Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Trojaner entdeckt / gelöscht, am Folgetag neuen entdeckt (Trojan.Downloader, Trojan.Vundo) (https://www.trojaner-board.de/88516-trojaner-entdeckt-geloescht-folgetag-neuen-entdeckt-trojan-downloader-trojan-vundo.html)

dante_222 21.07.2010 21:23
Trojaner entdeckt / gelöscht, am Folgetag neuen entdeckt (Trojan.Downloader, Trojan.Vundo)
 
Hallo,

1) ich hatte vorgestern 'JAVA/Agent.yio.3361' mit Antivir gefunden und in Quarantäne gesetzt. Das war hier: C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\36\38108924-4631117e'

2) Daraufhin habe ich Malwarebytes' Anti-Malware verwendet, und das hier gefunden:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter)

C:\U.exe (Trojan.Downloader)

Habe alles gelöscht und in Quarantäne gesetzt (siehe auch unten mbam-log-2010-07-20 (13-01-34).txt)

3) Dann fand ich gestern wieder etwas mit Anti-Malware:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{4ffaded8-ce19-4fc5-9547-7881fdb5d120} (Trojan.Vundo)

Ebenfalls gelöscht und in Quarantäne gesetzt (siehe bitte unten mbam-log-2010-07-20 (22-11-11).txt).

4) Jetzt findet Anti-Malware nichts mehr (siehe unten mbam-log-2010-07-21 (14-11-09).txt)

5) Dennoch bin ich etwas skeptisch. Ich frage mich, ob ich nicht trotz der scheinbaren Sicherheit das System neu aufsetzen sollte. Deshalb habe ich mit RSIT die info.txt und die log.txt generiert, kann sie aber nicht selbst ausdeuten. Daher möchte ich einen von euch bitten, da nochmal drüber zu sehen, ob alles in Ordnung ist.

Vielen Dank! =)

mbam-log-2010-07-20 (13-01-34).txt
Code:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4329

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

20.07.2010 13:01:34
mbam-log-2010-07-20 (13-01-34).txt

Art des Suchlaufs: Vollständiger Suchlauf (A:\|C:\|D:\|E:\|F:\|G:\|Z:\|)
Durchsuchte Objekte: 391602
Laufzeit: 1 Stunde(n), 37 Minute(n), 42 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 3
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\U.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
mbam-log-2010-07-20 (22-11-11).txt
Code:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4332

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

20.07.2010 22:11:11
mbam-log-2010-07-20 (22-11-11).txt

Scan type: Quick scan
Objects scanned: 127461
Time elapsed: 5 minute(s), 28 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{4ffaded8-ce19-4fc5-9547-7881fdb5d120} (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
mbam-log-2010-07-21 (14-11-09).txt
Code:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4332

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

21.07.2010 14:11:09
mbam-log-2010-07-21 (14-11-09).txt

Scan type: Full scan (C:\|D:\|E:\|Z:\|)
Objects scanned: 361334
Time elapsed: 49 minute(s), 0 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
info.txt logfile of random's system information tool 1.08 2010-07-21 15:07:59
Code:
info.txt logfile of random's system information tool 1.08 2010-07-21 15:07:59

======Uninstall list======

-->C:\Programme\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL
-->C:\WINDOWS\IsUninst.exe -fC:\WINDOWS\system32\UninstIPP.isu
-->C:\WINDOWS\UNNeroVision.exe /UNINSTALL
-->MsiExec.exe /I{C4CBAD7E-DF4A-4FEC-AC17-8BC709AFB844}
-->MsiExec.exe /X{7B4AB13C-1A5C-4BC5-ABA6-762F8198444C}
-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{329899E1-CBBA-49BC-9FFE-199E94316727}\setup.exe" -l0x7  -removeonly
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
adgangforalle.dk 2.0-->D:\Programme\paf\uninstall.exe
Adobe After Effects 6.0-->MsiExec.exe /I{1EC60864-A294-44BF-984A-3E8867D74EA2}
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\FlashUtil10h_Plugin.exe -maintain plugin
Adobe MPEG Encoder-->MsiExec.exe /I{9811A185-3D3D-11D6-9E14-00036D172B00}
Adobe Photoshop Elements 5.0-->msiexec /I {A7B609FB-83D8-4FC3-8477-1BC65ECFE85B}
Adobe Reader 8.1.4 - Deutsch-->MsiExec.exe /I{AC76BA86-7AD7-1031-7B44-A81300000003}
Adobe Shockwave Player 11.5-->"C:\WINDOWS\system32\Adobe\Shockwave 11\uninstaller.exe"
Adobe SVG Viewer 3.0-->C:\Programme\Gemeinsame Dateien\Adobe\SVG Viewer 3.0\Uninstall\Winstall.exe -u -fC:\Programme\Gemeinsame Dateien\Adobe\SVG Viewer 3.0\Uninstall\Install.log
Advanced RealMedia Export Plug-in for Premiere 6.0-->C:\Programme\Adobe\Premiere 6.5\Plug-ins\RNCompiler\rnuninst.exe RealNetworks|RNCompiler|6.0
AGEIA PhysX v6.10.05-->MsiExec.exe /X{582876EC-A178-44D4-9823-C10D6C62EAFF}
Apple Application Support-->MsiExec.exe /I{B2D328BE-45AD-4D92-96F9-2151490A203E}
Apple Mobile Device Support-->MsiExec.exe /I{85991ED2-010C-4930-96FA-52F43C2CE98A}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
ArcSoft PhotoStudio 5.5-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{85309D89-7BE9-4094-BB17-24999C6118FC}\SETUP.EXE" -l0x7
Avira AntiVir Personal - Free Antivirus-->C:\Programme\Avira\AntiVir Desktop\setup.exe /REMOVE
Bioshock Demo-->"D:\games\halflife\steam.exe" steam://uninstall/7710
Bonjour-->MsiExec.exe /X{0CB9668D-F979-4F31-B8B8-67FE90F929F8}
Canon CanoScan Toolbox 5.0-->"C:\Programme\Canon\CanoScan Toolbox Ver5.0\Maint.exe" /UninstallRemove C:\Programme\Canon\CanoScan Toolbox Ver5.0\uninst.ini
Canon iP4500 series-->"C:\WINDOWS\system32\CanonIJ Uninstaller Information\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP4500_series\DelDrv.exe" /U:{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP4500_series /L0x0007
Canon My Printer-->C:\Programme\Canon\MyPrinter\uninst.exe uninst.ini
Canon Utilities Solution Menu-->C:\Programme\Canon\SolutionMenu\uninst.exe uninst.ini
CanoScan 4400F-->"C:\WINDOWS\system32\CanonIJ Uninstaller Information\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_CNQ4803\DelDrv.exe" /U:{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_CNQ4803 /L0x0007
CCleaner-->"D:\Programme\CCleaner\uninst.exe"
CD-LabelPrint-->"D:\Programme\canondrucker\CD-LabelPrint\Uninstal.exe" Canon.CDLabelPrint.Application
Cool Edit Pro 2.0-->E:\coolpro2\cep2unin.exe
DivX Player-->C:\Programme\DivX\DivXPlayerUninstall.exe /PLAYER
DivX-->C:\Programme\DivX\DivXCodecUninstall.exe /CODEC
Dystopia-->"d:\games\halflife\SteamApps\SourceMods\dystopia\uninstall.exe"
EasyCleaner-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{F5346614-B7C4-4E94-826A-E2363155233D}\setup.exe" -l0x9  -removeonly
EAX4 Unified Redist-->MsiExec.exe /X{89661B04-C646-4412-B6D3-5E19F02F1F37}
fahrinfo-->D:\PROGRAMME\FAHRINFO\uninst32.exe
FaJo XP File Security Extension v1.2-->"C:\Programme\FaJo\XP File Security Extension\unins000.exe"
FileZilla (remove only)-->"C:\Programme\FileZilla\uninstall.exe"
Free Download Manager 2.1-->"C:\Programme\Free Download Manager\unins000.exe"
Gimp 2.6.2 Debug-->"D:\Programme\gimp\Gimp-2.0\setup\unins000.exe"
GMX SMS-Manager-->C:\Programme\GMX\GMX SMS-Manager\Uninstall.exe
Half-Life(R) 2-->MsiExec.exe /I{D45EC259-4A19-4656-B588-C2C360DD18EA}
Heroes of Might and Magic V-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{20071984-5EB1-4881-8EDB-082532ACEC6D}\setup.exe" -l0x7
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall  /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
Hotfix für Windows Media Player 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
Hotfix für Windows XP (KB942288-v3)-->"C:\WINDOWS\$NtUninstallKB942288-v3$\spuninst\spuninst.exe"
Hotfix für Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Hotfix für Windows XP (KB961118)-->"C:\WINDOWS\$NtUninstallKB961118$\spuninst\spuninst.exe"
Hotfix für Windows XP (KB970653-v3)-->"C:\WINDOWS\$NtUninstallKB970653-v3$\spuninst\spuninst.exe"
Hotfix für Windows XP (KB976098-v2)-->"C:\WINDOWS\$NtUninstallKB976098-v2$\spuninst\spuninst.exe"
Hotfix für Windows XP (KB979306)-->"C:\WINDOWS\$NtUninstallKB979306$\spuninst\spuninst.exe"
Hotfix für Windows XP (KB981793)-->"C:\WINDOWS\$NtUninstallKB981793$\spuninst\spuninst.exe"
ICQ6.5-->"C:\Programme\InstallShield Installation Information\{60DE4033-9503-48D1-A483-7846BD217CA9}\setup.exe" -runfromtemp -l0x0009 -removeonly
IEEE802.11a/b/g Wireless LAN Software-->MsiExec.exe /I{902C0D79-8D7F-4956-9DCB-A223D5BF55B3}
IrfanView (remove only)-->D:\Programme\IrfanView\iv_uninstall.exe
iTunes-->MsiExec.exe /I{7AB3A249-FB81-416B-917A-A2A10E74C503}
J2SE Runtime Environment 5.0 Update 10-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150100}
J2SE Runtime Environment 5.0 Update 6-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150060}
Java(TM) 6 Update 20-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}
Java(TM) 6 Update 3-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}
Java(TM) 6 Update 5-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
Macromedia Shockwave Player-->C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log
Malwarebytes' Anti-Malware-->"D:\Programme\Malwarebytes' Anti-Malware\unins000.exe"
Media Go-->MsiExec.exe /X{FBE5AA96-22F0-4C4A-8E92-4BE3498D4CCB}
Microsoft .NET Framework 2.0 Language Pack - DEU-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0 Language Pack - DEU\install.exe
Microsoft .NET Framework 2.0 Service Pack 2-->MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
Microsoft .NET Framework 3.0 German Language Pack-->C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 German Language Pack\setup.exe
Microsoft .NET Framework 3.0 German Language Pack-->MsiExec.exe /X{F2A7F421-1679-48D5-B918-96999014ED53}
Microsoft .NET Framework 3.0 Service Pack 2-->MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}
Microsoft .NET Framework 3.5 SP1-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office 2000 Premium-->MsiExec.exe /I{00000407-78E1-11D2-B60F-006097C998E7}
Microsoft Office Professional Edition 2003-->MsiExec.exe /I{90110409-6000-11D3-8CFE-0150048383C9}
Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{837b34e3-7c30-493c-8f6a-2b0f04e2912c}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148-->MsiExec.exe /X{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}
MINERVA: Metastasis 2-->D:\games\halflife\STEAMA~1\SOURCE~1\METAST~1\UNWISE.EXE D:\games\halflife\STEAMA~1\SOURCE~1\METAST~1\metastasis.log
Miranda IM 0.8.9-->D:\Programme\Miranda IM\Uninstall.exe
Mozilla Firefox (3.6.3)-->D:\Programme\firefox\uninstall\helper.exe
Mozilla Sunbird (0.5)-->C:\Programme\Mozilla Sunbird\uninstall\uninst.exe
Mozilla Thunderbird (3.0.5)-->D:\Programme\Mozilla Thunderbird\uninstall\helper.exe
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 4.0 SP2 (KB973688)-->MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}
MSXML 4.0 SP2 Parser and SDK-->MsiExec.exe /I{716E0306-8318-4364-8B8F-0CC4E9376BAC}
MSXML 6.0 Parser (KB925673)-->MsiExec.exe /I{FE9126DB-5F84-495A-BB46-3C724F1C2D08}
Nero Suite-->C:\Programme\Gemeinsame Dateien\Ahead\Uninstall\Setup.exe /uninstall
NVIDIA Drivers-->C:\WINDOWS\system32\nvudisp.exe UninstallGUI
Oblivion-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{35CB6715-41F8-4F99-8881-6FC75BF054B0}\setup.exe" -l0x7  -removeonly
OpenAL-->"C:\Programme\OpenAL\oalinst.exe" /U
OpenOffice.org 3.1-->MsiExec.exe /I{99E862CC-6F69-4D39-99AA-DBF71BF3B585}
OpenVPN 2.1_rc15-->D:\Programme\OpenVPN\Uninstall.exe
Opera 10.60-->MsiExec.exe /X{1D2C96C3-A3F3-49E7-B839-95279DED837F}
Opera 9.22-->MsiExec.exe /X{7AF56274-3D8C-4CCE-AD7A-25FD4D27B9F3}
PDFCreator-->D:\Programme\PDFCreator\unins000.exe
PlayStation(R)Network Downloader-->MsiExec.exe /X{B6659DD8-00A7-4A24-BBFB-C1F6982E5D66}
PlayStation(R)Store-->MsiExec.exe /X{0E532C84-4275-41B3-9D81-D4A1A20D8EE7}
Politikens Nudansk Ordbog med etymologi-->MsiExec.exe /I{8B8A07EC-4DAB-407C-BC4A-AA3A01F569A6}
Presto! PageManager 7.15.14-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{D2D6B9EB-C6DC-4DAA-B4DE-BB7D9735E7DA}\PMSetup.exe" -l0x7 anything -removeonly
Prince of Persia The Sands of Time-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{8C453F13-6877-4D34-8816-009ABDE306DB}\setup.exe" -l0x7
QuickTime-->MsiExec.exe /I{3D9892BB-A751-4E48-ADC8-E4289956CE1D}
Ralink RT2860 Wireless LAN Card-->C:\Programme\InstallShield Installation Information\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}\setup.exe -runfromtemp -l0x0009 -removeonly
Ralink Wireless LAN-->C:\Programme\InstallShield Installation Information\{FAB1F336-1B7C-4057-A7BC-2922CD82A781}\setup.exe -runfromtemp -l0x0009 -removeonly
Realtek AC'97 Audio-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\setup.exe" -l0x7  -removeonly
RGSS-RTP Standard-->MsiExec.exe /I{5A9FE525-8B8F-4701-A937-7F6745A4E9C7}
Rhapsody Player Engine-->MsiExec.exe /I{8A62A068-3FD6-495A-9F66-26FE94F32EC9}
RPGXP-->MsiExec.exe /I{9B34CAC6-738F-4A20-B428-A115C3E3474C}
RTP for RM2K (Png, Wav, Midi, Fonts)-->C:\WINDOWS\UnGins.exe "E:\rtp for rm2k\RTP\install.log"
ScanSoft OmniPage SE 4.0-->MsiExec.exe /I{C1E693A4-B1D5-4DCD-B68D-2087835B7184}
Sicherheitsupdate für Windows Internet Explorer 7 (KB938127)-->"C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 7 (KB938127-v2)-->"C:\WINDOWS\ie7updates\KB938127-v2-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 7 (KB953838)-->"C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 7 (KB956390)-->"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 7 (KB958215)-->"C:\WINDOWS\ie7updates\KB958215-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 7 (KB960714)-->"C:\WINDOWS\ie7updates\KB960714-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 7 (KB961260)-->"C:\WINDOWS\ie7updates\KB961260-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 7 (KB963027)-->"C:\WINDOWS\ie7updates\KB963027-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 7 (KB969897)-->"C:\WINDOWS\ie7updates\KB969897-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 7 (KB972260)-->"C:\WINDOWS\ie7updates\KB972260-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 7 (KB974455)-->"C:\WINDOWS\ie7updates\KB974455-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 7 (KB976325)-->"C:\WINDOWS\ie7updates\KB976325-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 7 (KB978207)-->"C:\WINDOWS\ie7updates\KB978207-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 7 (KB982381)-->"C:\WINDOWS\ie7updates\KB982381-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Media Player (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Media Player (KB954155)-->"C:\WINDOWS\$NtUninstallKB954155_WM9$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Media Player (KB968816)-->"C:\WINDOWS\$NtUninstallKB968816_WM9$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Media Player (KB973540)-->"C:\WINDOWS\$NtUninstallKB973540_WM9$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Media Player (KB978695)-->"C:\WINDOWS\$NtUninstallKB978695_WM9$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Media Player 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Media Player 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Media Player 9 (KB911565)-->"C:\WINDOWS\$NtUninstallKB911565$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB2229593)-->"C:\WINDOWS\$NtUninstallKB2229593$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB938464-v2)-->"C:\WINDOWS\$NtUninstallKB938464-v2$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB950759)-->"C:\WINDOWS\$NtUninstallKB950759$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB951376)-->"C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB953838)-->"C:\WINDOWS\$NtUninstallKB953838$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB953839)-->"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB956744)-->"C:\WINDOWS\$NtUninstallKB956744$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB956844)-->"C:\WINDOWS\$NtUninstallKB956844$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB958690)-->"C:\WINDOWS\$NtUninstallKB958690$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB958869)-->"C:\WINDOWS\$NtUninstallKB958869$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB960715)-->"C:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB960859)-->"C:\WINDOWS\$NtUninstallKB960859$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB961371)-->"C:\WINDOWS\$NtUninstallKB961371$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB961373)-->"C:\WINDOWS\$NtUninstallKB961373$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB961501)-->"C:\WINDOWS\$NtUninstallKB961501$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB968537)-->"C:\WINDOWS\$NtUninstallKB968537$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB969059)-->"C:\WINDOWS\$NtUninstallKB969059$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB969898)-->"C:\WINDOWS\$NtUninstallKB969898$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB969947)-->"C:\WINDOWS\$NtUninstallKB969947$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB970238)-->"C:\WINDOWS\$NtUninstallKB970238$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB970430)-->"C:\WINDOWS\$NtUninstallKB970430$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB971468)-->"C:\WINDOWS\$NtUninstallKB971468$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB971486)-->"C:\WINDOWS\$NtUninstallKB971486$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB971557)-->"C:\WINDOWS\$NtUninstallKB971557$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB971633)-->"C:\WINDOWS\$NtUninstallKB971633$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB971657)-->"C:\WINDOWS\$NtUninstallKB971657$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB971961)-->"C:\WINDOWS\$NtUninstallKB971961$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB972270)-->"C:\WINDOWS\$NtUninstallKB972270$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB973346)-->"C:\WINDOWS\$NtUninstallKB973346$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB973354)-->"C:\WINDOWS\$NtUninstallKB973354$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB973507)-->"C:\WINDOWS\$NtUninstallKB973507$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB973525)-->"C:\WINDOWS\$NtUninstallKB973525$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB973869)-->"C:\WINDOWS\$NtUninstallKB973869$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB973904)-->"C:\WINDOWS\$NtUninstallKB973904$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB974112)-->"C:\WINDOWS\$NtUninstallKB974112$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB974318)-->"C:\WINDOWS\$NtUninstallKB974318$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB974392)-->"C:\WINDOWS\$NtUninstallKB974392$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB974571)-->"C:\WINDOWS\$NtUninstallKB974571$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB975025)-->"C:\WINDOWS\$NtUninstallKB975025$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB975467)-->"C:\WINDOWS\$NtUninstallKB975467$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB975560)-->"C:\WINDOWS\$NtUninstallKB975560$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB975561)-->"C:\WINDOWS\$NtUninstallKB975561$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB975562)-->"C:\WINDOWS\$NtUninstallKB975562$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB975713)-->"C:\WINDOWS\$NtUninstallKB975713$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB977165)-->"C:\WINDOWS\$NtUninstallKB977165$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB977816)-->"C:\WINDOWS\$NtUninstallKB977816$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB977914)-->"C:\WINDOWS\$NtUninstallKB977914$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB978037)-->"C:\WINDOWS\$NtUninstallKB978037$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB978251)-->"C:\WINDOWS\$NtUninstallKB978251$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB978262)-->"C:\WINDOWS\$NtUninstallKB978262$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB978338)-->"C:\WINDOWS\$NtUninstallKB978338$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB978542)-->"C:\WINDOWS\$NtUninstallKB978542$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB978601)-->"C:\WINDOWS\$NtUninstallKB978601$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB978706)-->"C:\WINDOWS\$NtUninstallKB978706$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB979309)-->"C:\WINDOWS\$NtUninstallKB979309$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB979482)-->"C:\WINDOWS\$NtUninstallKB979482$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB979559)-->"C:\WINDOWS\$NtUninstallKB979559$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB979683)-->"C:\WINDOWS\$NtUninstallKB979683$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB980195)-->"C:\WINDOWS\$NtUninstallKB980195$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB980218)-->"C:\WINDOWS\$NtUninstallKB980218$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB980232)-->"C:\WINDOWS\$NtUninstallKB980232$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB981349)-->"C:\WINDOWS\$NtUninstallKB981349$\spuninst\spuninst.exe"
Spybot - Search & Destroy-->"C:\Programme\Spybot - Search & Destroy\unins000.exe"
Steam(TM)-->MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3}
The Fall - Last Days of Gaia-->D:\games\The Fall\setup_res\uninstall.exe
the white chamber: definitive edition 1.7-->D:\games\the white chamber\uninst.exe
The Witcher Enhanced Edition - "Nebenwirkungen"-->"C:\Programme\InstallShield Installation Information\{6D93BD2D-BA71-491A-926C-37FE1580CEE0}\setup.exe" -runfromtemp -l0x0007 -removeonly
The Witcher-->"C:\Programme\InstallShield Installation Information\{F138762F-5A1F-4CF0-A5E1-1588EF6088A4}\setup.exe" -runfromtemp -l0x0007 -removeonly
Tom Clancy's Splinter Cell Double Agent-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{CAD1691A-FA24-4B95-9009-3257B8440ECC}\setup.exe" -l0x7  -removeonly
Tomb Raider: Legend 1.0-->D:\games\Tomb Raider - Legend\uninsttrl.exe
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
Update für Windows Internet Explorer 7 (KB976749)-->"C:\WINDOWS\ie7updates\KB976749-IE7\spuninst\spuninst.exe"
Update für Windows Internet Explorer 7 (KB980182)-->"C:\WINDOWS\ie7updates\KB980182-IE7\spuninst\spuninst.exe"
Update für Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Update für Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Update für Windows XP (KB955759)-->"C:\WINDOWS\$NtUninstallKB955759$\spuninst\spuninst.exe"
Update für Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
Update für Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
Update für Windows XP (KB968389)-->"C:\WINDOWS\$NtUninstallKB968389$\spuninst\spuninst.exe"
Update für Windows XP (KB971737)-->"C:\WINDOWS\$NtUninstallKB971737$\spuninst\spuninst.exe"
Update für Windows XP (KB973687)-->"C:\WINDOWS\$NtUninstallKB973687$\spuninst\spuninst.exe"
Update für Windows XP (KB973815)-->"C:\WINDOWS\$NtUninstallKB973815$\spuninst\spuninst.exe"
VDMSound-->d:\Programme\VDMSound\uninst.exe
VLC media player 0.9.4-->D:\Programme\VideoLAN\VLC\uninstall.exe
Wichtiges Update für Windows Media Player 11 (KB959772)-->"C:\WINDOWS\$NtUninstallKB959772_WM11$\spuninst\spuninst.exe"
WinAce Archiver-->C:\Programme\WinAce\SXUNINST.EXE C:\Programme\WinAce\SXUNINST.INI
Winamp-->"D:\Programme\Winamp\UninstWA.exe"
Windows Genuine Advantage v1.3.0254.0-->MsiExec.exe /I{63569CE9-FA00-469C-AF5C-E5D4D93ACF91}
Windows Media Format 11 runtime-->"C:\Programme\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11-->"C:\Programme\Windows Media Player\Setup_wm.exe" /Uninstall
Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
Windows Media Player Firefox Plugin-->MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}
Windows Presentation Foundation Language Pack (DEU)-->MsiExec.exe /X{92DF2F1B-F63C-4D9A-B3E1-B2D11AE29790}
Windows Presentation Foundation-->MsiExec.exe /X{BAF78226-3200-4DB4-BE33-4D922A799840}
Windows Workflow Foundation DE Language Pack-->MsiExec.exe /I{7228FD8C-3B9E-4204-AE36-8A466107685B}
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
WinFast(R) Display Driver-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{F69FD33C-8815-46BF-9134-A643DE68F3C0}\setup.exe"
WinRAR archiver-->C:\Programme\WinRAR\uninstall.exe
WinSCP 4.1.6-->"C:\Programme\WinSCP\unins000.exe"
XML Paper Specification Shared Components Language Pack 1.0-->"C:\WINDOWS\$NtUninstallXPSEPSCLP$\spuninst\spuninst.exe"
xp-AntiSpy 3.92-->C:\Programme\xp-AntiSpy\uninst.exe

======Hosts File======

127.0.0.1        www.007guard.com
127.0.0.1        007guard.com
127.0.0.1        008i.com
127.0.0.1        www.008k.com
127.0.0.1        008k.com
127.0.0.1        www.00hq.com
127.0.0.1        00hq.com
127.0.0.1        010402.com
127.0.0.1        www.032439.com
127.0.0.1        032439.com

======Security center information======

AV: Avira AntiVir PersonalEdition Classic
AV: Avira AntiVir PersonalEdition Classic
AV: AntiVir Desktop
AV: Avira AntiVir PersonalEdition Classic

======System event log======

Computer Name: ***
Event Code: 2
Message: Device identified.

Record Number: 109536
Source Name: nvatabus
Time Written: 20100617142130.000000+120
Event Type: Informationen
User:

Computer Name: ***
Event Code: 6005
Message: Der Ereignisprotokolldienst wurde gestartet.

Record Number: 109535
Source Name: EventLog
Time Written: 20100617142120.000000+120
Event Type: Informationen
User:

Computer Name: ***
Event Code: 6009
Message: Microsoft (R) Windows (R) 5.01. 2600 Service Pack 3 Uniprocessor Free.

Record Number: 109534
Source Name: EventLog
Time Written: 20100617142120.000000+120
Event Type: Informationen
User:

Computer Name: ***
Event Code: 6006
Message: Der Ereignisprotokolldienst wurde beendet.

Record Number: 109533
Source Name: EventLog
Time Written: 20100617094900.000000+120
Event Type: Informationen
User:

Computer Name: ***
Event Code: 7036
Message: Dienst "IMAPI-CD-Brenn-COM-Dienste" befindet sich jetzt im Status "Beendet".

Record Number: 109532
Source Name: Service Control Manager
Time Written: 20100617094754.000000+120
Event Type: Informationen
User:

=====Application event log=====

Computer Name: ANDRE
Event Code: 100
Message:
Record Number: 10086
Source Name: MySQL
Time Written: 20091020204859.000000+120
Event Type: Informationen
User:

Computer Name: ***
Event Code: 100
Message:
Record Number: 10085
Source Name: MySQL
Time Written: 20091020204147.000000+120
Event Type: Informationen
User:

Computer Name: ***
Event Code: 100
Message:
Record Number: 10084
Source Name: MySQL
Time Written: 20091020204147.000000+120
Event Type: Warnung
User:

Computer Name: ***
Event Code: 100
Message:
Record Number: 10083
Source Name: MySQL
Time Written: 20091020204147.000000+120
Event Type: Informationen
User:

Computer Name: ***
Event Code: 100
Message:
Record Number: 10082
Source Name: MySQL
Time Written: 20091020204146.000000+120
Event Type: Informationen
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;d:\Programme\VDMSound;D:\Programme\QuickTime\QTSystem\
"windir"=%SystemRoot%
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 12 Stepping 0, AuthenticAMD
"PROCESSOR_REVISION"=0c00
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"FP_NO_HOST_CHECK"=NO
"VDMSPath"=d:\Programme\VDMSound
"asl.log"=Destination=file;OnFirstLog=command,environment,parent
"CLASSPATH"=.;C:\Programme\Java\jre6\lib\ext\QTJava.zip
"QTJAVA"=C:\Programme\Java\jre6\lib\ext\QTJava.zip

-----------------EOF-----------------
[B]Logfile of random's system information tool 1.08 (written by random/random)
Code:
Logfile of random's system information tool 1.08 (written by random/random)
Run by admin at 2010-07-21 15:07:41
Microsoft Windows XP Professional Service Pack 3
System drive C: has 322 MB (3%) free of 10 GB
Total RAM: 2047 MB (65% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 15:07:57, on 21.07.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17055)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Avira\AntiVir Desktop\sched.exe
D:\adobe\elements\PhotoshopElementsFileAgent.exe
C:\Programme\Avira\AntiVir Desktop\avguard.exe
C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Programme\Bonjour\mDNSResponder.exe
C:\Programme\Java\jre6\bin\jqs.exe
C:\Programme\RALINK\Common\RalinkRegistryWriter.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Avira\AntiVir Desktop\avshadow.exe
C:\WINDOWS\system32\UAService7.exe
C:\Programme\iPod\bin\iPodService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
D:\adobe\elements\apdproxy.exe
D:\Programme\ScanSoft OmniPage\OpwareSE4.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe
C:\Programme\Canon\MyPrinter\BJMyPrt.exe
D:\Programme\Winamp\winampa.exe
C:\Programme\Avira\AntiVir Desktop\avgnt.exe
C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtProc.exe
C:\Programme\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\RALINK\Common\RaUI.exe
C:\Programme\MicroStar\WLANUtility\WlanUtility.exe
C:\Programme\MicroStar\WLANUtility\WLAN_Service.exe
D:\Programme\Opera\Opera.exe
D:\Programme\CCleaner\ccleaner.exe
Z:\RSIT.exe
C:\Programme\trend micro\admin.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: ActiveX Control - {357AD019-1EC1-48C7-A771-8DF993344BB0} - C:\WINDOWS\system32\msehc.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\PROGRA~1\FREEDO~1\iefdmcks.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Adobe Photo Downloader] "D:\adobe\elements\apdproxy.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Programme\Gemeinsame Dateien\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "D:\Programme\ScanSoft OmniPage\OpwareSE4.exe"
O4 - HKLM\..\Run: [WrtMon.exe] C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Programme\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Programme\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [WinampAgent] D:\Programme\Winamp\winampa.exe
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\adobe\Adobe_CS3\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [QuickTime Task] "D:\Programme\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programme\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Programme\RALINK\Common\RaUI.exe
O4 - Global Startup: WlanUtility.lnk = C:\Programme\MicroStar\WLANUtility\WlanUtility.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - D:\Programme\icq6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - D:\Programme\icq6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1120334696046
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} (Java Plug-in 1.6.0_02) -
O16 - DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} (Java Plug-in 1.6.0_11) -
O17 - HKLM\System\CCS\Services\Tcpip\..\{3DA41E87-3EFA-4847-80BC-47996343A4E8}: NameServer = 69.50.176.156,195.225.176.31
O20 - Winlogon Notify: tuvvwur - tuvvwur.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Active File Monitor V5 (AdobeActiveFileMonitor5.0) - Unknown owner - D:\adobe\elements\PhotoshopElementsFileAgent.exe
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Dienst "Bonjour" (Bonjour Service) - Apple Inc. - C:\Programme\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: OpenVPN Service (OpenVPNService) - Unknown owner - D:\Programme\OpenVPN\bin\openvpnserv.exe
O23 - Service: Ralink Registry Writer (RalinkRegistryWriter) - Ralink Technology, Corp. - C:\Programme\RALINK\Common\RalinkRegistryWriter.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe

--
End of file - 9340 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-23 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{357AD019-1EC1-48C7-A771-8DF993344BB0}]
ActiveX Control - C:\WINDOWS\system32\msehc.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CC59E0F9-7E43-44FA-9FAA-8377850BF205}]
FDMIECookiesBHO Class - C:\PROGRA~1\FREEDO~1\iefdmcks.dll [2006-08-20 81920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Programme\Java\jre6\bin\jp2ssv.dll [2010-04-12 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-04-12 79648]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2006-10-22 7700480]
"nwiz"=nwiz.exe /install []
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2006-10-22 86016]
"SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2006-11-17 577536]
"Adobe Photo Downloader"=D:\adobe\elements\apdproxy.exe [2006-12-22 67752]
"SSBkgdUpdate"=C:\Programme\Gemeinsame Dateien\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [2006-09-28 185896]
"OpwareSE4"=D:\Programme\ScanSoft OmniPage\OpwareSE4.exe [2006-10-11 75304]
"WrtMon.exe"=C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe [2006-09-20 20480]
"CanonSolutionMenu"=C:\Programme\Canon\SolutionMenu\CNSLMAIN.exe [2007-05-15 644696]
"CanonMyPrinter"=C:\Programme\Canon\MyPrinter\BJMyPrt.exe [2007-04-04 1603152]
"WinampAgent"=D:\Programme\Winamp\winampa.exe [2009-07-01 37888]
"avgnt"=C:\Programme\Avira\AntiVir Desktop\avgnt.exe [2010-03-02 282792]
"Adobe Reader Speed Launcher"=D:\adobe\Adobe_CS3\Reader\Reader_sl.exe [2008-10-15 39792]
"SunJavaUpdateSched"=C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe [2010-02-18 248040]
"KernelFaultCheck"=C:\WINDOWS\system32\dumprep 0 -k []
"QuickTime Task"=D:\Programme\QuickTime\QTTask.exe [2010-03-18 421888]
"iTunesHelper"=C:\Programme\iTunes\iTunesHelper.exe [2010-06-15 141624]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe [2002-03-28 188416]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Programme\iTunes\iTunesHelper.exe [2010-06-15 141624]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
C:\WINDOWS\system32\dumprep 0 -k []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
D:\games\halflife\\Steam.exe [2008-09-04 1271032]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe  -osboot []

C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart
Microsoft Office.lnk - C:\Programme\Microsoft Office\Office\OSA9.EXE
Ralink Wireless Utility.lnk - C:\Programme\RALINK\Common\RaUI.exe
WlanUtility.lnk - C:\Programme\MicroStar\WLANUtility\WlanUtility.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\tuvvwur]
tuvvwur.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2008-09-06 267304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Programme\ICQLite\ICQLite.exe"="C:\Programme\ICQLite\ICQLite.exe:*:Enabled:ICQ Lite"
"C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe"="C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe:*:Disabled:Kerio Personal Firewall 4 - GUI"
"D:\games\halflife\Steam.exe"="D:\games\halflife\Steam.exe:*:Enabled:Steam"
"Z:\downloader\eMule\emule.exe"="Z:\downloader\eMule\emule.exe:*:Enabled:eMule"
"C:\Programme\OpenVPN\bin\openvpn.exe"="C:\Programme\OpenVPN\bin\openvpn.exe:*:Enabled:openvpn"
"D:\games\halflife\SteamApps\biberbruder34\counter-strike source\hl2.exe"="D:\games\halflife\SteamApps\biberbruder34\counter-strike source\hl2.exe:*:Enabled:hl2"
"D:\games\halflife\SteamApps\biberbruder34\half-life 2 deathmatch\hl2.exe"="D:\games\halflife\SteamApps\biberbruder34\half-life 2 deathmatch\hl2.exe:*:Enabled:hl2"
"D:\UnrealTournament\System\TacticalOps.exe"="D:\UnrealTournament\System\TacticalOps.exe:*:Enabled:TacticalOps"
"D:\games\halflife\SteamApps\biberbruder34\half-life 2\hl2.exe"="D:\games\halflife\SteamApps\biberbruder34\half-life 2\hl2.exe:*:Enabled:hl2"
"C:\Programme\MicroStar\WLANUtility\APUtility.exe"="C:\Programme\MicroStar\WLANUtility\APUtility.exe:*:Enabled:APUtility Configs AP "
"C:\Programme\Opera\Opera.exe"="C:\Programme\Opera\Opera.exe:*:Enabled:Opera Internet Browser"
"D:\games\halflife\SteamApps\common\lost planet demo\LostPlanetDX9.exe"="D:\games\halflife\SteamApps\common\lost planet demo\LostPlanetDX9.exe:*:Disabled:LostPlanetDX9"
"D:\games\halflife\SteamApps\common\defcon\defcon.exe"="D:\games\halflife\SteamApps\common\defcon\defcon.exe:*:Enabled:Defcon"
"C:\Dokumente und Einstellungen\alki\Lokale Einstellungen\Temp\Rar$EX00.328\jabbin-2.0beta-win\Jabbin.exe"="C:\Dokumente und Einstellungen\alki\Lokale Einstellungen\Temp\Rar$EX00.328\jabbin-2.0beta-win\Jabbin.exe:*:Enabled:Jabbin"
"C:\Dokumente und Einstellungen\alki\Lokale Einstellungen\Temp\Rar$EX00.360\jabbin-2.0beta-win\Jabbin.exe"="C:\Dokumente und Einstellungen\alki\Lokale Einstellungen\Temp\Rar$EX00.360\jabbin-2.0beta-win\Jabbin.exe:*:Enabled:Jabbin"
"C:\Dokumente und Einstellungen\alki\Lokale Einstellungen\Temp\Rar$EX00.219\jabbin-2.0beta-win\Jabbin.exe"="C:\Dokumente und Einstellungen\alki\Lokale Einstellungen\Temp\Rar$EX00.219\jabbin-2.0beta-win\Jabbin.exe:*:Enabled:Jabbin"
"C:\Dokumente und Einstellungen\alki\Lokale Einstellungen\Temp\Rar$EX01.094\jabbin-2.0beta-win\Jabbin.exe"="C:\Dokumente und Einstellungen\alki\Lokale Einstellungen\Temp\Rar$EX01.094\jabbin-2.0beta-win\Jabbin.exe:*:Enabled:Jabbin"
"C:\Dokumente und Einstellungen\alki\Lokale Einstellungen\Temp\Rar$EX00.062\jabbin-2.0beta-win\Jabbin.exe"="C:\Dokumente und Einstellungen\alki\Lokale Einstellungen\Temp\Rar$EX00.062\jabbin-2.0beta-win\Jabbin.exe:*:Enabled:Jabbin"
"C:\Dokumente und Einstellungen\alki\Desktop\jabbin-2.0beta-4-win\jabbin-2.0beta-win\Jabbin.exe"="C:\Dokumente und Einstellungen\alki\Desktop\jabbin-2.0beta-4-win\jabbin-2.0beta-win\Jabbin.exe:*:Enabled:Jabbin"
"C:\Programme\Skype\Phone\Skype.exe"="C:\Programme\Skype\Phone\Skype.exe:*:Enabled:Skype"
"D:\games\Warcraft III\Warcraft III.exe"="D:\games\Warcraft III\Warcraft III.exe:*:Enabled:Warcraft III"
"C:\Programme\ICQ6\ICQ.exe"="C:\Programme\ICQ6\ICQ.exe:*:Enabled:ICQ6"
"E:\games\splinter cell_double agent\SCDA-Online\System\SCDA_online.exe"="E:\games\splinter cell_double agent\SCDA-Online\System\SCDA_online.exe:*:Enabled:SCDA_online"
"E:\games\splinter cell_double agent\SCDA-Offline\System\SplinterCell4.exe"="E:\games\splinter cell_double agent\SCDA-Offline\System\SplinterCell4.exe:*:Enabled:SplinterCell4"
"D:\games\halflife\SteamApps\biberbruder34\dark messiah might and magic multi-player\mm.exe"="D:\games\halflife\SteamApps\biberbruder34\dark messiah might and magic multi-player\mm.exe:*:Enabled:mm"
"C:\Programme\Miranda IM\miranda32.exe"="C:\Programme\Miranda IM\miranda32.exe:*:Enabled:Miranda IM"
"C:\Programme\Winamp Remote\bin\Orb.exe"="C:\Programme\Winamp Remote\bin\Orb.exe:*:Enabled:Orb"
"C:\Programme\Winamp Remote\bin\OrbTray.exe"="C:\Programme\Winamp Remote\bin\OrbTray.exe:*:Enabled:OrbTray"
"C:\Programme\Winamp Remote\bin\OrbStreamerClient.exe"="C:\Programme\Winamp Remote\bin\OrbStreamerClient.exe:*:Enabled:Orb Stream Client"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Programme\MSN Messenger\msnmsgr.exe"="C:\Programme\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Programme\MSN Messenger\livecall.exe"="C:\Programme\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"E:\xampplite\mysql\bin\mysqld.exe"="E:\xampplite\mysql\bin\mysqld.exe:*:Enabled:mysqld"
"E:\xampplite\apache\bin\httpd.exe"="E:\xampplite\apache\bin\httpd.exe:*:Enabled:Apache HTTP Server"
"D:\Programme\Miranda IM\miranda32.exe"="D:\Programme\Miranda IM\miranda32.exe:*:Enabled:Miranda IM"
"D:\Programme\Opera\opera.exe"="D:\Programme\Opera\opera.exe:*:Enabled:Opera Internet Browser"
"E:\xampplite\xampplite\mysql\bin\mysqld.exe"="E:\xampplite\xampplite\mysql\bin\mysqld.exe:*:Enabled:mysqld"
"E:\xampplite\xampplite\apache\bin\httpd.exe"="E:\xampplite\xampplite\apache\bin\httpd.exe:*:Enabled:Apache HTTP Server"
"D:\Programme\icq6.5\ICQ.exe"="D:\Programme\icq6.5\ICQ.exe:*:Enabled:ICQ6"
"Z:\xampplite\apache\bin\httpd.exe"="Z:\xampplite\apache\bin\httpd.exe:*:Enabled:Apache HTTP Server"
"Z:\xampplite\mysql\bin\mysqld.exe"="Z:\xampplite\mysql\bin\mysqld.exe:*:Enabled:The MySQL Server"
"C:\Programme\Bonjour\mDNSResponder.exe"="C:\Programme\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Programme\iTunes\iTunes.exe"="C:\Programme\iTunes\iTunes.exe:*:Enabled:iTunes"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Programme\MSN Messenger\msnmsgr.exe"="C:\Programme\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Programme\MSN Messenger\livecall.exe"="C:\Programme\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

======File associations======

.js - edit -
.js - open -
.txt - open -

======List of files/folders created in the last 1 months======

2010-07-21 15:07:41 ----D---- C:\rsit
2010-07-21 15:07:41 ----D---- C:\Programme\trend micro
2010-07-21 15:01:17 ----D---- C:\Dokumente und Einstellungen\admin\Anwendungsdaten\Opera
2010-07-20 11:15:36 ----D---- C:\Dokumente und Einstellungen\admin\Anwendungsdaten\Avira
2010-07-20 11:14:18 ----D---- C:\Dokumente und Einstellungen\admin\Anwendungsdaten\Malwarebytes
2010-07-20 11:14:08 ----A---- C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2010-07-20 11:14:06 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
2010-07-20 11:14:06 ----A---- C:\WINDOWS\system32\drivers\mbam.sys
2010-07-20 10:25:30 ----D---- C:\Dokumente und Einstellungen\admin\Anwendungsdaten\Winamp
2010-07-20 10:25:00 ----D---- C:\Dokumente und Einstellungen\admin\Anwendungsdaten\Adobe
2010-07-20 10:03:13 ----D---- C:\Dokumente und Einstellungen\admin\Anwendungsdaten\Apple Computer
2010-07-20 10:02:57 ----D---- C:\Dokumente und Einstellungen\admin\Anwendungsdaten\Identities
2010-07-20 10:02:41 ----SD---- C:\Dokumente und Einstellungen\admin\Anwendungsdaten\Microsoft
2010-07-20 10:02:41 ----ASH---- C:\Dokumente und Einstellungen\admin\Anwendungsdaten\desktop.ini
2010-07-15 13:27:40 ----HDC---- C:\WINDOWS\$NtUninstallKB2229593$
2010-07-08 11:49:54 ----D---- C:\WINDOWS\system32\NtmsData
2010-06-28 15:41:13 ----A---- C:\WINDOWS\system32\GEARAspi.dll
2010-06-28 15:41:13 ----A---- C:\WINDOWS\system32\drivers\GEARAspiWDM.sys
2010-06-28 15:40:44 ----D---- C:\Programme\iPod
2010-06-28 15:40:40 ----D---- C:\Programme\iTunes
2010-06-28 15:40:40 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-06-28 15:39:16 ----A---- C:\WINDOWS\system32\drivers\usbaapl.sys
2010-06-28 15:39:15 ----A---- C:\WINDOWS\system32\usbaaplrc.dll
2010-06-28 15:39:04 ----D---- C:\Programme\Bonjour
2010-06-28 15:38:58 ----D---- C:\Programme\Gemeinsame Dateien\Apple

======List of files/folders modified in the last 1 months======

2010-07-21 15:07:41 ----RD---- C:\Programme
2010-07-21 15:07:39 ----D---- C:\WINDOWS\Prefetch
2010-07-21 15:00:09 ----D---- C:\WINDOWS\Temp
2010-07-21 12:38:56 ----SHD---- C:\WINDOWS\Installer
2010-07-21 12:38:56 ----A---- C:\WINDOWS\ODBC.INI
2010-07-21 11:47:34 ----D---- C:\WINDOWS\system32\CatRoot2
2010-07-21 01:06:01 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-07-20 15:20:10 ----D---- C:\WINDOWS\Registration
2010-07-20 11:14:08 ----D---- C:\WINDOWS\system32\drivers
2010-07-20 10:06:46 ----SD---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft
2010-07-20 10:02:59 ----A---- C:\WINDOWS\OEWABLog.txt
2010-07-20 10:02:41 ----D---- C:\Dokumente und Einstellungen
2010-07-19 19:27:17 ----D---- C:\WINDOWS\system32
2010-07-15 16:56:19 ----D---- C:\WINDOWS
2010-07-15 13:27:46 ----HD---- C:\WINDOWS\inf
2010-07-15 13:27:43 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-07-15 13:27:36 ----HD---- C:\WINDOWS\$hf_mig$
2010-07-08 11:49:54 ----D---- C:\WINDOWS\repair
2010-07-02 21:39:05 ----A---- C:\WINDOWS\system32\MRT.exe
2010-06-28 15:41:16 ----D---- C:\WINDOWS\system32\CatRoot
2010-06-28 15:41:13 ----DC---- C:\WINDOWS\system32\DRVSTORE
2010-06-28 15:39:58 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Apple Computer
2010-06-28 15:39:17 ----D---- C:\WINDOWS\system32\ReinstallBackups
2010-06-28 15:38:58 ----D---- C:\Programme\Gemeinsame Dateien
2010-06-24 10:51:03 ----D---- C:\WINDOWS\Microsoft.NET
2010-06-24 10:51:01 ----RSD---- C:\WINDOWS\assembly
2010-06-24 01:30:09 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-06-24 01:30:02 ----D---- C:\WINDOWS\WinSxS

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 nv_agp;NVIDIA nForce AGP Bus Filter; C:\WINDOWS\System32\DRIVERS\nv_agp.sys [2003-10-29 21120]
R0 nvatabus;nvatabus; C:\WINDOWS\System32\DRIVERS\nvatabus.sys [2004-06-03 79360]
R0 ohci1394;VIA OHCI-konformer IEEE 1394-Hostcontroller; C:\WINDOWS\System32\DRIVERS\ohci1394.sys [2008-04-13 61696]
R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\DRIVERS\PxHelp20.sys [2009-04-28 44944]
R0 sfdrv01;StarForce Protection Environment Driver (version 1.x); C:\WINDOWS\System32\drivers\sfdrv01.sys [2005-03-03 48640]
R0 sfhlp02;StarForce Protection Helper Driver (version 2.x); C:\WINDOWS\System32\drivers\sfhlp02.sys [2005-02-23 6656]
R0 sfsync02;StarForce Protection Synchronization Driver (version 2.x); C:\WINDOWS\System32\drivers\sfsync02.sys [2004-12-03 20544]
R1 AmdK8;AMD Athlon64 Processor Driver; C:\WINDOWS\System32\DRIVERS\AmdK8.sys [2003-11-07 35328]
R1 avgio;avgio; \??\C:\Programme\Avira\AntiVir Desktop\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2010-03-01 124784]
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2009-05-11 28520]
R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.7.5.0; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2003-01-01 21361]
R2 atksgt;atksgt; C:\WINDOWS\system32\DRIVERS\atksgt.sys [2007-12-16 278984]
R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2010-02-16 60936]
R2 ithsgt;ithsgt; C:\WINDOWS\system32\DRIVERS\ithsgt.sys [2005-10-28 162432]
R2 lilsgt;lilsgt; C:\WINDOWS\system32\DRIVERS\lilsgt.sys [2005-10-28 12032]
R2 lirsgt;lirsgt; C:\WINDOWS\system32\DRIVERS\lirsgt.sys [2007-12-16 25416]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2007-03-08 4027840]
R3 Arp1394;1394-ARP-Clientprotokoll; C:\WINDOWS\System32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600]
R3 HidUsb;Microsoft HID Class-Treiber; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 mouhid;Maus-HID-Treiber; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-08-18 12288]
R3 NIC1394;1394-Netzwerktreiber; C:\WINDOWS\System32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\System32\DRIVERS\nvnetbus.sys [2004-05-17 12928]
R3 PCANDIS5;PCANDIS5 NDIS Protocol Driver; \??\C:\WINDOWS\system32\PCANDIS5.SYS []
R3 pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2003-10-24 10368]
R3 RT2500;RT2500 Wireless Driver; C:\WINDOWS\system32\DRIVERS\RT2500.sys [2004-12-15 218368]
R3 S3SAVAGE4M;S3SAVAGE4M; C:\WINDOWS\system32\DRIVERS\s3sav4m.sys [2001-08-17 77824]
R3 tap0901;TAP-Win32 Adapter V9; C:\WINDOWS\system32\DRIVERS\tap0901.sys [2008-11-19 25216]
S1 kbdhid;Tastatur-HID-Treiber; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14720]
S3 61883;61883-Einheitsgerät; C:\WINDOWS\system32\DRIVERS\61883.sys [2008-04-13 48128]
S3 ALCXSENS;Service for WDM 3D Audio Driver; C:\WINDOWS\system32\drivers\ALCXSENS.SYS []
S3 Avc;AVC-Gerät; C:\WINDOWS\system32\DRIVERS\avc.sys [2008-04-13 38912]
S3 Bridge;MAC-Brücke; C:\WINDOWS\system32\DRIVERS\bridge.sys [2008-04-13 71552]
S3 BridgeMP;MAC-Brückenminiport; C:\WINDOWS\system32\DRIVERS\bridge.sys [2008-04-13 71552]
S3 CCDECODE;Untertiteldecoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 ENTECH;ENTECH; \??\C:\WINDOWS\System32\DRIVERS\ENTECH.SYS []
S3 GMSIPCI;GMSIPCI; \??\F:\INSTALL\GMSIPCI.SYS []
S3 hcw95bda;Hauppauge MOD7700 Tuner Driver; C:\WINDOWS\System32\Drivers\hcw95bda.sys [2007-04-04 467456]
S3 hcw95rc;Hauppauge MOD7700 IR Driver; C:\WINDOWS\system32\DRIVERS\hcw95rc.sys [2007-04-04 15488]
S3 M2500;802.11g Wireless Network Driver; C:\WINDOWS\System32\DRIVERS\M2500.sys [2004-06-24 191360]
S3 MPE;BDA MPE-Filter; C:\WINDOWS\system32\DRIVERS\MPE.sys [2008-04-13 15232]
S3 MSDV;Microsoft DV Camera and VCR; C:\WINDOWS\system32\DRIVERS\msdv.sys [2008-04-13 51200]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink-Konvertierung; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI-Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV-/Videoverbindung; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 nv;nv; C:\WINDOWS\System32\DRIVERS\nv4_mini.sys [2006-10-22 3994624]
S3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\System32\DRIVERS\NVENETFD.sys [2004-05-17 33280]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 sony_ssm.sys;sony_ssm.sys; \??\C:\DOKUME~1\alki\LOKALE~1\Temp\sony_ssm.sys []
S3 streamip;BDA-IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 tap0801;TAP-Win32 Adapter V8; C:\WINDOWS\system32\DRIVERS\tap0801.sys [2006-04-12 23552]
S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2010-04-19 41984]
S3 usbccgp;Microsoft Standard-USB-Haupttreiber; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbprint;Microsoft USB-Druckerklasse; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;USB-Scannertreiber; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;USB-Massenspeichertreiber; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WSTCODEC;World Standard Teletext-Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeActiveFileMonitor5.0;Adobe Active File Monitor V5; D:\adobe\elements\PhotoshopElementsFileAgent.exe [2006-12-22 108712]
R2 AntiVirSchedulerService;Avira AntiVir Planer; C:\Programme\Avira\AntiVir Desktop\sched.exe [2010-02-24 135336]
R2 AntiVirService;Avira AntiVir Guard; C:\Programme\Avira\AntiVir Desktop\avguard.exe [2010-04-01 267432]
R2 Apple Mobile Device;Apple Mobile Device; C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2010-06-10 144176]
R2 Bonjour Service;Dienst "Bonjour"; C:\Programme\Bonjour\mDNSResponder.exe [2010-05-18 345376]
R2 JavaQuickStarterService;Java Quick Starter; C:\Programme\Java\jre6\bin\jqs.exe [2010-04-12 153376]
R2 RalinkRegistryWriter;Ralink Registry Writer; C:\Programme\RALINK\Common\RalinkRegistryWriter.exe [2008-04-23 69632]
R2 UserAccess7;SecuROM User Access Service (V7); C:\WINDOWS\system32\UAService7.exe [2007-06-10 122880]
R3 iPod Service;iPod-Dienst; C:\Programme\iPod\bin\iPodService.exe [2010-06-15 540472]
S2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2006-10-22 159810]
S3 Adobe LM Service;Adobe LM Service; C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe [2008-03-03 72704]
S3 aspnet_state;ASP.NET-Zustandsdienst; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 IDriverT;InstallDriver Table Manager; C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 OpenVPNService;OpenVPN Service; D:\Programme\OpenVPN\bin\openvpnserv.exe [2008-11-19 15872]
S3 ose;Office Source Engine; C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 WMPNetworkSvc;Windows Media Player-Netzwerkfreigabedienst; C:\Programme\Windows Media Player\WMPNetwk.exe [2006-11-03 920576]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Net.Tcp-Portfreigabedienst; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

kira 22.07.2010 04:54
Hallo und Herzlich Willkommen! :)

- Die Anweisungen bitte gründlich lesen und immer streng einhalten, da ich die Reihenfolge nach bestimmten Kriterien vorbereitet habe:
Deine persönlichen Angaben/Daten (die persönliche Merkmale enthalten, wie Name, Seriennummer etc) kannst Du aus dem geposteten Logs heraus löschen

1.
lade Dir TrendMicro™ HijackThis™/Version 2.0.4 - *von hier* herunter
HijackThis starten→ "Do a system scan and save a logfile" klicken→ das erhaltene Logfile "markieren" → "kopieren"→ hier in deinem Thread (rechte Maustaste) "einfügen"

2.
Bitte Versteckte - und Systemdateien sichtbar machen den Link hier anklicken:
System-Dateien und -Ordner unter XP und Vista sichtbar machen
Am Ende unserer Arbeit, kannst wieder rückgängig machen!

3.
→ Lade Dir HJTscanlist.zip herunter
→ entpacke die Datei auf deinem Desktop
→ Bei WindowsXP Home musst vor dem Scan zusätzlich tasklist.zip installieren
→ per Doppelklick starten
→ Wähle dein Betriebsystem aus - Vista
→ Wenn Du gefragt wirst, die Option "Einstellung" (1) - scanlist" wählen
→ Nach kurzer Zeit sollte sich Dein Editor öffnen und die Datei hjtscanlist.txt präsentieren
→ Bitte kopiere den Inhalt hier in Deinen Thread.

4.
Ich würde gerne noch all deine installierten Programme sehen:
Lade dir das Tool ccleaner herunter
installieren ("Füge CCleaner Yahoo! Toolbar hinzu" abwählen)→ starten→ falls nötig - unter Options settings-> "german" einstellen
dann klick auf "Extra (um die installierten Programme auch anzuzeigen)→ weiter auf "Als Textdatei speichern..."
wird eine Textdatei (*.txt) erstellt, kopiere dazu den Inhalt und füge ihn da ein

5.
Achtung!:
WENN GMER NICHT AUSGEFÜHRT WERDEN KANN ODER PROBMLEME VERURSACHT, fahre mit dem nächsten Punkt fort!- Es ist NICHT sinnvoll einen zweiten Versuch zu starten!
Um einen tieferen Einblick in dein System, um eine mögliche Infektion mit einem Rootkit/Info v.wikipedia.org) aufzuspüren, werden wir ein Tool - Gmer - einsetzen :
  • - also lade Dir Gmer herunter und entpacke es auf deinen Desktop
    - starte gmer.exe
    - [b]schließe alle Programme, ausserdem Antiviren und andere Schutzprogramme usw müssen deaktiviert sein, keine Verbindung zum Internet, WLAN auch trennen)
    - bitte nichts am Pc machen während der Scan läuft!
    - klicke auf "Scan", um das Tool zu starten
    - wenn der Scan fertig ist klicke auf "Copy" (das Log wird automatisch in die Zwischenablage kopiert) und mit STRG + V musst Du gleich da einfügen
    - mit "Ok" wird Gmer beendet.
    - das Log aus der Zwischenablage hier in Deinem Thread vollständig hineinkopieren

** keine Verbindung zu einem Netzwerk und Internet - WLAN nicht vergessen
Wenn der Scan beendet ist, bitte alle Programme und Tools wieder aktivieren!

6.
Lade und installiere das Tool RootRepeal herunter
  • setze einen Hacken bei: "Drivers"-> "Scan"-> Save Report"...
  • "Stealth Objects" -> "Scan"-> Save Report"...
  • "Hidden Services" -> "Scan"-> Save Report"...
  • speichere das Logfile als "RootRepeal.txt" auf dem Desktop und Kopiere den Inhalt hier in den Thread

7.
Code:
eMule
Zitat:
Internet-Tauschbörsen gehören leider zu den unseriösesten Anbietern, und dort werden sehr viele Schädlinge verbreitet, hierbei sollte deshalb, wenn überhaupt, nur ganz besonders vorsichtig umgegangen werden ! Laut Studien sind bei den Tauschbörsen bei 45% der zum Download angebotenen Dateien, Viren oder Würmer und sonstige Schädlinge enthalten!
Hinzu kommt noch, dass die meisten Downloads von diesen Tauschbörsen eh illegal sind, und damit die Nutzer verleitet werden, „Straftaten“ zu begehen!
Selbst wenn du ein „sicheres“ P2P Programm verwendest, ist es nur das Programm, das sicher ist.Du wirst Daten von "uncertified Quellen" teilen, und diese werden häufig angesteckt...;)

Damit dein Thread übersichtlicher und schön lesbar bleibt, am besten nutze den Code-Tags für deinen Post:
→ vor dein log schreibst du:[code]
hier kommt dein logfile rein
→ dahinter:[/code]

** Möglichst nicht ins internet gehen, kein Online-Banking, File-sharing, Chatprogramme usw
gruß
Coverflow

dante_222 22.07.2010 11:08
Hi Coverflow! Danke soweit! :)

Hier sind die Logfiles. Während ich allerdings mit RootRepeal nach HiddenServices suchte, kam es selbst nach zwei Versuchen zu keinem Ergebnis, weil alles nach eine Weile stillstand, die Maus sich nicht mehr rührte, usw. Daher musste ich neustarten . . .

1. HijackThis
Code:
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 06:18:17, on 22.07.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17055)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Avira\AntiVir Desktop\sched.exe
D:\adobe\elements\PhotoshopElementsFileAgent.exe
C:\Programme\Avira\AntiVir Desktop\avguard.exe
C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Programme\Bonjour\mDNSResponder.exe
C:\Programme\Java\jre6\bin\jqs.exe
C:\Programme\RALINK\Common\RalinkRegistryWriter.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Avira\AntiVir Desktop\avshadow.exe
C:\WINDOWS\system32\UAService7.exe
C:\Programme\iPod\bin\iPodService.exe
C:\WINDOWS\System32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
D:\adobe\elements\apdproxy.exe
D:\Programme\ScanSoft OmniPage\OpwareSE4.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe
C:\Programme\Canon\MyPrinter\BJMyPrt.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtProc.exe
D:\Programme\Winamp\winampa.exe
C:\Programme\Avira\AntiVir Desktop\avgnt.exe
C:\Programme\iTunes\iTunesHelper.exe
C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\RALINK\Common\RaUI.exe
C:\Programme\MicroStar\WLANUtility\WlanUtility.exe
C:\Programme\MicroStar\WLANUtility\WLAN_Service.exe
D:\Programme\Opera\Opera.exe
C:\WINDOWS\system32\msiexec.exe
D:\Programme\hijackthis\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = hxxp://www.ccleaner.com/help/?v=2.33.1184&l=1031
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {357AD019-1EC1-48C7-A771-8DF993344BB0} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\PROGRA~1\FREEDO~1\iefdmcks.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Adobe Photo Downloader] "D:\adobe\elements\apdproxy.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Programme\Gemeinsame Dateien\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "D:\Programme\ScanSoft OmniPage\OpwareSE4.exe"
O4 - HKLM\..\Run: [WrtMon.exe] C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Programme\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Programme\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [WinampAgent] D:\Programme\Winamp\winampa.exe
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [QuickTime Task] "D:\Programme\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programme\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\adobe\Adobe_CS3\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Programme\RALINK\Common\RaUI.exe
O4 - Global Startup: WlanUtility.lnk = C:\Programme\MicroStar\WLANUtility\WlanUtility.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - D:\Programme\icq6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - D:\Programme\icq6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1120334696046
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} (Java Plug-in 1.6.0_02) -
O16 - DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} (Java Plug-in 1.6.0_11) -
O17 - HKLM\System\CCS\Services\Tcpip\..\{3DA41E87-3EFA-4847-80BC-47996343A4E8}: NameServer = 69.50.176.156,195.225.176.31
O20 - Winlogon Notify: tuvvwur - tuvvwur.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Active File Monitor V5 (AdobeActiveFileMonitor5.0) - Unknown owner - D:\adobe\elements\PhotoshopElementsFileAgent.exe
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Dienst "Bonjour" (Bonjour Service) - Apple Inc. - C:\Programme\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle - C:\Programme\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: OpenVPN Service (OpenVPNService) - Unknown owner - D:\Programme\OpenVPN\bin\openvpnserv.exe
O23 - Service: Ralink Registry Writer (RalinkRegistryWriter) - Ralink Technology, Corp. - C:\Programme\RALINK\Common\RalinkRegistryWriter.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe

--
End of file - 9537 bytes

2. erledigt

3. hjtscanlist.txt
Code:

                        $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
                        º                                    º
                                    hjtscanlist v2.0             
                        º                                    º
                        $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

Microsoft Windows XP [Version 5.1.2600]
 
 
C:

  21.07.2010 22:04      C:\Temp --------- 0
  21.07.2010 21:03      C:\WINDOWS --------- 0
  21.07.2010 20:10      C:\Programme --------- 0
  21.07.2010 15:12      C:\RECYCLER --------- 0
  21.07.2010 15:07      C:\rsit --------- 0
  20.07.2010 10:02      C:\Dokumente und Einstellungen --------- 0
  22.02.2010 02:10      C:\tmp --------- 0
  27.11.2009 20:13      C:\Fahrplan mit Heiligabend und Silvester 2009 --------- 0
  07.09.2009 12:34      C:\bink_log.txt --------- 7801
  07.09.2009 12:23      C:\sound_bank_log.txt --------- 560
  25.07.2009 23:04      C:\sqmdata02.sqm --------- 268
  25.07.2009 23:04      C:\sqmnoopt02.sqm --------- 244
  10.04.2009 20:56      C:\sqmdata01.sqm --------- 268
  10.04.2009 20:56      C:\sqmnoopt01.sqm --------- 244
  04.03.2009 20:20      C:\ntldr --------- 251712
  01.05.2008 15:21      C:\temp.log --------- 2146
  23.03.2008 21:17      C:\uniTvTv.log --------- 676
  25.12.2007 13:55      C:\AdobeDebug.txt --------- 0
  21.07.2007 12:07      C:\HEUREKA --------- 0
  27.03.2007 21:49      C:\Program Files --------- 0
  27.03.2007 21:29      C:\durktus.txt --------- 11230
  27.03.2007 21:27      C:\index.html --------- 99
  16.09.2006 20:31      C:\boot.ini --------- 211
  16.03.2006 08:11      C:\audiograbber --------- 0
  14.12.2005 22:44      C:\NVIDIA --------- 0
  26.01.2005 21:45      C:\System Volume Information --------- 0
  26.01.2005 20:54      C:\NTDETECT.COM --------- 47564
  17.11.2004 22:58      C:\CONFIG.SYS --------- 0
  17.11.2004 22:58      C:\AUTOEXEC.BAT --------- 0
  17.11.2004 22:58      C:\MSDOS.SYS --------- 0
  17.11.2004 22:58      C:\IO.SYS --------- 0
  01.01.2003 03:42      C:\sqmdata00.sqm --------- 268
  01.01.2003 03:42      C:\sqmnoopt00.sqm --------- 244
  18.08.2001 14:00      C:\bootfont.bin --------- 4952
----------------------------------------

 
C:\WINDOWS

  22.07.2010 06:13    C:\WINDOWS\WindowsUpdate.log --------- 1728987
  21.07.2010 21:03    C:\WINDOWS\0.log --------- 0
  21.07.2010 21:03    C:\WINDOWS\wiadebug.log --------- 159
  21.07.2010 21:03    C:\WINDOWS\wiaservc.log --------- 50
  21.07.2010 21:03    C:\WINDOWS\bootstat.dat --------- 2048
  21.07.2010 21:00    C:\WINDOWS\SchedLgU.Txt --------- 32600
  21.07.2010 12:38    C:\WINDOWS\ODBC.INI --------- 1518
  20.07.2010 10:24    C:\WINDOWS\ALCFDRTM.VER --------- 60416
  18.06.2010 21:58    C:\WINDOWS\win.ini --------- 751
  18.06.2010 21:58    C:\WINDOWS\system.ini --------- 303
  20.05.2010 20:22    C:\WINDOWS\NeroDigital.ini --------- 202
  30.03.2010 13:33    C:\WINDOWS\Twain001.Mtx --------- 5
  30.03.2010 13:33    C:\WINDOWS\Twunk001.MTX --------- 156
  09.01.2010 15:42    C:\WINDOWS\cdplayer.ini --------- 283
  05.11.2009 20:12    C:\WINDOWS\Irremote.ini --------- 31786
  07.09.2009 16:55    C:\WINDOWS\dinksmallwood.ini --------- 92
  05.03.2009 18:08    C:\WINDOWS\WMSysPr9.prx --------- 316640
  04.03.2009 20:24    C:\WINDOWS\setupapi.log.0.old --------- 1038537
  08.08.2008 18:23    C:\WINDOWS\setup.iss --------- 264
  08.08.2008 18:21    C:\WINDOWS\MAXLINK.INI --------- 398
  14.05.2008 12:21    C:\WINDOWS\Twunk002.MTX --------- 0
  14.04.2008 04:23    C:\WINDOWS\winhlp32.exe --------- 288768
  14.04.2008 04:23    C:\WINDOWS\slrundll.exe --------- 32866
  14.04.2008 04:22    C:\WINDOWS\regedit.exe --------- 153600
  14.04.2008 04:22    C:\WINDOWS\notepad.exe --------- 70144
  14.04.2008 04:22    C:\WINDOWS\hh.exe --------- 10752
  14.04.2008 04:22    C:\WINDOWS\explorer.exe --------- 1036800
  14.04.2008 04:22    C:\WINDOWS\twain_32.dll --------- 50688
  11.04.2008 02:40    C:\WINDOWS\scmate.ini --------- 48
  23.03.2008 21:20    C:\WINDOWS\HCWPNP.INI --------- 6314
  23.03.2008 21:17    C:\WINDOWS\ODBCINST.INI --------- 4429
  04.01.2008 01:41    C:\WINDOWS\Filzip.ini --------- 41
  28.09.2007 09:53    C:\WINDOWS\HAFASWIN.INI --------- 460
  03.08.2007 18:57    C:\WINDOWS\BlendSettings.ini --------- 23
  16.04.2007 20:21    C:\WINDOWS\Videodeluxe.INI --------- 0
  28.12.2006 21:01    C:\WINDOWS\005720_.tmp --------- 19569
  17.11.2006 05:42    C:\WINDOWS\soundman.exe --------- 577536
  31.07.2006 11:27    C:\WINDOWS\Alcrmv.exe --------- 217088
  31.07.2006 11:19    C:\WINDOWS\alcupd.exe --------- 315392
  10.07.2006 21:53    C:\WINDOWS\winamp.ini --------- 192
  02.07.2006 11:57    C:\WINDOWS\WMSysPr8.prx --------- 156910
  25.03.2006 19:26    C:\WINDOWS\syscheck.INI --------- 0
  25.03.2006 19:25    C:\WINDOWS\pcfriend.INI --------- 0
  06.02.2006 12:12    C:\WINDOWS\mgxoschk.ini --------- 3237
  15.12.2005 00:22    C:\WINDOWS\progman.ini --------- 21
  12.12.2005 19:31    C:\WINDOWS\d3dx.dat --------- 4096
  14.10.2005 23:25    C:\WINDOWS\UninstallFirefox.exe --------- 99970
  14.10.2005 23:25    C:\WINDOWS\mozver.dat --------- 5697
  14.10.2005 23:21    C:\WINDOWS\nsreg.dat --------- 0
  02.07.2005 23:58    C:\WINDOWS\War3Unin.dat --------- 19280
  02.07.2005 10:30    C:\WINDOWS\War3Unin.pif --------- 2829
  02.07.2005 10:30    C:\WINDOWS\War3Unin.exe --------- 126976
  30.04.2005 09:57    C:\WINDOWS\balloon.wav --------- 6400
  04.02.2005 21:38    C:\WINDOWS\MSOPrefs.232 --------- 10304
  04.02.2005 21:38    C:\WINDOWS\MSOClip.232 --------- 4544
  03.02.2005 05:26    C:\WINDOWS\vbaddin.ini --------- 59
  31.12.2004 14:38    C:\WINDOWS\WORDPAD.INI --------- 754
  19.11.2004 01:24    C:\WINDOWS\ALCFDRTM.EXE --------- 60416
  17.11.2004 22:58    C:\WINDOWS\control.ini --------- 0
  17.11.2004 22:58    C:\WINDOWS\WMSysPrx.prx --------- 299552
  17.11.2004 22:57    C:\WINDOWS\WindowsShell.Manifest --------- 749
  17.11.2004 22:56    C:\WINDOWS\vb.ini --------- 36
  17.11.2004 22:51    C:\WINDOWS\Sti_Trace.log --------- 0
  13.08.2004 11:46    C:\WINDOWS\UNNeroVision.cfg --------- 125614
  26.07.2004 19:09    C:\WINDOWS\UNNeroVision.exe --------- 2023424
  01.01.2003 02:22    C:\WINDOWS\wininit.ini --------- 1113
  03.06.2002 08:49    C:\WINDOWS\uninst.exe --------- 299520
  18.08.2001 14:00    C:\WINDOWS\twunk_16.exe --------- 49680
  18.08.2001 14:00    C:\WINDOWS\twunk_32.exe --------- 25600
  18.08.2001 14:00    C:\WINDOWS\SET7.tmp --------- 13898
  18.08.2001 14:00    C:\WINDOWS\wmprfDEU.prx --------- 34818
  18.08.2001 14:00    C:\WINDOWS\TASKMAN.EXE --------- 15872
  18.08.2001 14:00    C:\WINDOWS\twain.dll --------- 94800
  18.08.2001 14:00    C:\WINDOWS\SET3.tmp --------- 1085913
  18.08.2001 14:00    C:\WINDOWS\Seifenblase.bmp --------- 65978
  18.08.2001 14:00    C:\WINDOWS\Rhododendron.bmp --------- 17362
  18.08.2001 14:00    C:\WINDOWS\Pr„riewind.bmp --------- 65954
  18.08.2001 14:00    C:\WINDOWS\msdfmap.ini --------- 1405
  18.08.2001 14:00    C:\WINDOWS\Kaffeetasse.bmp --------- 17062
  18.08.2001 14:00    C:\WINDOWS\vmmreg32.dll --------- 18944
  18.08.2001 14:00    C:\WINDOWS\Zapotek.bmp --------- 9522
  18.08.2001 14:00    C:\WINDOWS\Granit.bmp --------- 26582
  18.08.2001 14:00    C:\WINDOWS\F„cher.bmp --------- 26680
  18.08.2001 14:00    C:\WINDOWS\Feder.bmp --------- 16730
  18.08.2001 14:00    C:\WINDOWS\winnt256.bmp --------- 48680
  18.08.2001 14:00    C:\WINDOWS\explorer.scf --------- 80
  18.08.2001 14:00    C:\WINDOWS\desktop.ini --------- 2
  18.08.2001 14:00    C:\WINDOWS\clock.avi --------- 82944
  18.08.2001 14:00    C:\WINDOWS\Blaue Spitzen 16.bmp --------- 1272
  18.08.2001 14:00    C:\WINDOWS\winhelp.exe --------- 257568
  18.08.2001 14:00    C:\WINDOWS\Angler.bmp --------- 17336
  18.08.2001 14:00    C:\WINDOWS\Santa Fe-Stuck.bmp --------- 65832
  18.08.2001 14:00    C:\WINDOWS\winnt.bmp --------- 48680
  18.08.2001 14:00    C:\WINDOWS\_default.pif --------- 707
  18.06.2001 10:41    C:\WINDOWS\ActiveSkin.INI --------- 112
  16.05.2000 10:40    C:\WINDOWS\UnGins.exe --------- 83968
  17.11.1998 12:44    C:\WINDOWS\IsUn0407.exe --------- 328704
  29.10.1998 16:45    C:\WINDOWS\IsUninst.exe --------- 306688
  08.02.1996 17:06    C:\WINDOWS\UN160407.EXE --------- 247296
  31.07.1995 13:44    C:\WINDOWS\PCDLIB32.DLL --------- 212480
  03.03.1995 00:00    C:\WINDOWS\ODBCADM.EXE --------- 6464
----------------------------------------

 
C:\WINDOWS\System

 14.04.2008 04:23    C:\WINDOWS\System\winspool.drv --------- 146944
 04.08.2004 01:37    C:\WINDOWS\System\mmsystem.dll --------- 69632
 21.11.2002 09:07    C:\WINDOWS\System\crlds3d.dll --------- 765952
 18.08.2001 14:00    C:\WINDOWS\System\VGA.DRV --------- 2176
 18.08.2001 14:00    C:\WINDOWS\System\COMMDLG.DLL --------- 33744
 18.08.2001 14:00    C:\WINDOWS\System\VER.DLL --------- 9200
 18.08.2001 14:00    C:\WINDOWS\System\KEYBOARD.DRV --------- 2000
 18.08.2001 14:00    C:\WINDOWS\System\LZEXPAND.DLL --------- 9936
 18.08.2001 14:00    C:\WINDOWS\System\MCIAVI.DRV --------- 73760
 18.08.2001 14:00    C:\WINDOWS\System\MCISEQ.DRV --------- 25296
 18.08.2001 14:00    C:\WINDOWS\System\MCIWAVE.DRV --------- 28160
 18.08.2001 14:00    C:\WINDOWS\System\AVIFILE.DLL --------- 109504
 18.08.2001 14:00    C:\WINDOWS\System\MMTASK.TSK --------- 1152
 18.08.2001 14:00    C:\WINDOWS\System\MOUSE.DRV --------- 2032
 18.08.2001 14:00    C:\WINDOWS\System\TIMER.DRV --------- 4048
 18.08.2001 14:00    C:\WINDOWS\System\TAPI.DLL --------- 19200
 18.08.2001 14:00    C:\WINDOWS\System\SYSTEM.DRV --------- 3360
 18.08.2001 14:00    C:\WINDOWS\System\MSVIDEO.DLL --------- 127104
 18.08.2001 14:00    C:\WINDOWS\System\stdole.tlb --------- 5532
 18.08.2001 14:00    C:\WINDOWS\System\SOUND.DRV --------- 1744
 18.08.2001 14:00    C:\WINDOWS\System\SHELL.DLL --------- 5120
 18.08.2001 14:00    C:\WINDOWS\System\setup.inf --------- 59167
 18.08.2001 14:00    C:\WINDOWS\System\OLESVR.DLL --------- 24064
 18.08.2001 14:00    C:\WINDOWS\System\OLECLI.DLL --------- 82944
 18.08.2001 14:00    C:\WINDOWS\System\AVICAP.DLL --------- 70368
 18.08.2001 14:00    C:\WINDOWS\System\WFWNET.DRV --------- 13600
 03.03.1995 00:00    C:\WINDOWS\System\ODBC.DLL --------- 56240
 03.03.1995 00:00    C:\WINDOWS\System\ODBCCURS.DLL --------- 88896
 03.03.1995 00:00    C:\WINDOWS\System\ODBCINST.DLL --------- 92576
 03.03.1995 00:00    C:\WINDOWS\System\ODBCINST.HLP --------- 17412
 03.03.1995 00:00    C:\WINDOWS\System\CTL3DV2.DLL --------- 26992
 18.11.1994 00:00    C:\WINDOWS\System\OLE2PROX.DLL --------- 51712
 18.11.1994 00:00    C:\WINDOWS\System\ODBCJT16.DLL --------- 246928
 18.11.1994 00:00    C:\WINDOWS\System\ODBCJET.HLP --------- 113064
 18.11.1994 00:00    C:\WINDOWS\System\OLE2DISP.DLL --------- 169440
 18.11.1994 00:00    C:\WINDOWS\System\OLE2CONV.DLL --------- 57328
 18.11.1994 00:00    C:\WINDOWS\System\OLE2.REG --------- 27026
 18.11.1994 00:00    C:\WINDOWS\System\OLE2.DLL --------- 302592
 18.11.1994 00:00    C:\WINDOWS\System\STORAGE.DLL --------- 157696
 18.11.1994 00:00    C:\WINDOWS\System\MSJETINT.DLL --------- 15936
 18.11.1994 00:00    C:\WINDOWS\System\MSJETERR.DLL --------- 11232
 18.11.1994 00:00    C:\WINDOWS\System\MSAJT200.DLL --------- 995056
 18.11.1994 00:00    C:\WINDOWS\System\TYPELIB.DLL --------- 177856
 18.11.1994 00:00    C:\WINDOWS\System\VAEN2.OLB --------- 41124
 18.11.1994 00:00    C:\WINDOWS\System\VBAJET.DLL --------- 1984
 18.11.1994 00:00    C:\WINDOWS\System\VBAR2.DLL --------- 298880
 18.11.1994 00:00    C:\WINDOWS\System\OLE2NLS.DLL --------- 153040
 18.11.1994 00:00    C:\WINDOWS\System\COMPOBJ.DLL --------- 108544
 18.11.1994 00:00    C:\WINDOWS\System\ODBCTL16.DLL --------- 64080
 18.11.1994 00:00    C:\WINDOWS\System\ODBCJTNW.HLP --------- 83833
----------------------------------------

 
C:\WINDOWS\System32

 22.07.2010 06:10    C:\WINDOWS\system32\wpa.dbl --------- 2206
 21.07.2010 23:07    C:\WINDOWS\system32\NtmsData --------- 0
 21.07.2010 21:03    C:\WINDOWS\system32\CatRoot2 --------- 0
 21.07.2010 20:24    C:\WINDOWS\system32\jupdate-1.6.0_21-b06.log --------- 5372
 20.07.2010 11:14    C:\WINDOWS\system32\drivers --------- 0
 18.07.2010 18:36    C:\WINDOWS\system32\d3d9caps.dat --------- 2176
 15.07.2010 13:27    C:\WINDOWS\system32\dllcache --------- 0
 02.07.2010 21:39    C:\WINDOWS\system32\MRT.exe --------- 34045896
 28.06.2010 15:41    C:\WINDOWS\system32\CatRoot --------- 0
 28.06.2010 15:41    C:\WINDOWS\system32\DRVSTORE --------- 0
 28.06.2010 15:39    C:\WINDOWS\system32\ReinstallBackups --------- 0
 24.06.2010 01:30    C:\WINDOWS\system32\perfh009.dat --------- 435260
 24.06.2010 01:30    C:\WINDOWS\system32\perfh007.dat --------- 451374
 24.06.2010 01:30    C:\WINDOWS\system32\perfc009.dat --------- 68156
 24.06.2010 01:30    C:\WINDOWS\system32\perfc007.dat --------- 80754
 24.06.2010 01:30    C:\WINDOWS\system32\PerfStringBackup.INI --------- 1004146
 22.06.2010 04:36    C:\WINDOWS\system32\javaws.exe --------- 153376
 22.06.2010 04:36    C:\WINDOWS\system32\javaw.exe --------- 145184
 22.06.2010 04:36    C:\WINDOWS\system32\java.exe --------- 145184
 22.06.2010 04:36    C:\WINDOWS\system32\deployJava1.dll --------- 423656
 22.06.2010 02:24    C:\WINDOWS\system32\javacpl.cpl --------- 73728
 12.06.2010 15:23    C:\WINDOWS\system32\NEWSOFT --------- 8680
 12.06.2010 10:08    C:\WINDOWS\system32\FNTCACHE.DAT --------- 1557184
 12.06.2010 09:14    C:\WINDOWS\system32\de-de --------- 0
 26.05.2010 11:00    C:\WINDOWS\system32\TZLog.log --------- 600910
 18.05.2010 16:35    C:\WINDOWS\system32\dnssd.dll --------- 91424
 18.05.2010 16:35    C:\WINDOWS\system32\jdns_sd.dll --------- 75040
 18.05.2010 16:35    C:\WINDOWS\system32\dnssdX.dll --------- 197920
 18.05.2010 16:35    C:\WINDOWS\system32\dns-sd.exe --------- 107808
 11.05.2010 17:57    C:\WINDOWS\system32\jupdate-1.6.0_20-b02.log --------- 4551
 04.05.2010 19:14    C:\WINDOWS\system32\wininet.dll --------- 832512
 04.05.2010 19:14    C:\WINDOWS\system32\urlmon.dll --------- 1168384
 04.05.2010 19:14    C:\WINDOWS\system32\webcheck.dll --------- 233472
 04.05.2010 19:14    C:\WINDOWS\system32\pngfilt.dll --------- 44544
 04.05.2010 19:14    C:\WINDOWS\system32\occache.dll --------- 102912
 04.05.2010 19:14    C:\WINDOWS\system32\url.dll --------- 105984
 04.05.2010 19:14    C:\WINDOWS\system32\mstime.dll --------- 671232
 04.05.2010 19:14    C:\WINDOWS\system32\mshtml.dll --------- 3600384
 04.05.2010 19:14    C:\WINDOWS\system32\msrating.dll --------- 193024
 04.05.2010 19:14    C:\WINDOWS\system32\mshtmled.dll --------- 477696
 04.05.2010 19:14    C:\WINDOWS\system32\jsproxy.dll --------- 27648
 04.05.2010 19:14    C:\WINDOWS\system32\msfeedsbs.dll --------- 52224
 04.05.2010 19:14    C:\WINDOWS\system32\inetcpl.cpl --------- 1830912
 04.05.2010 19:14    C:\WINDOWS\system32\msfeeds.dll --------- 459264
 04.05.2010 19:14    C:\WINDOWS\system32\iertutil.dll --------- 268288
 04.05.2010 19:14    C:\WINDOWS\system32\ieframe.dll --------- 6067200
 04.05.2010 19:14    C:\WINDOWS\system32\iernonce.dll --------- 44544
 04.05.2010 19:14    C:\WINDOWS\system32\iepeers.dll --------- 192512
 04.05.2010 19:14    C:\WINDOWS\system32\iedkcs32.dll --------- 385024
 04.05.2010 19:14    C:\WINDOWS\system32\ieencode.dll --------- 78336
 04.05.2010 19:14    C:\WINDOWS\system32\ieapfltr.dll --------- 380928
 04.05.2010 19:14    C:\WINDOWS\system32\ieaksie.dll --------- 230400
 04.05.2010 19:14    C:\WINDOWS\system32\dxtrans.dll --------- 214528
 04.05.2010 19:14    C:\WINDOWS\system32\ieakeng.dll --------- 153088
 04.05.2010 19:14    C:\WINDOWS\system32\extmgr.dll --------- 133120
 04.05.2010 19:14    C:\WINDOWS\system32\icardie.dll --------- 63488
 04.05.2010 19:14    C:\WINDOWS\system32\dxtmsft.dll --------- 347136
 04.05.2010 19:14    C:\WINDOWS\system32\corpol.dll --------- 17408
 04.05.2010 19:14    C:\WINDOWS\system32\advpack.dll --------- 124928
 04.05.2010 14:40    C:\WINDOWS\system32\html.iec --------- 389120
 04.05.2010 14:39    C:\WINDOWS\system32\ie4uinit.exe --------- 70656
 04.05.2010 14:39    C:\WINDOWS\system32\ieudinit.exe --------- 13824
 02.05.2010 10:05    C:\WINDOWS\system32\win32k.sys --------- 1851392
 21.04.2010 15:28    C:\WINDOWS\system32\tzchange.exe --------- 46080
 20.04.2010 07:29    C:\WINDOWS\system32\atmfd.dll --------- 285696
 19.04.2010 20:47    C:\WINDOWS\system32\usbaaplrc.dll --------- 3062048
 16.04.2010 13:43    C:\WINDOWS\system32\ieakui.dll --------- 161792
 06.04.2010 04:52    C:\WINDOWS\system32\WMVCore.dll --------- 2462720
 31.03.2010 00:16    C:\WINDOWS\system32\PresentationHostProxy.dll --------- 99176
 31.03.2010 00:10    C:\WINDOWS\system32\PresentationHost.exe --------- 295264
 18.03.2010 22:16    C:\WINDOWS\system32\QuickTime.qts --------- 69632
 18.03.2010 22:16    C:\WINDOWS\system32\QuickTimeVR.qtx --------- 94208
 09.03.2010 13:09    C:\WINDOWS\system32\vbscript.dll --------- 430080
 05.03.2010 16:37    C:\WINDOWS\system32\asycfilt.dll --------- 65536
 27.02.2010 20:57    C:\WINDOWS\system32\wbem --------- 0
 23.02.2010 00:09    C:\WINDOWS\system32\ieframe.dll.mui --------- 1040384
 22.02.2010 20:31    C:\WINDOWS\system32\jupdate-1.6.0_17-b04.log --------- 3617
 17.02.2010 14:04    C:\WINDOWS\system32\ntoskrnl.exe --------- 2192256
 16.02.2010 21:04    C:\WINDOWS\system32\ntkrnlpa.exe --------- 2069120
 12.02.2010 12:03    C:\WINDOWS\system32\browserchoice.exe --------- 293376
 12.02.2010 06:33    C:\WINDOWS\system32\6to4svc.dll --------- 100864
 08.02.2010 09:03    C:\WINDOWS\system32\LoopyMusic.wav --------- 940794
 08.02.2010 09:03    C:\WINDOWS\system32\Lang --------- 0
 05.02.2010 20:25    C:\WINDOWS\system32\quartz.dll --------- 1297408
 29.01.2010 16:59    C:\WINDOWS\system32\inetcomm.dll --------- 691712
 29.01.2010 16:43    C:\WINDOWS\system32\l3codeca.acm --------- 307260
 29.01.2010 16:43    C:\WINDOWS\system32\l3codecx.ax --------- 143422
 13.01.2010 16:00    C:\WINDOWS\system32\cabview.dll --------- 86528
 24.12.2009 08:59    C:\WINDOWS\system32\wintrust.dll --------- 177664
 17.12.2009 09:40    C:\WINDOWS\system32\mspaint.exe --------- 346624
 14.12.2009 09:08    C:\WINDOWS\system32\csrsrv.dll --------- 33280
 08.12.2009 11:23    C:\WINDOWS\system32\shlwapi.dll --------- 474624
 27.11.2009 19:11    C:\WINDOWS\system32\msyuv.dll --------- 17920
 27.11.2009 18:08    C:\WINDOWS\system32\msvidc32.dll --------- 28672
 27.11.2009 18:08    C:\WINDOWS\system32\avifil32.dll --------- 85504
 27.11.2009 18:08    C:\WINDOWS\system32\msrle32.dll --------- 11264
 27.11.2009 18:08    C:\WINDOWS\system32\iyuv_32.dll --------- 48128
 27.11.2009 18:08    C:\WINDOWS\system32\tsbyuv.dll --------- 8704
 07.11.2009 01:07    C:\WINDOWS\system32\netfxperf.dll --------- 49488
 07.11.2009 01:07    C:\WINDOWS\system32\mscoree.dll --------- 297808
----------------------------------------

 
C:\WINDOWS\Prefetch

 22.07.2010 06:26    C:\WINDOWS\Prefetch\CMD.EXE-087B4001.pf --------- 14816
 22.07.2010 06:26    C:\WINDOWS\Prefetch\WMIPRVSE.EXE-28F301A9.pf --------- 75904
 22.07.2010 06:26    C:\WINDOWS\Prefetch\TASKLIST.EXE-08FCAEE9.pf --------- 22308
 22.07.2010 06:26    C:\WINDOWS\Prefetch\WINRAR.EXE-3588DFE8.pf --------- 199292
 22.07.2010 06:22    C:\WINDOWS\Prefetch\VERCLSID.EXE-3667BD89.pf --------- 18550
 22.07.2010 06:20    C:\WINDOWS\Prefetch\AVWSC.EXE-24612965.pf --------- 33280
 22.07.2010 06:18    C:\WINDOWS\Prefetch\NOTEPAD.EXE-336351A9.pf --------- 143970
 22.07.2010 06:17    C:\WINDOWS\Prefetch\HIJACKTHIS.EXE-13354F39.pf --------- 22298
 22.07.2010 06:17    C:\WINDOWS\Prefetch\MSIEXEC.EXE-2F8A8CAE.pf --------- 118334
 22.07.2010 06:16    C:\WINDOWS\Prefetch\AVSCAN.EXE-25724B6E.pf --------- 71284
 22.07.2010 06:12    C:\WINDOWS\Prefetch\WUAUCLT.EXE-399A8E72.pf --------- 20422
 22.07.2010 06:11    C:\WINDOWS\Prefetch\OPERA.EXE-2405C968.pf --------- 143286
 22.07.2010 06:10    C:\WINDOWS\Prefetch\CCLEANER.EXE-17760B94.pf --------- 21306
 22.07.2010 06:10    C:\WINDOWS\Prefetch\ADOBEUPDATER.EXE-370FC314.pf --------- 58846
 22.07.2010 06:10    C:\WINDOWS\Prefetch\BJMYPRT.EXE-2D435E4B.pf --------- 11918
 22.07.2010 06:10    C:\WINDOWS\Prefetch\WRTPROC.EXE-0F829E53.pf --------- 10882
 22.07.2010 06:10    C:\WINDOWS\Prefetch\WRTMON.EXE-1699DBF4.pf --------- 11730
 22.07.2010 06:10    C:\WINDOWS\Prefetch\OPWARESE4.EXE-34F8E21B.pf --------- 8392
 22.07.2010 06:10    C:\WINDOWS\Prefetch\APDPROXY.EXE-01FC57E2.pf --------- 19738
 22.07.2010 06:10    C:\WINDOWS\Prefetch\SOUNDMAN.EXE-19745A34.pf --------- 12686
 22.07.2010 06:10    C:\WINDOWS\Prefetch\NWIZ.EXE-2D0F9FBC.pf --------- 11596
 22.07.2010 06:10    C:\WINDOWS\Prefetch\OSA9.EXE-07EC1F61.pf --------- 13844
 22.07.2010 06:10    C:\WINDOWS\Prefetch\IMAPI.EXE-0BF740A4.pf --------- 78996
 22.07.2010 06:10    C:\WINDOWS\Prefetch\CNSLMAIN.EXE-32AB703B.pf --------- 12306
 22.07.2010 06:10    C:\WINDOWS\Prefetch\SSBKGDUPDATE.EXE-060EC2B1.pf --------- 12788
 22.07.2010 06:10    C:\WINDOWS\Prefetch\RUNDLL32.EXE-1340EF7F.pf --------- 27518
 22.07.2010 06:10    C:\WINDOWS\Prefetch\NEROCHECK.EXE-092C6DFA.pf --------- 6808
 22.07.2010 06:10    C:\WINDOWS\Prefetch\RUNDLL32.EXE-415F88EC.pf --------- 18894
 22.07.2010 06:10    C:\WINDOWS\Prefetch\EXPLORER.EXE-082F38A9.pf --------- 129620
 22.07.2010 06:10    C:\WINDOWS\Prefetch\USERINIT.EXE-30B18140.pf --------- 54960
 22.07.2010 06:10    C:\WINDOWS\Prefetch\WGATRAY.EXE-0ED38BED.pf --------- 66752
 22.07.2010 06:09    C:\WINDOWS\Prefetch\LOGONUI.EXE-0AF22957.pf --------- 53718
 22.07.2010 06:08    C:\WINDOWS\Prefetch\MBAM.EXE-123253AA.pf --------- 84812
 22.07.2010 06:04    C:\WINDOWS\Prefetch\AVCENTER.EXE-1D2DB8A2.pf --------- 63320
 22.07.2010 02:16    C:\WINDOWS\Prefetch\DFRGNTFS.EXE-269967DF.pf --------- 106768
 22.07.2010 02:15    C:\WINDOWS\Prefetch\DEFRAG.EXE-273F131E.pf --------- 171990
 22.07.2010 02:15    C:\WINDOWS\Prefetch\Layout.ini --------- 542284
 22.07.2010 02:10    C:\WINDOWS\Prefetch\LOGON.SCR-151EFAEA.pf --------- 145260
 22.07.2010 01:49    C:\WINDOWS\Prefetch\WINWORD.EXE-3395695A.pf --------- 113252
 22.07.2010 01:40    C:\WINDOWS\Prefetch\ACRORD32INFO.EXE-210DB5B7.pf --------- 97048
 22.07.2010 01:39    C:\WINDOWS\Prefetch\RUNDLL32.EXE-451FC2C0.pf --------- 14520
 22.07.2010 01:17    C:\WINDOWS\Prefetch\AVNOTIFY.EXE-31D7686A.pf --------- 51850
 22.07.2010 01:14    C:\WINDOWS\Prefetch\GUARDGUI.EXE-147E0160.pf --------- 13912
 22.07.2010 01:09    C:\WINDOWS\Prefetch\WINLOGON.EXE-32C57D49.pf --------- 10402
 22.07.2010 01:09    C:\WINDOWS\Prefetch\CSRSS.EXE-12B63473.pf --------- 47438
 22.07.2010 01:04    C:\WINDOWS\Prefetch\NERO.EXE-32314E31.pf --------- 65570
 22.07.2010 01:02    C:\WINDOWS\Prefetch\CDSPEED.EXE-259C8326.pf --------- 19302
 22.07.2010 00:47    C:\WINDOWS\Prefetch\ITUNESHELPER.EXE-08906EB7.pf --------- 29826
 22.07.2010 00:47    C:\WINDOWS\Prefetch\NEROSTARTSMART.EXE-280EC446.pf --------- 59496
 22.07.2010 00:47    C:\WINDOWS\Prefetch\WLAN_SERVICE.EXE-294201E8.pf --------- 11582
 22.07.2010 00:47    C:\WINDOWS\Prefetch\RAUI.EXE-257AD180.pf --------- 27678
 22.07.2010 00:47    C:\WINDOWS\Prefetch\WLANUTILITY.EXE-092DB324.pf --------- 19632
 22.07.2010 00:47    C:\WINDOWS\Prefetch\WINAMPA.EXE-1077910C.pf --------- 13282
 21.07.2010 23:26    C:\WINDOWS\Prefetch\ACRORD32.EXE-313AE542.pf --------- 78390
 21.07.2010 23:06    C:\WINDOWS\Prefetch\RSMSINK.EXE-032F2BAB.pf --------- 55882
 21.07.2010 23:05    C:\WINDOWS\Prefetch\THUNDERBIRD.EXE-0373FB43.pf --------- 77356
 21.07.2010 23:04    C:\WINDOWS\Prefetch\VSSVC.EXE-0F74375A.pf --------- 30492
 21.07.2010 23:04    C:\WINDOWS\Prefetch\DLLHOST.EXE-4C601168.pf --------- 89314
 21.07.2010 22:55    C:\WINDOWS\Prefetch\HELPSVC.EXE-2878DDA2.pf --------- 102444
 21.07.2010 22:33    C:\WINDOWS\Prefetch\MSDTC.EXE-0E6E4AF7.pf --------- 22174
 21.07.2010 22:33    C:\WINDOWS\Prefetch\DLLHOST.EXE-1ECB6754.pf --------- 33872
 21.07.2010 22:31    C:\WINDOWS\Prefetch\UPDATE.EXE-3398FCD6.pf --------- 65222
 21.07.2010 22:31    C:\WINDOWS\Prefetch\CTFMON.EXE-0E17969B.pf --------- 15376
 21.07.2010 22:31    C:\WINDOWS\Prefetch\READER_SL.EXE-0CDA54A2.pf --------- 13468
 21.07.2010 21:35    C:\WINDOWS\Prefetch\SOFFICE.BIN-29DEC863.pf --------- 100144
 21.07.2010 21:35    C:\WINDOWS\Prefetch\AVGNT.EXE-39CD89BF.pf --------- 56786
 21.07.2010 21:35    C:\WINDOWS\Prefetch\DUMPREP.EXE-1B46F901.pf --------- 12738
 21.07.2010 21:35    C:\WINDOWS\Prefetch\QTTASK.EXE-072D8A2B.pf --------- 8554
 21.07.2010 21:25    C:\WINDOWS\Prefetch\HELPCTR.EXE-3862B6F5.pf --------- 67306
 21.07.2010 21:06    C:\WINDOWS\Prefetch\ADOBEARM.EXE-237273D1.pf --------- 59420
 21.07.2010 21:06    C:\WINDOWS\Prefetch\READERUPDATER.EXE-33DFA392.pf --------- 36268
 21.07.2010 21:05    C:\WINDOWS\Prefetch\IEXPLORE.EXE-2CA9778D.pf --------- 86446
 21.07.2010 21:04    C:\WINDOWS\Prefetch\IPODSERVICE.EXE-233792DA.pf --------- 18812
 21.07.2010 21:04    C:\WINDOWS\Prefetch\NTOSBOOT-B00DFAAD.pf --------- 1131960
 21.07.2010 21:00    C:\WINDOWS\Prefetch\REGEDIT.EXE-1B606482.pf --------- 27812
 21.07.2010 20:59    C:\WINDOWS\Prefetch\FINDSTR.EXE-0CA6274B.pf --------- 11482
 21.07.2010 20:59    C:\WINDOWS\Prefetch\FIND.EXE-0EC32F1E.pf --------- 12972
 21.07.2010 20:59    C:\WINDOWS\Prefetch\PV.EXE-0267BFC2.pf --------- 25788
 21.07.2010 20:59    C:\WINDOWS\Prefetch\CSCRIPT.EXE-1C26180C.pf --------- 14948
 21.07.2010 20:59    C:\WINDOWS\Prefetch\FLASH_DISINFECTOR.EXE-196D49BA.pf --------- 35534
 21.07.2010 20:59    C:\WINDOWS\Prefetch\NET.EXE-01A53C2F.pf --------- 12254
 21.07.2010 20:59    C:\WINDOWS\Prefetch\NET1.EXE-029B9DB4.pf --------- 13722
 21.07.2010 20:58    C:\WINDOWS\Prefetch\NIRCMD.EXE-28BA593E.pf --------- 14756
 21.07.2010 20:30    C:\WINDOWS\Prefetch\SPYBOTSD.EXE-1D495A65.pf --------- 88142
 21.07.2010 20:30    C:\WINDOWS\Prefetch\SDUPDATE.EXE-30CF90C0.pf --------- 80628
 21.07.2010 20:24    C:\WINDOWS\Prefetch\JAUREG.EXE-010962C5.pf --------- 12546
 21.07.2010 20:24    C:\WINDOWS\Prefetch\WMIAPSRV.EXE-1E2270A5.pf --------- 18596
 21.07.2010 20:24    C:\WINDOWS\Prefetch\WMIC.EXE-3B772CC6.pf --------- 31138
 21.07.2010 20:24    C:\WINDOWS\Prefetch\JAVAWS.EXE-1714DD62.pf --------- 26272
 21.07.2010 20:24    C:\WINDOWS\Prefetch\JAVAW.EXE-0159D575.pf --------- 117664
 21.07.2010 20:24    C:\WINDOWS\Prefetch\JQS.EXE-352796B1.pf --------- 64228
 21.07.2010 20:24    C:\WINDOWS\Prefetch\PATCHJRE.EXE-32D75151.pf --------- 33726
 21.07.2010 20:23    C:\WINDOWS\Prefetch\MSI1A3.TMP-06F43F86.pf --------- 12028
 21.07.2010 20:23    C:\WINDOWS\Prefetch\MSI19A.TMP-1DCC091C.pf --------- 13230
 21.07.2010 20:23    C:\WINDOWS\Prefetch\JRE-6U21-WINDOWS-I586-IFTW-RV-13866810.pf --------- 63032
 21.07.2010 20:20    C:\WINDOWS\Prefetch\JAVA.EXE-2167859B.pf --------- 63188
 21.07.2010 20:12    C:\WINDOWS\Prefetch\XP-ANTISPY.EXE-2D7FB4DB.pf --------- 106278
 21.07.2010 20:09    C:\WINDOWS\Prefetch\A~NSISU_.EXE-2C299849.pf --------- 13418
 21.07.2010 20:09    C:\WINDOWS\Prefetch\UNINST.EXE-38149EFF.pf --------- 12420
 21.07.2010 20:09    C:\WINDOWS\Prefetch\XP-ANTISPY_SETUP-DEUTSCH.EXE-1A3F7D86.pf --------- 49044
 21.07.2010 19:33    C:\WINDOWS\Prefetch\JAVAW.EXE-3AE013C1.pf --------- 29340
 21.07.2010 19:33    C:\WINDOWS\Prefetch\JAVAW.EXE-095CED93.pf --------- 29262
 21.07.2010 19:33    C:\WINDOWS\Prefetch\JAVAW.EXE-2826389B.pf --------- 26868
 21.07.2010 19:33    C:\WINDOWS\Prefetch\JAVAW.EXE-376854F9.pf --------- 25960
 21.07.2010 19:33    C:\WINDOWS\Prefetch\JAUCHECK.EXE-2D8C9795.pf --------- 30178
 21.07.2010 19:33    C:\WINDOWS\Prefetch\JAVAW.EXE-02BFF384.pf --------- 25944
 21.07.2010 15:21    C:\WINDOWS\Prefetch\RUNDLL32.EXE-2BF3472E.pf --------- 34106
 21.07.2010 15:07    C:\WINDOWS\Prefetch\ADMIN.EXE-31EA2098.pf --------- 13312
 21.07.2010 15:07    C:\WINDOWS\Prefetch\RSIT.EXE-1E2944BA.pf --------- 16620
 21.07.2010 15:07    C:\WINDOWS\Prefetch\CCSETUP233.EXE-0D58F638.pf --------- 24384
 21.07.2010 15:00    C:\WINDOWS\Prefetch\JUSCHED.EXE-0137DEC5.pf --------- 11880
 21.07.2010 13:41    C:\WINDOWS\Prefetch\RUNDLL32.EXE-2576181F.pf --------- 71520
 21.07.2010 13:15    C:\WINDOWS\Prefetch\MIRANDA32.EXE-0EB82F06.pf --------- 39254
 21.07.2010 13:04    C:\WINDOWS\Prefetch\TASKMGR.EXE-20256C55.pf --------- 19236
 21.07.2010 11:51    C:\WINDOWS\Prefetch\EXCEL.EXE-0DC93B7A.pf --------- 44888
 21.07.2010 11:50    C:\WINDOWS\Prefetch\AVCONFIG.EXE-18FA6095.pf --------- 59956
 21.07.2010 11:48    C:\WINDOWS\Prefetch\QUICKSTART.EXE-1E741B86.pf --------- 10598
 20.07.2010 22:38    C:\WINDOWS\Prefetch\WINAMP.EXE-0DA1BB35.pf --------- 69324
 20.07.2010 22:04    C:\WINDOWS\Prefetch\REGSVR32.EXE-25EEFE2F.pf --------- 15902
 20.07.2010 21:08    C:\WINDOWS\Prefetch\MSHTA.EXE-331DF029.pf --------- 50414
 20.07.2010 21:07    C:\WINDOWS\Prefetch\RUNDLL32.EXE-19F507BE.pf --------- 16614
 20.07.2010 10:33    C:\WINDOWS\Prefetch\SOFFICE.EXE-31CE5D8A.pf --------- 38296
 07.03.2009 16:44    C:\WINDOWS\Prefetch\EASYCLEA.EXE-011EAFCA.pf --------- 0
----------------------------------------

 
C:\WINDOWS\Tasks

 21.07.2010 21:03    C:\WINDOWS\Tasks\SA.DAT --------- 6
 15.07.2010 17:33    C:\WINDOWS\Tasks\AppleSoftwareUpdate.job --------- 276
 18.08.2001 14:00    C:\WINDOWS\Tasks\desktop.ini --------- 65
----------------------------------------

 
C:\WINDOWS\Temp

 22.07.2010 06:09    C:\WINDOWS\Temp\WGAErrLog.txt --------- 483
 22.07.2010 01:17    C:\WINDOWS\Temp\Cookies --------- 0
 22.07.2010 00:01    C:\WINDOWS\Temp\History --------- 0
 21.07.2010 21:03    C:\WINDOWS\Temp\Perflib_Perfdata_61c.dat --------- 16384
 07.07.2010 18:11    C:\WINDOWS\Temp\Temporary Internet Files --------- 0
 24.06.2010 01:30    C:\WINDOWS\Temp\ASPNETSetup_00002.log --------- 5158
 24.06.2010 01:28    C:\WINDOWS\Temp\dd_clwireg.txt --------- 59809
 12.06.2010 09:19    C:\WINDOWS\Temp\dd_wcf_retCAE94.txt --------- 4841
 12.06.2010 09:19    C:\WINDOWS\Temp\ASPNETSetup_00001.log --------- 5158
 12.06.2010 09:17    C:\WINDOWS\Temp\ASPNETSetup_00000.log --------- 5158
 12.06.2010 09:14    C:\WINDOWS\Temp\FixitPatchRegistration.log --------- 23
----------------------------------------

 
C:\DOKUME~1\admin\LOKALE~1\Temp

 22.07.2010 06:15      C:\DOKUME~1\admin\LOKALE~1\Temp\jusched.log --------- 8711
 22.07.2010 06:10      C:\DOKUME~1\admin\LOKALE~1\Temp\AdobeARM.log --------- 6144
 22.07.2010 06:10      C:\DOKUME~1\admin\LOKALE~1\Temp\WPDNSE --------- 0
 21.07.2010 20:59      C:\DOKUME~1\admin\LOKALE~1\Temp\null --------- 62
 21.07.2010 20:28      C:\DOKUME~1\admin\LOKALE~1\Temp\{AC76BA86-7AD7-1031-7B44-A82000000003}.ini --------- 670
 21.07.2010 20:28      C:\DOKUME~1\admin\LOKALE~1\Temp\{AC76BA86-7AD7-1031-7B44-A81300000003}.ini --------- 801
 21.07.2010 20:24      C:\DOKUME~1\admin\LOKALE~1\Temp\JAUReg.log --------- 160
 21.07.2010 20:24      C:\DOKUME~1\admin\LOKALE~1\Temp\AUCHECK_PARSER.txt --------- 299
 21.07.2010 20:24      C:\DOKUME~1\admin\LOKALE~1\Temp\hsperfdata_admin --------- 0
 21.07.2010 20:24      C:\DOKUME~1\admin\LOKALE~1\Temp\java_install_reg.log --------- 1873
 21.07.2010 20:23      C:\DOKUME~1\admin\LOKALE~1\Temp\java_install_sp.log --------- 1823
 21.07.2010 20:23      C:\DOKUME~1\admin\LOKALE~1\Temp\jinstall.cfg --------- 1217
 21.07.2010 19:33      C:\DOKUME~1\admin\LOKALE~1\Temp\AUCHECK_CORE.txt --------- 302
 20.07.2010 10:25      C:\DOKUME~1\admin\LOKALE~1\Temp\TWAIN.LOG --------- 932
 20.07.2010 10:25      C:\DOKUME~1\admin\LOKALE~1\Temp\Twain001.Mtx --------- 2
 20.07.2010 10:25      C:\DOKUME~1\admin\LOKALE~1\Temp\Twunk001.MTX --------- 156
----------------------------------------

 
C:\Programme

 21.07.2010 20:24    C:\Programme\Java --------- 0
 21.07.2010 15:07    C:\Programme\trend micro --------- 0
 28.06.2010 15:41    C:\Programme\iTunes --------- 0
 28.06.2010 15:40    C:\Programme\iPod --------- 0
 28.06.2010 15:39    C:\Programme\Bonjour --------- 0
 28.06.2010 15:38    C:\Programme\Gemeinsame Dateien --------- 0
 12.06.2010 09:14    C:\Programme\Internet Explorer --------- 0
 12.05.2010 17:00    C:\Programme\Outlook Express --------- 0
 01.04.2010 19:49    C:\Programme\Mozilla Firefox --------- 0
 12.03.2010 10:11    C:\Programme\Movie Maker --------- 0
 18.01.2010 22:56    C:\Programme\Mozilla Sunbird --------- 0
 15.01.2010 23:56    C:\Programme\Sony --------- 0
 27.11.2009 16:59    C:\Programme\Mozilla Thunderbird --------- 0
 15.11.2009 14:34    C:\Programme\ICQ6 --------- 0
 05.11.2009 20:19    C:\Programme\CyberLink --------- 0
 05.11.2009 20:19    C:\Programme\InstallShield Installation Information --------- 0
 05.11.2009 20:12    C:\Programme\WinTV --------- 0
 03.11.2009 10:16    C:\Programme\Adobe --------- 0
 15.10.2009 15:46    C:\Programme\QuickTime --------- 0
 15.10.2009 15:46    C:\Programme\Apple Software Update --------- 0
 09.08.2009 21:17    C:\Programme\Spybot - Search & Destroy --------- 0
 06.08.2009 13:38    C:\Programme\MSBuild --------- 0
 06.08.2009 13:34    C:\Programme\Reference Assemblies --------- 0
 05.08.2009 14:05    C:\Programme\OpenAL --------- 0
 04.08.2009 20:04    C:\Programme\VDMSound --------- 0
 03.08.2009 13:49    C:\Programme\hp deskjet 3820 series --------- 0
 02.08.2009 20:00    C:\Programme\Windows Media Connect 2 --------- 0
 04.07.2009 13:00    C:\Programme\Avira --------- 0
 04.07.2009 12:58    C:\Programme\AntiVir PersonalEdition Classic --------- 0
 03.07.2009 09:06    C:\Programme\Winamp --------- 0
 23.04.2009 05:08    C:\Programme\Windows Media Player --------- 0
 04.03.2009 20:25    C:\Programme\Messenger --------- 0
 04.03.2009 20:21    C:\Programme\NetMeeting --------- 0
 04.03.2009 20:21    C:\Programme\Windows NT --------- 0
 20.11.2008 18:50    C:\Programme\Polob32 --------- 0
 03.11.2008 06:39    C:\Programme\Canon --------- 0
 03.11.2008 06:34    C:\Programme\CanonBJ --------- 0
 07.09.2008 18:20    C:\Programme\WinSCP --------- 0
 07.09.2008 16:30    C:\Programme\Miranda IM --------- 0
 11.08.2008 15:30    C:\Programme\settings.dat --------- 14852
 25.06.2008 00:10    C:\Programme\ICQ6Toolbar --------- 0
 21.05.2008 22:25    C:\Programme\IrfanView --------- 0
 04.01.2008 15:43    C:\Programme\Filzip --------- 0
 21.12.2007 22:46    C:\Programme\OpenVPN --------- 0
 21.12.2007 22:16    C:\Programme\FaJo --------- 0
 16.12.2007 02:21    C:\Programme\Verkn�pfung mit Adobe.lnk --------- 442
 18.10.2007 17:44    C:\Programme\Real --------- 0
 14.10.2007 20:07    C:\Programme\Microsoft.NET --------- 0
 14.10.2007 20:07    C:\Programme\Microsoft ActiveSync --------- 0
 14.10.2007 20:07    C:\Programme\Microsoft Office --------- 0
 10.06.2007 13:36    C:\Programme\AGEIA Technologies --------- 0
 16.05.2007 18:16    C:\Programme\Hewlett-Packard --------- 0
 16.05.2007 18:15    C:\Programme\Free Download Manager --------- 0
 07.05.2007 21:19    C:\Programme\Realtek AC97 --------- 0
 27.03.2007 21:25    C:\Programme\FileZilla --------- 0
 07.03.2007 00:31    C:\Programme\ICQToolbar --------- 0
 14.01.2007 20:39    C:\Programme\MicroStar --------- 0
 30.12.2006 16:35    C:\Programme\WinRAR --------- 0
 12.11.2006 14:23    C:\Programme\Cleaner 5 EZ --------- 0
 04.07.2006 19:45    C:\Programme\GMX --------- 0
 02.07.2006 11:57    C:\Programme\directx --------- 0
 16.05.2006 09:34    C:\Programme\WinAce --------- 0
 27.12.2005 17:23    C:\Programme\DivX --------- 0
 02.07.2005 22:05    C:\Programme\WindowsUpdate --------- 0
 03.02.2005 05:25    C:\Programme\Microsoft Visual Studio --------- 0
 03.02.2005 05:23    C:\Programme\microsoft frontpage --------- 0
 26.01.2005 20:34    C:\Programme\Kerio --------- 0
 05.12.2004 14:45    C:\Programme\MSXML 4.0 --------- 0
 25.11.2004 22:39    C:\Programme\Ahead --------- 0
 17.11.2004 23:01    C:\Programme\Uninstall Information --------- 0
 17.11.2004 22:58    C:\Programme\xerox --------- 0
 17.11.2004 22:57    C:\Programme\Online-Dienste --------- 0
 17.11.2004 22:56    C:\Programme\ComPlus Applications --------- 0
 17.11.2004 22:55    C:\Programme\Online Services --------- 0
 17.11.2004 22:55    C:\Programme\MSN --------- 0
 17.11.2004 22:55    C:\Programme\MSN Gaming Zone --------- 0
 01.01.2003 01:21    C:\Programme\RALINK --------- 0
----------------------------------------

 
C:\Dokumente und Einstellungen\All Users\..

admin   
*** 
All Users   
***   
***~1~AND   
BB443B11-7D12-450c-9F85-2D32804655F9   
Gast   
LocalService   
NetworkService   
Default User   
----------------------------------------

 
C:\WINDOWS\system32\drivers\etc\hosts

127.0.0.1        www.007guard.com
127.0.0.1        007guard.com
127.0.0.1        008i.com
127.0.0.1        www.008k.com
127.0.0.1        008k.com
127.0.0.1        www.00hq.com
127.0.0.1        00hq.com
127.0.0.1        010402.com
127.0.0.1        www.032439.com
127.0.0.1        032439.com
127.0.0.1        www.0scan.com
127.0.0.1        0scan.com
127.0.0.1        www.1000gratisproben.com
127.0.0.1        1000gratisproben.com
127.0.0.1        www.1001namen.com
127.0.0.1        1001namen.com
127.0.0.1        100888290cs.com
127.0.0.1        www.100888290cs.com
127.0.0.1        100sexlinks.com
127.0.0.1        www.100sexlinks.com
127.0.0.1        10sek.com
127.0.0.1        www.10sek.com
127.0.0.1        www.1-2005-search.com
127.0.0.1        1-2005-search.com
127.0.0.1        123haustiereundmehr.com
127.0.0.1        www.123haustiereundmehr.com
127.0.0.1        123moviedownload.com
127.0.0.1        www.123moviedownload.com
127.0.0.1        www.123simsen.com
127.0.0.1        123simsen.com
127.0.0.1        123topsearch.com
127.0.0.1        www.123topsearch.com
127.0.0.1        125sms.co.uk
127.0.0.1        www.125sms.co.uk
127.0.0.1        125sms.com
127.0.0.1        www.125sms.com
127.0.0.1        132.com
127.0.0.1        www.132.com
127.0.0.1        1337crew.info
127.0.0.1        www.1337crew.info
127.0.0.1        www.1337-crew.to
127.0.0.1        1337-crew.to
127.0.0.1        136136.net
127.0.0.1        www.136136.net
127.0.0.1        150freesms.de
127.0.0.1        www.150freesms.de
127.0.0.1        163ns.com
127.0.0.1        www.163ns.com
127.0.0.1        171203.com
127.0.0.1        17-plus.com
127.0.0.1        1800searchonline.com
127.0.0.1        www.1800searchonline.com
127.0.0.1        180searchassistant.com
127.0.0.1        www.180searchassistant.com
127.0.0.1        180solutions.com
127.0.0.1        www.180solutions.com
127.0.0.1        www.181.365soft.info
127.0.0.1        181.365soft.info
127.0.0.1        1987324.com
127.0.0.1        www.1987324.com
127.0.0.1        1-domains-registrations.com
127.0.0.1        www.1-domains-registrations.com
127.0.0.1        www.1sexparty.com
127.0.0.1        1sexparty.com
127.0.0.1        www.1sms.de
127.0.0.1        1sms.de
127.0.0.1        www.1stantivirus.com
127.0.0.1        1stantivirus.com
127.0.0.1        www.1stpagehere.com
127.0.0.1        1stpagehere.com
127.0.0.1        www.1stsearchportal.com
127.0.0.1        1stsearchportal.com
127.0.0.1        2.82211.net
127.0.0.1        2006ooo.com
127.0.0.1        www.2006ooo.com
127.0.0.1        www.2007-download.com
127.0.0.1        2007-download.com
127.0.0.1        www.2008search-destroy.com
127.0.0.1        2008search-destroy.com
127.0.0.1        www.2008-search-destroy.com
127.0.0.1        2008-search-destroy.com
127.0.0.1        2009--access.com
127.0.0.1        www.2009--access.com
127.0.0.1        www.2020search.com
127.0.0.1        2020search.com
127.0.0.1        20x2p.com
127.0.0.1        2-2005-search.com
127.0.0.1        www.2-2005-search.com
127.0.0.1        www.24.365soft.info
127.0.0.1        24.365soft.info
127.0.0.1        24-7pharmacy.info
127.0.0.1        www.24-7pharmacy.info
127.0.0.1        24-7searching-and-more.com
127.0.0.1        www.24-7searching-and-more.com
127.0.0.1        www.24mainstreet.com
127.0.0.1        24mainstreet.com
127.0.0.1        www.24teen.com
127.0.0.1        24teen.com
127.0.0.1        2ndpower.com

----------------------------------------

 

Abbildname                  PID Sitzungsname      Sitz.-Nr. Speichernutzung
========================= ===== ================ ========== ===============
System Idle Process          0 Console                  0            28 K
System                        4 Console                  0            44 K
smss.exe                    652 Console                  0          268 K
csrss.exe                  736 Console                  0        3.152 K
winlogon.exe                760 Console                  0        3.668 K
services.exe                808 Console                  0        2.104 K
lsass.exe                  820 Console                  0        1.392 K
svchost.exe                980 Console                  0        2.232 K
svchost.exe                1040 Console                  0        2.408 K
svchost.exe                1080 Console                  0        19.688 K
svchost.exe                1140 Console                  0        5.092 K
svchost.exe                1196 Console                  0        1.400 K
spoolsv.exe                1300 Console                  0        1.600 K
sched.exe                  1340 Console                  0          812 K
svchost.exe                1384 Console                  0          724 K
PhotoshopElementsFileAgen  1456 Console                  0          388 K
avguard.exe                1480 Console                  0        10.924 K
AppleMobileDeviceService.  1500 Console                  0        1.228 K
mDNSResponder.exe          1516 Console                  0        1.528 K
jqs.exe                    1564 Console                  0        1.396 K
RalinkRegistryWriter.exe  1644 Console                  0          500 K
svchost.exe                1676 Console                  0        1.884 K
avshadow.exe              1684 Console                  0          892 K
UAService7.exe            1780 Console                  0          172 K
alg.exe                    1560 Console                  0          884 K
wmiprvse.exe              3072 Console                  0        2.928 K
iPodService.exe            3128 Console                  0        2.272 K
dllhost.exe                1120 Console                  0        1.536 K
msdtc.exe                  3388 Console                  0          508 K
explorer.exe                252 Console                  0        14.788 K
soundman.exe                916 Console                  0        3.216 K
apdproxy.exe              2528 Console                  0        4.956 K
OpWareSE4.exe              3972 Console                  0        2.088 K
WrtMon.exe                2456 Console                  0        2.844 K
BJMYPRT.EXE                3264 Console                  0        2.912 K
WrtProc.exe                3036 Console                  0        2.908 K
winampa.exe                716 Console                  0        2.716 K
avgnt.exe                  3736 Console                  0        2.808 K
iTunesHelper.exe          2892 Console                  0        13.752 K
jusched.exe                212 Console                  0        2.772 K
ctfmon.exe                1704 Console                  0        3.500 K
RaUI.exe                  4068 Console                  0        7.680 K
WlanUtility.exe            2328 Console                  0        5.196 K
WLAN_Service.exe            872 Console                  0        1.852 K
opera.exe                  1848 Console                  0        25.384 K
notepad.exe                2692 Console                  0          660 K
wmiprvse.exe              1928 Console                  0        6.172 K
cmd.exe                    256 Console                  0        2.488 K
tasklist.exe              3040 Console                  0        4.688 K

 
***** Ende des Scans 22.07.2010 um  6:27:40,98 ***

4. Ccleaner-Programmliste
Code:
adgangforalle.dk 2.0        IT & Telestyrelsen / efaktum ApS       
Adobe After Effects 6.0        Adobe Systems Inc.        6.0
Adobe Flash Player 10 ActiveX        Adobe Systems Incorporated        10.0.32.18
Adobe Flash Player 10 Plugin        Adobe Systems Incorporated        10.1.53.64
Adobe Photoshop Elements 5.0        Adobe Systems, Inc.        5.0
Adobe Reader 8.2.0 - Deutsch        Adobe Systems Incorporated        8.2.0
Adobe Shockwave Player 11.5        Adobe Systems, Inc.        11.5
Adobe SVG Viewer 3.0        Adobe Systems, Inc.        3.0
Advanced RealMedia Export Plug-in for Premiere 6.0               
AGEIA PhysX v6.10.05        AGEIA Technologies, Inc.        6.10.05
Apple Application Support        Apple Inc.        1.3.0
Apple Mobile Device Support        Apple Inc.        3.1.0.62
Apple Software Update        Apple Inc.        2.1.1.116
ArcSoft PhotoStudio 5.5        ArcSoft       
Avira AntiVir Personal - Free Antivirus        Avira GmbH        10.0.0.567
Bioshock Demo        2K Boston       
Bonjour        Apple Inc.        2.0.2.0
Canon CanoScan Toolbox 5.0               
Canon iP4500 series               
Canon My Printer               
Canon Utilities Solution Menu               
CanoScan 4400F               
CCleaner        Piriform        2.33
CD-LabelPrint               
DivX        DivX, Inc.        6.1
DivX Player        DivXNetworks, Inc.        6.0
EasyCleaner        ToniArts        2.0.6.380
fahrinfo               
FaJo XP File Security Extension v1.2        FaJo        v1.2
FileZilla (remove only)               
Free Download Manager 2.1        FreeDownloadManager.ORG       
Gimp 2.6.2 Debug               
GMX SMS-Manager               
Heroes of Might and Magic V               
HiJackThis        Trend Micro        1.0.0
ICQ6.5        ICQ        6.5
IEEE802.11a/b/g Wireless LAN Software        MICRO-STAR        2.1.2.11
IrfanView (remove only)               
iTunes        Apple Inc.        9.2.0.61
J2SE Runtime Environment 5.0 Update 10        Sun Microsystems, Inc.        1.5.0.100
J2SE Runtime Environment 5.0 Update 6        Sun Microsystems, Inc.        1.5.0.60
Java(TM) 6 Update 21        Sun Microsystems, Inc.        6.0.210
Java(TM) 6 Update 3        Sun Microsystems, Inc.        1.6.0.30
Java(TM) 6 Update 5        Sun Microsystems, Inc.        1.6.0.50
Java(TM) 6 Update 7        Sun Microsystems, Inc.        1.6.0.70
Malwarebytes' Anti-Malware        Malwarebytes Corporation       
Media Go        Sony        1.3.227
Microsoft .NET Framework 2.0 Language Pack - DEU        Microsoft Corporation       
Microsoft .NET Framework 2.0 Service Pack 2        Microsoft Corporation        2.2.30729
Microsoft .NET Framework 3.0 German Language Pack        Microsoft Corporation       
Microsoft .NET Framework 3.0 Service Pack 2        Microsoft Corporation        3.2.30729
Microsoft .NET Framework 3.5 SP1        Microsoft Corporation       
Microsoft Office 2000 Premium        Microsoft Corporation        9.00.2816
Microsoft Office Professional Edition 2003        Microsoft Corporation        11.0.5614.0
Microsoft Visual C++ 2005 Redistributable        Microsoft Corporation        8.0.59193
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17        Microsoft Corporation        9.0.30729
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148        Microsoft Corporation        9.0.30729.4148
MINERVA: Metastasis 2                2.0
Miranda IM 0.8.9               
Mozilla Firefox (3.6.3)        Mozilla        3.6.3 (de)
Mozilla Sunbird (0.5)        Mozilla        0.5 (de)
Mozilla Thunderbird (3.0.5)        Mozilla        3.0.5 (de)
MSXML 4.0 SP2 (KB936181)        Microsoft Corporation        4.20.9848.0
MSXML 4.0 SP2 (KB954430)        Microsoft Corporation        4.20.9870.0
MSXML 4.0 SP2 (KB973688)        Microsoft Corporation        4.20.9876.0
MSXML 4.0 SP2 Parser and SDK        Microsoft Corporation        4.20.9818.0
MSXML 6.0 Parser (KB925673)        Microsoft Corporation        6.00.3888.0
Nero Suite               
NVIDIA Drivers               
Oblivion        Bethesda Softworks        1.00.0000
OpenAL               
OpenVPN 2.1_rc15                2.1_rc15
Opera 10.60        Opera Software ASA        10.60
PDFCreator        Frank Heindörfer, Philip Chinery        0.9.5
PlayStation(R)Network Downloader        Sony Computer Entertainment Inc.        2.01.11251
Presto! PageManager 7.15.14        NewSoft        7.15.14G
Prince of Persia The Sands of Time                1.00.181
QuickTime        Apple Inc.        7.66.73.0
Ralink RT2860 Wireless LAN Card        Ralink        1.0.6.0
Ralink Wireless LAN        RaLink        1.0.1.0
Realtek AC'97 Audio        Realtek Semiconductor Corp.        5.34
RGSS-RTP Standard        Enterbrain        1.0.0
RPGXP        Enterbrain        1.0.0
RTP for RM2K (Png, Wav, Midi, Fonts)               
ScanSoft OmniPage SE 4.0        Nuance Communications, Inc.        15.00.0020
Spybot - Search & Destroy        Safer Networking Limited        1.6.2
The Fall - Last Days of Gaia        Silver Style Entertainment       
the white chamber: definitive edition 1.7        Studio Trophis        1.7
The Witcher        CD Projekt Red        1.00.0000
The Witcher Enhanced Edition - "Nebenwirkungen"        CD Projekt Red        1.0.0.0000
Tom Clancy's Splinter Cell Double Agent        Ubisoft        1.00.0000
Tomb Raider: Legend 1.0               
VDMSound        Vlad Romascanu        2.1.0
VLC media player 0.9.4        VideoLAN Team        0.9.4
Winamp        Nullsoft, Inc        5.56
Windows Internet Explorer 7        Microsoft Corporation        20070813.185237
Windows Media Format 11 runtime               
Windows Media Player 11               
WinFast(R) Display Driver               
WinRAR archiver               
WinSCP 4.1.6        Martin Prikryl        4.1.6
xp-AntiSpy 3.97-9        Christian Taubenheim

5. Gmer-Logfile
GMER Logfile:
GMER Logfile:
Code:
GMER 1.0.15.15281 - hxxp://www.gmer.net
Rootkit scan 2010-07-22 11:31:22
Windows 5.1.2600 Service Pack 3
Running: dzdsx7k8.exe; Driver: C:\DOKUME~1\***\LOKALE~1\Temp\uxtdrpob.sys


---- System - GMER 1.0.15 ----

SSDT    BA7EFBB6                                ZwCreateKey
SSDT    BA7EFBAC                                ZwCreateThread
SSDT    BA7EFBBB                                ZwDeleteKey
SSDT    BA7EFBC5                                ZwDeleteValueKey
SSDT    BA7EFBCA                                ZwLoadKey
SSDT    BA7EFB98                                ZwOpenProcess
SSDT    BA7EFB9D                                ZwOpenThread
SSDT    BA7EFBD4                                ZwReplaceKey
SSDT    BA7EFBCF                                ZwRestoreKey
SSDT    BA7EFBC0                                ZwSetValueKey

---- Kernel code sections - GMER 1.0.15 ----

.text  C:\WINDOWS\system32\DRIVERS\atksgt.sys  section is writeable [0xA1CE1300, 0x3AE88, 0xE8000020]
.text  C:\WINDOWS\system32\DRIVERS\ithsgt.sys  section is writeable [0xA1C91300, 0x21770, 0xE8000020]
.text  C:\WINDOWS\system32\DRIVERS\lirsgt.sys  section is writeable [0xA861D300, 0x1B7E, 0xE8000020]

---- Devices - GMER 1.0.15 ----

Device  \Driver\nvatabus \Device\00000070      sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device  \Driver\nvatabus \Device\0000006d      sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device  \Driver\nvatabus \Device\NvAta0        sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device  \Driver\nvatabus \Device\0000006e      sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device  \Driver\nvatabus \Device\NvAta1        sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device  \Driver\nvatabus \Device\NvAta2        sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)

---- EOF - GMER 1.0.15 ----
--- --- ---

--- --- ---



6. RootRepeal-Logfile (ohne HiddenServices, siehe oben)
Code:
ROOTREPEAL (c) AD, 2007-2009
==================================================
Scan Start Time:                2010/07/22 11:42
Program Version:                Version 1.3.5.0
Windows Version:                Windows XP SP3
==================================================

Drivers
-------------------
Name: 1394BUS.SYS
Image Path: C:\WINDOWS\System32\DRIVERS\1394BUS.SYS
Address: 0xBA0C8000        Size: 57344        File Visible: -        Signed: -
Status: -

Name: ACPI.sys
Image Path: ACPI.sys
Address: 0xB9F78000        Size: 188800        File Visible: -        Signed: -
Status: -

Name: ACPI_HAL
Image Path: \Driver\ACPI_HAL
Address: 0x804D7000        Size: 2069120        File Visible: -        Signed: -
Status: -

Name: aec.sys
Image Path: C:\WINDOWS\system32\drivers\aec.sys
Address: 0xA12AC000        Size: 142592        File Visible: -        Signed: -
Status: -

Name: AegisP.sys
Image Path: C:\WINDOWS\system32\DRIVERS\AegisP.sys
Address: 0xBA3E0000        Size: 19296        File Visible: -        Signed: -
Status: -

Name: afd.sys
Image Path: C:\WINDOWS\System32\drivers\afd.sys
Address: 0xB08EC000        Size: 138496        File Visible: -        Signed: -
Status: -

Name: ALCXWDM.SYS
Image Path: C:\WINDOWS\system32\drivers\ALCXWDM.SYS
Address: 0xB90EF000        Size: 4027840        File Visible: -        Signed: -
Status: -

Name: AmdK8.sys
Image Path: C:\WINDOWS\System32\DRIVERS\AmdK8.sys
Address: 0xBA1C8000        Size: 57344        File Visible: -        Signed: -
Status: -

Name: arp1394.sys
Image Path: C:\WINDOWS\System32\DRIVERS\arp1394.sys
Address: 0xB40CB000        Size: 60800        File Visible: -        Signed: -
Status: -

Name: atapi.sys
Image Path: atapi.sys
Address: 0xB9F0A000        Size: 96512        File Visible: -        Signed: -
Status: -

Name: atksgt.sys
Image Path: C:\WINDOWS\system32\DRIVERS\atksgt.sys
Address: 0xA151B000        Size: 271872        File Visible: -        Signed: -
Status: -

Name: ATMFD.DLL
Image Path: C:\WINDOWS\System32\ATMFD.DLL
Address: 0xBFFA0000        Size: 286720        File Visible: -        Signed: -
Status: -

Name: audstub.sys
Image Path: C:\WINDOWS\System32\DRIVERS\audstub.sys
Address: 0xBA6DF000        Size: 3072        File Visible: -        Signed: -
Status: -

Name: avgio.sys
Image Path: C:\Programme\Avira\AntiVir Desktop\avgio.sys
Address: 0xBA644000        Size: 6144        File Visible: -        Signed: -
Status: -

Name: avgntflt.sys
Image Path: C:\WINDOWS\system32\DRIVERS\avgntflt.sys
Address: 0xA15DB000        Size: 86016        File Visible: -        Signed: -
Status: -

Name: avipbb.sys
Image Path: C:\WINDOWS\system32\DRIVERS\avipbb.sys
Address: 0xB0545000        Size: 139264        File Visible: -        Signed: -
Status: -

Name: Beep.SYS
Image Path: C:\WINDOWS\System32\Drivers\Beep.SYS
Address: 0xBA634000        Size: 4224        File Visible: -        Signed: -
Status: -

Name: BOOTVID.dll
Image Path: C:\WINDOWS\system32\BOOTVID.dll
Address: 0xBA4B8000        Size: 12288        File Visible: -        Signed: -
Status: -

Name: Cdfs.SYS
Image Path: C:\WINDOWS\System32\Drivers\Cdfs.SYS
Address: 0xA8398000        Size: 63744        File Visible: -        Signed: -
Status: -

Name: cdrom.sys
Image Path: C:\WINDOWS\System32\DRIVERS\cdrom.sys
Address: 0xBA1F8000        Size: 62976        File Visible: -        Signed: -
Status: -

Name: CLASSPNP.SYS
Image Path: C:\WINDOWS\System32\DRIVERS\CLASSPNP.SYS
Address: 0xBA108000        Size: 53248        File Visible: -        Signed: -
Status: -

Name: disk.sys
Image Path: disk.sys
Address: 0xBA0F8000        Size: 36352        File Visible: -        Signed: -
Status: -

Name: dmio.sys
Image Path: dmio.sys
Address: 0xB9F22000        Size: 154112        File Visible: -        Signed: -
Status: -

Name: dmload.sys
Image Path: dmload.sys
Address: 0xBA5AC000        Size: 5888        File Visible: -        Signed: -
Status: -

Name: DMusic.sys
Image Path: C:\WINDOWS\system32\drivers\DMusic.sys
Address: 0xBA148000        Size: 52864        File Visible: -        Signed: -
Status: -

Name: drmk.sys
Image Path: C:\WINDOWS\system32\drivers\drmk.sys
Address: 0xBA1E8000        Size: 61440        File Visible: -        Signed: -
Status: -

Name: drmkaud.sys
Image Path: C:\WINDOWS\system32\drivers\drmkaud.sys
Address: 0xA7DDA000        Size: 2944        File Visible: -        Signed: -
Status: -

Name: Dxapi.sys
Image Path: C:\WINDOWS\System32\drivers\Dxapi.sys
Address: 0xA7F7F000        Size: 12288        File Visible: -        Signed: -
Status: -

Name: dxg.sys
Image Path: C:\WINDOWS\System32\drivers\dxg.sys
Address: 0xBF000000        Size: 73728        File Visible: -        Signed: -
Status: -

Name: dxgthk.sys
Image Path: C:\WINDOWS\System32\drivers\dxgthk.sys
Address: 0xBA692000        Size: 4096        File Visible: -        Signed: -
Status: -

Name: fdc.sys
Image Path: C:\WINDOWS\System32\DRIVERS\fdc.sys
Address: 0xBA448000        Size: 27392        File Visible: -        Signed: -
Status: -

Name: Fips.SYS
Image Path: C:\WINDOWS\System32\Drivers\Fips.SYS
Address: 0xB4ECF000        Size: 44672        File Visible: -        Signed: -
Status: -

Name: flpydisk.sys
Image Path: C:\WINDOWS\System32\DRIVERS\flpydisk.sys
Address: 0xB55A4000        Size: 20480        File Visible: -        Signed: -
Status: -

Name: fltmgr.sys
Image Path: fltmgr.sys
Address: 0xB9ED6000        Size: 129792        File Visible: -        Signed: -
Status: -

Name: Fs_Rec.SYS
Image Path: C:\WINDOWS\System32\Drivers\Fs_Rec.SYS
Address: 0xBA632000        Size: 7936        File Visible: -        Signed: -
Status: -

Name: ftdisk.sys
Image Path: ftdisk.sys
Address: 0xB9F48000        Size: 126336        File Visible: -        Signed: -
Status: -

Name: GEARAspiWDM.sys
Image Path: C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
Address: 0xBA438000        Size: 21120        File Visible: -        Signed: -
Status: -

Name: hal.dll
Image Path: C:\WINDOWS\system32\hal.dll
Address: 0x806D1000        Size: 131840        File Visible: -        Signed: -
Status: -

Name: HIDCLASS.SYS
Image Path: C:\WINDOWS\system32\DRIVERS\HIDCLASS.SYS
Address: 0xB40BB000        Size: 36864        File Visible: -        Signed: -
Status: -

Name: HIDPARSE.SYS
Image Path: C:\WINDOWS\system32\DRIVERS\HIDPARSE.SYS
Address: 0xB5594000        Size: 28672        File Visible: -        Signed: -
Status: -

Name: hidusb.sys
Image Path: C:\WINDOWS\system32\DRIVERS\hidusb.sys
Address: 0xB8337000        Size: 10368        File Visible: -        Signed: -
Status: -

Name: HTTP.sys
Image Path: C:\WINDOWS\System32\Drivers\HTTP.sys
Address: 0xA0E9B000        Size: 265728        File Visible: -        Signed: -
Status: -

Name: i8042prt.sys
Image Path: C:\WINDOWS\System32\DRIVERS\i8042prt.sys
Address: 0xB9868000        Size: 52992        File Visible: -        Signed: -
Status: -

Name: imapi.sys
Image Path: C:\WINDOWS\system32\DRIVERS\imapi.sys
Address: 0xB9888000        Size: 42112        File Visible: -        Signed: -
Status: -

Name: ipnat.sys
Image Path: C:\WINDOWS\System32\DRIVERS\ipnat.sys
Address: 0xB082B000        Size: 152832        File Visible: -        Signed: -
Status: -

Name: ipsec.sys
Image Path: C:\WINDOWS\System32\DRIVERS\ipsec.sys
Address: 0xB098F000        Size: 75264        File Visible: -        Signed: -
Status: -

Name: isapnp.sys
Image Path: isapnp.sys
Address: 0xBA0A8000        Size: 37632        File Visible: -        Signed: -
Status: -

Name: ithsgt.sys
Image Path: C:\WINDOWS\system32\DRIVERS\ithsgt.sys
Address: 0xA14F3000        Size: 162432        File Visible: -        Signed: -
Status: -

Name: kbdclass.sys
Image Path: C:\WINDOWS\System32\DRIVERS\kbdclass.sys
Address: 0xBA440000        Size: 25216        File Visible: -        Signed: -
Status: -

Name: KDCOM.DLL
Image Path: C:\WINDOWS\system32\KDCOM.DLL
Address: 0xBA5A8000        Size: 8192        File Visible: -        Signed: -
Status: -

Name: kmixer.sys
Image Path: C:\WINDOWS\system32\drivers\kmixer.sys
Address: 0xA11B9000        Size: 172416        File Visible: -        Signed: -
Status: -

Name: ks.sys
Image Path: C:\WINDOWS\system32\drivers\ks.sys
Address: 0xB90A8000        Size: 143360        File Visible: -        Signed: -
Status: -

Name: KSecDD.sys
Image Path: KSecDD.sys
Address: 0xB9EBF000        Size: 92928        File Visible: -        Signed: -
Status: -

Name: lilsgt.sys
Image Path: C:\WINDOWS\system32\DRIVERS\lilsgt.sys
Address: 0xA7F73000        Size: 12032        File Visible: -        Signed: -
Status: -

Name: lirsgt.sys
Image Path: C:\WINDOWS\system32\DRIVERS\lirsgt.sys
Address: 0xA81AA000        Size: 18048        File Visible: -        Signed: -
Status: -

Name: mnmdd.SYS
Image Path: C:\WINDOWS\System32\Drivers\mnmdd.SYS
Address: 0xBA636000        Size: 4224        File Visible: -        Signed: -
Status: -

Name: mouclass.sys
Image Path: C:\WINDOWS\System32\DRIVERS\mouclass.sys
Address: 0xBA450000        Size: 23552        File Visible: -        Signed: -
Status: -

Name: mouhid.sys
Image Path: C:\WINDOWS\System32\DRIVERS\mouhid.sys
Address: 0xB8333000        Size: 12288        File Visible: -        Signed: -
Status: -

Name: MountMgr.sys
Image Path: MountMgr.sys
Address: 0xBA0D8000        Size: 42368        File Visible: -        Signed: -
Status: -

Name: mrxdav.sys
Image Path: C:\WINDOWS\System32\DRIVERS\mrxdav.sys
Address: 0xA15AE000        Size: 180608        File Visible: -        Signed: -
Status: -

Name: mrxsmb.sys
Image Path: C:\WINDOWS\System32\DRIVERS\mrxsmb.sys
Address: 0xB0851000        Size: 455680        File Visible: -        Signed: -
Status: -

Name: Msfs.SYS
Image Path: C:\WINDOWS\System32\Drivers\Msfs.SYS
Address: 0xB5584000        Size: 19072        File Visible: -        Signed: -
Status: -

Name: msgpc.sys
Image Path: C:\WINDOWS\System32\DRIVERS\msgpc.sys
Address: 0xB9828000        Size: 35072        File Visible: -        Signed: -
Status: -

Name: mssmbios.sys
Image Path: C:\WINDOWS\System32\DRIVERS\mssmbios.sys
Address: 0xBA550000        Size: 15488        File Visible: -        Signed: -
Status: -

Name: Mup.sys
Image Path: Mup.sys
Address: 0xB9DDA000        Size: 105344        File Visible: -        Signed: -
Status: -

Name: NDIS.sys
Image Path: NDIS.sys
Address: 0xB9E05000        Size: 182656        File Visible: -        Signed: -
Status: -

Name: ndistapi.sys
Image Path: C:\WINDOWS\System32\DRIVERS\ndistapi.sys
Address: 0xBA538000        Size: 10112        File Visible: -        Signed: -
Status: -

Name: ndiswan.sys
Image Path: C:\WINDOWS\System32\DRIVERS\ndiswan.sys
Address: 0xB9020000        Size: 91520        File Visible: -        Signed: -
Status: -

Name: NDProxy.SYS
Image Path: C:\WINDOWS\System32\Drivers\NDProxy.SYS
Address: 0xB811F000        Size: 40576        File Visible: -        Signed: -
Status: -

Name: netbios.sys
Image Path: C:\WINDOWS\System32\DRIVERS\netbios.sys
Address: 0xB4EEF000        Size: 34688        File Visible: -        Signed: -
Status: -

Name: netbt.sys
Image Path: C:\WINDOWS\System32\DRIVERS\netbt.sys
Address: 0xB090E000        Size: 162816        File Visible: -        Signed: -
Status: -

Name: nic1394.sys
Image Path: C:\WINDOWS\System32\DRIVERS\nic1394.sys
Address: 0xBA2C8000        Size: 61824        File Visible: -        Signed: -
Status: -

Name: Npfs.SYS
Image Path: C:\WINDOWS\System32\Drivers\Npfs.SYS
Address: 0xB557C000        Size: 30848        File Visible: -        Signed: -
Status: -

Name: Ntfs.sys
Image Path: Ntfs.sys
Address: 0xB9E32000        Size: 574976        File Visible: -        Signed: -
Status: -

Name: ntkrnlpa.exe
Image Path: C:\WINDOWS\system32\ntkrnlpa.exe
Address: 0x804D7000        Size: 2069120        File Visible: -        Signed: -
Status: -

Name: Null.SYS
Image Path: C:\WINDOWS\System32\Drivers\Null.SYS
Address: 0xBA767000        Size: 2944        File Visible: -        Signed: -
Status: -

Name: nv_agp.sys
Image Path: nv_agp.sys
Address: 0xBA348000        Size: 21120        File Visible: -        Signed: -
Status: -

Name: nvatabus.sys
Image Path: nvatabus.sys
Address: 0xB9EF6000        Size: 79360        File Visible: -        Signed: -
Status: -

Name: nvnetbus.sys
Image Path: C:\WINDOWS\System32\DRIVERS\nvnetbus.sys
Address: 0xB9DA6000        Size: 12928        File Visible: -        Signed: -
Status: -

Name: NVNRM.SYS
Image Path: C:\WINDOWS\System32\DRIVERS\NVNRM.SYS
Address: 0xBA1D8000        Size: 57344        File Visible: -        Signed: -
Status: -

Name: NVSNPU.SYS
Image Path: C:\WINDOWS\System32\DRIVERS\NVSNPU.SYS
Address: 0xB94C7000        Size: 192512        File Visible: -        Signed: -
Status: -

Name: ohci1394.sys
Image Path: ohci1394.sys
Address: 0xBA0B8000        Size: 61696        File Visible: -        Signed: -
Status: -

Name: parport.sys
Image Path: C:\WINDOWS\System32\DRIVERS\parport.sys
Address: 0xB9037000        Size: 80384        File Visible: -        Signed: -
Status: -

Name: PartMgr.sys
Image Path: PartMgr.sys
Address: 0xBA330000        Size: 19712        File Visible: -        Signed: -
Status: -

Name: ParVdm.SYS
Image Path: C:\WINDOWS\System32\Drivers\ParVdm.SYS
Address: 0xAF605000        Size: 7040        File Visible: -        Signed: -
Status: -

Name: PCANDIS5.SYS
Image Path: C:\WINDOWS\system32\PCANDIS5.SYS
Address: 0xA0DDF000        Size: 16128        File Visible: -        Signed: -
Status: -

Name: pci.sys
Image Path: pci.sys
Address: 0xB9F67000        Size: 68224        File Visible: -        Signed: -
Status: -

Name: pciide.sys
Image Path: pciide.sys
Address: 0xBA670000        Size: 3328        File Visible: -        Signed: -
Status: -

Name: PCIIDEX.SYS
Image Path: C:\WINDOWS\System32\DRIVERS\PCIIDEX.SYS
Address: 0xBA328000        Size: 28672        File Visible: -        Signed: -
Status: -

Name: pfc.sys
Image Path: C:\WINDOWS\system32\drivers\pfc.sys
Address: 0xB9D9A000        Size: 10368        File Visible: -        Signed: -
Status: -

Name: PnpManager
Image Path: \Driver\PnpManager
Address: 0x804D7000        Size: 2069120        File Visible: -        Signed: -
Status: -

Name: portcls.sys
Image Path: C:\WINDOWS\system32\drivers\portcls.sys
Address: 0xB90CB000        Size: 147456        File Visible: -        Signed: -
Status: -

Name: psched.sys
Image Path: C:\WINDOWS\System32\DRIVERS\psched.sys
Address: 0xB900F000        Size: 69120        File Visible: -        Signed: -
Status: -

Name: ptilink.sys
Image Path: C:\WINDOWS\System32\DRIVERS\ptilink.sys
Address: 0xBA418000        Size: 17792        File Visible: -        Signed: -
Status: -

Name: PxHelp20.sys
Image Path: PxHelp20.sys
Address: 0xBA118000        Size: 37376        File Visible: -        Signed: -
Status: -

Name: rasacd.sys
Image Path: C:\WINDOWS\System32\DRIVERS\rasacd.sys
Address: 0xB9DA2000        Size: 8832        File Visible: -        Signed: -
Status: -

Name: rasl2tp.sys
Image Path: C:\WINDOWS\System32\DRIVERS\rasl2tp.sys
Address: 0xB9858000        Size: 51328        File Visible: -        Signed: -
Status: -

Name: raspppoe.sys
Image Path: C:\WINDOWS\System32\DRIVERS\raspppoe.sys
Address: 0xB9848000        Size: 41472        File Visible: -        Signed: -
Status: -

Name: raspptp.sys
Image Path: C:\WINDOWS\System32\DRIVERS\raspptp.sys
Address: 0xB9838000        Size: 48384        File Visible: -        Signed: -
Status: -

Name: raspti.sys
Image Path: C:\WINDOWS\System32\DRIVERS\raspti.sys
Address: 0xBA420000        Size: 16512        File Visible: -        Signed: -
Status: -

Name: RAW
Image Path: \FileSystem\RAW
Address: 0x804D7000        Size: 2069120        File Visible: -        Signed: -
Status: -

Name: rdbss.sys
Image Path: C:\WINDOWS\System32\DRIVERS\rdbss.sys
Address: 0xB08C1000        Size: 175744        File Visible: -        Signed: -
Status: -

Name: RDPCDD.sys
Image Path: C:\WINDOWS\System32\DRIVERS\RDPCDD.sys
Address: 0xBA638000        Size: 4224        File Visible: -        Signed: -
Status: -

Name: rdpdr.sys
Image Path: C:\WINDOWS\System32\DRIVERS\rdpdr.sys
Address: 0xB8FDF000        Size: 196224        File Visible: -        Signed: -
Status: -

Name: redbook.sys
Image Path: C:\WINDOWS\System32\DRIVERS\redbook.sys
Address: 0xBA208000        Size: 57728        File Visible: -        Signed: -
Status: -

Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xA0BE3000        Size: 49152        File Visible: No        Signed: -
Status: -

Name: RT2500.sys
Image Path: C:\WINDOWS\system32\DRIVERS\RT2500.sys
Address: 0xB904B000        Size: 218368        File Visible: -        Signed: -
Status: -

Name: s3sav4.dll
Image Path: C:\WINDOWS\System32\s3sav4.dll
Address: 0xBFF40000        Size: 200704        File Visible: -        Signed: -
Status: -

Name: s3sav4m.sys
Image Path: C:\WINDOWS\system32\DRIVERS\s3sav4m.sys
Address: 0xB9095000        Size: 77824        File Visible: -        Signed: -
Status: -

Name: secdrv.sys
Image Path: C:\WINDOWS\System32\DRIVERS\secdrv.sys
Address: 0xA7D22000        Size: 40960        File Visible: -        Signed: -
Status: -

Name: serenum.sys
Image Path: C:\WINDOWS\System32\DRIVERS\serenum.sys
Address: 0xBA534000        Size: 15744        File Visible: -        Signed: -
Status: -

Name: serial.sys
Image Path: C:\WINDOWS\System32\DRIVERS\serial.sys
Address: 0xB9878000        Size: 65536        File Visible: -        Signed: -
Status: -

Name: sfdrv01.sys
Image Path: sfdrv01.sys
Address: 0xB9DF4000        Size: 69632        File Visible: -        Signed: -
Status: -

Name: sfhlp02.sys
Image Path: sfhlp02.sys
Address: 0xBA340000        Size: 32768        File Visible: -        Signed: -
Status: -

Name: sfsync02.sys
Image Path: sfsync02.sys
Address: 0xBA338000        Size: 20544        File Visible: -        Signed: -
Status: -

Name: splitter.sys
Image Path: C:\WINDOWS\system32\drivers\splitter.sys
Address: 0xAC93E000        Size: 6272        File Visible: -        Signed: -
Status: -

Name: srv.sys
Image Path: C:\WINDOWS\System32\DRIVERS\srv.sys
Address: 0xA1424000        Size: 353792        File Visible: -        Signed: -
Status: -

Name: ssmdrv.sys
Image Path: C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
Address: 0xB5574000        Size: 23040        File Visible: -        Signed: -
Status: -

Name: swenum.sys
Image Path: C:\WINDOWS\System32\DRIVERS\swenum.sys
Address: 0xBA5DE000        Size: 4352        File Visible: -        Signed: -
Status: -

Name: swmidi.sys
Image Path: C:\WINDOWS\system32\drivers\swmidi.sys
Address: 0xBA318000        Size: 56576        File Visible: -        Signed: -
Status: -

Name: sysaudio.sys
Image Path: C:\WINDOWS\system32\drivers\sysaudio.sys
Address: 0xB9582000        Size: 60800        File Visible: -        Signed: -
Status: -

Name: tap0901.sys
Image Path: C:\WINDOWS\system32\DRIVERS\tap0901.sys
Address: 0xBA428000        Size: 25216        File Visible: -        Signed: -
Status: -

Name: tcpip.sys
Image Path: C:\WINDOWS\System32\DRIVERS\tcpip.sys
Address: 0xB0936000        Size: 361600        File Visible: -        Signed: -
Status: -

Name: TDI.SYS
Image Path: C:\WINDOWS\System32\DRIVERS\TDI.SYS
Address: 0xBA410000        Size: 20480        File Visible: -        Signed: -
Status: -

Name: termdd.sys
Image Path: C:\WINDOWS\System32\DRIVERS\termdd.sys
Address: 0xB9818000        Size: 40704        File Visible: -        Signed: -
Status: -

Name: update.sys
Image Path: C:\WINDOWS\System32\DRIVERS\update.sys
Address: 0xB8F81000        Size: 384768        File Visible: -        Signed: -
Status: -

Name: USBD.SYS
Image Path: C:\WINDOWS\System32\DRIVERS\USBD.SYS
Address: 0xBA60E000        Size: 8192        File Visible: -        Signed: -
Status: -

Name: usbhub.sys
Image Path: C:\WINDOWS\System32\DRIVERS\usbhub.sys
Address: 0xB7BE8000        Size: 59520        File Visible: -        Signed: -
Status: -

Name: usbohci.sys
Image Path: C:\WINDOWS\System32\DRIVERS\usbohci.sys
Address: 0xBA430000        Size: 17152        File Visible: -        Signed: -
Status: -

Name: USBPORT.SYS
Image Path: C:\WINDOWS\System32\DRIVERS\USBPORT.SYS
Address: 0xB94F6000        Size: 147456        File Visible: -        Signed: -
Status: -

Name: vga.sys
Image Path: C:\WINDOWS\System32\drivers\vga.sys
Address: 0xB558C000        Size: 20992        File Visible: -        Signed: -
Status: -

Name: VIDEOPRT.SYS
Image Path: C:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS
Address: 0xB9081000        Size: 81920        File Visible: -        Signed: -
Status: -

Name: VolSnap.sys
Image Path: VolSnap.sys
Address: 0xBA0E8000        Size: 53760        File Visible: -        Signed: -
Status: -

Name: wanarp.sys
Image Path: C:\WINDOWS\System32\DRIVERS\wanarp.sys
Address: 0xB4EBF000        Size: 34560        File Visible: -        Signed: -
Status: -

Name: watchdog.sys
Image Path: C:\WINDOWS\System32\watchdog.sys
Address: 0xA81C2000        Size: 20480        File Visible: -        Signed: -
Status: -

Name: wdmaud.sys
Image Path: C:\WINDOWS\system32\drivers\wdmaud.sys
Address: 0xA12CF000        Size: 83072        File Visible: -        Signed: -
Status: -

Name: Win32k
Image Path: \Driver\Win32k
Address: 0xBF800000        Size: 1851392        File Visible: -        Signed: -
Status: -

Name: win32k.sys
Image Path: C:\WINDOWS\System32\win32k.sys
Address: 0xBF800000        Size: 1851392        File Visible: -        Signed: -
Status: -

Name: WMILIB.SYS
Image Path: C:\WINDOWS\System32\DRIVERS\WMILIB.SYS
Address: 0xBA5AA000        Size: 8192        File Visible: -        Signed: -
Status: -

Name: WMIxWDM
Image Path: \Driver\WMIxWDM
Address: 0x804D7000        Size: 2069120        File Visible: -        Signed: -
Status: -


ROOTREPEAL (c) AD, 2007-2009
==================================================
Scan Start Time:                2010/07/22 11:38
Program Version:                Version 1.3.5.0
Windows Version:                Windows XP SP3
==================================================

Stealth Objects
-------------------

Vielen Dank nochmal!

gruß, dante

kira 24.07.2010 09:20
1.
Schliesse alle Programme einschliesslich Internet Explorer und fixe mit Hijackthis die Einträge aus der nachfolgenden Codebox (HijackThis starten→ "Do a system scan only"→ Einträge auswählen→ Häckhen setzen→ "Fix checked" klicken→ PC neu aufstarten):
HijackThis erstellt ein Backup, Falls bei "Fixen" etwas schief geht, kann man unter "View the list of backups"- die Objekte wiederherstellen
Code:
O2 - BHO: (no name) - {357AD019-1EC1-48C7-A771-8DF993344BB0} - (no file)
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing)
O20 - Winlogon Notify: tuvvwur - tuvvwur.dll (file missing)
2.
Java aktualisieren
Deine Javaversion ist nicht aktuell. D
- Also Deinstalliere zunächst alle vorhandenen Java-Versionen über Systemsteuerung → Software → deinstallieren.
- Starte den Rechner neu.
- Downloade nun die Offline-Version von Java Version 6 Update 20 von Oracle und installiere sie. Achte darauf, eventuell angebotene Toolbars nicht mitzuinstallieren, also während der Installation den Haken bei der Toolbar entfernen.[/QUOTE]

3.
Adobe Reader aktualisieren :
Adobe Reader
Oder: Adobe starten-> gehe auf "Hilfe"-> "Nach Update suchen..."

4.
alle Anwendungen schließen → Ordner für temporäre Dateien bitte leeren
**Der Temp Ordner,ist für temporäre Dateien,also der Inhalt kann man ohne weiteres löschen.- Dateien, die noch in Benutzung sind, nicht löschbar.
**Lösche nur den Inhalt der Ordner, nicht die Ordner selbst!
  • `Start → ausführen` "cleanmgr" reinschreiben (ohne "") → "ok" - die Temporary Files, Temporary Internet Files, und der Papierkorb (Recycle Bin) müssen geleert werden→ "Ok"
  • `Start → ausführen` → %temp% reinschreiben (ohne "")→ "Ok" - - Ordnerinhalt überall markieren und löschen
  • für jedes Benutzerkonto bitte durchführen
  • anschließend den Papierkorb leeren

5.
reinige dein System mit Ccleaner:
  • "Cleaner"→ "Analysieren"→ Klick auf den Button "Start CCleaner"
  • "Registry""Fehler suchen"→ "Fehler beheben"→ "Alle beheben"
  • Starte dein System neu auf

6.
  • lade Dir SUPERAntiSpyware FREE Edition herunter.
  • installiere das Programm und update online.
  • starte SUPERAntiSpyware und klicke auf "Ihren Computer durchsuchen"
  • setze ein Häkchen bei "Kompletter Scan" und klicke auf "Weiter"
  • anschließend alle gefundenen Schadprogramme werden aufgelistet, bei alle Funde Häkchen setzen und mit "OK" bestätigen
  • auf "Weiter" klicken dann "OK" und auf "Fertig stellen"
  • um die Ergebnisse anzuzeigen: auf "Präferenzen" dann auf den "Statistiken und Protokolle" klicken
  • drücke auf "Protokoll anzeigen" - anschließend diesen Bericht bitte speichern und hier posten

7.
Auch auf USB-Sticks, selbstgebrannten Datenträgern, externen Festplatten und anderen Datenträgern können Viren transportiert werden. Man muss daher durch regelmäßige Prüfungen auf Schäden, die durch Malware verursacht worden sein können, überwacht werden. Hierfür sind ser gut geegnet und empfohlen, die auf dem Speichermedium gesicherten Daten, mit Hilfe des kostenlosen Online Scanners zu prüfen.
→ Also alle vorhandenen externen Laufwerke inkl. evtl. vorhandener USB-Sticks an den Rechner anschließen, aber dabei die Shift-Taste gedrückt halten, damit die Autorun-Funktion nicht ausgeführt wird.
Außerdem kann man die Autostarteigenschaft auch ausschalten:
→ Windows-Sicherheit: Datenträger-Autorun deaktivieren- bebilderte Anleitung v.Leonidas/3dcenter.org
→ Autorun/Autoplay gezielt für Laufwerkstypen oder -buchstaben abschalten/wintotal.de
→ Diese Silly -Beschreibung stützt die Annahme, dass er über einen USB-Stick kam. Die Ursache ist durch formatieren des Sticks aus der Welt geschafft, Du solltest darauf achten, dass dort keine Datei autorun.inf wieder auftaucht und etwas wählerisch sein, wo Du deinen Stick reinsteckst.

→ Den kompletten Rechner (also das ganze System) zu überprüfen (Systemprüfung ohne Säuberung) mit Kaspersky Online Scanner/klicke hier
→ um mit dem Vorgang fortzufahren klicke auf "Accept"
→ dann wähle "My computer" aus - Es dauert einige Zeit, bis ein Komplett-Scan durch gelaufen ist, also bitte um Geduld!
Es kann einige Zeit dauern, bis der Scan abgeschlossen ist - je nach Größe der Festplatte eine oder mehrere Stunden - also Geduld...
→ Report angezeigt, klicke auf "Save as" - den bitte kopieren und in deinem Thread hier einfügen
Vor dem Scan Einstellungen im Internet Explorer:
→ "Extras→ Internetoptionen→ Sicherheit":
→ alles auf Standardstufe stellen
→ Active X erlauben - damit die neue Virendefinitionen installiert werden können

** Hast du sonst Probleme mit deinem Rechner?

dante_222 26.07.2010 11:01
Hi Coverflow,

ich habe alle Punkte abgearbeitet. Kaspersky hat nichts mehr auf meinem Rechner gefunden, daher gibt es diesbezüglich nichts zu posten.

SUPERAntiSpyware Scan Log
Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 07/24/2010 at 07:44 PM

Application Version : 4.41.1000

Core Rules Database Version : 5261
Trace Rules Database Version: 3073

Scan type      : Complete Scan
Total Scan Time : 00:41:43

Memory items scanned      : 443
Memory threats detected  : 0
Registry items scanned    : 7245
Registry threats detected : 3
File items scanned        : 28007
File threats detected    : 18

Adware.SBSoft
        HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{08BEC6AA-49FC-4379-3587-4B21E286C19E}
        HKCR\CLSID\{08BEC6AA-49FC-4379-3587-4B21E286C19E}
        HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{08BEC6AA-49FC-4379-3587-4B21E286C19E}

Adware.Tracking Cookie
        adverts.freeloader.com [ C:\Dokumente und Einstellungen\***\Anwendungsdaten\Macromedia\Flash Player\#SharedObjects\HQXXGVWG ]
        banner.mindshare.de [ C:\Dokumente und Einstellungen\***\Anwendungsdaten\Macromedia\Flash Player\#SharedObjects\HQXXGVWG ]
        macromedia.com [ C:\Dokumente und Einstellungen\***\Anwendungsdaten\Macromedia\Flash Player\#SharedObjects\HQXXGVWG ]
        media.gamespy.com [ C:\Dokumente und Einstellungen\***\Anwendungsdaten\Macromedia\Flash Player\#SharedObjects\HQXXGVWG ]
        media.ign.com [ C:\Dokumente und Einstellungen\***\Anwendungsdaten\Macromedia\Flash Player\#SharedObjects\HQXXGVWG ]
        media1.break.com [ C:\Dokumente und Einstellungen\***\Anwendungsdaten\Macromedia\Flash Player\#SharedObjects\HQXXGVWG ]
        oddcast.com [ C:\Dokumente und Einstellungen\***\Anwendungsdaten\Macromedia\Flash Player\#SharedObjects\HQXXGVWG ]
        spe.atdmt.com [ C:\Dokumente und Einstellungen\***\Anwendungsdaten\Macromedia\Flash Player\#SharedObjects\HQXXGVWG ]
        www.soundclick.com [ C:\Dokumente und Einstellungen\***\Anwendungsdaten\Macromedia\Flash Player\#SharedObjects\HQXXGVWG ]
        ad.zanox.com [ C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\un8vc22s.default\cookies.txt ]
        ad.zanox.com [ C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\un8vc22s.default\cookies.txt ]
        .specificclick.net [ C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\un8vc22s.default\cookies.txt ]
        .specificclick.net [ C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\un8vc22s.default\cookies.txt ]
        .specificclick.net [ C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\un8vc22s.default\cookies.txt ]
        .specificclick.net [ C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\un8vc22s.default\cookies.txt ]
        .doubleclick.net [ C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\un8vc22s.default\cookies.txt ]
        .mediaplex.com [ C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\un8vc22s.default\cookies.txt ]
        .adfarm1.adition.com [ C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\un8vc22s.default\cookies.txt ]
Vielen Dank für die Hilfe! Allem Anschein nach ist der Rechner jetzt wieder frei von allem. Andere Probleme haben sich nicht gezeigt, alles läuft normal.

gruß, dante

kira 26.07.2010 17:32
1.
Kannst du die Programme die wir verwendet haben und nicht brauchst entfernen, bis auf:
Code:
HijackThis/Trend Micro
filelist.bat
CCleaner
Die sind nützliche Programme, die bei Probleme/Notfall können sehr hilfreich sein!

Zum Schluss, führe den folgenden Schritt aus:
2.
wenn alles gut verlaufen ist und dein System läuft stabil,mache folgendes:
** Rechten Maustaste auf den "Arbeitsplatz"→ auf "Eigenschaften"→ Registerkarte "Systemwiederherstellung"→ "Systemwiederherstellung deaktivieren"→ auf "OK"→ alles schließen→ Rechner neu starten→die Standardeinstellung wiederherzustellen(SWH wieder"aktivieren")

Ändere deine Passworte und Zugangsdaten! - von einem sauberen System aus

Lesestoff:
Zitat:
Da der Bestand der Datenbank wird täglich ergänzt und erweitert bzw werden mit der aktuellen Virendefinition die Informationen über den betroffenen Virus aufgenommen, empfehle ich dir mindestens einmal pro Woche (später genügt es sicherlich einmal im Monat) dein System Online Scannen lassen (immer mit einen anderen Scanner), um eine zweite Meinung einzuholen
(benutzen meist ActiveX und/oder Java): Kostenlose Online Scanner -
wünsch Dir alles Gute:)

dante_222 30.07.2010 11:52
Besten Dank nochmal! Ich habe auch die letzten Ratschläge befolgt!

Gruß Dante


Alle Zeitangaben in WEZ +1. Es ist jetzt 17:24 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19