B66EA345726EDB5862A46B1ECCD5 ] RasMan          C:\WINDOWS\System32\rasmans.dll

13:13:27.0531 2524  RasMan - ok

13:13:27.0546 2524  [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe        C:\WINDOWS\system32\DRIVERS\raspppoe.sys

13:13:27.0609 2524  RasPppoe - ok

13:13:27.0609 2524  [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti          C:\WINDOWS\system32\DRIVERS\raspti.sys

13:13:27.0687 2524  Raspti - ok

13:13:27.0703 2524  [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss           C:\WINDOWS\system32\DRIVERS\rdbss.sys

13:13:27.0781 2524  Rdbss - ok

13:13:27.0781 2524  [ 4912D5B403614CE99C28420F75353332 ] RDPCDD          C:\WINDOWS\system32\DRIVERS\RDPCDD.sys

13:13:27.0843 2524  RDPCDD - ok

13:13:27.0875 2524  [ 43AF5212BD8FB5BA6EED9754358BD8F7 ] RDPWD           C:\WINDOWS\system32\drivers\RDPWD.sys

13:13:27.0906 2524  RDPWD - ok

13:13:27.0906 2524  [ 263AF18AF0F3DB99F574C95F284CCEC9 ] RDSessMgr       C:\WINDOWS\system32\sessmgr.exe

13:13:27.0984 2524  RDSessMgr - ok

13:13:28.0000 2524  [ ED761D453856F795A7FE056E42C36365 ] redbook         C:\WINDOWS\system32\DRIVERS\redbook.sys

13:13:28.0062 2524  redbook - ok

13:13:28.0078 2524  [ 0E97EC96D6942CEEC2D188CC2EB69A01 ] RemoteAccess    C:\WINDOWS\System32\mprdim.dll

13:13:28.0156 2524  RemoteAccess - ok

13:13:28.0171 2524  [ 2A02E21867497DF20B8FC95631395169 ] RpcLocator      C:\WINDOWS\system32\locator.exe

13:13:28.0234 2524  RpcLocator - ok

13:13:28.0250 2524  [ 3127AFBF2C1ED0AB14A1BBB7AAECB85B ] RpcSs           C:\WINDOWS\system32\rpcss.dll

13:13:28.0296 2524  RpcSs - ok

13:13:28.0312 2524  [ 4BDD71B4B521521499DFD14735C4F398 ] RSVP            C:\WINDOWS\system32\rsvp.exe

13:13:28.0390 2524  RSVP - ok

13:13:28.0421 2524  [ 1E11171C0B9989E1BDAA59E96B2E81C4 ] RTL8023xp       C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys

13:13:28.0468 2524  RTL8023xp - ok

13:13:28.0484 2524  [ 4294FDF954125CE9E39E68F826415C29 ] s3legacy        C:\WINDOWS\system32\DRIVERS\s3legacy.sys

13:13:28.0562 2524  s3legacy - ok

13:13:28.0578 2524  [ AFB8261B56CBA0D86AEB6DF682AF9785 ] SamSs           C:\WINDOWS\system32\lsass.exe

13:13:28.0625 2524  SamSs - ok

13:13:28.0671 2524  [ 69AF63ABC08B418E613BD1241FEB49E9 ] SbieDrv         C:\Programme\Sandboxie\SbieDrv.sys

13:13:28.0671 2524  SbieDrv ( UnsignedFile.Multi.Generic ) - warning

13:13:28.0671 2524  SbieDrv - detected UnsignedFile.Multi.Generic (1)

13:13:28.0687 2524  [ D701C5A242C31D018375459E1373FE22 ] SbieSvc         C:\Programme\Sandboxie\SbieSvc.exe

13:13:28.0703 2524  SbieSvc ( UnsignedFile.Multi.Generic ) - warning

13:13:28.0703 2524  SbieSvc - detected UnsignedFile.Multi.Generic (1)

13:13:28.0718 2524  [ DCEC079FAD95D36C8DD5CB6D779DFE32 ] SCardSvr        C:\WINDOWS\System32\SCardSvr.exe

13:13:28.0796 2524  SCardSvr - ok

13:13:28.0812 2524  [ A050194A44D7FA8D7186ED2F4E8367AE ] Schedule        C:\WINDOWS\system32\schedsvc.dll

13:13:28.0890 2524  Schedule - ok

13:13:28.0921 2524  [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv          C:\WINDOWS\system32\DRIVERS\secdrv.sys

13:13:28.0984 2524  Secdrv - ok

13:13:29.0000 2524  [ BEE4CFD1D48C23B44CF4B974B0B79B2B ] seclogon        C:\WINDOWS\System32\seclogon.dll

13:13:29.0078 2524  seclogon - ok

13:13:29.0093 2524  [ 2AAC9B6ED9EDDFFB721D6452E34D67E3 ] SENS            C:\WINDOWS\system32\sens.dll

13:13:29.0156 2524  SENS - ok

13:13:29.0187 2524  [ 0F29512CCD6BEAD730039FB4BD2C85CE ] serenum         C:\WINDOWS\system32\DRIVERS\serenum.sys

13:13:29.0250 2524  serenum - ok

13:13:29.0265 2524  [ CF24EB4F0412C82BCD1F4F35A025E31D ] Serial          C:\WINDOWS\system32\DRIVERS\serial.sys

13:13:29.0328 2524  Serial - ok

13:13:29.0343 2524  [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy         C:\WINDOWS\system32\drivers\Sfloppy.sys

13:13:29.0406 2524  Sfloppy - ok

13:13:29.0421 2524  [ CAD058D5F8B889A87CA3EB3CF624DCEF ] SharedAccess    C:\WINDOWS\System32\ipnathlp.dll

13:13:29.0500 2524  SharedAccess - ok

13:13:29.0515 2524  [ 2DB7D303C36DDD055215052F118E8E75 ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll

13:13:29.0531 2524  ShellHWDetection - ok

13:13:29.0531 2524  Simbad - ok

13:13:29.0625 2524  [ DDAA5F4A6B958FC313EBD02DD925752F ] SkypeUpdate     C:\Dokumente und Einstellungen\Steffen\Desktop\Updater\Updater.exe

13:13:29.0640 2524  SkypeUpdate - ok

13:13:29.0640 2524  Sparrow - ok

13:13:29.0656 2524  [ 3FA2E254BFBCE52B3C6F1BF23AAB6911 ] speedfan        C:\WINDOWS\system32\speedfan.sys

13:13:29.0671 2524  speedfan - ok

13:13:29.0703 2524  [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter        C:\WINDOWS\system32\drivers\splitter.sys

13:13:29.0765 2524  splitter - ok

13:13:29.0796 2524  [ 60784F891563FB1B767F70117FC2428F ] Spooler         C:\WINDOWS\system32\spoolsv.exe

13:13:29.0828 2524  Spooler - ok

13:13:29.0843 2524  [ 0022CFFF1A41E5CE3A764050A7DDF22A ] sptd            C:\WINDOWS\System32\Drivers\sptd.sys

13:13:29.0859 2524  sptd - ok

13:13:29.0875 2524  [ 50FA898F8C032796D3B1B9951BB5A90F ] sr              C:\WINDOWS\system32\DRIVERS\sr.sys

13:13:29.0937 2524  sr - ok

13:13:29.0968 2524  [ FE77A85495065F3AD59C5C65B6C54182 ] srservice       C:\WINDOWS\system32\srsvc.dll

13:13:30.0031 2524  srservice - ok

13:13:30.0046 2524  [ 47DDFC2F003F7F9F0592C6874962A2E7 ] Srv             C:\WINDOWS\system32\DRIVERS\srv.sys

13:13:30.0093 2524  Srv - ok

13:13:30.0109 2524  [ 4DF5B05DFAEC29E13E1ED6F6EE12C500 ] SSDPSRV         C:\WINDOWS\System32\ssdpsrv.dll

13:13:30.0187 2524  SSDPSRV - ok

13:13:30.0218 2524  [ A36EE93698802CD899F98BFD553D8185 ] ssmdrv          C:\WINDOWS\system32\DRIVERS\ssmdrv.sys

13:13:30.0218 2524  ssmdrv - ok

13:13:30.0218 2524  [ BC2C5985611C5356B24AEB370953DED9 ] stisvc          C:\WINDOWS\system32\wiaservc.dll

13:13:30.0296 2524  stisvc - ok

13:13:30.0312 2524  [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum          C:\WINDOWS\system32\DRIVERS\swenum.sys

13:13:30.0375 2524  swenum - ok

13:13:30.0390 2524  [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi          C:\WINDOWS\system32\drivers\swmidi.sys

13:13:30.0468 2524  swmidi - ok

13:13:30.0468 2524  SwPrv - ok

13:13:30.0468 2524  symc810 - ok

13:13:30.0468 2524  symc8xx - ok

13:13:30.0468 2524  sym_hi - ok

13:13:30.0484 2524  sym_u3 - ok

13:13:30.0484 2524  [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio        C:\WINDOWS\system32\drivers\sysaudio.sys

13:13:30.0562 2524  sysaudio - ok

13:13:30.0562 2524  [ 2903FFFA2523926D6219428040DCE6B9 ] SysmonLog       C:\WINDOWS\system32\smlogsvc.exe

13:13:30.0625 2524  SysmonLog - ok

13:13:30.0656 2524  [ 05903CAC4B98908D55EA5774775B382E ] TapiSrv         C:\WINDOWS\System32\tapisrv.dll

13:13:30.0718 2524  TapiSrv - ok

13:13:30.0718 2524  [ 04E1C782CF14B7282EBC633B0FD3ED16 ] TBPanel         C:\WINDOWS\system32\drivers\TBPanel.sys

13:13:30.0734 2524  TBPanel - ok

13:13:30.0750 2524  [ 9AEFA14BD6B182D61E3119FA5F436D3D ] Tcpip           C:\WINDOWS\system32\DRIVERS\tcpip.sys

13:13:30.0781 2524  Tcpip - ok

13:13:30.0796 2524  [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE          C:\WINDOWS\system32\drivers\TDPIPE.sys

13:13:30.0859 2524  TDPIPE - ok

13:13:30.0875 2524  [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP           C:\WINDOWS\system32\drivers\TDTCP.sys

13:13:30.0937 2524  TDTCP - ok

13:13:30.0953 2524  [ 88155247177638048422893737429D9E ] TermDD          C:\WINDOWS\system32\DRIVERS\termdd.sys

13:13:31.0031 2524  TermDD - ok

13:13:31.0062 2524  [ B7DE02C863D8F5A005A7BF375375A6A4 ] TermService     C:\WINDOWS\System32\termsrv.dll

13:13:31.0140 2524  TermService - ok

13:13:31.0156 2524  [ 2DB7D303C36DDD055215052F118E8E75 ] Themes          C:\WINDOWS\System32\shsvcs.dll

13:13:31.0171 2524  Themes - ok

13:13:31.0171 2524  TosIde - ok

13:13:31.0187 2524  [ 626504572B175867F30F3215C04B3E2F ] TrkWks          C:\WINDOWS\system32\trkwks.dll

13:13:31.0250 2524  TrkWks - ok

13:13:31.0265 2524  [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs            C:\WINDOWS\system32\drivers\Udfs.sys

13:13:31.0328 2524  Udfs - ok

13:13:31.0328 2524  ultra - ok

13:13:31.0359 2524  [ C81B8635DEE0D3EF5F64B3DD643023A5 ] UMWdf           C:\WINDOWS\system32\wdfmgr.exe

13:13:31.0390 2524  UMWdf - ok

13:13:31.0406 2524  [ 402DDC88356B1BAC0EE3DD1580C76A31 ] Update          C:\WINDOWS\system32\DRIVERS\update.sys

13:13:31.0500 2524  Update - ok

13:13:31.0515 2524  [ 1DFD8975D8C89214B98D9387C1125B49 ] upnphost        C:\WINDOWS\System32\upnphost.dll

13:13:31.0593 2524  upnphost - ok

13:13:31.0640 2524  [ 9B11E6118958E63E1FEF129466E2BDA7 ] UPS             C:\WINDOWS\System32\ups.exe

13:13:31.0703 2524  UPS - ok

13:13:31.0718 2524  [ E919708DB44ED8543A7C017953148330 ] usbaudio        C:\WINDOWS\system32\drivers\usbaudio.sys

13:13:31.0781 2524  usbaudio - ok

13:13:31.0796 2524  [ 173F317CE0DB8E21322E71B7E60A27E8 ] usbccgp         C:\WINDOWS\system32\DRIVERS\usbccgp.sys

13:13:31.0859 2524  usbccgp - ok

13:13:31.0875 2524  [ 65DCF09D0E37D4C6B11B5B0B76D470A7 ] usbehci         C:\WINDOWS\system32\DRIVERS\usbehci.sys

13:13:31.0937 2524  usbehci - ok

13:13:31.0953 2524  [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub          C:\WINDOWS\system32\DRIVERS\usbhub.sys

13:13:32.0031 2524  usbhub - ok

13:13:32.0046 2524  [ A717C8721046828520C9EDF31288FC00 ] usbprint        C:\WINDOWS\system32\DRIVERS\usbprint.sys

13:13:32.0109 2524  usbprint - ok

13:13:32.0109 2524  [ A0B8CF9DEB1184FBDD20784A58FA75D4 ] usbscan         C:\WINDOWS\system32\DRIVERS\usbscan.sys

13:13:32.0171 2524  usbscan - ok

13:13:32.0187 2524  [ A32426D9B14A089EAA1D922E0C5801A9 ] USBSTOR         C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

13:13:32.0250 2524  USBSTOR - ok

13:13:32.0250 2524  [ 26496F9DEE2D787FC3E61AD54821FFE6 ] usbuhci         C:\WINDOWS\system32\DRIVERS\usbuhci.sys

13:13:32.0312 2524  usbuhci - ok

13:13:32.0328 2524  [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave         C:\WINDOWS\System32\drivers\vga.sys

13:13:32.0406 2524  VgaSave - ok

13:13:32.0406 2524  ViaIde - ok

13:13:32.0421 2524  [ A5A712F4E880874A477AF790B5186E1D ] VolSnap         C:\WINDOWS\system32\drivers\VolSnap.sys

13:13:32.0484 2524  VolSnap - ok

13:13:32.0500 2524  [ 68F106273BE29E7B7EF8266977268E78 ] VSS             C:\WINDOWS\System32\vssvc.exe

13:13:32.0562 2524  VSS - ok

13:13:32.0578 2524  [ 7B353059E665F8B7AD2BBEAEF597CF45 ] W32Time         C:\WINDOWS\system32\w32time.dll

13:13:32.0656 2524  W32Time - ok

13:13:32.0656 2524  [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp          C:\WINDOWS\system32\DRIVERS\wanarp.sys

13:13:32.0718 2524  Wanarp - ok

13:13:32.0718 2524  WDICA - ok

13:13:32.0734 2524  [ 6768ACF64B18196494413695F0C3A00F ] wdmaud          C:\WINDOWS\system32\drivers\wdmaud.sys

13:13:32.0796 2524  wdmaud - ok

13:13:32.0812 2524  [ 81727C9873E3905A2FFC1EBD07265002 ] WebClient       C:\WINDOWS\System32\webclnt.dll

13:13:32.0890 2524  WebClient - ok

13:13:32.0953 2524  [ 6F3F3973D97714CC5F906A19FE883729 ] winmgmt         C:\WINDOWS\system32\wbem\WMIsvc.dll

13:13:33.0015 2524  winmgmt - ok

13:13:33.0046 2524  [ A477391B7A8B0A0DAABADB17CF533A4B ] WmdmPmSN        C:\WINDOWS\system32\mspmsnsv.dll

13:13:33.0062 2524  WmdmPmSN - ok

13:13:33.0078 2524  [ 93908111BA57A6E60EC2FA2DE202105C ] WmiApSrv        C:\WINDOWS\system32\wbem\wmiapsrv.exe

13:13:33.0140 2524  WmiApSrv - ok

13:13:33.0156 2524  [ C1B3D9D75C3FB735F5FA3A5806ADED57 ] WpdUsb          C:\WINDOWS\system32\Drivers\wpdusb.sys

13:13:33.0156 2524  WpdUsb - ok

13:13:33.0187 2524  [ 300B3E84FAF1A5C1F791C159BA28035D ] wscsvc          C:\WINDOWS\system32\wscsvc.dll

13:13:33.0250 2524  wscsvc - ok

13:13:33.0265 2524  [ 7B4FE05202AA6BF9F4DFD0E6A0D8A085 ] wuauserv        C:\WINDOWS\system32\wuauserv.dll

13:13:33.0328 2524  wuauserv - ok

13:13:33.0359 2524  [ C4F109C005F6725162D2D12CA751E4A7 ] WZCSVC          C:\WINDOWS\System32\wzcsvc.dll

13:13:33.0437 2524  WZCSVC - ok

13:13:33.0453 2524  [ 0ADA34871A2E1CD2CAAFED1237A47750 ] xmlprov         C:\WINDOWS\System32\xmlprov.dll

13:13:33.0531 2524  xmlprov - ok

13:13:33.0531 2524  ================ Scan global ===============================

13:13:33.0546 2524  [ 2C60091CA5F67C3032EAB3B30390C27F ] C:\WINDOWS\system32\basesrv.dll

13:13:33.0578 2524  [ A28CE25B59C90E12743001A1F2AE3613 ] C:\WINDOWS\system32\winsrv.dll

13:13:33.0593 2524  [ A28CE25B59C90E12743001A1F2AE3613 ] C:\WINDOWS\system32\winsrv.dll

13:13:33.0593 2524  [ A3EDBE9053889FB24AB22492472B39DC ] C:\WINDOWS\system32\services.exe

13:13:33.0593 2524  [Global] - ok

13:13:33.0593 2524  ================ Scan MBR ==================================

13:13:33.0609 2524  [ 72B8CE41AF0DE751C946802B3ED844B4 ] \Device\Harddisk0\DR0

13:13:33.0828 2524  \Device\Harddisk0\DR0 - ok

13:13:33.0828 2524  ================ Scan VBR ==================================

13:13:33.0828 2524  [ B5181DB679D3301D734522E1BA17BC9F ] \Device\Harddisk0\DR0\Partition1

13:13:33.0828 2524  \Device\Harddisk0\DR0\Partition1 - ok

13:13:33.0843 2524  [ 136B8A0C0BF5727CAC170225E79AA8E7 ] \Device\Harddisk0\DR0\Partition2

13:13:33.0859 2524  \Device\Harddisk0\DR0\Partition2 - ok

13:13:33.0859 2524  ============================================================

13:13:33.0859 2524  Scan finished

13:13:33.0859 2524  ============================================================

13:13:33.0984 0168  Detected object count: 9

13:13:33.0984 0168  Actual detected object count: 9

13:13:49.0015 0168  atksgt ( UnsignedFile.Multi.Generic ) - skipped by user

13:13:49.0015 0168  atksgt ( UnsignedFile.Multi.Generic ) - User select action: Skip 

13:13:49.0031 0168  BIOS ( UnsignedFile.Multi.Generic ) - skipped by user

13:13:49.0031 0168  BIOS ( UnsignedFile.Multi.Generic ) - User select action: Skip 

13:13:49.0031 0168  BS_I2cIo ( UnsignedFile.Multi.Generic ) - skipped by user

13:13:49.0031 0168  BS_I2cIo ( UnsignedFile.Multi.Generic ) - User select action: Skip 

13:13:49.0031 0168  Cherry Device Interface ( UnsignedFile.Multi.Generic ) - skipped by user

13:13:49.0031 0168  Cherry Device Interface ( UnsignedFile.Multi.Generic ) - User select action: Skip 

13:13:49.0031 0168  giveio ( UnsignedFile.Multi.Generic ) - skipped by user

13:13:49.0031 0168  giveio ( UnsignedFile.Multi.Generic ) - User select action: Skip 

13:13:49.0031 0168  LightScribeService ( UnsignedFile.Multi.Generic ) - skipped by user

13:13:49.0031 0168  LightScribeService ( UnsignedFile.Multi.Generic ) - User select action: Skip 

13:13:49.0031 0168  lirsgt ( UnsignedFile.Multi.Generic ) - skipped by user

13:13:49.0031 0168  lirsgt ( UnsignedFile.Multi.Generic ) - User select action: Skip 

13:13:49.0031 0168  SbieDrv ( UnsignedFile.Multi.Generic ) - skipped by user

13:13:49.0031 0168  SbieDrv ( UnsignedFile.Multi.Generic ) - User select action: Skip 

13:13:49.0031 0168  SbieSvc ( UnsignedFile.Multi.Generic ) - skipped by user

13:13:49.0031 0168  SbieSvc ( UnsignedFile.Multi.Generic ) - User select action: Skip

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop.

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

Code:

ComboFix 12-10-21.01 - Steffen 21.10.2012  14:28:17.1.2 - x86

Microsoft Windows XP Home Edition  5.1.2600.3.1252.49.1031.18.2046.1363 [GMT 2:00]

ausgeführt von:: c:\dokumente und einstellungen\Steffen\Desktop\ComboFix.exe

AV: Avira Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\dokumente und einstellungen\Steffen\Anwendungsdaten\siw_sdk.dll

c:\dokumente und einstellungen\Steffen\WINDOWS

c:\programme\Clickster\ClICkster.exe

c:\windows\IsUn0407.exe

c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.exe

c:\windows\system32\URTTemp

c:\windows\system32\URTTemp\regtlib.exe

c:\windows\unin0407.exe

Z:\install.exe

.

.

(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

-------\Legacy_NVSVC

-------\Legacy_PASSWORD

-------\Service_NVSvc

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-09-21 bis 2012-10-21  ))))))))))))))))))))))))))))))

.

.

2012-10-19 13:31 . 2012-10-19 13:31        --------        d-----w-        C:\_OTL

2012-10-15 16:43 . 2012-10-15 16:43        --------        d-----w-        c:\programme\ESET

2012-10-12 13:35 . 2012-10-12 13:35        --------        d-----w-        c:\dokumente und einstellungen\Steffen\Anwendungsdaten\Malwarebytes

2012-10-12 13:34 . 2012-10-12 13:34        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes

2012-10-12 13:34 . 2012-10-12 13:34        --------        d-----w-        c:\programme\Malwarebytes' Anti-Malware

2012-10-12 13:34 . 2012-09-07 15:04        22856        ----a-w-        c:\windows\system32\drivers\mbam.sys

2012-09-22 12:58 . 2012-09-22 12:58        477168        ----a-w-        c:\windows\system32\npdeployJava1.dll

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-09-22 12:58 . 2010-07-02 22:15        473072        ----a-w-        c:\windows\system32\deployJava1.dll

2012-09-22 12:58 . 2009-01-13 18:46        73728        ----a-w-        c:\windows\system32\javacpl.cpl

2012-08-30 20:28 . 2004-08-04 12:00        672768        ----a-w-        c:\windows\system32\wininet.dll

2012-08-30 20:28 . 2004-08-04 12:00        61952        ----a-w-        c:\windows\system32\tdc.ocx

2012-08-30 20:28 . 2004-08-04 12:00        81920        ----a-w-        c:\windows\system32\ieencode.dll

2012-08-30 20:26 . 2004-08-04 12:00        371200        ----a-w-        c:\windows\system32\html.iec

2012-08-24 13:53 . 2004-08-04 12:00        177664        ----a-w-        c:\windows\system32\wintrust.dll

2012-08-23 06:26 . 2008-10-30 21:04        2151424        ----a-w-        c:\windows\system32\ntoskrnl.exe

2012-08-23 06:26 . 2008-10-30 21:04        2030080        ----a-w-        c:\windows\system32\ntkrnlpa.exe

2012-07-30 20:35 . 2012-07-30 20:35        1409        ----a-w-        c:\windows\QTFont.for

2012-10-13 12:16 . 2012-10-13 12:16        261600        ----a-w-        c:\programme\mozilla firefox\components\browsercomps.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\programme\Gemeinsame Dateien\Nero\Lib\NMBgMonitor.exe" [2007-08-03 202024]

"GAINWARD"="c:\programme\EXPERTool\TBPanel.exe" [2008-07-10 2177576]

"SandboxieControl"="c:\programme\Sandboxie\SbieCtrl.exe" [2009-12-01 389120]

"Steam"="z:\spiele\empire\steam.exe" [2012-08-04 1353080]

"DAEMON Tools Lite"="c:\programme\DAEMON Tools Lite\DTLite.exe" [2012-04-11 3672384]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RTHDCPL"="RTHDCPL.EXE" [2007-10-16 16855552]

"SkyTel"="SkyTel.EXE" [2007-10-11 1826816]

"NeroFilterCheck"="c:\programme\Gemeinsame Dateien\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]

"RemoteControl"="c:\programme\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144]

"nwiz"="nwiz.exe" [2008-10-07 1630208]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-07 86016]

"CherryKeyMan"="c:\programme\Cherry\KeyMan\KeyMan.exe" [2007-11-28 237620]

"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2012-08-08 348664]

"BCSSync"="c:\programme\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]

"LogMeIn Hamachi Ui"="c:\programme\LogMeIn Hamachi\hamachi-2-ui.exe" [2012-08-29 1996200]

"Adobe ARM"="c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]

"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2012-01-18 254696]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

.

c:\dokumente und einstellungen\Steffen\Startmenü\Programme\Autostart\

StarOffice 8.lnk - c:\programme\Sun\StarOffice 8\program\quickstart.exe [2008-1-21 122880]

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Programme\\TeamViewer3\\TeamViewer.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"z:\\Spiele\\Battlefront 2\\GameData\\BattlefrontII.exe"=

"c:\\Programme\\LogMeIn Hamachi\\hamachi-2-ui.exe"=

"z:\\Spiele\\Anno 1602\\ANNO1602\\1602.EXE"=

"c:\\WINDOWS\\system32\\dplaysvr.exe"=

"z:\\Spiele\\Stronghold\\Stronghold.exe"=

"c:\\Programme\\Call Graph\\CallGraph.exe"=

"c:\\Riot Games\\League of Legends\\lol.launcher.exe"=

"c:\\Programme\\Mozilla Firefox\\plugin-container.exe"=

"c:\\Programme\\ICQ7.5\\ICQ.exe"=

"z:\\Spiele\\EMpire\\SteamApps\\common\\empire total war\\Empire.exe"=

"z:\\Spiele\\Assassins Creed\\AssassinsCreed_Dx9.exe"=

"z:\\Spiele\\Assassins Creed\\AssassinsCreed_Dx10.exe"=

"z:\\Spiele\\Assassins Creed\\AssassinsCreed_Launcher.exe"=

"c:\\Programme\\Microsoft Office\\Office14\\GROOVE.EXE"=

"c:\\Programme\\Microsoft Office\\Office14\\ONENOTE.EXE"=

"c:\\Programme\\Microsoft Office\\Office14\\OUTLOOK.EXE"=

"c:\\Dokumente und Einstellungen\\Steffen\\Desktop\\Phone\\Skype.exe"=

"z:\\Spiele\\EMpire\\SteamApps\\common\\total war shogun 2\\Shogun2.exe"=

"z:\\Spiele\\EMpire\\SteamApps\\common\\total war shogun 2\\data\\encyclopedia\\how_to_play.html"=

"z:\\Spiele\\EMpire\\SteamApps\\common\\total war shogun 2\\benchmarks\\benchmark_current_settings.bat"=

"z:\\Spiele\\EMpire\\SteamApps\\common\\total war shogun 2\\benchmarks\\benchmark_specify_properties.bat"=

"c:\\Programme\\Pando Networks\\Media Booster\\PMB.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"58282:TCP"= 58282:TCP:Em4

"12345:UDP"= 12345:UDP:Em4

"54321:UDP"= 54321:UDP:Em4

"1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015

"1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016

"500:UDP"= 500:UDP:@xpsp2res.dll,-22017

"58931:TCP"= 58931:TCP:Pando Media Booster

"58931:UDP"= 58931:UDP:Pando Media Booster

"8396:TCP"= 8396:TCP:League of Legends Launcher

"8396:UDP"= 8396:UDP:League of Legends Launcher

"6907:TCP"= 6907:TCP:League of Legends Launcher

"6907:UDP"= 6907:UDP:League of Legends Launcher

"6969:TCP"= 6969:TCP:League of Legends Launcher

"6969:UDP"= 6969:UDP:League of Legends Launcher

"6911:TCP"= 6911:TCP:League of Legends Launcher

"6911:UDP"= 6911:UDP:League of Legends Launcher

"6941:TCP"= 6941:TCP:League of Legends Launcher

"6941:UDP"= 6941:UDP:League of Legends Launcher

"8397:TCP"= 8397:TCP:League of Legends Launcher

"8397:UDP"= 8397:UDP:League of Legends Launcher

"6908:TCP"= 6908:TCP:League of Legends Launcher

"6908:UDP"= 6908:UDP:League of Legends Launcher

"6937:TCP"= 6937:TCP:League of Legends Launcher

"6937:UDP"= 6937:UDP:League of Legends Launcher

"6896:TCP"= 6896:TCP:League of Legends Launcher

"6896:UDP"= 6896:UDP:League of Legends Launcher

"6992:TCP"= 6992:TCP:League of Legends Launcher

"6992:UDP"= 6992:UDP:League of Legends Launcher

"6968:TCP"= 6968:TCP:League of Legends Launcher

"6968:UDP"= 6968:UDP:League of Legends Launcher

"6947:TCP"= 6947:TCP:League of Legends Launcher

"6947:UDP"= 6947:UDP:League of Legends Launcher

"8398:TCP"= 8398:TCP:League of Legends Launcher

"8398:UDP"= 8398:UDP:League of Legends Launcher

"8393:TCP"= 8393:TCP:League of Legends Lobby

"8393:UDP"= 8393:UDP:League of Legends Lobby

"8390:TCP"= 8390:TCP:League of Legends Game Client

"8390:UDP"= 8390:UDP:League of Legends Game Client

"58797:TCP"= 58797:TCP:Pando Media Booster

"58797:UDP"= 58797:UDP:Pando Media Booster

.

R0 sptd;sptd;\SystemRoot\\SystemRoot\System32\Drivers\sptd.sys --> \SystemRoot\\SystemRoot\System32\Drivers\sptd.sys [?]

R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [01.01.2007 23:39 36000]

R1 BIOS;BIOS;c:\windows\system32\drivers\BIOS.sys [29.10.2008 22:06 13696]

R1 BS_I2cIo;BS_I2cIo;c:\windows\system32\drivers\BS_I2cIo.sys [29.10.2008 23:31 8192]

R2 acedrv11;acedrv11;c:\windows\system32\drivers\acedrv11.sys [30.07.2008 07:51 277736]

R2 AntiVirSchedulerService;Avira Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [01.01.2007 23:39 86224]

R2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\programme\LogMeIn Hamachi\hamachi-2.exe [29.08.2012 12:03 1385896]

R2 NitroReaderDriverReadSpool2;NitroPDFReaderDriverCreatorReadSpool2;c:\programme\Nitro PDF\Reader 2\NitroPDFReaderDriverService2.exe [20.12.2011 11:28 196904]

R3 Ch2kPS2;Cherry PS/2 Tastatur Treiber (CDI);c:\windows\system32\drivers\Ch2kPS2.sys [24.01.2008 10:41 130560]

R3 Cherry Device Interface;Cherry Device Interface;c:\programme\Cherry\CDI\cdi.exe [04.12.2007 13:03 585774]

S2 gupdate;Google Update Service (gupdate);c:\programme\Google\Update\GoogleUpdate.exe [01.04.2010 00:06 135664]

S2 SkypeUpdate;Skype Updater;c:\dokumente und einstellungen\Steffen\Desktop\Updater\Updater.exe [07.06.2012 19:12 160944]

S3 gupdatem;Google Update-Dienst (gupdatem);c:\programme\Google\Update\GoogleUpdate.exe [01.04.2010 00:06 135664]

S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\programme\Microsoft Office\Office14\GROOVE.EXE [12.06.2011 11:15 31125880]

S3 MozillaMaintenance;Mozilla Maintenance Service;c:\programme\Mozilla Maintenance Service\maintenanceservice.exe [25.04.2012 18:47 115168]

S3 osppsvc;Office Software Protection Platform;c:\programme\Gemeinsame Dateien\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [09.01.2010 21:37 4640000]

S3 s3legacy;s3legacy;c:\windows\system32\drivers\s3legacy.sys [29.10.2008 21:49 65664]

.

--- Andere Dienste/Treiber im Speicher ---

.

*NewlyCreated* - WS2IFSL

.

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

2008-03-17 16:56        451872        ----a-w-        c:\programme\Gemeinsame Dateien\LightScribe\LSRunOnce.exe

.

Inhalt des "geplante Tasks" Ordners

.

2012-10-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\programme\Google\Update\GoogleUpdate.exe [2010-03-31 22:06]

.

2012-10-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\programme\Google\Update\GoogleUpdate.exe [2010-03-31 22:06]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.google.com

uDefault_Search_URL = hxxp://www.google.com/ie

uInternet Connection Wizard,ShellNext = hxxp://dt-updates.com/activate?query=VRgPIJB%2fH0qFMbR03XC69w%2bJz9sYmQmjN5N3c58svn93rjd0cC88VCk2kRaioc9KjgOxZoSiUyCjnKgYv7QAutPTP4VjP9Qul7q%2furUCNGGjYVsktbCTd5ETgFl2O1IQq9BLWXca6cSybCO%2fFMi9kvvZVnod3UW0E6aF9pKJWuq0bBTerxroeQ0Pihklg%2fb60k%2fXf9HDlIrSaN79NE4Y7Y%2bf2R7KSR2RCvYfYHJwo5N%2fhagcDQhJygdlY92Tq6BOzYm2%2buzzLZlnA0d2YauysBHfCm6pVQ7K1ZXZflN3L%2fw%3d

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: An OneNote s&enden - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105

IE: Google Sidewiki... - c:\programme\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html

IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000

IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\programme\ICQ7.5\ICQ.exe

TCP: DhcpNameServer = 192.168.2.1

FF - ProfilePath - c:\dokumente und einstellungen\Steffen\Anwendungsdaten\Mozilla\Firefox\Profiles\1pwc4e03.default\

FF - prefs.js: browser.search.defaulturl - 

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://google.de/

FF - ExtSQL: 2012-09-22 14:58; {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}; c:\programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}

FF - ExtSQL: !HIDDEN! 2009-10-13 17:22; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

HKCU-Run-EPSON Stylus CX3600 Series - c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE

HKLM-Run-EPSON Stylus CX3600 Series - c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE

AddRemove-Covert Operations - c:\windows\IsUn0407.exe

AddRemove-Reise nach Nordland - c:\windows\IsUn0407.exe

AddRemove-RiseofNationsExpansion 1.0 - z:\spiele\Rise of Nations\UNINSTLX.EXE

AddRemove-Sacred_is1 - z:\spiele\Sacred\unins000.exe

AddRemove-vShare.tv plugin - c:\programme\vShare.tv plugin\uninst.exe

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2012-10-21 14:39

Windows 5.1.2600 Service Pack 3 NTFS

.

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteinträge... 

.

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

  EPSON Stylus CX3600 Series = c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P26 "EPSON Stylus CX3600 Series" /M "Stylus CX3600" /EF "HKCU"????????????????????????????????????????p???W?9~0?6~????*?6~??6~??????8~"?????????????????Y???6~????????????????????T???????????W?9~??6~??????6~??6~??Y???????????6~???????????????????????????????|??????????Y???????????????8~s?6~??6~-?7~"??????????? ???????????2???'I??0???????????4????Y7~"???????????????P???????????????T????Y7~????P????????S??????????????X?8~????P???????j?8~P???????8???????????`?? 

.

Scanne versteckte Dateien... 

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 0

.

**************************************************************************

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\S-1-5-21-1078081533-1563985344-682003330-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]

"??"=hex:c1,6b,58,41,43,56,a8,8f,86,e2,1e,63,25,fd,58,a5,ed,fe,d7,8b,9c,da,5c,

   a6,7d,65,91,4f,74,5e,fb,d9,37,38,33,c0,0e,b4,02,67,31,29,b2,02,eb,8d,a5,68,\

"??"=hex:69,a3,33,3c,a5,c9,72,a7,2d,1d,f8,d7,9a,21,46,16

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

.

- - - - - - - > 'explorer.exe'(3576)

c:\progra~1\GEMEIN~1\MICROS~1\OFFICE14\Cultures\office.odf

c:\progra~1\MICROS~2\Office14\1031\GrooveIntlResource.dll

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\programme\Avira\AntiVir Desktop\avguard.exe

c:\programme\Java\jre6\bin\jqs.exe

c:\programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe

c:\programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE

c:\programme\Sandboxie\SbieSvc.exe

c:\windows\system32\wdfmgr.exe

c:\programme\Avira\AntiVir Desktop\avshadow.exe

c:\windows\RTHDCPL.EXE

c:\windows\system32\RUNDLL32.EXE

c:\programme\Gemeinsame Dateien\Nero\Lib\NMIndexingService.exe

c:\programme\Gemeinsame Dateien\Nero\Lib\NMIndexStoreSvr.exe

c:\programme\Sun\StarOffice 8\program\soffice.exe

c:\programme\Sun\StarOffice 8\program\soffice.BIN

c:\programme\avira\antivir desktop\ipmGui.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2012-10-21  14:44:27 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2012-10-21 12:44

.

Vor Suchlauf: 12 Verzeichnis(se), 57.590.394.880 Bytes frei

Nach Suchlauf: 15 Verzeichnis(se), 57.737.875.456 Bytes frei

.

WindowsXP-KB310994-SP2-Home-BootDisk-DEU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

.

- - End Of File - - 82CBA4B509AE5F6F288CE2C1B9AD4C18

Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte

aswMBR.exe und speichere die Datei auf deinem Desktop.

Starte die aswMBR.exe - (aswMBR.exe Anleitung)
Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
Klicke auf Scan.
Warte bitte bis Scan finished successfully im DOS-Fenster steht.
Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).

Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

Code:

GMER 1.0.15.15641 - hxxp://www.gmer.net

Rootkit scan 2012-10-25 00:49:07

Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-7 SAMSUNG_HD322HJ rev.1AC01112

Running: dhfc6g1b.exe; Driver: C:\DOKUME~1\Steffen\LOKALE~1\Temp\pgtdapow.sys
 
 

---- System - GMER 1.0.15 ----
 

SSDT            BA7711CE                                                                                                             ZwCreateKey

SSDT            BA7711C4                                                                                                             ZwCreateThread

SSDT            BA7711D3                                                                                                             ZwDeleteKey

SSDT            BA7711DD                                                                                                             ZwDeleteValueKey

SSDT            BA7711E2                                                                                                             ZwLoadKey

SSDT            BA7711B0                                                                                                             ZwOpenProcess

SSDT            BA7711B5                                                                                                             ZwOpenThread

SSDT            BA7711EC                                                                                                             ZwReplaceKey

SSDT            BA7711E7                                                                                                             ZwRestoreKey

SSDT            BA7711D8                                                                                                             ZwSetValueKey
 

INT 0x63        ?                                                                                                                    8A65BCB8

INT 0x63        ?                                                                                                                    8A65BCB8

INT 0x63        ?                                                                                                                    8A65BCB8

INT 0x63        ?                                                                                                                    8A65BCB8

INT 0x63        ?                                                                                                                    8A40AF00

INT 0x63        ?                                                                                                                    8A40AF00

INT 0x63        ?                                                                                                                    8A65BCB8

INT 0x73        ?                                                                                                                    8A65BCB8

INT 0x84        ?                                                                                                                    8A40AF00

INT 0xA4        ?                                                                                                                    8A40AF00

INT 0xB1        ?                                                                                                                    8A445CB8

INT 0xB1        ?                                                                                                                    8A445CB8

INT 0xB4        ?                                                                                                                    8A40AF00
 

Code            89755BAC                                                                                                             ZwRequestPort

Code            89755C4C                                                                                                             ZwRequestWaitReplyPort

Code            89755B0C                                                                                                             ZwTraceEvent

Code            89755BAB                                                                                                             NtRequestPort

Code            89755C4B                                                                                                             NtRequestWaitReplyPort

Code            89755B0B                                                                                                             NtTraceEvent
 

---- Kernel code sections - GMER 1.0.15 ----
 

.text           ntkrnlpa.exe!NtTraceEvent                                                                                            805351AE 5 Bytes  JMP 89755B10 

PAGE            ntkrnlpa.exe!NtRequestPort                                                                                           805A2A52 5 Bytes  JMP 89755BB0 

PAGE            ntkrnlpa.exe!NtRequestWaitReplyPort                                                                                  805A2D7E 5 Bytes  JMP 89755C50 

.sptd1          C:\WINDOWS\system32\drivers\sptd.sys                                                                                 entry point in ".sptd1" section [0xB9F83B2E]

.text           C:\WINDOWS\system32\DRIVERS\nv4_mini.sys                                                                             section is writeable [0xB8F65360, 0x32E00D, 0xE8000020]

.text           USBPORT.SYS!DllUnload                                                                                                B8F458AC 5 Bytes  JMP 8A40A410 

.text           a6ey5oc4.SYS!A0DB34FC6FE35D429A28ADDE5467D4D7                                                                        B8E7E900 48 Bytes  [6F, C6, 98, 52, 85, F4, 03, ...]

?               C:\WINDOWS\System32\Drivers\a6ey5oc4.SYS                                                                             suspicious PE modification

.text           avbqhs6f.SYS!A0DB34FC6FE35D429A28ADDE5467D4D7                                                                        B8DD9EA0 48 Bytes  [8F, AF, 03, 9F, F3, B0, C0, ...]

?               C:\WINDOWS\System32\Drivers\avbqhs6f.SYS                                                                             suspicious PE modification

.text           win32k.sys!EngAcquireSemaphore + 20F0                                                                                BF8082F4 5 Bytes  JMP 897554D0 

.text           win32k.sys!EngFreeUserMem + 5BD7                                                                                     BF80EE80 5 Bytes  JMP 89755430 

.text           win32k.sys!EngSetLastError + 79AA                                                                                    BF8240ED 5 Bytes  JMP 89755610 

.text           win32k.sys!FONTOBJ_pxoGetXform + 84ED                                                                                BF851765 5 Bytes  JMP 897559D0 

.text           win32k.sys!XLATEOBJ_iXlate + 2EDD                                                                                    BF85DC50 5 Bytes  JMP 89755570 

.text           win32k.sys!EngCreatePalette + 8A                                                                                     BF85F5F2 5 Bytes  JMP 89755890 

.text           win32k.sys!EngCopyBits + 4DF9                                                                                        BF89D7BD 5 Bytes  JMP 897556B0 

.text           win32k.sys!EngEraseSurface + A9E8                                                                                    BF8C1D00 5 Bytes  JMP 89755750 

.text           win32k.sys!EngDeleteSemaphore + 3B35                                                                                 BF8EBDCE 5 Bytes  JMP 89755930 

.text           win32k.sys!EngCreateClip + 1A2F                                                                                      BF9142F4 5 Bytes  JMP 89755A70 

.text           win32k.sys!EngCreateClip + 2605                                                                                      BF914ECA 5 Bytes  JMP 897557F0 

.reloc          C:\WINDOWS\system32\drivers\acedrv11.sys                                                                             section is executable [0xA5642600, 0x25B0C, 0xE0000060]

.text           C:\WINDOWS\system32\DRIVERS\atksgt.sys                                                                               section is writeable [0xA55E3300, 0x3ACC8, 0xE8000020]

.text           C:\WINDOWS\system32\DRIVERS\lirsgt.sys                                                                               section is writeable [0xBA478300, 0x1B7E, 0xE8000020]
 

---- Kernel IAT/EAT - GMER 1.0.15 ----
 

IAT             \WINDOWS\system32\DRIVERS\PCIIDEX.SYS[HAL.dll!WRITE_PORT_ULONG]                                                      [B9E8F232] sptd.sys (SCSI Pass Through Direct Host/Duplex Secure Ltd.)

IAT             \WINDOWS\system32\DRIVERS\PCIIDEX.SYS[HAL.dll!READ_PORT_UCHAR]                                                       [B9E8E730] sptd.sys (SCSI Pass Through Direct Host/Duplex Secure Ltd.)

IAT             \WINDOWS\system32\DRIVERS\PCIIDEX.SYS[HAL.dll!WRITE_PORT_UCHAR]                                                      [B9E8EF12] sptd.sys (SCSI Pass Through Direct Host/Duplex Secure Ltd.)

IAT             atapi.sys[HAL.dll!READ_PORT_UCHAR]                                                                                   [B9E8E730] sptd.sys (SCSI Pass Through Direct Host/Duplex Secure Ltd.)

IAT             atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT]                                                                           [B9E8E914] sptd.sys (SCSI Pass Through Direct Host/Duplex Secure Ltd.)

IAT             atapi.sys[HAL.dll!READ_PORT_USHORT]                                                                                  [B9E8E856] sptd.sys (SCSI Pass Through Direct Host/Duplex Secure Ltd.)

IAT             atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT]                                                                          [B9E8F0F0] sptd.sys (SCSI Pass Through Direct Host/Duplex Secure Ltd.)

IAT             atapi.sys[HAL.dll!WRITE_PORT_UCHAR]                                                                                  [B9E8EF12] sptd.sys (SCSI Pass Through Direct Host/Duplex Secure Ltd.)

IAT             \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR]                                                   [B9EA2EB0] sptd.sys (SCSI Pass Through Direct Host/Duplex Secure Ltd.)
 

---- Devices - GMER 1.0.15 ----
 

Device          \FileSystem\Ntfs \Ntfs                                                                                               8A65A1E8

Device          \FileSystem\Udfs \UdfsCdRom                                                                                          8A09D430

Device          \FileSystem\Udfs \UdfsDisk                                                                                           8A09D430
 

AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0                                                                              Ch2kPS2.sys (Cherry PS2 driver for Win2k/Cherry GmbH)

AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1                                                                              Ch2kPS2.sys (Cherry PS2 driver for Win2k/Cherry GmbH)
 

Device          \Driver\usbuhci \Device\USBPDO-0                                                                                     8A4091E8

Device          \Driver\usbuhci \Device\USBPDO-1                                                                                     8A4091E8

Device          \Driver\NetBT \Device\NetBT_Tcpip_{B609E8BE-0B04-454C-96A5-365B594E0528}                                             89F80430

Device          \Driver\usbuhci \Device\USBPDO-2                                                                                     8A4091E8

Device          \Driver\usbehci \Device\USBPDO-3                                                                                     8A4A31E8

Device          \Driver\usbuhci \Device\USBPDO-4                                                                                     8A4091E8

Device          \Driver\usbuhci \Device\USBPDO-5                                                                                     8A4091E8

Device          \Driver\usbuhci \Device\USBPDO-6                                                                                     8A4091E8

Device          \Driver\usbehci \Device\USBPDO-7                                                                                     8A4A31E8

Device          \Driver\Cdrom \Device\CdRom0                                                                                         8A4711E8

Device          \Driver\atapi \Device\Ide\IdeDeviceP3T0L0-12                                                                         [B9E1EB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}

Device          \Driver\atapi \Device\Ide\IdePort0                                                                                   [B9E1EB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}

Device          \Driver\atapi \Device\Ide\IdePort1                                                                                   [B9E1EB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}

Device          \Driver\atapi \Device\Ide\IdePort2                                                                                   [B9E1EB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}

Device          \Driver\atapi \Device\Ide\IdeDeviceP2T0L0-7                                                                          [B9E1EB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}

Device          \Driver\atapi \Device\Ide\IdePort3                                                                                   [B9E1EB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}

Device          \Driver\atapi \Device\Ide\IdePort4                                                                                   [B9E1EB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}

Device          \Driver\atapi \Device\Ide\IdePort5                                                                                   [B9E1EB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}

Device          \Driver\Cdrom \Device\CdRom1                                                                                         8A4711E8

Device          \Driver\Cdrom \Device\CdRom2                                                                                         8A4711E8

Device          \Driver\NetBT \Device\NetBT_Tcpip_{0762DB52-1742-43FC-BBB6-E784D191B0C4}                                             89F80430

Device          \Driver\NetBT \Device\NetBt_Wins_Export                                                                              89F80430

Device          \Driver\PCI_PNP5730 \Device\0000004a                                                                                 sptd.sys (SCSI Pass Through Direct Host/Duplex Secure Ltd.)

Device          \Driver\PCI_PNP5730 \Device\0000004a                                                                                 sptd.sys (SCSI Pass Through Direct Host/Duplex Secure Ltd.)

Device          \Driver\PCI_PNP5730 \Device\0000004b                                                                                 sptd.sys (SCSI Pass Through Direct Host/Duplex Secure Ltd.)

Device          \Driver\PCI_PNP5730 \Device\0000004b                                                                                 sptd.sys (SCSI Pass Through Direct Host/Duplex Secure Ltd.)

Device          \Driver\NetBT \Device\NetbiosSmb                                                                                     89F80430

Device          \Driver\usbuhci \Device\USBFDO-0                                                                                     8A4091E8

Device          \Driver\usbuhci \Device\USBFDO-1                                                                                     8A4091E8

Device          \FileSystem\MRxSmb \Device\LanmanDatagramReceiver                                                                    8A065430

Device          \Driver\usbuhci \Device\USBFDO-2                                                                                     8A4091E8

Device          \FileSystem\MRxSmb \Device\LanmanRedirector                                                                          8A065430

Device          \Driver\usbehci \Device\USBFDO-3                                                                                     8A4A31E8

Device          \Driver\usbuhci \Device\USBFDO-4                                                                                     8A4091E8

Device          \Driver\usbuhci \Device\USBFDO-5                                                                                     8A4091E8

Device          \Driver\usbuhci \Device\USBFDO-6                                                                                     8A4091E8

Device          \Driver\usbehci \Device\USBFDO-7                                                                                     8A4A31E8

Device          \Driver\a6ey5oc4 \Device\Scsi\a6ey5oc41Port7Path0Target0Lun0                                                         8A3611E8

Device          \Driver\avbqhs6f \Device\Scsi\avbqhs6f1                                                                              8A43E430

Device          \Driver\avbqhs6f \Device\Scsi\avbqhs6f1Port6Path0Target0Lun0                                                         8A43E430

Device          \Driver\a6ey5oc4 \Device\Scsi\a6ey5oc41                                                                              8A3611E8

Device          \FileSystem\Cdfs \Cdfs                                                                                               8A045430
 

---- Registry - GMER 1.0.15 ----
 

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC                                     

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                  C:\Programme\DAEMON Tools Lite\

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                  0x00 0x00 0x00 0x00 ...

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                  1

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                               0x45 0xB1 0x61 0xB6 ...

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001                            

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                         0xA0 0x02 0x00 0x00 ...

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                      0x16 0x3D 0xF5 0x8B ...

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0                       

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                 0xE8 0xBA 0xBC 0x1B ...

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4                                     

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0                                  C:\Programme\DAEMON Tools Lite\

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                  0

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                               0x5F 0xCE 0xF0 0xA6 ...

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001                            

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0                         0x20 0x01 0x00 0x00 ...

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh                      0xDD 0x77 0x55 0xF1 ...

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40                      

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh                0xDE 0x90 0x18 0x41 ...

Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)                 

Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0                                      C:\Programme\DAEMON Tools Lite\

Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                      0

Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                                   0x5F 0xCE 0xF0 0xA6 ...

Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)        

Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0                             0x20 0x01 0x00 0x00 ...

Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh                          0xDD 0x77 0x55 0xF1 ...

Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)  

Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh                    0xDE 0x90 0x18 0x41 ...

Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)                 

Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0                                      C:\Programme\DAEMON Tools Lite\

Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                      0

Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                                   0x5F 0xCE 0xF0 0xA6 ...

Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)        

Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0                             0x20 0x01 0x00 0x00 ...

Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh                          0xDD 0x77 0x55 0xF1 ...

Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)  

Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh                    0xDE 0x90 0x18 0x41 ...

Reg             HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)                 

Reg             HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0                                      C:\Programme\DAEMON Tools Lite\

Reg             HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                      0

Reg             HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                                   0x5F 0xCE 0xF0 0xA6 ...

Reg             HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)        

Reg             HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0                             0x20 0x01 0x00 0x00 ...

Reg             HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh                          0xDD 0x77 0x55 0xF1 ...

Reg             HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)  

Reg             HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh                    0xDE 0x90 0x18 0x41 ...

Reg             HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)                 

Reg             HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                      C:\Programme\DAEMON Tools Lite\

Reg             HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                      0x00 0x00 0x00 0x00 ...

Reg             HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                      1

Reg             HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                   0xAC 0x6D 0x62 0x0B ...

Reg             HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)        

Reg             HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                             0xA0 0x02 0x00 0x00 ...

Reg             HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                          0x16 0x3D 0xF5 0x8B ...

Reg             HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)   

Reg             HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                     0xE8 0xBA 0xBC 0x1B ...

Reg             HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)                 

Reg             HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0                                      C:\Programme\DAEMON Tools Lite\

Reg             HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                      0

Reg             HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                                   0x5F 0xCE 0xF0 0xA6 ...

Reg             HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)        

Reg             HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0                             0x20 0x01 0x00 0x00 ...

Reg             HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh                          0xDD 0x77 0x55 0xF1 ...

Reg             HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)  

Reg             HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh                    0xDE 0x90 0x18 0x41 ...
 

---- EOF - GMER 1.0.15 ----

Das Osam Log kommt (hoffentlich) morgen

Ok, ich seh ja wenn es da ist ;)

Naja hat nicht ganz geklappt...jetzt aber gleich beide ausstehende Logs:

OSAM:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 19:45:11 on 27.10.2012
 

OS: Windows XP Home Edition Service Pack 3 (Build 2600)

Default Browser: Mozilla Corporation Firefox 16.0.2
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Common]

-----( %SystemRoot%\Tasks )-----

"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe

"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\WINDOWS\system32\FlashPlayerCPLApp.cpl

"infocardcpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\infocardcpl.cpl

"javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl

"nvcpl.cpl" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvcpl.cpl

"nvtuicpl.cpl" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvtuicpl.cpl

"QuickTime.cpl" - "Apple Computer, Inc." - C:\WINDOWS\system32\QuickTime.cpl

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"Avira AntiVir Personal – Free Antivirus " - "Avira Operations GmbH & Co. KG" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl

"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\MLCFG32.CPL

"Nero BurnRights" - "Nero AG" - C:\Programme\Nero\Nero8\Nero Toolkit\NeroBurnRights.cpl

"Pando" - "Pando Networks" - C:\Programme\Pando Networks\Media Booster\PMB.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"acedrv11" (acedrv11) - "Protect Software GmbH" - C:\WINDOWS\system32\drivers\acedrv11.sys

"aoce3mos" (aoce3mos) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\aoce3mos.sys  (Hidden registry entry, rootkit activity | File signed by Microsoft)

"atksgt" (atksgt) - ? - C:\WINDOWS\System32\DRIVERS\atksgt.sys  (File found, but it contains no detailed information)

"av4l9n0y" (av4l9n0y) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\av4l9n0y.sys  (Hidden registry entry, rootkit activity | File signed by Microsoft)

"avgntflt" (avgntflt) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avgntflt.sys

"avipbb" (avipbb) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avipbb.sys

"avkmgr" (avkmgr) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avkmgr.sys

"BIOS" (BIOS) - "BIOSTAR Group" - C:\WINDOWS\system32\drivers\BIOS.sys

"BS_I2cIo" (BS_I2cIo) - "BIOSTAR Group" - C:\WINDOWS\system32\drivers\BS_I2cIo.sys

"Cardex" (Cardex) - "Windows (R) 2000 DDK provider" - C:\WINDOWS\system32\drivers\TBPANEL.SYS

"catchme" (catchme) - ? - C:\ComboFix\catchme.sys  (File not found)

"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys  (File not found)

"giveio" (giveio) - ? - C:\WINDOWS\System32\giveio.sys  (File found, but it contains no detailed information)

"Hamachi Network Interface" (hamachi) - "LogMeIn, Inc." - C:\WINDOWS\System32\DRIVERS\hamachi.sys

"i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys  (File not found)

"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)

"lirsgt" (lirsgt) - ? - C:\WINDOWS\System32\DRIVERS\lirsgt.sys  (File found, but it contains no detailed information)

"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)

"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)

"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)

"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)

"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)

"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\PxHelp20.sys

"SbieDrv" (SbieDrv) - "tzuk" - C:\Programme\Sandboxie\SbieDrv.sys

"speedfan" (speedfan) - "Almico Software" - C:\WINDOWS\System32\speedfan.sys

"sptd" (sptd) - "Duplex Secure Ltd." - C:\WINDOWS\System32\Drivers\sptd.sys

"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\ssmdrv.sys

"TBPanel" (TBPanel) - "Windows (R) 2000 DDK provider" - C:\WINDOWS\system32\drivers\TBPanel.sys

"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)
 

[Explorer]

-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----

{10880D85-AAD9-4558-ABDC-2AB1552D831F} "LightScribe Control Panel" - "Hewlett-Packard Company" - "C:\Programme\Gemeinsame Dateien\LightScribe\LSRunOnce.exe"

{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

aswMBR:

Code:

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software

Run date: 2012-10-27 19:54:54

-----------------------------

19:54:54.171    OS Version: Windows 5.1.2600 Service Pack 3

19:54:54.171    Number of processors: 2 586 0x1706

19:54:54.171    ComputerName: PC1  UserName: 

19:54:54.671    Initialize success

20:04:08.703    AVAST engine defs: 12102700

20:33:36.875    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-7

20:33:36.875    Disk 0 Vendor: SAMSUNG_HD322HJ 1AC01112 Size: 305245MB BusType: 3

20:33:36.875    Disk 0 MBR read successfully

20:33:36.875    Disk 0 MBR scan

20:33:37.000    Disk 0 Windows XP default MBR code

20:33:37.000    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS       102398 MB offset 63

20:33:37.031    Disk 0 Partition 2 00     07    HPFS/NTFS NTFS       202844 MB offset 209712510

20:33:37.046    Disk 0 scanning sectors +625137345

20:33:37.109    Disk 0 scanning C:\WINDOWS\system32\drivers

20:33:48.218    Service scanning

20:34:00.500    Modules scanning

20:34:04.562    Disk 0 trace - called modules:

20:34:04.578    ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys sptd.sys pciide.sys PCIIDEX.SYS 

20:34:04.578    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8a5ebab8]

20:34:04.578    3 CLASSPNP.SYS[ba0e8fd7] -> nt!IofCallDriver -> \Device\00000073[0x8a61bf18]

20:34:04.578    5 ACPI.sys[b9e63620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-7[0x8a619940]

20:34:05.046    AVAST engine scan C:\WINDOWS

20:34:11.937    AVAST engine scan C:\WINDOWS\system32

20:37:17.156    AVAST engine scan C:\WINDOWS\system32\drivers

20:37:31.203    AVAST engine scan C:\Dokumente und Einstellungen\Steffen

20:51:18.468    AVAST engine scan C:\Dokumente und Einstellungen\All Users

20:54:58.312    Scan finished successfully

20:55:27.796    Disk 0 MBR has been saved successfully to "C:\Dokumente und Einstellungen\Steffen\Desktop\MBR.dat"

20:55:27.796    The log file has been saved successfully to "C:\Dokumente und Einstellungen\Steffen\Desktop\aswMBR.txt"

Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle Scans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!