Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   weder Zugriff auf die Registry, den Taskmanager, noch online update (https://www.trojaner-board.de/89303-weder-zugriff-registry-taskmanager-noch-online-update.html)

mrfuji 09.08.2010 15:38
weder Zugriff auf die Registry, den Taskmanager, noch online update
 
...weder habe ich Zugriff auf die Registry, den Taskmanager, noch kann ich auf irgendeine Seite um online mal ein Update durchlaufen zu lassen :( Auch wenn ich in die Registry dank Hilfsmittelchen gehe und dort alles abändere, stellt sich dies nach 2 sec wieder um! Ebenso kann ich keinerlei AntivirSoftware installieren, da deren dienste sich nicht starten lassen!!! Hatte sowas noch nie und weiss nicht weiter und mag zu allem nicht unbedingt alles neu installieren...

Hat jemand vielleicht ne Idee woran es liegen könnte, oder wie man es doch noch austricksen kann um zB trendmicro housecall oder dergleichen drüber laufen zulassen???

thx im voraus =)

Hoffe das Highjackpostfile ist aussagekräftig genug!!!

HiJackthis Logfile:
Code:
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 16:37:04, on 09.08.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
 
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Programme\Faronics\Deep Freeze\Install C-0\DF5Serv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\InterCafe 2008\Client\Client.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\DAEMON Tools\daemon.exe
C:\WINDOWS\System32\WScript.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Faronics\Deep Freeze\Install C-0\_$Df\FrzState2k.exe
C:\Programme\InterCafe 2008\Client\ICClientHelper.exe
C:\Programme\Java\jre6\bin\jqs.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\explorer.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\DOKUME~1\user\LOKALE~1\Temp\jiwjb.exe
C:\DOKUME~1\user\LOKALE~1\Temp\pqbjvf.exe
C:\Dokumente und Einstellungen\user\Desktop\HiJackThis204.exe
 
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Hacked by PC-11
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,"C:\Programme\InterCafe 2008\Client\Client.exe",
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [Verknüpfung mit der High Definition Audio-Eigenschaftenseite] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Programme\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [PC-11] C:\WINDOWS\SYSTEM32\PC-11.vbs
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\PROGRA~1\Yahoo!\MESSEN~1\YahooMessenger.exe" -quiet
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: Google Sidewiki... - res://C:\Programme\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Programme\Paltalk Messenger\Paltalk.exe
O9 - Extra button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O15 - Trusted Zone: hxxp://www.trendmicro.de
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Programme\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1281349501312
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1205762813937
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: DfLogon - LogonDll.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: .NET Runtime Optimization Service v2.0.50727_X86 (clr_optimization_v2.0.50727_32) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (file missing)
O23 - Service: DF5Serv - Faronics Corporation - C:\Programme\Faronics\Deep Freeze\Install C-0\DF5Serv.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Programme\Google\Update\GoogleUpdate.exe
O23 - Service: ICClientHelperService - blue image GmbH - C:\Programme\InterCafe 2008\Client\ICClientHelper.exe
O23 - Service: Client Service (iClientService) - Unknown owner - C:\WINDOWS\system32\IClientService.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Programme\Gemeinsame Dateien\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Office Source Engine (ose) - Unknown owner - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
 
--
End of file - 8224 bytes
--- --- ---


wenn ich maleware oder cclean drüber laufen lassen, findet er auch einiges, was sich auch super alles löschen lässt, nur nach dem neustart ist es dann wieder dasselbe spiel:( und das liegt jetzt nicht an deepfreeze, welche natürlich vorher ausgeschaltet wurde!!!

markusg 09.08.2010 17:29
hi, bitte führe nur die von mir genannten schritte aus, sonst könnte es probleme geben und außerdem weis ich so was gemacht wurde.ootl:
Systemscan mit OTL
download otl:
http://filepony.de/download-otl/

Doppelklick auf die OTL.exe
(user von Windows 7 und Vista: Rechtsklick als Administrator ausführen)
1. Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
2. Hake an "scan all users"
3. Unter "Extra Registry wähle:
"Use Safelist" "LOP Check" "Purity Check"
4. Kopiere in die Textbox:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
5. Klicke "Scan"
6. 2 reporte werden erstellt:
OTL.Txt
Extras.Txt
poste beide

mrfuji 09.08.2010 17:52
thx erstmal für die schnelle antwort =) habe es nach anleitung durchgeführt und das kam bei raus...

-------OTL.TXT-------
OTL Logfile:
Code:
OTL logfile created on: 09.08.2010 18:40:55 - Run 1
OTL by OldTimer - Version 3.2.9.1    Folder = C:\Dokumente und Einstellungen\user\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1.023,00 Mb Total Physical Memory | 391,00 Mb Available Physical Memory | 38,00% Memory free
2,00 Gb Paging File | 2,00 Gb Available in Paging File | 79,00% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 48,83 Gb Total Space | 33,67 Gb Free Space | 68,95% Space Free | Partition Type: NTFS
Drive D: | 68,36 Gb Total Space | 6,08 Gb Free Space | 8,89% Space Free | Partition Type: NTFS
Drive E: | 31,85 Gb Total Space | 12,57 Gb Free Space | 39,46% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive M: | 3,97 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive Y: | 1,91 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
 
Computer Name: PC-11
Current User Name: user
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Processes (SafeList) ==========
 
PRC - C:\Dokumente und Einstellungen\user\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Dokumente und Einstellungen\user\Lokale Einstellungen\Temp\oyuwsn.exe ()
PRC - C:\Dokumente und Einstellungen\user\Lokale Einstellungen\Temp\bksyo.exe ()
PRC - C:\Programme\Faronics\Deep Freeze\Install C-0\_$Df\FrzState2k.exe (Faronics Corporation)
PRC - C:\Programme\Mozilla Firefox\plugin-container.exe (Mozilla Corporation)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\InterCafe 2008\Client\ICClientHelper.exe (blue image GmbH)
PRC - C:\Programme\InterCafe 2008\Client\Client.exe (blue image GmbH)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\DAEMON Tools\daemon.exe (DT Soft Ltd.)
PRC - C:\Programme\Faronics\Deep Freeze\Install C-0\DF5Serv.exe (Faronics Corporation)
PRC - C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE (Microsoft Corporation)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Dokumente und Einstellungen\user\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\Chrome\Hook\rpchromebrowserrecordhelper.dll ()
MOD - C:\WINDOWS\system32\msvcp71.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msvcr71.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\dwlGina3.dll (Kassl GmbH)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE File not found
SRV - (iClientService) -- C:\WINDOWS\System32\IClientService.exe File not found
SRV - (clr_optimization_v2.0.50727_32) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe File not found
SRV - (AppMgmt) -- C:\WINDOWS\System32\appmgmts.dll File not found
SRV - (ICClientHelperService) -- C:\Programme\InterCafe 2008\Client\ICClientHelper.exe (blue image GmbH)
SRV - (LVSrvLauncher) -- C:\Programme\Gemeinsame Dateien\LogiShrd\SrvLnch\SrvLnch.exe (Logitech Inc.)
SRV - (DF5Serv) -- C:\Programme\Faronics\Deep Freeze\Install C-0\DF5Serv.exe (Faronics Corporation)
SRV - (IDriverT) -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (MDM) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (PxHelp20) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys File not found
DRV - (PciCon) -- F:\PciCon.sys File not found
DRV - (mlwahn) -- C:\WINDOWS\System32\drivers\bnjagds.sys File not found
DRV - (cpuz132) -- C:\DOKUME~1\user\LOKALE~1\Temp\cpuz132\cpuz132_x32.sys File not found
DRV - (amsint32) -- C:\WINDOWS\System32\drivers\iilonn.sys File not found
DRV - (nv) -- C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (dwlkbf) -- C:\WINDOWS\System32\drivers\dwlkbf.sys (Kassl)
DRV - (NwlnkIpx) -- C:\WINDOWS\system32\drivers\nwlnkipx.sys (Microsoft Corporation)
DRV - (MPE) -- C:\WINDOWS\system32\drivers\mpe.sys (Microsoft Corporation)
DRV - (usbaudio) USB-Audiotreiber (WDM) -- C:\WINDOWS\system32\drivers\usbaudio.sys (Microsoft Corporation)
DRV - (HDAudBus) -- C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows (R) Server 2003 DDK provider)
DRV - (sptd) -- C:\WINDOWS\System32\Drivers\sptd.sys ()
DRV - (3xHybrid) -- C:\WINDOWS\system32\drivers\3xHybrid.sys (Philips Semiconductors GmbH)
DRV - (LVMVDrv) -- C:\WINDOWS\system32\drivers\LVMVdrv.sys (Logitech Inc.)
DRV - (DeepFrz) -- C:\WINDOWS\System32\drivers\DeepFrz.sys (Faronics Corporation)
DRV - (HSF_DPV) -- C:\WINDOWS\system32\drivers\HSF_DPV.sys (Conexant Systems, Inc.)
DRV - (HSFHWBS2) -- C:\WINDOWS\system32\drivers\HSFHWBS2.sys (Conexant Systems, Inc.)
DRV - (winachsf) -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (QCMerced) -- C:\WINDOWS\system32\drivers\lvcm.sys ()
DRV - (LVUSBSta) -- C:\WINDOWS\system32\drivers\LVUSBSta.sys (Logitech Inc.)
DRV - (NwlnkNb) -- C:\WINDOWS\system32\drivers\nwlnknb.sys (Microsoft Corporation)
DRV - (NwlnkSpx) -- C:\WINDOWS\system32\drivers\nwlnkspx.sys (Microsoft Corporation)
DRV - (rtl8139) NT-Treiber für Realtek RTL8139(A/B/C) -- C:\WINDOWS\system32\drivers\RTL8139.sys (Realtek Semiconductor Corporation)
DRV - (HdAudAddService) -- C:\WINDOWS\system32\drivers\Hdaudio.sys (Windows (R) Server 2003 DDK provider)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant =
 
 
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Home - AlamoTel - PC Hilfe, PC Notdienst, PC Reparatur, PC Service, EDV Beratung, Telekommunikation Service
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Home - AlamoTel - PC Hilfe, PC Notdienst, PC Reparatur, PC Service, EDV Beratung, Telekommunikation Service
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Google
IE - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "hxxp://www.alamotel.de"
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.1.5
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:1.5.4.20081105
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..network.proxy.type: 0
 
 
FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010.07.21 20:11:25 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.08.06 11:19:56 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.08.06 11:19:56 | 000,000,000 | ---D | M]
 
[2010.07.16 21:59:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Mozilla\Extensions
[2010.08.09 16:30:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Mozilla\Firefox\Profiles\gsqoe35c.default\extensions
[2010.08.09 11:23:33 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Mozilla\Firefox\Profiles\gsqoe35c.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010.08.09 16:30:39 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2010.08.09 16:26:56 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010.08.09 16:26:47 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll
[2010.06.26 10:03:55 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.06.26 10:03:55 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.06.26 10:03:55 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.06.26 10:03:55 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.06.26 10:03:55 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2004.08.04 14:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O3 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.
O4 - HKLM..\Run: [DAEMON Tools] C:\Programme\DAEMON Tools\daemon.exe (DT Soft Ltd.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz]  File not found
O4 - HKLM..\Run: [PC-11] C:\WINDOWS\system32\PC-11.vbs ()
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [Verknüpfung mit der High Definition Audio-Eigenschaftenseite] C:\WINDOWS\System32\Hdaudpropshortcut.exe (Windows (R) Server 2003 DDK provider)
O4 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005..\Run: [Messenger (Yahoo!)] C:\Programme\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Toolbars present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFileUrl = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoChangeStartMenu = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoExpandedNewMenu = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRecentDocsNetHood = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSaveSettings = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoTrayContextMenu = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoToolbarCustomize = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetTaskbar = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoViewContextMenu = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoAddPrinter = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDeletePrinter = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoPropertiesRecycleBin = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWinKeys = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ClassicShell = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoManageMyComputerVerb = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetFolders = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoStartMenuSubFolders = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoInternetIcon = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoNetHood = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoShellSearchButton = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LockTaskbar = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFavoritesMenu = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFileMenu = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: StartMenuLogoff = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMMyDocs = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoStartMenuMyMusic = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoStartMenuNetworkPlaces = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMMyPictures = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoNetworkConnections = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoStartMenuPinnedList = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoPropertiesMyComputer = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFind = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: SpecifyDefaultButtons = 1
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: Btn_Media = 1
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: Btn_History = 1
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: Btn_Edit = 1
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMConfigurePrograms = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSharedDocuments = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoHardwareTab = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMHelp = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoNetConnectDisconnect = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoBandCustomize = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSecurityTab = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoToolbarsOnTaskbar = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoTrayItemsDisplay = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoUserNameInStartMenu = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoComputersNearMe = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoViewOnDrive = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideClock = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSearchCommInStartMenu = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSearchComputerLinkInStartMenu = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSearchFilesInStartMenu = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSearchInternetInStartMenu = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSearchProgramsInStartMenu = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCloseDragDropBands = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: RestrictWelcomeCenter = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoStartMenuMorePrograms = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisallowRun = 1
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoClose = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun:  =
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun: 3 = BF2.exe
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun: 4 = iw3sp.exe
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun: 5 = generals.exe
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun: 6 = Warcraft III.exe
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun: 7 = Game.exe
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun: 8 = Crysis.exe
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun: 9 = NFSC.exe
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun: 10 = TestDriveUnlimited.exe
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun: 11 = ACTOFWAR.EXE
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun: 12 = tra.exe
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun: 13 = gta_sa.exe
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun: 14 = Startup.exe
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun: 15 = Steam.exe
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun: 16 = fifa07.exe
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun: 17 = Frozen Throne.exe
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun: 18 = graw.exe
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun: 19 = FIFA08.exe
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideFastUserSwitching = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispCPL = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableLockWorkstation = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispBackgroundPage = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispAppearancePage = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispSettingsPage = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispScrSavPage = 0
O7 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableChangePassword = 0
O9 - Extra Button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Programme\Paltalk Messenger\paltalk.exe (AVM Software Inc.)
O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O15 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\..Trusted Domains: trendmicro.de ([www] http in Vertrauenswürdige Sites)
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} hxxp://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.cab (Office Genuine Advantage Validation Tool)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Programme\Yahoo!\Common\yinsthelper.dll (YInstStarter Class)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1281349501312 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1205762813937 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} hxxp://office.microsoft.com/officeupdate/content/opuc4.cab (Office Update Installation Engine)
O16 - DPF: {CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA} </title> <script language="JavaScript" type="text/javascript" src="/ocom/groups/systemobject/@mktg_admin/documents/webcontent/oraclelib.js"> </script> <style type="text/css"> HTML,BODY,TD,H1,H2,H3,H4,OL,UL,DL,LI,DT,DD {font-family:arial,helvetica,san (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.123.253
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - ("C:\Programme\InterCafe 2008\Client\Client.exe") - C:\Programme\InterCafe 2008\Client\Client.exe (blue image GmbH)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Reg Error: Value error. - Reg Error: Value error. File not found
O20 - Winlogon\Notify\DfLogon: DllName - LogonDll.dll - C:\WINDOWS\System32\LogonDll.dll ()
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\user\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\user\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008.03.16 23:32:59 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2010.08.09 16:51:14 | 000,000,092 | RHS- | M] () - C:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2010.08.09 16:51:17 | 000,000,092 | RHS- | M] () - D:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2010.08.09 16:51:17 | 000,000,092 | RHS- | M] () - E:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2004.11.18 22:59:22 | 000,000,000 | R--D | M] - M:\AutoRun -- [ CDFS ]
O32 - AutoRun File - [2004.11.18 22:25:54 | 000,684,032 | R--- | M] (Electronic Arts Inc.) - M:\AutoRun.exe -- [ CDFS ]
O32 - AutoRun File - [2004.11.14 16:08:54 | 000,929,792 | R--- | M] (Electronic Arts Inc.) - M:\AutoRunGUI.dll -- [ CDFS ]
O32 - AutoRun File - [2004.11.18 22:58:27 | 000,000,103 | R--- | M] () - M:\autorun.inf -- [ CDFS ]
O32 - AutoRun File - [2005.05.23 01:22:41 | 001,187,840 | R--- | M] () - Y:\autorun.exe -- [ UDF ]
O32 - AutoRun File - [2005.05.23 01:22:41 | 001,187,840 | R--- | M] () - Y:\Autorun.exe -- [ UDF ]
O32 - AutoRun File - [2005.05.23 01:22:40 | 000,000,043 | R--- | M] () - Y:\Autorun.inf -- [ UDF ]
O33 - MountPoints2\{08829b26-a13b-11df-b8f2-0011d813e4a0}\Shell - "" = AutoRun
O33 - MountPoints2\{08829b26-a13b-11df-b8f2-0011d813e4a0}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{90dc20c1-f39e-11dc-a4fb-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{90dc20c1-f39e-11dc-a4fb-806d6172696f}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{90dc20c1-f39e-11dc-a4fb-806d6172696f}\Shell\AutoRun\command - "" = F:\Autorun\ShelExec.exe default.htm -- File not found
O34 - HKLM BootExecute: (autocheck autochk /k:C /k:D /k:E *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: 6to4 -  File not found
NetSvcs: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: Irmon -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: Wmi - C:\WINDOWS\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp -  File not found
 
 
 
 
ActiveX: {0291E591-EA41-4c82-8106-3DC6CE7F7664} - Reg Error: Value error.
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 10.3
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 10.3
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} - Reg Error: Value error.
ActiveX: {347B0667-C7ED-429B-BDE3-CC8D3BACAA31} - Reg Error: Value error.
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Sicherheitsupdate für Windows XP (KB923789)
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9309DD7E-EBFE-3C95-8B47-30D3A012F606} - .NET Framework
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {A17E30C4-A9BA-11D4-8673-60DB54C10000} - Reg Error: Value error.
ActiveX: {AA218328-0EA8-4D70-8972-E987A9190FF4} - Reg Error: Value error.
ActiveX: {B508B3F1-A24A-32C0-B310-85786919EF28} - .NET Framework
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - Reg Error: Value error.
ActiveX: {E78BFA60-5393-4C38-82AB-E8019E464EB4} - .NET Framework
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {ECD292A0-0347-4244-8C24-5DBCE990FB40} - Hotfix for Microsoft .NET Framework 3.0 (KB932471)
ActiveX: {EF289A85-8E57-408d-BE47-73B55609861A} - RootsUpdate
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
ActiveX: Microsoft Base Smart Card Crypto Provider Package -
 
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.siren - C:\WINDOWS\System32\sirenacm.dll (Microsoft Corporation)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
Drivers32: VIDC.I420 - C:\WINDOWS\System32\lvcodec2.dll (Logitech Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.MP42 - C:\WINDOWS\System32\mpg4c32.dll (Microsoft Corporation)
Drivers32: VIDC.MPG4 - C:\WINDOWS\System32\mpg4c32.dll (Microsoft Corporation)
Drivers32: vidc.yv12 - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902109354000384)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.08.09 18:37:47 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\user\Desktop\OTL.exe
[2010.08.09 16:33:34 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\user\Lokale Einstellungen\Anwendungsdaten\PCHealth
[2010.08.09 14:51:59 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\user\Recent
[2010.08.09 13:40:43 | 000,000,000 | ---D | C] -- C:\WINDOWS\Sun
[2010.08.09 13:18:55 | 000,000,000 | ---D | C] -- C:\Programme\Catan GmbH
[2010.08.09 12:54:55 | 000,353,792 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\srv.sys
[2010.08.09 12:54:32 | 000,455,680 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mrxsmb.sys
[2010.08.09 12:54:10 | 000,119,808 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\t2embed.dll
[2010.08.09 12:54:10 | 000,081,920 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fontsub.dll
[2010.08.09 12:53:53 | 003,558,912 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\moviemk.exe
[2010.08.09 12:53:30 | 000,203,136 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\rmcast.sys
[2010.08.09 12:53:17 | 000,331,776 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msadce.dll
[2010.08.09 12:53:09 | 000,293,376 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\browserchoice.exe
[2010.08.09 12:52:02 | 000,273,024 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\bthport.sys
[2010.08.09 12:51:12 | 000,744,448 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\helpsvc.exe
[2010.08.09 12:50:55 | 002,192,256 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntoskrnl.exe
[2010.08.09 12:50:48 | 002,148,864 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntkrnlmp.exe
[2010.08.09 12:50:46 | 002,027,008 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntkrpamp.exe
[2010.08.09 12:49:44 | 000,471,552 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\aclayers.dll
[2010.08.09 12:46:23 | 000,337,408 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\netapi32.dll
[2010.08.09 12:45:54 | 001,172,480 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msxml3.dll
[2010.08.09 12:33:46 | 000,274,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mucltui.dll
[2010.08.09 12:33:46 | 000,017,776 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mucltui.dll.mui
[2010.08.09 12:25:21 | 000,015,584 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wuapi.dll.mui
[2010.08.09 11:24:09 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Malwarebytes
[2010.08.09 11:23:54 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2010.08.09 11:23:54 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2010.08.09 11:11:10 | 000,000,000 | ---D | C] -- C:\Programme\Spybot - Search & Destroy
[2010.08.09 11:11:10 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
[2010.08.09 10:45:44 | 000,000,000 | ---D | C] -- C:\WINDOWS\Downloaded Installations
[2010.08.07 13:25:31 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Driver Whiz
[2010.08.07 13:03:55 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\DivX Shared
[2010.08.07 13:03:48 | 000,000,000 | ---D | C] -- C:\Programme\DivX
[2010.08.07 12:57:46 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DivX
[2010.08.07 12:17:39 | 000,000,000 | ---D | C] -- C:\WINDOWS\Prefetch
[2010.08.06 11:31:38 | 001,372,672 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msxml6.dll
[2010.08.06 11:31:38 | 000,093,184 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msxml6r.dll
[2010.08.06 11:31:36 | 000,870,784 | ---- | C] (ATI Technologies Inc. ) -- C:\WINDOWS\System32\ati3d1ag.dll
[2010.08.06 11:31:36 | 000,377,984 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\ati2dvaa.dll
[2010.08.06 11:31:36 | 000,023,040 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\ativmvxx.ax
[2010.08.06 11:31:36 | 000,009,728 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\ativdaxx.ax
[2010.08.06 11:31:35 | 000,651,264 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dot3ui.dll
[2010.08.06 11:31:35 | 000,233,472 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\azroles.dll
[2010.08.06 11:31:35 | 000,184,832 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\eapp3hst.dll
[2010.08.06 11:31:35 | 000,182,272 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\eapphost.dll
[2010.08.06 11:31:35 | 000,126,976 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\eappcfg.dll
[2010.08.06 11:31:35 | 000,095,232 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\eappgnui.dll
[2010.08.06 11:31:35 | 000,062,976 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dot3cfg.dll
[2010.08.06 11:31:35 | 000,059,392 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\eapqec.dll
[2010.08.06 11:31:35 | 000,056,832 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dot3msm.dll
[2010.08.06 11:31:35 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dhcpqec.dll
[2010.08.06 11:31:35 | 000,040,960 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\eappprxy.dll
[2010.08.06 11:31:35 | 000,039,936 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dot3gpclnt.dll
[2010.08.06 11:31:35 | 000,039,936 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dimsroam.dll
[2010.08.06 11:31:35 | 000,032,768 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\ativtmxx.dll
[2010.08.06 11:31:35 | 000,030,720 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\eapolqec.dll
[2010.08.06 11:31:35 | 000,026,112 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dot3api.dll
[2010.08.06 11:31:35 | 000,009,216 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dot3dlg.dll
[2010.08.06 11:31:35 | 000,007,168 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\bitsprx4.dll
[2010.08.06 11:31:34 | 000,081,920 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ieencode.dll
[2010.08.06 11:31:34 | 000,032,285 | ---- | C] (Conexant Systems, Inc.) -- C:\WINDOWS\System32\hsfcisp2.dll
[2010.08.06 11:31:33 | 000,037,376 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\l2gpstore.dll
[2010.08.06 11:31:32 | 001,737,856 | ---- | C] (Matrox Graphics Inc.) -- C:\WINDOWS\System32\mtxparhd.dll
[2010.08.06 11:31:32 | 000,198,656 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\napmontr.dll
[2010.08.06 11:31:32 | 000,177,664 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\napstat.exe
[2010.08.06 11:31:32 | 000,155,136 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mssha.dll
[2010.08.06 11:31:32 | 000,151,040 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\qagent.dll
[2010.08.06 11:31:32 | 000,145,408 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\onex.dll
[2010.08.06 11:31:32 | 000,081,408 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msshavmsg.dll
[2010.08.06 11:31:32 | 000,062,464 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\qcliprov.dll
[2010.08.06 11:31:32 | 000,030,208 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\napipsec.dll
[2010.08.06 11:31:31 | 000,397,056 | ---- | C] (S3 Graphics, Inc.) -- C:\WINDOWS\System32\s3gnb.dll
[2010.08.06 11:31:31 | 000,286,792 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\slextspk.dll
[2010.08.06 11:31:31 | 000,188,508 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\slgen.dll
[2010.08.06 11:31:31 | 000,076,800 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\qutil.dll
[2010.08.06 11:31:31 | 000,073,832 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\slcoinst.dll
[2010.08.06 11:31:31 | 000,073,796 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\slserv.exe
[2010.08.06 11:31:31 | 000,061,952 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\rasqec.dll
[2010.08.06 11:31:31 | 000,032,866 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\slrundll.exe
[2010.08.06 11:31:31 | 000,032,768 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\setupn.exe
[2010.08.06 11:31:30 | 000,069,120 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wlanapi.dll
[2010.08.06 11:31:28 | 000,032,866 | ---- | C] (Smart Link) -- C:\WINDOWS\slrundll.exe
[2010.08.06 11:31:27 | 000,000,000 | ---D | C] -- C:\WINDOWS\l2schemas
[2010.08.06 11:31:27 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\bits
[2010.08.06 11:27:10 | 000,004,255 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\adv01nt5.dll
[2010.08.06 11:27:09 | 000,056,623 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati1btxx.sys
[2010.08.06 11:27:09 | 000,043,008 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\WINDOWS\System32\drivers\amdagp.sys
[2010.08.06 11:27:09 | 000,030,671 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati1raxx.sys
[2010.08.06 11:27:09 | 000,012,047 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati1pdxx.sys
[2010.08.06 11:27:09 | 000,011,615 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati1mdxx.sys
[2010.08.06 11:27:09 | 000,003,967 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\adv02nt5.dll
[2010.08.06 11:27:09 | 000,003,775 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\adv11nt5.dll
[2010.08.06 11:27:09 | 000,003,711 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\adv09nt5.dll
[2010.08.06 11:27:09 | 000,003,647 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\adv07nt5.dll
[2010.08.06 11:27:09 | 000,003,615 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\adv05nt5.dll
[2010.08.06 11:27:09 | 000,003,135 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\adv08nt5.dll
[2010.08.06 11:27:08 | 000,327,168 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati2mtaa.sys
[2010.08.06 11:27:08 | 000,104,960 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\atinrvxx.sys
[2010.08.06 11:27:08 | 000,073,216 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\atintuxx.sys
[2010.08.06 11:27:08 | 000,063,663 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati1rvxx.sys
[2010.08.06 11:27:08 | 000,057,856 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\atinbtxx.sys
[2010.08.06 11:27:08 | 000,052,224 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\atinraxx.sys
[2010.08.06 11:27:08 | 000,036,463 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati1tuxx.sys
[2010.08.06 11:27:08 | 000,034,735 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati1xsxx.sys
[2010.08.06 11:27:08 | 000,029,455 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati1xbxx.sys
[2010.08.06 11:27:08 | 000,028,672 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\atinsnxx.sys
[2010.08.06 11:27:08 | 000,026,367 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati1snxx.sys
[2010.08.06 11:27:08 | 000,021,343 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati1ttxx.sys
[2010.08.06 11:27:08 | 000,014,336 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\atinpdxx.sys
[2010.08.06 11:27:08 | 000,013,824 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\atinttxx.sys
[2010.08.06 11:27:08 | 000,013,824 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\atinmdxx.sys
[2010.08.06 11:27:07 | 000,063,488 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\atinxsxx.sys
[2010.08.06 11:27:07 | 000,036,480 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\bthprint.sys
[2010.08.06 11:27:07 | 000,031,744 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\atinxbxx.sys
[2010.08.06 11:27:07 | 000,025,471 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\atv04nt5.dll
[2010.08.06 11:27:07 | 000,021,183 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\atv01nt5.dll
[2010.08.06 11:27:07 | 000,017,279 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\atv10nt5.dll
[2010.08.06 11:27:07 | 000,014,143 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\atv06nt5.dll
[2010.08.06 11:27:07 | 000,011,359 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\atv02nt5.dll
[2010.08.06 11:27:06 | 000,015,423 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\ch7xxnt5.dll
[2010.08.06 11:27:04 | 001,309,184 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\drivers\mtlstrm.sys
[2010.08.06 11:27:04 | 000,452,736 | ---- | C] (Matrox Graphics Inc.) -- C:\WINDOWS\System32\drivers\mtxparhm.sys
[2010.08.06 11:27:04 | 000,180,360 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\drivers\ntmtlfax.sys
[2010.08.06 11:27:04 | 000,166,912 | ---- | C] (S3 Graphics, Inc.) -- C:\WINDOWS\System32\drivers\s3gnbm.sys
[2010.08.06 11:27:04 | 000,126,686 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\drivers\mtlmnt5.sys
[2010.08.06 11:27:04 | 000,030,592 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\rndismpx.sys
[2010.08.06 11:27:04 | 000,013,776 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\drivers\recagent.sys
[2010.08.06 11:27:04 | 000,012,672 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\mutohpen.sys
[2010.08.06 11:27:03 | 000,404,990 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\drivers\slntamr.sys
[2010.08.06 11:27:03 | 000,129,535 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\drivers\slnt7554.sys
[2010.08.06 11:27:03 | 000,095,424 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\drivers\slnthal.sys
[2010.08.06 11:27:03 | 000,040,960 | ---- | C] (Silicon Integrated Systems Corporation) -- C:\WINDOWS\System32\drivers\sisagp.sys
[2010.08.06 11:27:03 | 000,013,240 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\drivers\slwdmsup.sys
[2010.08.06 11:27:03 | 000,005,888 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\smbali.sys
[2010.08.06 11:27:03 | 000,003,901 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\siint5.dll
[2010.08.06 11:27:02 | 000,011,807 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\wadv07nt.sys
[2010.08.06 11:27:02 | 000,011,325 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\vchnt5.dll
[2010.08.06 11:27:02 | 000,011,295 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\wadv08nt.sys
[2010.08.06 11:27:01 | 000,025,471 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\watv10nt.sys
[2010.08.06 11:27:01 | 000,022,271 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\watv06nt.sys
[2010.08.06 11:27:01 | 000,011,935 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\wadv11nt.sys
[2010.08.06 11:27:01 | 000,011,871 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\wadv09nt.sys
[2010.08.06 11:22:07 | 000,000,000 | -H-D | C] -- C:\WINDOWS\$NtServicePackUninstall$
[2010.08.06 11:22:04 | 000,000,000 | ---D | C] -- C:\WINDOWS\EHome
[2010.08.06 11:17:10 | 000,000,000 | ---D | C] -- C:\Programme\AGEIA Technologies
[2010.08.06 11:17:03 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NVIDIA Corporation
[2010.08.06 11:16:54 | 000,000,000 | ---D | C] -- C:\Programme\NVIDIA Corporation
[2010.08.06 11:16:36 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\ReinstallBackups
[2010.08.06 11:16:05 | 004,077,672 | ---- | C] (NVIDIA Corporation) -- C:\WINDOWS\System32\nvcuvenc.dll
[2010.08.06 11:16:05 | 002,259,560 | ---- | C] (NVIDIA Corporation) -- C:\WINDOWS\System32\nvcuvid.dll
[2010.08.06 11:16:05 | 000,061,440 | ---- | C] (Khronos Group) -- C:\WINDOWS\System32\OpenCL.dll
[2010.08.06 11:16:01 | 011,632,640 | ---- | C] (NVIDIA Corporation) -- C:\WINDOWS\System32\nvcompiler.dll
[2010.08.06 11:15:57 | 000,000,000 | ---D | C] -- C:\NVIDIA
[2010.07.27 08:29:42 | 008,503,296 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\shell32.dll
[2010.07.21 20:19:06 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\user\Eigene Dateien\Downloads
[2010.07.21 20:17:26 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sun
[2010.07.21 20:17:04 | 000,423,656 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll
[2010.07.21 20:16:53 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2010.07.21 20:16:53 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2010.07.21 20:16:53 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2010.07.21 20:15:23 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\Adobe
[2010.07.21 20:14:55 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NOS
[2010.07.21 20:11:20 | 000,185,920 | ---- | C] (RealNetworks, Inc.) -- C:\WINDOWS\System32\rmoc3260.dll
[2010.07.21 20:11:15 | 000,006,656 | ---- | C] (RealNetworks, Inc.) -- C:\WINDOWS\System32\pndx5016.dll
[2010.07.21 20:11:15 | 000,005,632 | ---- | C] (RealNetworks, Inc.) -- C:\WINDOWS\System32\pndx5032.dll
[2010.07.21 20:11:09 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\xing shared
[2010.07.21 20:10:40 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real
[2010.07.21 20:02:15 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Skype
[2010.07.21 20:02:13 | 000,000,000 | R--D | C] -- C:\Programme\Skype
[2010.07.21 20:01:01 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\user\Lokale Einstellungen\Anwendungsdaten\AOL
[2010.07.21 20:00:49 | 000,000,000 | ---D | C] -- C:\Programme\ICQ7.2
[2010.07.16 23:26:34 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\user\IECompatCache
[2010.07.16 23:25:22 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\user\PrivacIE
[2010.07.16 22:50:35 | 000,000,000 | ---D | C] -- C:\WINDOWS\Minidump
[2010.07.16 22:23:17 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\user\IETldCache
[2010.07.16 22:19:41 | 000,000,000 | ---D | C] -- C:\WINDOWS\ie8updates
[2010.07.16 22:14:48 | 000,000,000 | -H-D | C] -- C:\WINDOWS\ie8
[2010.07.16 22:11:03 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\user\Lokale Einstellungen\Anwendungsdaten\Temp
[2010.07.16 22:11:00 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\Google
[2010.07.16 22:08:41 | 000,743,424 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iedvtool.dll
[2010.07.16 22:06:50 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\Google
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2010.08.09 18:43:22 | 000,004,208 | RHS- | M] () -- C:\WINDOWS\System32\PC-11.vbs
[2010.08.09 18:43:22 | 000,004,208 | RHS- | M] () -- C:\PC-11.vbs
[2010.08.09 18:37:47 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\user\Desktop\OTL.exe
[2010.08.09 18:11:00 | 000,001,088 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010.08.09 16:52:07 | 008,396,544 | ---- | M] () -- C:\Persi0.sys
[2010.08.09 16:51:18 | 000,001,084 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010.08.09 16:51:17 | 000,000,268 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-3781621405-2229333351-2813762238-1005.job
[2010.08.09 16:51:14 | 000,000,092 | RHS- | M] () -- C:\autorun.inf
[2010.08.09 16:51:11 | 000,271,490 | ---- | M] () -- C:\WINDOWS\System32\NvApps.xml
[2010.08.09 16:51:07 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010.08.09 16:49:23 | 003,932,160 | -H-- | M] () -- C:\Dokumente und Einstellungen\user\NTUSER.DAT
[2010.08.09 16:44:22 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-3781621405-2229333351-2813762238-1005.job
[2010.08.09 16:26:47 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll
[2010.08.09 16:26:47 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2010.08.09 16:26:47 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2010.08.09 16:26:47 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2010.08.09 16:26:47 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2010.08.09 16:22:01 | 000,459,152 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2010.08.09 16:22:01 | 000,441,260 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010.08.09 16:22:01 | 000,084,524 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2010.08.09 16:22:01 | 000,071,196 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010.08.09 16:22:00 | 001,070,080 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010.08.09 15:12:41 | 000,067,184 | ---- | M] () -- C:\Dokumente und Einstellungen\user\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT
[2010.08.09 15:12:07 | 000,251,880 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010.08.09 15:05:54 | 000,002,163 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Safari.lnk
[2010.08.09 13:01:43 | 000,459,600 | ---- | M] () -- C:\WINDOWS\System32\prfh0407.dat
[2010.08.09 13:01:43 | 000,084,884 | ---- | M] () -- C:\WINDOWS\System32\prfc0407.dat
[2010.08.09 09:56:15 | 004,326,454 | -H-- | M] () -- C:\Dokumente und Einstellungen\user\Lokale Einstellungen\Anwendungsdaten\IconCache.db
[2010.08.08 21:47:45 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010.08.07 13:18:44 | 000,000,287 | ---- | M] () -- C:\WINDOWS\system.ini
[2010.08.06 11:34:27 | 000,000,190 | -HS- | M] () -- C:\Dokumente und Einstellungen\user\ntuser.ini
[2010.08.06 11:26:47 | 000,251,712 | RHS- | M] () -- C:\ntldr
[2010.07.27 08:29:42 | 008,503,296 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\shell32.dll
[2010.07.21 20:11:20 | 000,185,920 | ---- | M] (RealNetworks, Inc.) -- C:\WINDOWS\System32\rmoc3260.dll
[2010.07.21 20:11:15 | 000,006,656 | ---- | M] (RealNetworks, Inc.) -- C:\WINDOWS\System32\pndx5016.dll
[2010.07.21 20:11:15 | 000,005,632 | ---- | M] (RealNetworks, Inc.) -- C:\WINDOWS\System32\pndx5032.dll
[2010.07.21 20:10:55 | 000,499,712 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\msvcp71.dll
[2010.07.21 20:10:55 | 000,348,160 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\msvcr71.dll
[2010.07.21 20:10:55 | 000,278,528 | ---- | M] (Real Networks, Inc) -- C:\WINDOWS\System32\pncrt.dll
[2010.07.21 20:10:17 | 000,002,509 | ---- | M] () -- C:\Dokumente und Einstellungen\user\Desktop\Microsoft Office Word 2003.lnk
[2010.07.21 20:04:36 | 000,001,590 | ---- | M] () -- C:\Dokumente und Einstellungen\user\Desktop\PaltalkScene.lnk
[2010.07.21 20:02:15 | 000,001,872 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Skype.lnk
[2010.07.21 20:01:14 | 000,001,457 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\ICQ7.2.lnk
[2010.07.21 19:57:16 | 000,000,786 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Yahoo! Messenger.lnk
[2010.07.16 21:59:05 | 000,001,572 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Mozilla Firefox.lnk
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010.08.09 13:01:43 | 000,459,600 | ---- | C] () -- C:\WINDOWS\System32\prfh0407.dat
[2010.08.09 13:01:43 | 000,084,884 | ---- | C] () -- C:\WINDOWS\System32\prfc0407.dat
[2010.08.07 13:19:18 | 000,000,092 | RHS- | C] () -- C:\autorun.inf
[2010.08.06 11:27:07 | 000,064,352 | ---- | C] () -- C:\WINDOWS\System32\drivers\ativmc20.cod
[2010.08.06 11:27:06 | 000,129,045 | ---- | C] () -- C:\WINDOWS\System32\drivers\cxthsfs2.cty
[2010.08.06 11:27:04 | 000,067,866 | ---- | C] () -- C:\WINDOWS\System32\drivers\netwlan5.img
[2010.08.06 11:16:05 | 000,009,047 | ---- | C] () -- C:\WINDOWS\System32\nvinfo.pb
[2010.08.06 11:16:01 | 002,283,526 | ---- | C] () -- C:\WINDOWS\System32\nvdata.bin
[2010.07.21 20:11:28 | 000,000,268 | ---- | C] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-3781621405-2229333351-2813762238-1005.job
[2010.07.21 20:11:26 | 000,000,276 | ---- | C] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-3781621405-2229333351-2813762238-1005.job
[2010.07.21 20:01:14 | 000,001,457 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\ICQ7.2.lnk
[2010.07.21 19:57:16 | 000,000,786 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Yahoo! Messenger.lnk
[2010.07.16 22:06:47 | 000,001,088 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010.07.16 22:06:46 | 000,001,084 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2009.04.22 00:19:06 | 000,172,173 | ---- | C] () -- C:\WINDOWS\System32\xlive.dll.cat
[2008.11.08 23:10:01 | 000,006,812 | R--- | C] () -- C:\WINDOWS\System32\lvcoinst.ini
[2008.11.08 23:09:57 | 000,585,824 | R--- | C] () -- C:\WINDOWS\System32\drivers\lvcm.sys
[2008.07.14 11:24:01 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\csExWBDLMan.dll
[2008.04.16 17:23:58 | 000,001,469 | ---- | C] () -- C:\WINDOWS\{BEE3FBB3-3C09-4B88-97CA-CA6F9129F5A9}_WiseFW.ini
[2008.04.05 13:20:01 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\LogonDll.dll
[2008.04.05 00:09:41 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\xrsasn12.dll
[2008.04.05 00:09:41 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\xrsmai12.drv
[2008.04.05 00:09:41 | 000,098,304 | ---- | C] () -- C:\WINDOWS\System32\xrsslm12.dll
[2008.04.05 00:09:41 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\xrsfns12.dll
[2008.04.05 00:09:41 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\xrscom12.dll
[2008.04.05 00:09:41 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\xrsatr12.dll
[2008.04.03 22:49:47 | 000,000,311 | ---- | C] () -- C:\WINDOWS\game.ini
[2008.04.02 23:53:42 | 000,022,328 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2008.04.02 17:19:24 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2008.04.02 11:52:04 | 000,000,010 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2008.03.20 19:59:07 | 000,639,224 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys
[2008.03.17 16:22:19 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2008.03.17 00:26:33 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2008.03.16 23:36:48 | 000,001,082 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2008.02.21 04:05:44 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2008.02.21 04:04:16 | 000,000,416 | ---- | C] () -- C:\WINDOWS\System32\dtu100.dll.manifest
[2008.02.04 19:23:10 | 000,693,792 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.DLL
[2007.12.07 07:51:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2007.08.16 16:03:00 | 000,000,049 | R--- | C] () -- C:\WINDOWS\System32\regini.ini
[2007.07.13 17:17:48 | 000,042,496 | ---- | C] () -- C:\WINDOWS\System32\dwlGina2.dll
[2005.11.07 10:15:48 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\34CoInstaller.dll
[2005.01.25 16:23:52 | 000,025,600 | ---- | C] () -- C:\WINDOWS\System32\dwlgina.dll
[2003.02.20 18:53:42 | 000,005,702 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
 
========== LOP Check ==========
 
[2008.04.16 17:27:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\blue image
[2010.08.07 13:25:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Driver Whiz
[2008.04.04 13:33:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Test Drive Unlimited
[2010.07.21 20:01:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\ICQ
[2008.03.19 13:30:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\ICQ Toolbar
[2008.03.19 15:37:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\MSNInstaller
[2008.03.18 14:55:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\OfficeUpdate12
[2008.03.19 13:42:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Paltalk
[2008.03.17 19:44:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\TeamViewer
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2008.03.19 15:37:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Adobe
[2008.04.02 12:49:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Apple Computer
[2008.03.17 20:05:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\ATI
[2008.04.02 17:19:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\DivX
[2008.03.19 15:42:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Google
[2008.04.04 18:30:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Help
[2010.07.21 20:01:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\ICQ
[2008.03.19 13:30:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\ICQ Toolbar
[2008.03.17 00:04:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Identities
[2008.03.19 15:24:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Macromedia
[2010.08.09 11:24:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Malwarebytes
[2008.04.04 12:40:56 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Microsoft
[2008.04.04 12:40:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Microsoft Games
[2010.07.16 21:59:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Mozilla
[2008.03.19 15:37:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\MSNInstaller
[2008.03.18 14:55:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\OfficeUpdate12
[2008.03.19 13:42:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Paltalk
[2010.07.21 20:12:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Real
[2008.03.20 20:14:17 | 000,000,000 | RH-D | M] -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\SecuROM
[2010.07.21 20:20:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Skype
[2008.03.19 13:07:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\skypePM
[2008.03.16 23:36:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Sun
[2008.03.21 22:07:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Talkback
[2008.03.17 19:44:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\TeamViewer
[2008.03.19 13:30:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Yahoo!
 
< %APPDATA%\*.exe /s >
[2008.11.08 23:03:11 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Microsoft\Installer\{5FE1E412-D114-46E8-A891-5BE087B256A5}\ARPPRODUCTICON.exe
[2008.03.20 21:24:20 | 000,118,784 | R--- | M] (InstallShield Software Corp.) -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Microsoft\Installer\{C37A0BC1-52EE-4F97-8223-5CA9FC0357B0}\ARPPRODUCTICON.exe
[2008.04.02 12:54:06 | 000,131,072 | R--- | M] (InstallShield Software Corp.) -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Microsoft\Installer\{FB706A00-C234-4716-AB1F-27DCB192C664}\ARPPRODUCTICON.exe
[2008.03.19 15:37:21 | 000,908,776 | ---- | M] (Microsoft Corporation) -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\MSNInstaller\msnauins.exe
[2010.07.21 20:09:55 | 000,812,552 | ---- | M] (RealNetworks, Inc.) -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Real\RealPlayer\setup\AU_setup20100218.exe
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2004.08.04 14:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2008.04.14 08:03:54 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2008.04.14 08:03:54 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008.04.14 00:06:40 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008.04.14 00:06:40 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys
 
< MD5 for: ATAPI.SYS  >
[2004.08.04 14:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2008.04.14 08:03:54 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008.04.14 08:03:54 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008.04.14 00:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008.04.14 00:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004.08.04 14:00:00 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
 
< MD5 for: EVENTLOG.DLL  >
[2008.04.14 07:52:12 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008.04.14 07:52:12 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll
[2004.08.04 14:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll
 
< MD5 for: NETLOGON.DLL  >
[2008.04.14 07:52:20 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008.04.14 07:52:20 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll
[2004.08.04 14:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D27395EDCD3416AFD125A9370DCB585C -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll
 
< MD5 for: SCECLI.DLL  >
[2008.04.14 07:52:24 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008.04.14 07:52:24 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll
[2004.08.04 14:00:00 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
 
< MD5 for: USER32.DLL  >
[2007.03.08 17:36:30 | 000,579,072 | ---- | M] (Microsoft Corporation) MD5=492E166CFD26A50FB9160DB536FF7D2B -- C:\WINDOWS\$NtServicePackUninstall$\user32.dll
[2005.03.02 20:19:56 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=4C90159A69A5FD3EB39C71411F28FCFF -- C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll
[2007.03.08 17:48:39 | 000,579,584 | ---- | M] (Microsoft Corporation) MD5=78785EFF8CB90CEC1862A4CCFD9A3C3A -- C:\WINDOWS\$hf_mig$\KB925902\SP2QFE\user32.dll
[2008.04.14 07:52:32 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\ServicePackFiles\i386\user32.dll
[2008.04.14 07:52:32 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.04.14 07:53:04 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008.04.14 07:53:04 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe
[2004.08.04 14:00:00 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2004.08.04 14:00:00 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2008.04.14 07:53:06 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008.04.14 07:53:06 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2004.08.04 14:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys
[2004.08.04 14:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
[2008.03.20 19:59:07 | 000,639,224 | ---- | M] () Unable to obtain MD5 -- C:\WINDOWS\system32\drivers\sptd.sys
 
< %systemroot%\System32\config\*.sav >
[2008.03.17 00:18:15 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2008.03.17 00:18:14 | 000,638,976 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2008.03.17 00:18:14 | 000,458,752 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]
< End of report >
--- --- ---

mrfuji 09.08.2010 17:53
-----------------------------

mrfuji 09.08.2010 17:54
--------EXTRAS:TXT--------
OTL EXTRAS Logfile:
Code:
OTL Extras logfile created on: 09.08.2010 18:40:55 - Run 1
OTL by OldTimer - Version 3.2.9.1    Folder = C:\Dokumente und Einstellungen\user\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1.023,00 Mb Total Physical Memory | 391,00 Mb Available Physical Memory | 38,00% Memory free
2,00 Gb Paging File | 2,00 Gb Available in Paging File | 79,00% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 48,83 Gb Total Space | 33,67 Gb Free Space | 68,95% Space Free | Partition Type: NTFS
Drive D: | 68,36 Gb Total Space | 6,08 Gb Free Space | 8,89% Space Free | Partition Type: NTFS
Drive E: | 31,85 Gb Total Space | 12,57 Gb Free Space | 39,46% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive M: | 3,97 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive Y: | 1,91 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
 
Computer Name: PC-11
Current User Name: user
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
 
[HKEY_USERS\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Programme\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Programme\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusOverride" = 1
"FirewallOverride" = 1
"UacDisableNotify" = 1
"AntiVirusDisableNotify" = 1
"FirewallDisableNotify" = 1
"UpdatesDisableNotify" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 1
"AntiVirusDisableNotify" = 1
"FirewallDisableNotify" = 1
"FirewallOverride" = 1
"UpdatesDisableNotify" = 1
"UacDisableNotify" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Programme\ICQ7.2\ICQ.exe" = C:\Programme\ICQ7.2\ICQ.exe:*:Enabled:ICQ7.2 -- (ICQ, LLC.)
"C:\Programme\ICQ7.2\aolload.exe" = C:\Programme\ICQ7.2\aolload.exe:*:Enabled:aolload.exe -- (AOL LLC)
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\Yahoo!\Messenger\YahooMessenger.exe" = C:\Programme\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger -- (Yahoo! Inc.)
"C:\Programme\Yahoo!\Messenger\YServer.exe" = C:\Programme\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server -- File not found
"C:\Programme\ICQ6\ICQ.exe" = C:\Programme\ICQ6\ICQ.exe:*:Enabled:ICQ6 -- File not found
"C:\Programme\Paltalk Messenger\paltalk.exe" = C:\Programme\Paltalk Messenger\paltalk.exe:*:Enabled:PaltalkScene -- (AVM Software Inc.)
"D:\Programme\EA Games\Battlefield 2\BF2.exe" = D:\Programme\EA Games\Battlefield 2\BF2.exe:*:Enabled:Battlefield 2 -- File not found
"D:\Programme\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe" = D:\Programme\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe:*:Enabled:Crysis_32 -- (Crytek GmbH)
"D:\Programme\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe" = D:\Programme\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe:*:Enabled:CrysisDedicatedServer_32 -- (Crytek GmbH)
"D:\Programme\Microsoft Games\Gears of War\Binaries\WarGame-G4WLive.exe" = D:\Programme\Microsoft Games\Gears of War\Binaries\WarGame-G4WLive.exe:*:Enabled:Gears of War -- (Epic Games, Inc.)
"D:\Programme\Warcraft III\Warcraft III.exe" = D:\Programme\Warcraft III\Warcraft III.exe:*:Enabled:Warcraft III -- ()
"D:\Programme\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe" = D:\Programme\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:*:Enabled:Call of Duty(R) 4 - Modern Warfare(TM) -- ()
"E:\Programme\Steam\steamapps\csqbpc11\condition zero\hl.exe" = E:\Programme\Steam\steamapps\csqbpc11\condition zero\hl.exe:*:Enabled:Half-Life Launcher -- File not found
"E:\Programme\Steam\steamapps\csqbpc11\counter-strike\hl.exe" = E:\Programme\Steam\steamapps\csqbpc11\counter-strike\hl.exe:*:Enabled:Half-Life Launcher -- File not found
"C:\Programme\Spiele\EA GAMES\Battlefield 2\BF2.exe" = C:\Programme\Spiele\EA GAMES\Battlefield 2\BF2.exe:*:Enabled:Battlefield 2 -- ()
"D:\Programme\Atari\Test Drive Unlimited\TestDriveUnlimited.exe" = D:\Programme\Atari\Test Drive Unlimited\TestDriveUnlimited.exe:*:Enabled:Test Drive Unlimited -- (Eden Games)
"C:\Programme\Real\RealPlayer\realplay.exe" = C:\Programme\Real\RealPlayer\realplay.exe:*:Enabled:RealPlayer -- (RealNetworks, Inc.)
"D:\Programme\EA Games\Command and Conquer Generals\patchget.dat" = D:\Programme\EA Games\Command and Conquer Generals\patchget.dat:*:Enabled:patchgrabber -- (Electronic Arts)
"D:\Programme\Atari\Act of War - Direct Action\ACTOFWAR.EXE" = D:\Programme\Atari\Act of War - Direct Action\ACTOFWAR.EXE:*:Enabled:ACTOFWAR -- ()
"D:\Programme\EA Games\Command & Conquer Generäle Stunde Null\game.dat" = D:\Programme\EA Games\Command & Conquer Generäle Stunde Null\game.dat:*:Enabled:game -- ()
"D:\Programme\EA Games\Command & Conquer Generäle Stunde Null\patchget.dat" = D:\Programme\EA Games\Command & Conquer Generäle Stunde Null\patchget.dat:*:Enabled:patchgrabber -- (Electronic Arts)
"C:\Programme\InterCafe 2008\Client\ICClientHelper.exe" = C:\Programme\InterCafe 2008\Client\ICClientHelper.exe:*:Enabled:ICClientHelper.exe -- (blue image GmbH)
"C:\Programme\InterCafe 2008\Client\Client.exe" = C:\Programme\InterCafe 2008\Client\Client.exe:*:Enabled:ipsec -- (blue image GmbH)
"C:\Programme\InterCafe 2008\Client\PrinterPreview.exe" = C:\Programme\InterCafe 2008\Client\PrinterPreview.exe:*:Enabled:PrinterPreview.exe -- (blue image GmbH)
"D:\Programme\CAPCOM\StreetFighterIV.exe" = D:\Programme\CAPCOM\StreetFighterIV.exe:*:Enabled:STREET FIGHTER IV -- (CAPCOM U.S.A., INC.)
"C:\Programme\ICQ7.2\ICQ.exe" = C:\Programme\ICQ7.2\ICQ.exe:*:Enabled:ICQ7.2 -- (ICQ, LLC.)
"C:\Programme\ICQ7.2\aolload.exe" = C:\Programme\ICQ7.2\aolload.exe:*:Enabled:aolload.exe -- (AOL LLC)
"C:\DOKUME~1\user\LOKALE~1\Temp\157086.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\157086.exe:*:Enabled:ipsec -- File not found
"C:\WINDOWS\explorer.exe" = C:\WINDOWS\Explorer.EXE:*:Enabled:ipsec -- (Microsoft Corporation)
"C:\DOKUME~1\user\LOKALE~1\Temp\winopben.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\winopben.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\sdmpnm.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\sdmpnm.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\winoxyfk.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\winoxyfk.exe:*:Enabled:ipsec -- File not found
"C:\WINDOWS\system32\HDAudPropShortcut.exe" = C:\WINDOWS\system32\HDAudPropShortcut.exe:*:Enabled:ipsec -- (Windows (R) Server 2003 DDK provider)
"C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" = C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\winguub.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\winguub.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\winpppbn.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\winpppbn.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\winjfyxjn.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\winjfyxjn.exe:*:Enabled:ipsec -- File not found
"C:\PROGRA~1\Yahoo!\MESSEN~1\YahooMessenger.exe" = C:\PROGRA~1\Yahoo!\MESSEN~1\YahooMessenger.exe:*:Enabled:ipsec -- (Yahoo! Inc.)
"C:\DOKUME~1\user\LOKALE~1\Temp\winwyynt.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\winwyynt.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\qnqc.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\qnqc.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\wpeul.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\wpeul.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\winroybw.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\winroybw.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\cosy.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\cosy.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\oeue.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\oeue.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\winlgwnh.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\winlgwnh.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\vfxf.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\vfxf.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\winomylch.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\winomylch.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\jkkdoh.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\jkkdoh.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\ibmajb.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\ibmajb.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\winisxb.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\winisxb.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\winxhexaw.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\winxhexaw.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\bsarb.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\bsarb.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\wintqrsd.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\wintqrsd.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\gcfa.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\gcfa.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\bpvl.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\bpvl.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\winwtkc.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\winwtkc.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\winjpqha.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\winjpqha.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\gqbc.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\gqbc.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\atsg.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\atsg.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\winpoya.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\winpoya.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\winqxemg.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\winqxemg.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\oxkx.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\oxkx.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\fjlc.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\fjlc.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\winlsbksf.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\winlsbksf.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\wingicw.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\wingicw.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\wincxsf.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\wincxsf.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\wincrhx.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\wincrhx.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\winyfavy.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\winyfavy.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\winoctij.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\winoctij.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\winroui.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\winroui.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\winpvbb.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\winpvbb.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\sygvp.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\sygvp.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\winibljh.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\winibljh.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\kieoen.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\kieoen.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\windrkkc.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\windrkkc.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\winxshqe.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\winxshqe.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\hxhbm.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\hxhbm.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\winfxnvf.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\winfxnvf.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\yodgud.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\yodgud.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\wingqrrwc.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\wingqrrwc.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\dkla.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\dkla.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\winpyvsg.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\winpyvsg.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\gqjspp.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\gqjspp.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\winfiecbq.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\winfiecbq.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\lowmc.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\lowmc.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\wintveb.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\wintveb.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\winhrmqg.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\winhrmqg.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\jvhpc.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\jvhpc.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\winuiumvk.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\winuiumvk.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\winuucfp.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\winuucfp.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\winnenwd.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\winnenwd.exe:*:Enabled:ipsec -- File not found
"C:\Programme\Mozilla Firefox\plugin-container.exe" = C:\Programme\Mozilla Firefox\plugin-container.exe:*:Enabled:ipsec -- (Mozilla Corporation)
"C:\DOKUME~1\user\LOKALE~1\Temp\jiwjb.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\jiwjb.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\pqbjvf.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\pqbjvf.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\drpol.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\drpol.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\winreyem.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\winreyem.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\bksyo.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\bksyo.exe:*:Enabled:ipsec -- ()
"C:\DOKUME~1\user\LOKALE~1\Temp\oyuwsn.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\oyuwsn.exe:*:Enabled:ipsec -- ()
"C:\DOKUME~1\user\LOKALE~1\Temp\winodsn.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\winodsn.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\vjgvh.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\vjgvh.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\ptccgp.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\ptccgp.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\ydtcp.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\ydtcp.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\hiskj.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\hiskj.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\luiqa.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\luiqa.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\winughs.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\winughs.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\winsaxi.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\winsaxi.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\winivdip.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\winivdip.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\winiylj.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\winiylj.exe:*:Enabled:ipsec -- File not found
"C:\DOKUME~1\user\LOKALE~1\Temp\jdsh.exe" = C:\DOKUME~1\user\LOKALE~1\Temp\jdsh.exe:*:Enabled:ipsec -- File not found
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{000E79B7-E725-4F01-870A-C12942B7F8E4}" = Crysis(R)
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{04858915-9F49-4B2A-AED4-DC49A7DE6A7B}" = Battlefield 2(TM)
"{05B49229-22A2-4F88-842A-BBC2EBE1CCF6}" = Microsoft Games for Windows - LIVE Redistributable
"{06F80017-8F98-4C94-B868-52358569FC32}" = Command & Conquer Generals
"{086BADF8-9B1F-4E89-B207-2EDA520972D6}" = Grand Theft Auto San Andreas
"{0A2A5039-B37F-489D-B1DC-A5258DF9E697}" = FIFA 08
"{1170D24F-42B7-40CF-AA1B-6395CE562354}" = Gears of War
"{1E04F83B-2AB9-4301-9EF7-E86307F79C72}" = Google Earth
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{259C0ABB-A3B2-4D70-008F-BF7EE491B70B}" = Need for Speed™ Carbon
"{26A24AE4-039D-4CA4-87B4-2F83216021FF}" = Java(TM) 6 Update 21
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java(TM) 6 Update 5
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4D243BA7-9AC4-46D1-90E5-EEB88974F501}" = Microsoft Games for Windows - LIVE
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{59ABBDF0-E1E5-48AF-85FB-F523A08C3490}" = STREET FIGHTER IV
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{5F4C776F-8CBD-4C4F-892F-B568ABDD70C8}" = GameSpy Comrade
"{5FE1E412-D114-46E8-A891-5BE087B256A5}" = MVision
"{7148F0A8-6813-11D6-A77B-00B0D0142050}" = Java 2 Runtime Environment, SE v1.4.2_05
"{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}" = ICQ7.2
"{81C9205D-3BC2-4059-A303-61405032A482}" = Xerox Netzwerkscanner-Hilfsprogramm2
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-00A4-0407-0000-0000000FF1CE}" = Microsoft Office 2003 Web Components
"{90F80407-6000-11D3-8CFE-0150048383C9}" = Tool zum Entfernen verborgener Daten
"{91110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{9309DD7E-EBFE-3C95-8B47-30D3A012F606}" = Microsoft .NET Framework 2.0 Service Pack 1 Language Pack - DEU
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A1071AEB-B0EF-3F5F-BC84-83A270EBE496}" = Microsoft .NET Framework 3.0 Service Pack 1 Language Pack - DEU
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-A81200000003}" = Adobe Reader 8.1.2 - Deutsch
"{ADFBC522-0E15-4E35-B932-8CE2EE0DDEA3}" = Microsoft Office 2003 Spracheinstellungen
"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger
"{B6828215-1469-43A2-8BEE-F5A970F98161}" = Microsoft Office 2003 International Character Toolbar
"{B74F042E-E1B9-4A5B-8D46-387BB172F0A4}" = Apple Software Update
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{BEE3FBB3-3C09-4B88-97CA-CA6F9129F5A9}" = InterCafe 2008
"{BFD96B89-B769-4CD6-B11E-E79FFD46F067}" = QuickTime
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C37A0BC1-52EE-4F97-8223-5CA9FC0357B0}" = Test Drive Unlimited
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call
"{E10DB5DA-E576-40EA-A7FC-1CB2A7B283A6}" = NVIDIA PhysX
"{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty(R) 4 - Modern Warfare(TM)
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F0E8F94D-6E68-4B35-92DF-3AA6DC6A6768}" = Safari
"{F3E9C243-122E-4D6B-ACC1-E1FEC02F6CA1}" = Command and Conquer(TM) Generäle Die Stunde Null
"{F4F4F84E-804F-4E9A-84D7-C34283F0088F}" = RealUpgrade 1.0
"{F9B915DF-B79C-4747-9BA3-9705A57DC717}" = Act of War - Direct Action
"{FB706A00-C234-4716-AB1F-27DCB192C664}" = Opera 9.26
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Catan Online Welt" = Catan Online Welt
"CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200014F1" = Soft Data Fax Modem with SmartCP
"DivX Setup.divx.com" = DivX-Setup
"GameSpy Arcade" = GameSpy Arcade
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{06F80017-8F98-4C94-B868-52358569FC32}" = Command & Conquer Generals
"InstallShield_{1170D24F-42B7-40CF-AA1B-6395CE562354}" = Gears of War
"InstallShield_{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty(R) 4 - Modern Warfare(TM)
"InstallShield_{F3E9C243-122E-4D6B-ACC1-E1FEC02F6CA1}" = Command and Conquer(TM) Generäle Die Stunde Null
"Jetfighter 5_is1" = Jetfighter 5
"lvdrivers_11.50" = Logitech QuickCam-Treiberpaket
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.8)" = Mozilla Firefox (3.6.8)
"MSNINST" = MSN
"Nero - Burning Rom!UninstallKey" = Nero OEM
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA Drivers" = NVIDIA Drivers
"NVIDIA nView Desktop Manager" = NVIDIA nView Desktop Manager
"PalTalk8.2" = PaltalkScene
"PunkBusterSvc" = PunkBuster Services
"RealPlayer 12.0" = RealPlayer
"Tomb Raider: Anniversary" = Tomb Raider: Anniversary 1.0
"WIC" = Windows Imaging Component
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinLiveSuite_Wave3" = Windows Live Essentials
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
"Yahoo! Internet Mail" = Yahoo! Internet Mail
"Yahoo! Messenger" = Yahoo! Messenger
"YInstHelper" = Yahoo! Install Manager
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-3781621405-2229333351-2813762238-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Warcraft III" = Warcraft III
 
========== Last 10 Event Log Errors ==========
 
[ System Events ]
Error - 09.08.2010 10:48:39 | Computer Name = PC-11 | Source = Windows Update Agent | ID = 20
Description = Installationsfehler: Die Installation des folgenden Updates ist mit
 Fehler 0x80070643 fehlgeschlagen: Sicherheitsupdate für Microsoft Office Outlook
 2003 (KB980373)
 
Error - 09.08.2010 10:48:39 | Computer Name = PC-11 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Office Source Engine" wurde aufgrund folgenden Fehlers
 nicht gestartet:  %%2
 
Error - 09.08.2010 10:48:39 | Computer Name = PC-11 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Office Source Engine" wurde aufgrund folgenden Fehlers
 nicht gestartet:  %%2
 
Error - 09.08.2010 10:48:49 | Computer Name = PC-11 | Source = Windows Update Agent | ID = 20
Description = Installationsfehler: Die Installation des folgenden Updates ist mit
 Fehler 0x80070643 fehlgeschlagen: Sicherheitsupdate für Microsoft Office 2003 (KB982311)
 
Error - 09.08.2010 10:48:49 | Computer Name = PC-11 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Office Source Engine" wurde aufgrund folgenden Fehlers
 nicht gestartet:  %%2
 
Error - 09.08.2010 10:48:49 | Computer Name = PC-11 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Office Source Engine" wurde aufgrund folgenden Fehlers
 nicht gestartet:  %%2
 
Error - 09.08.2010 10:48:59 | Computer Name = PC-11 | Source = Windows Update Agent | ID = 20
Description = Installationsfehler: Die Installation des folgenden Updates ist mit
 Fehler 0x80070643 fehlgeschlagen: Sicherheitsupdate für Microsoft Office 2003 (KB976382)
 
Error - 09.08.2010 10:48:59 | Computer Name = PC-11 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Office Source Engine" wurde aufgrund folgenden Fehlers
 nicht gestartet:  %%2
 
Error - 09.08.2010 10:48:59 | Computer Name = PC-11 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Office Source Engine" wurde aufgrund folgenden Fehlers
 nicht gestartet:  %%2
 
Error - 09.08.2010 10:52:34 | Computer Name = PC-11 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Client Service" wurde aufgrund folgenden Fehlers nicht
 gestartet:  %%2
 
 
< End of report >
--- --- ---

markusg 09.08.2010 18:06
• Starte bitte die OTL.exe.
Vista-User mit Rechtsklick "als Administrator starten"
• Kopiere nun das Folgende in die Textbox.

:OTL
PRC - C:\Dokumente und Einstellungen\user\Lokale Einstellungen\Temp\oyuwsn.exe ()
PRC - C:\Dokumente und Einstellungen\user\Lokale Einstellungen\Temp\bksyo.exe ()
SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE File not found
SRV - (iClientService) -- C:\WINDOWS\System32\IClientService.exe File not found
SRV - (clr_optimization_v2.0.50727_32) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe File not found
SRV - (AppMgmt) -- C:\WINDOWS\System32\appmgmts.dll File not found
DRV - (PxHelp20) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys File not found
DRV - (PciCon) -- F:\PciCon.sys File not found
DRV - (mlwahn) -- C:\WINDOWS\System32\drivers\bnjagds.sys File not found
DRV - (cpuz132) -- C:\DOKUME~1\user\LOKALE~1\Temp\cpuz132\cpuz132_x32.sys File not found
DRV - (amsint32) -- C:\WINDOWS\System32\drivers\iilonn.sys File not found
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found
O3 - HKU\S-1-5-21-3781621405-2229333351-2813762238-1005\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found
O4 - HKLM..\Run: [nwiz] File not found
O4 - HKLM..\Run: [PC-11] C:\WINDOWS\system32\PC-11.vbs ()
O20 - Winlogon\Notify\AtiExtEvent: DllName - Reg Error: Value error. - Reg Error: Value error. File not found
:Files
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument dieses posten

bitte erstelle und poste ein combofix log.
Ein Leitfaden und Tutorium zur Nutzung von ComboFix

mrfuji 09.08.2010 18:19
Das kam bei raus....

All processes killed
========== OTL ==========
No active process named oyuwsn.exe was found!
No active process named bksyo.exe was found!
Service ose stopped successfully!
Service ose deleted successfully!
File C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE File not found not found.
Service iClientService stopped successfully!
Service iClientService deleted successfully!
File C:\WINDOWS\System32\IClientService.exe File not found not found.
Service clr_optimization_v2.0.50727_32 stopped successfully!
Service clr_optimization_v2.0.50727_32 deleted successfully!
File C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe File not found not found.
Service AppMgmt stopped successfully!
Service AppMgmt deleted successfully!
File C:\WINDOWS\System32\appmgmts.dll File not found not found.
Service PxHelp20 stopped successfully!
Service PxHelp20 deleted successfully!
File C:\WINDOWS\System32\Drivers\PxHelp20.sys File not found not found.
Service PciCon stopped successfully!
Service PciCon deleted successfully!
File F:\PciCon.sys File not found not found.
Service mlwahn stopped successfully!
Service mlwahn deleted successfully!
File C:\WINDOWS\System32\drivers\bnjagds.sys File not found not found.
Service cpuz132 stopped successfully!
Service cpuz132 deleted successfully!
File C:\DOKUME~1\user\LOKALE~1\Temp\cpuz132\cpuz132_x32.sys File not found not found.
Error: Unable to stop service amsint32!
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\amsint32 deleted successfully.
File C:\WINDOWS\System32\drivers\iilonn.sys File not found not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry value HKEY_USERS\S-1-5-21-3781621405-2229333351-2813762238-1005\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{855F3B16-6D32-4FE6-8A56-BBB695989046} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4FE6-8A56-BBB695989046}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\nwiz deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\PC-11 deleted successfully.
File move failed. C:\WINDOWS\system32\PC-11.vbs scheduled to be moved on reboot.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent\ deleted successfully.
========== FILES ==========
========== COMMANDS ==========

[EMPTYFLASH]

User: All Users

User: Default User

User: LocalService

User: NetworkService

User: user
->Flash cache emptied: 708 bytes

Total Flash Files Cleaned = 0,00 mb


[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 6341147 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33237 bytes

User: user
->Temp folder emptied: 279113850 bytes
->Temporary Internet Files folder emptied: 975572 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 40783645 bytes
->Google Chrome cache emptied: 6340428 bytes
->Apple Safari cache emptied: 236544 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2134333 bytes
%systemroot%\System32 .tmp files removed: 11447 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 69947 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 321,00 mb


OTL by OldTimer - Version 3.2.9.1 log created on 08092010_191215

Files\Folders moved on Reboot...
C:\WINDOWS\system32\PC-11.vbs moved successfully.

Registry entries deleted on Reboot...

markusg 09.08.2010 18:23
ok, dann mit combofix weiter. otl war nicht ganz so erfolgreich wie ichs gern gehabt hätte :-)

mrfuji 09.08.2010 18:32
COMBOFIX present...
Combofix Logfile:
Code:
ComboFix 10-08-08.03 - user 09.08.2010  19:25:01.1.1 - x86
Microsoft Windows XP Home Edition  5.1.2600.3.1252.49.1031.18.1023.602 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\user\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
C:\dfinstall.log
c:\windows\system32\config.dat
D:\autorun.inf
E:\86l2qw.bat
E:\autorun.inf
E:\f.bat
E:\gclwpivc.cmd
E:\j39y2.bat
E:\lad.bat
E:\p.exe
E:\RavMon.exe
E:\tel.xls.exe
E:\w.com

.
(((((((((((((((((((((((  Dateien erstellt von 2010-07-09 bis 2010-08-09  ))))))))))))))))))))))))))))))
.

2010-08-09 17:12 . 2010-08-09 17:12        --------        d-----w-        C:\_OTL
2010-08-09 14:33 . 2010-08-09 14:33        --------        d-----w-        c:\dokumente und einstellungen\user\Lokale Einstellungen\Anwendungsdaten\PCHealth
2010-08-09 14:24 . 2010-08-09 14:24        61440        ----a-w-        c:\dokumente und einstellungen\user\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-786e29ec-n\decora-sse.dll
2010-08-09 14:24 . 2010-08-09 14:24        503808        ----a-w-        c:\dokumente und einstellungen\user\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-75a26b7a-n\msvcp71.dll
2010-08-09 14:24 . 2010-08-09 14:24        499712        ----a-w-        c:\dokumente und einstellungen\user\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-75a26b7a-n\jmc.dll
2010-08-09 14:24 . 2010-08-09 14:24        348160        ----a-w-        c:\dokumente und einstellungen\user\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-75a26b7a-n\msvcr71.dll
2010-08-09 14:24 . 2010-08-09 14:24        12800        ----a-w-        c:\dokumente und einstellungen\user\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-786e29ec-n\decora-d3d.dll
2010-08-09 11:40 . 2010-08-09 11:40        --------        d-----w-        c:\windows\Sun
2010-08-09 11:18 . 2010-08-09 11:18        --------        d-----w-        c:\programme\Catan GmbH
2010-08-09 11:01 . 2010-08-09 11:01        84884        ----a-w-        c:\windows\system32\prfc0407.dat
2010-08-09 11:01 . 2010-08-09 11:01        459600        ----a-w-        c:\windows\system32\prfh0407.dat
2010-08-09 10:54 . 2009-12-31 16:50        353792        -c----w-        c:\windows\system32\dllcache\srv.sys
2010-08-09 10:54 . 2010-02-24 13:11        455680        -c----w-        c:\windows\system32\dllcache\mrxsmb.sys
2010-08-09 10:54 . 2009-10-15 16:28        81920        -c----w-        c:\windows\system32\dllcache\fontsub.dll
2010-08-09 10:54 . 2009-10-15 16:28        119808        -c----w-        c:\windows\system32\dllcache\t2embed.dll
2010-08-09 10:54 . 2009-06-21 21:45        153088        -c----w-        c:\windows\system32\dllcache\triedit.dll
2010-08-09 10:53 . 2009-10-23 15:28        3558912        -c----w-        c:\windows\system32\dllcache\moviemk.exe
2010-08-09 10:53 . 2008-05-08 14:02        203136        -c----w-        c:\windows\system32\dllcache\rmcast.sys
2010-08-09 10:53 . 2008-05-01 14:34        331776        -c----w-        c:\windows\system32\dllcache\msadce.dll
2010-08-09 10:53 . 2010-02-12 10:03        293376        ------w-        c:\windows\system32\browserchoice.exe
2010-08-09 10:52 . 2008-06-14 17:32        273024        -c----w-        c:\windows\system32\dllcache\bthport.sys
2010-08-09 10:51 . 2010-06-14 14:31        744448        -c----w-        c:\windows\system32\dllcache\helpsvc.exe
2010-08-09 10:50 . 2009-02-06 10:10        227840        -c----w-        c:\windows\system32\dllcache\wmiprvse.exe
2010-08-09 10:50 . 2010-02-17 12:04        2192256        -c----w-        c:\windows\system32\dllcache\ntoskrnl.exe
2010-08-09 10:50 . 2009-03-06 14:19        286720        -c----w-        c:\windows\system32\dllcache\pdh.dll
2010-08-09 10:50 . 2009-02-09 11:21        111104        -c----w-        c:\windows\system32\dllcache\services.exe
2010-08-09 10:50 . 2009-02-09 10:51        401408        -c----w-        c:\windows\system32\dllcache\rpcss.dll
2010-08-09 10:50 . 2009-02-09 10:51        473600        -c----w-        c:\windows\system32\dllcache\fastprox.dll
2010-08-09 10:50 . 2009-02-09 10:51        678400        -c----w-        c:\windows\system32\dllcache\advapi32.dll
2010-08-09 10:50 . 2009-02-09 10:51        453120        -c----w-        c:\windows\system32\dllcache\wmiprvsd.dll
2010-08-09 10:50 . 2009-02-09 10:51        740352        -c----w-        c:\windows\system32\dllcache\ntdll.dll
2010-08-09 10:50 . 2010-02-16 19:04        2148864        -c----w-        c:\windows\system32\dllcache\ntkrnlmp.exe
2010-08-09 10:50 . 2010-02-16 19:04        2027008        -c----w-        c:\windows\system32\dllcache\ntkrpamp.exe
2010-08-09 10:49 . 2009-11-21 15:54        471552        -c----w-        c:\windows\system32\dllcache\aclayers.dll
2010-08-09 10:46 . 2008-10-15 16:35        337408        -c----w-        c:\windows\system32\dllcache\netapi32.dll
2010-08-09 10:45 . 2009-07-31 04:32        1172480        -c----w-        c:\windows\system32\dllcache\msxml3.dll
2010-08-09 10:43 . 2008-04-21 21:13        217600        -c----w-        c:\windows\system32\dllcache\wordpad.exe
2010-08-09 10:33 . 2009-08-06 17:23        274288        ----a-w-        c:\windows\system32\mucltui.dll
2010-08-09 09:24 . 2010-08-09 09:24        --------        d-----w-        c:\dokumente und einstellungen\user\Anwendungsdaten\Malwarebytes
2010-08-09 09:23 . 2010-08-09 14:29        --------        d-----w-        c:\programme\Malwarebytes' Anti-Malware
2010-08-09 09:23 . 2010-08-09 09:23        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2010-08-09 09:11 . 2010-08-09 11:08        --------        d-----w-        c:\programme\Spybot - Search & Destroy
2010-08-09 09:11 . 2010-08-09 11:08        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
2010-08-09 08:45 . 2010-08-09 08:45        --------        d-----w-        c:\windows\Downloaded Installations
2010-08-07 11:25 . 2010-08-07 11:25        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Driver Whiz
2010-08-07 11:05 . 2010-08-07 11:05        130725        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\WebPlayer\Uninstaller.exe
2010-08-07 11:05 . 2010-08-07 11:05        130493        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\DivXPlusShortcuts\Uninstaller.exe
2010-08-07 11:05 . 2010-08-07 11:03        1062184        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\Setup\Resource.dll
2010-08-07 11:05 . 2010-08-07 11:03        964888        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\Setup\DivXSetup.exe
2010-08-07 11:05 . 2010-08-07 11:05        135539        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\Player\Uninstaller.exe
2010-08-07 11:05 . 2010-08-07 11:05        123232        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\Update\Uninstaller.exe
2010-08-07 11:05 . 2010-08-07 11:05        157782        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\TransferWizard\Uninstaller.exe
2010-08-07 11:04 . 2010-08-07 11:04        136086        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\DSAVCDecoder\Uninstaller.exe
2010-08-07 11:04 . 2010-08-07 11:04        130782        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\DSDesktopComponents\Uninstaller.exe
2010-08-07 11:04 . 2010-08-07 11:04        136094        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\DSAACDecoder\Uninstaller.exe
2010-08-07 11:04 . 2010-08-07 11:04        131260        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\DSASPDecoder\Uninstaller.exe
2010-08-07 11:04 . 2010-08-07 11:04        130186        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\DivXDecoderShortcut\Uninstaller.exe
2010-08-07 11:04 . 2010-08-07 11:04        123785        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\DFXPlugin\Uninstaller.exe
2010-08-07 11:04 . 2010-08-07 11:04        123760        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\Converter\Uninstaller.exe
2010-08-07 11:04 . 2010-08-07 11:04        132468        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\TranscodeEngine\Uninstaller.exe
2010-08-07 11:04 . 2010-08-07 11:04        136021        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\MPEG2Plugin\Uninstaller.exe
2010-08-07 11:04 . 2010-08-07 11:04        135233        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\ControlPanel\Uninstaller.exe
2010-08-07 11:04 . 2010-08-07 11:04        126691        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\MSVC80CRTRedist\Uninstaller.exe
2010-08-07 11:03 . 2010-08-07 11:03        123705        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\Qt4.5\Uninstaller.exe
2010-08-07 11:03 . 2010-08-07 11:03        --------        d-----w-        c:\programme\Gemeinsame Dateien\DivX Shared
2010-08-07 11:03 . 2010-08-07 11:03        130697        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\ASPEncoder\Uninstaller.exe
2010-08-07 11:03 . 2010-08-07 11:05        --------        d-----w-        c:\programme\DivX
2010-08-07 10:59 . 2010-08-07 11:05        57344        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\RunAsUser\RUNASUSERPROCESS.dll
2010-08-07 10:57 . 2010-08-07 11:28        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX
2010-08-07 10:17 . 2010-08-07 10:17        --------        d-sh--w-        c:\windows\system32\config\systemprofile\IETldCache
2010-08-06 09:27 . 2008-04-14 05:52        4255        ------w-        c:\windows\system32\drivers\adv01nt5.dll
2010-08-06 09:22 . 2010-08-06 09:22        --------        d-----w-        c:\windows\EHome
2010-08-06 09:17 . 2010-08-06 09:17        --------        d-----w-        c:\programme\AGEIA Technologies
2010-08-06 09:17 . 2010-08-06 09:17        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\NVIDIA Corporation
2010-08-06 09:16 . 2010-08-06 09:17        --------        d-----w-        c:\programme\NVIDIA Corporation
2010-08-06 09:16 . 2010-01-12 04:03        61440        ----a-w-        c:\windows\system32\OpenCL.dll
2010-08-06 09:16 . 2010-01-12 04:03        4077672        ----a-w-        c:\windows\system32\nvcuvenc.dll
2010-08-06 09:16 . 2010-01-12 04:03        2259560        ----a-w-        c:\windows\system32\nvcuvid.dll
2010-08-06 09:16 . 2010-01-12 04:03        2283526        ----a-w-        c:\windows\system32\nvdata.bin
2010-08-06 09:16 . 2010-01-12 04:03        11632640        ----a-w-        c:\windows\system32\nvcompiler.dll
2010-08-06 09:15 . 2010-08-06 09:15        --------        d-----w-        C:\NVIDIA
2010-07-27 06:29 . 2010-07-27 06:29        8503296        -c----w-        c:\windows\system32\dllcache\shell32.dll
2010-07-21 18:17 . 2010-07-21 18:17        61440        ----a-w-        c:\dokumente und einstellungen\user\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-41228cbd-n\decora-sse.dll
2010-07-21 18:17 . 2010-07-21 18:17        503808        ----a-w-        c:\dokumente und einstellungen\user\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-7f961a20-n\msvcp71.dll
2010-07-21 18:17 . 2010-07-21 18:17        499712        ----a-w-        c:\dokumente und einstellungen\user\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-7f961a20-n\jmc.dll
2010-07-21 18:17 . 2010-07-21 18:17        348160        ----a-w-        c:\dokumente und einstellungen\user\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-7f961a20-n\msvcr71.dll
2010-07-21 18:17 . 2010-07-21 18:17        12800        ----a-w-        c:\dokumente und einstellungen\user\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-41228cbd-n\decora-d3d.dll
2010-07-21 18:17 . 2010-08-09 14:26        423656        ----a-w-        c:\windows\system32\deployJava1.dll
2010-07-21 18:15 . 2010-07-21 18:15        --------        d-----w-        c:\windows\system32\Adobe
2010-07-21 18:14 . 2010-07-21 18:25        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\NOS
2010-07-21 18:09 . 2010-07-21 18:09        812552        ----a-w-        c:\dokumente und einstellungen\user\Anwendungsdaten\Real\RealPlayer\setup\AU_setup20100218.exe
2010-07-21 18:02 . 2010-07-21 18:02        --------        d-----w-        c:\programme\Gemeinsame Dateien\Skype
2010-07-21 18:02 . 2010-08-06 09:29        --------        d-----r-        c:\programme\Skype
2010-07-21 18:01 . 2010-07-21 18:01        --------        d-----w-        c:\dokumente und einstellungen\user\Lokale Einstellungen\Anwendungsdaten\AOL
2010-07-21 18:00 . 2010-07-21 18:01        --------        d-----w-        c:\programme\ICQ7.2
2010-07-21 17:57 . 2010-06-01 08:23        681272        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Yahoo!\YUpdater\yupdater.exe
2010-07-16 21:26 . 2010-07-16 21:26        --------        d-sh--w-        c:\dokumente und einstellungen\user\IECompatCache
2010-07-16 21:25 . 2010-07-16 21:25        --------        d-sh--w-        c:\dokumente und einstellungen\user\PrivacIE
2010-07-16 20:23 . 2010-07-16 20:23        --------        d-sh--w-        c:\dokumente und einstellungen\user\IETldCache
2010-07-16 20:19 . 2010-08-09 11:28        --------        d-----w-        c:\windows\ie8updates
2010-07-16 20:14 . 2010-07-16 20:15        --------        dc-h--w-        c:\windows\ie8
2010-07-16 20:11 . 2010-08-09 13:05        --------        d-----w-        c:\dokumente und einstellungen\user\Lokale Einstellungen\Anwendungsdaten\Temp
2010-07-16 20:11 . 2010-07-16 20:11        --------        d-----w-        c:\dokumente und einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\Google
2010-07-16 20:08 . 2010-05-06 10:31        12800        -c----w-        c:\windows\system32\dllcache\xpshims.dll
2010-07-16 20:08 . 2010-05-06 10:31        247808        -c----w-        c:\windows\system32\dllcache\ieproxy.dll
2010-07-16 20:08 . 2010-05-06 10:31        743424        -c----w-        c:\windows\system32\dllcache\iedvtool.dll
2010-07-16 20:08 . 2010-04-16 11:43        41984        -c----w-        c:\windows\system32\dllcache\iecompat.dll
2010-07-16 20:06 . 2010-07-16 20:06        --------        d-----w-        c:\dokumente und einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\Google

.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-09 17:11 . 2009-12-08 20:54        4208        --sha-r-        C:\PC-11.vbs
2010-08-09 14:29 . 2008-03-17 17:38        --------        d-----w-        c:\programme\Microsoft Silverlight
2010-08-09 14:26 . 2008-03-16 21:36        --------        d-----w-        c:\programme\Java
2010-08-09 14:26 . 2008-03-16 21:36        --------        d-----w-        c:\programme\Gemeinsame Dateien\Java
2010-08-09 14:22 . 2004-08-04 12:00        84524        ----a-w-        c:\windows\system32\perfc007.dat
2010-08-09 14:22 . 2004-08-04 12:00        459152        ----a-w-        c:\windows\system32\perfh007.dat
2010-08-09 13:12 . 2008-03-17 18:06        67184        ----a-w-        c:\dokumente und einstellungen\user\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT
2010-08-06 09:32 . 2008-03-16 21:32        76487        ----a-w-        c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-08-06 09:29 . 2008-03-19 13:20        --------        d-----w-        c:\programme\Google
2010-08-06 09:17 . 2008-04-16 15:23        --------        d-----w-        c:\programme\Gemeinsame Dateien\Wise Installation Wizard
2010-07-21 18:20 . 2008-03-19 11:04        --------        d-----w-        c:\dokumente und einstellungen\user\Anwendungsdaten\Skype
2010-07-21 18:11 . 2010-07-21 18:11        49152        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\Components\nprpffbrowserrecordext.dll
2010-07-21 18:11 . 2010-07-21 18:11        45056        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimwmp.dll
2010-07-21 18:11 . 2010-07-21 18:11        45056        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimswf.dll
2010-07-21 18:11 . 2010-07-21 18:11        45056        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimrp.dll
2010-07-21 18:11 . 2010-07-21 18:11        45056        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimqt.dll
2010-07-21 18:11 . 2010-07-21 18:11        40960        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\Chrome\Hook\rpchromebrowserrecordhelper.dll
2010-07-21 18:11 . 2010-07-21 18:11        341600        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
2010-07-21 18:11 . 2010-07-21 18:11        308808        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\Common\rpmainbrowserrecordplugin.dll
2010-07-21 18:11 . 2010-07-21 18:11        14848        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
2010-07-21 18:11 . 2008-03-19 13:20        --------        d-----w-        c:\programme\Gemeinsame Dateien\Real
2010-07-21 18:11 . 2008-03-19 13:20        --------        d-----w-        c:\programme\Real
2010-07-21 18:11 . 2010-07-21 18:11        --------        d-----w-        c:\programme\Gemeinsame Dateien\xing shared
2010-07-21 18:10 . 2008-03-19 13:20        499712        ----a-w-        c:\windows\system32\msvcp71.dll
2010-07-21 18:10 . 2008-03-19 13:20        348160        ----a-w-        c:\windows\system32\msvcr71.dll
2010-07-21 18:04 . 2008-03-19 10:59        --------        d-----w-        c:\programme\Paltalk Messenger
2010-07-21 18:01 . 2008-03-17 15:22        --------        d--h--w-        c:\programme\InstallShield Installation Information
2010-07-21 18:01 . 2008-03-19 10:59        --------        d-----w-        c:\dokumente und einstellungen\user\Anwendungsdaten\ICQ
2010-07-21 17:57 . 2008-03-19 13:38        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Yahoo!
2010-06-14 14:31 . 2008-03-16 21:30        744448        ----a-w-        c:\windows\pchealth\helpctr\binaries\helpsvc.exe
.

((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Messenger (Yahoo!)"="c:\progra~1\Yahoo!\MESSEN~1\YahooMessenger.exe" [2010-06-01 5322040]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Verknüpfung mit der High Definition Audio-Eigenschaftenseite"="HDAudPropShortcut.exe" [2004-03-17 135680]
"DAEMON Tools"="c:\programme\DAEMON Tools\daemon.exe" [2006-11-12 157592]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-01-11 13666408]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-01-11 110696]
"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2010-05-14 326376]
"DWQueuedReporting"="c:\progra~1\GEMEIN~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"HideFastUserSwitching"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoFileUrl"= 0 (0x0)
"NoExpandedNewMenu"= 0 (0x0)
"NoRecentDocsNetHood"= 0 (0x0)
"NoStartMenuSubFolders"= 0 (0x0)
"NoStartMenuMyMusic"= 0 (0x0)
"NoSMMyPictures"= 0 (0x0)
"SpecifyDefaultButtons"= 1 (0x1)
"Btn_Media"= 1 (0x1)
"Btn_History"= 1 (0x1)
"Btn_Edit"= 1 (0x1)
"NoSMConfigurePrograms"= 0 (0x0)
"NoSearchCommInStartMenu"= 0 (0x0)
"NoSearchComputerLinkInStartMenu"= 0 (0x0)
"NoSearchFilesInStartMenu"= 0 (0x0)
"NoSearchInternetInStartMenu"= 0 (0x0)
"NoSearchProgramsInStartMenu"= 0 (0x0)
"RestrictWelcomeCenter"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\DfLogon]
2005-10-15 14:13        49152        ----a-w-        c:\windows\system32\LogonDll.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute        REG_MULTI_SZ          autocheck autochk /k:C /k:D /k:E *

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programme\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Programme\\Paltalk Messenger\\paltalk.exe"=
"d:\\Programme\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"d:\\Programme\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"d:\\Programme\\Microsoft Games\\Gears of War\\Binaries\\WarGame-G4WLive.exe"=
"d:\\Programme\\Warcraft III\\Warcraft III.exe"=
"d:\\Programme\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\Programme\\Spiele\\EA GAMES\\Battlefield 2\\BF2.exe"=
"d:\\Programme\\Atari\\Test Drive Unlimited\\TestDriveUnlimited.exe"=
"c:\\Programme\\Real\\RealPlayer\\realplay.exe"=
"d:\\Programme\\EA Games\\Command and Conquer Generals\\patchget.dat"=
"d:\\Programme\\Atari\\Act of War - Direct Action\\ACTOFWAR.EXE"=
"d:\\Programme\\EA Games\\Command & Conquer Generäle Stunde Null\\game.dat"=
"d:\\Programme\\EA Games\\Command & Conquer Generäle Stunde Null\\patchget.dat"=
"c:\\Programme\\InterCafe 2008\\Client\\ICClientHelper.exe"=
"c:\\Programme\\InterCafe 2008\\Client\\Client.exe"=
"c:\\Programme\\InterCafe 2008\\Client\\PrinterPreview.exe"=
"d:\\Programme\\CAPCOM\\StreetFighterIV.exe"=
"c:\\Programme\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Programme\\ICQ7.2\\ICQ.exe"=
"c:\\Programme\\ICQ7.2\\aolload.exe"=
"c:\\Programme\\Skype\\Phone\\Skype.exe"=
"c:\\WINDOWS\\system32\\HDAudPropShortcut.exe"=
"c:\\PROGRA~1\\Yahoo!\\MESSEN~1\\YahooMessenger.exe"=
"c:\\PROGRA~1\\Yahoo!\\MESSEN~1\\ymsgr_tray.exe"=
"c:\\WINDOWS\\system32\\taskmgr.exe"=
"c:\\Programme\\Mozilla Firefox\\plugin-container.exe"=
"c:\\Dokumente und Einstellungen\\user\\Desktop\\OTL.exe"=
"c:\\Programme\\Java\\jre6\\bin\\jqsnotify.exe"=

R0 DeepFrz;DeepFrz;c:\windows\system32\drivers\DeepFrz.sys [15.10.2005 16:08 128128]
R2 ICClientHelperService;ICClientHelperService;c:\programme\InterCafe 2008\Client\ICClientHelper.exe [08.04.2008 10:26 229376]
R3 3xHybrid;Pinnacle PCTV 300i Stereo DVB-T;c:\windows\system32\drivers\3xHybrid.sys [07.11.2005 10:15 827008]
R3 dwlkbf;DwlKbf;c:\windows\system32\drivers\dwlkbf.sys [22.04.2009 10:47 5632]
S2 gupdate;Google Update Service (gupdate);c:\programme\Google\Update\GoogleUpdate.exe [16.07.2010 22:06 135664]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [20.03.2008 19:59 639224]
.
Inhalt des "geplante Tasks" Ordners

2010-08-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-07-16 20:06]

2010-08-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-07-16 20:06]

2010-08-09 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-3781621405-2229333351-2813762238-1005.job
- c:\programme\Real\RealUpgrade\realupgrade.exe [2010-06-03 01:02]

2010-08-09 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-3781621405-2229333351-2813762238-1005.job
- c:\programme\Real\RealUpgrade\realupgrade.exe [2010-06-03 01:02]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
IE: Google Sidewiki... - c:\programme\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Trusted Zone: trendmicro.de\www
FF - ProfilePath - c:\dokumente und einstellungen\user\Anwendungsdaten\Mozilla\Firefox\Profiles\gsqoe35c.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.alamotel.de
FF - prefs.js: network.proxy.type - 0
FF - component: c:\dokumente und einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\components\nprpffbrowserrecordext.dll
FF - plugin: c:\programme\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\programme\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\programme\Java\jre6\bin\new_plugin\npdeployJava1.dll

---- FIREFOX Richtlinien ----
FF - user.js: yahoo.homepage.dontask - truec:\programme\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type",                  5);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size",  4096);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation",  false);
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2010-08-09 19:28
Windows 5.1.2600 Service Pack 3 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_USERS\S-1-5-21-3781621405-2229333351-2813762238-1005\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"??"=hex:1f,14,f8,91,0e,5f,71,7f,01,2e,17,67,56,f1,93,9a,65,1d,2d,fd,d4,20,20,
  6b,04,56,44,ec,e2,c1,e6,f4,30,ad,66,eb,95,b8,54,e7,e3,76,4f,cb,83,85,70,50,\
"??"=hex:5a,da,71,d3,e6,f3,2c,cf,af,a7,25,e9,8f,b7,27,93

[HKEY_USERS\S-1-5-21-3781621405-2229333351-2813762238-1005\Software\SecuROM\License information*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"datasecu"=hex:ac,8e,ba,67,87,25,ca,bf,f3,97,56,e7,17,b0,bc,20,44,40,ff,92,13,
  80,4b,ac,03,4a,1a,9a,74,3a,50,a6,3e,0a,3d,5c,91,9b,74,c2,eb,9a,6f,91,6e,1b,\
"rkeysecu"=hex:81,12,56,d3,f0,8c,cb,05,e5,4d,ef,a9,0d,d6,8b,6f

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\*–€|ÿÿÿÿ;•€|ù•6~*]
"7040111900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

- - - - - - - > 'winlogon.exe'(544)
c:\windows\system32\LogonDll.dll
.
Zeit der Fertigstellung: 2010-08-09  19:30:12
ComboFix-quarantined-files.txt  2010-08-09 17:30

Vor Suchlauf: 10 Verzeichnis(se), 36.900.081.664 Bytes frei
Nach Suchlauf: 12 Verzeichnis(se), 36.829.466.624 Bytes frei

WindowsXP-KB310994-SP2-Home-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - A356B7636EAF280EFC95AF112DB80B40
--- --- ---

markusg 09.08.2010 18:57
was ist e: für ein laufwerk? nen usb stick?

mrfuji 09.08.2010 19:00
E: ist eine einfache Partition! Komisch ist jedoch das er mir seit das Problem besteht auf jener Partition alles versteckt anzeigt und dies sich auch nicht ändern lässt, da nach jedem neustart alles schön wieder aufs neue versteckelt wird!!!

mrfuji 09.08.2010 19:02
----------

markusg 09.08.2010 19:03
jo das kommt jetzt.
download malwarebytes:
Malwarebytes
instaliere das programm, öffne es, registerkarte aktualisierung, programm updaten.
schalte nun alles an laufenden programmen ab, auch antivirus, trenne die internetverbindung, starte nen komplett scan mit malwarebytes
funde löschen, antivirus+internet ein, log posten.

mrfuji 09.08.2010 19:39
sodele, eine gute halbe stunde später...


Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4411

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

09.08.2010 20:37:19
mbam-log-2010-08-09 (20-37-19).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|)
Durchsuchte Objekte: 214342
Laufzeit: 31 Minute(n), 19 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 5
Infizierte Verzeichnisse: 0
Infizierte Dateien: 24

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\Qoobox\Quarantine\E\lad.bat.vir (Worm.Magania) -> Quarantined and deleted successfully.
D:\weucbs.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
D:\Programme\Jetfighter 5\Game.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{7B6204E0-83DE-4B71-98E5-136B1D9591E4}\RP11\A0005887.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{7B6204E0-83DE-4B71-98E5-136B1D9591E4}\RP11\A0005989.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{7B6204E0-83DE-4B71-98E5-136B1D9591E4}\RP8\A0001956.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{7B6204E0-83DE-4B71-98E5-136B1D9591E4}\RP8\A0002247.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
E:\yetsd.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
E:\steam\programme\ltb\DeepUnfreezer1.6.exe (Trojan.Agent) -> Quarantined and deleted successfully.
E:\System Volume Information\_restore{7B6204E0-83DE-4B71-98E5-136B1D9591E4}\RP11\A0005693.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
E:\System Volume Information\_restore{7B6204E0-83DE-4B71-98E5-136B1D9591E4}\RP16\A0006410.exe (Trojan.Agent) -> Quarantined and deleted successfully.
E:\System Volume Information\_restore{7B6204E0-83DE-4B71-98E5-136B1D9591E4}\RP17\A0006592.exe (Trojan.Agent) -> Quarantined and deleted successfully.
E:\System Volume Information\_restore{7B6204E0-83DE-4B71-98E5-136B1D9591E4}\RP17\A0006672.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
E:\System Volume Information\_restore{7B6204E0-83DE-4B71-98E5-136B1D9591E4}\RP17\A0006680.bat (Worm.Magania) -> Quarantined and deleted successfully.
E:\System Volume Information\_restore{7B6204E0-83DE-4B71-98E5-136B1D9591E4}\RP18\A0006837.exe (Trojan.Agent) -> Quarantined and deleted successfully.
E:\System Volume Information\_restore{7B6204E0-83DE-4B71-98E5-136B1D9591E4}\RP7\A0001528.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
E:\System Volume Information\_restore{7B6204E0-83DE-4B71-98E5-136B1D9591E4}\RP7\A0001564.exe (Trojan.Agent) -> Quarantined and deleted successfully.
E:\System Volume Information\_restore{7B6204E0-83DE-4B71-98E5-136B1D9591E4}\RP7\A0001654.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
E:\System Volume Information\_restore{7B6204E0-83DE-4B71-98E5-136B1D9591E4}\RP7\A0001659.exe (Trojan.Agent) -> Quarantined and deleted successfully.
E:\System Volume Information\_restore{7B6204E0-83DE-4B71-98E5-136B1D9591E4}\RP7\A0001797.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
E:\System Volume Information\_restore{7B6204E0-83DE-4B71-98E5-136B1D9591E4}\RP8\A0002522.exe (Trojan.Agent) -> Quarantined and deleted successfully.
E:\System Volume Information\_restore{7B6204E0-83DE-4B71-98E5-136B1D9591E4}\RP9\A0003021.exe (Trojan.Agent) -> Quarantined and deleted successfully.
E:\System Volume Information\_restore{7B6204E0-83DE-4B71-98E5-136B1D9591E4}\RP9\A0003063.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
E:\System Volume Information\_restore{7B6204E0-83DE-4B71-98E5-136B1D9591E4}\RP9\A0005487.exe (Trojan.Agent) -> Quarantined and deleted successfully.

markusg 09.08.2010 19:48
start man neu und schau ob der taskmanager und regedit laufen


Alle Zeitangaben in WEZ +1. Es ist jetzt 02:44 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131