Trojaner-Board - Think Point Trojaner auf dem Laptop

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Think Point Trojaner auf dem Laptop (https://www.trojaner-board.de/92423-think-point-trojaner-laptop.html)

Think Point Trojaner auf dem Laptop

Hallo,

mich hat es leider auch erwischt. Der Trojaner Think Point blockiert meinen PC. Wenne r hochfährt kann ich durch öffnen des Taskmanagers die hotfix.exe Datei beenden und der Scan läuft nicht mehr durch.

Mit meinem Virenprogramm Antivir habe ich einen Suchdurchlauf gestartet der einige Stunden gedauert hat. Dort wurden 15 Objekte gefunden, Trojaner wie auch Malware. Diese habe ich durch das Programm entfernt.

Beim nächsten Hochfahren kam das Think Point Tool wieder. Nun habe ich mir laut Forum die Anti Malware Lamwarebytes heruntergeladen. Nur möchte mein PC das ganze nicht öffnen (Auch nicht als Adminstrator).

Mir wäre es eigentlich nur wichtig das ich meine Daten auf dem Rechner irgendwie bekomme. Wenn ich dann jemanden finde der mir meinen Rechner neu einrichtet würde ich ihn auch einmal platt machen lassen, hatte das sowieso in nächster Zeit vor.

Aber diesen Trojaner muss ich ja vorher irgendwie loswerden. Nur wie?

Grüße, Leena

kannst du die hotfix.exe beenden und dann mal folgendes machen:
ootl:
Systemscan mit OTL
download otl:
http://filepony.de/download-otl/

Doppelklick auf die OTL.exe
(user von Windows 7 und Vista: Rechtsklick als Administrator ausführen)
1. Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
2. Hake an "scan all users"
3. Unter "Extra Registry wähle:
"Use Safelist" "LOP Check" "Purity Check"
4. Kopiere in die Textbox:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
5. Klicke "Scan"
6. 2 reporte werden erstellt:
OTL.Txt
Extras.Txt
beide posten.

netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 58,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 78,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 224,04 Gb Total Space | 39,02 Gb Free Space | 17,42% Space Free | Partition Type: NTFS
Drive D: | 232,88 Gb Total Space | 82,87 Gb Free Space | 35,59% Space Free | Partition Type: NTFS
Drive E: | 8,84 Gb Total Space | 1,63 Gb Free Space | 18,43% Space Free | Partition Type: NTFS

Computer Name: LEENA-PC | User Name: Leena | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Leena\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Users\Leena\AppData\Local\Temp\dgmlk.exe ()
PRC - C:\Programme\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programme\ICQ6Toolbar\ICQ Service.exe ()
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Windows\System32\mmrtkrnl.exe (AlcaTech)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Winamp\winampa.exe ()
PRC - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_9a642328\stacsv.exe (IDT, Inc.)
PRC - C:\Programme\IDT\WDM\sttray.exe (IDT, Inc.)
PRC - C:\Windows\SMINST\BLService.exe ()
PRC - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_9a642328\AEstSrv.exe (Andrea Electronics Corporation)
PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Sidebar\sidebar.exe (Microsoft Corporation)
PRC - C:\Programme\WIDCOMM\Bluetooth Software\BTStackServer.exe (Broadcom Corporation.)
PRC - C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
PRC - C:\Programme\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
PRC - C:\Programme\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (Microsoft Corporation)
PRC - C:\Programme\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe (Microsoft Corporation)

========== Modules (SafeList) ==========

MOD - C:\Users\Leena\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18523_none_5cdd65e20837faf2\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (Apple Mobile Device) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (ICQ Service) -- C:\Programme\ICQ6Toolbar\ICQ Service.exe ()
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (STacSV) -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_9a642328\stacsv.exe (IDT, Inc.)
SRV - (Recovery Service for Windows) -- C:\Windows\SMINST\BLService.exe ()
SRV - (AESTFilters) -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_9a642328\AEstSrv.exe (Andrea Electronics Corporation)
SRV - (ezSharedSvc) -- C:\Windows\System32\ezsvc7.dll (EasyBits Sofware AS)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (UPnPService) -- C:\Programme\Common Files\MAGIX Shared\UPnPService\UPnPService.exe (Magix AG)
SRV - (FirebirdServerMAGIXInstance) -- C:\Programme\MAGIX\Common\Database\bin\fbserver.exe (MAGIX®)
SRV - (MSSQL$SONY_MEDIAMGR) -- C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (Microsoft Corporation)
SRV - (SQLAgent$SONY_MEDIAMGR) -- C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (Microsoft Corporation)
SRV - (MSSQLServerADHelper) -- C:\Programme\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (NwlnkFwd) -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) -- C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) -- C:\Windows\System32\DRIVERS\ipinip.sys File not found
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (npf) -- C:\Windows\System32\drivers\npf.sys (CACE Technologies, Inc.)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (MMRTKRNL) -- C:\Windows\system32\drivers\mmrtkrnl.sys (AlcaTech)
DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (AtiPcie) ATI PCI Express (3GIO) -- C:\Windows\system32\DRIVERS\AtiPcie.sys (ATI Technologies Inc.)
DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (STHDA) -- C:\Windows\System32\drivers\stwrt.sys (IDT, Inc.)
DRV - (JMCR) -- C:\Windows\System32\drivers\jmcr.sys (JMicron Technology Corp.)
DRV - (hpdskflt) -- C:\Windows\system32\DRIVERS\hpdskflt.sys (Hewlett-Packard Corporation)
DRV - (Accelerometer) -- C:\Windows\System32\drivers\Accelerometer.sys (Hewlett-Packard Corporation)
DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation )
DRV - (btwavdt) -- C:\Windows\System32\drivers\btwavdt.sys (Broadcom Corporation.)
DRV - (btwaudio) -- C:\Windows\System32\drivers\btwaudio.sys (Broadcom Corporation.)
DRV - (btwrchid) -- C:\Windows\System32\drivers\btwrchid.sys (Broadcom Corporation.)
DRV - (enecir) -- C:\Windows\System32\drivers\enecir.sys (ENE TECHNOLOGY INC.)
DRV - (MegaSR) -- C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.)
DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Corporation)
DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (MSDV) -- C:\Windows\System32\drivers\msdv.sys (Microsoft Corporation)
DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (winachsf) -- C:\Windows\System32\drivers\VSTCNXT3.SYS (Conexant Systems, Inc.)
DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (61883) -- C:\Windows\System32\drivers\61883.sys (Microsoft Corporation)
DRV - (HSF_DPV) -- C:\Windows\System32\drivers\VSTDPV3.SYS (Conexant Systems, Inc.)
DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (HSFHWAZL) -- C:\Windows\System32\drivers\VSTAZL3.SYS (Conexant Systems, Inc.)
DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (Avc) -- C:\Windows\System32\drivers\avc.sys (Microsoft Corporation)
DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (SynTP) -- C:\Windows\System32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (HpqKbFiltr) -- C:\Windows\System32\drivers\HpqKbFiltr.sys (Hewlett-Packard Development Company, L.P.)
DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (NVENETFD) -- C:\Windows\System32\drivers\nvm60x32.sys (NVIDIA Corporation)
DRV - (BCM43XV) -- C:\Windows\System32\drivers\BCMWL6.SYS (Broadcom Corporation)
DRV - (ATMhelpr) -- C:\Windows\System32\drivers\ATMHELPR.SYS (Adobe Systems Incorporated)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = HP Notebook | MSN
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = HP Notebook | MSN
IE - HKLM\..\URLSearchHook: {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Programme\Winload\tbWinl.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - C:\Programme\DVDVideoSoft\tbDVDV.dll (Conduit Ltd.)

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-2001224967-2248691082-3800531272-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = HP Notebook | MSN
IE - HKU\S-1-5-21-2001224967-2248691082-3800531272-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Search
IE - HKU\S-1-5-21-2001224967-2248691082-3800531272-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-2001224967-2248691082-3800531272-1000\..\URLSearchHook: - Reg Error: Key error. File not found
IE - HKU\S-1-5-21-2001224967-2248691082-3800531272-1000\..\URLSearchHook: {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Programme\Winload\tbWinl.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-2001224967-2248691082-3800531272-1000\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKU\S-1-5-21-2001224967-2248691082-3800531272-1000\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-2001224967-2248691082-3800531272-1000\..\URLSearchHook: {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - C:\Programme\DVDVideoSoft\tbDVDV.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-2001224967-2248691082-3800531272-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2001224967-2248691082-3800531272-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultthis.engineName: "Winload Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2319825&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.startup.homepage: "hxxp://www.t-online.de/"
FF - prefs.js..extensions.enabledItems: bejeweledblitz3cheat@thecybershadow.net:2.1
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {e9911ec6-1bcc-40b0-9993-e0eea7f6953f}:2.5.6.0
FF - prefs.js..extensions.enabledItems: {40c3cc16-7269-4b32-9531-17f2950fb06f}:2.5.8.6
FF - prefs.js..extensions.enabledItems: sparweltgutscheinewl@sparwelt.de:1.0
FF - prefs.js..keyword.URL: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2319825&q="

FF - HKLM\software\mozilla\Mozilla Firefox 3.0.19\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.07.19 09:56:31 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.19\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.07.19 09:56:31 | 000,000,000 | ---D | M]

[2008.08.11 19:03:07 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\mozilla\Extensions
[2010.11.02 09:51:47 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\mozilla\Firefox\Profiles\j7g0ittv.default\extensions
[2008.08.13 12:37:28 | 000,000,000 | ---D | M] (Winamp Toolbar) -- C:\Users\Leena\AppData\Roaming\mozilla\Firefox\Profiles\j7g0ittv.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}
[2009.09.03 10:41:15 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Leena\AppData\Roaming\mozilla\Firefox\Profiles\j7g0ittv.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.06.09 11:51:46 | 000,000,000 | ---D | M] (Winload Toolbar) -- C:\Users\Leena\AppData\Roaming\mozilla\Firefox\Profiles\j7g0ittv.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}
[2010.01.05 11:36:57 | 000,000,000 | ---D | M] (ReloadEvery) -- C:\Users\Leena\AppData\Roaming\mozilla\Firefox\Profiles\j7g0ittv.default\extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644}
[2010.04.28 20:20:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Leena\AppData\Roaming\mozilla\Firefox\Profiles\j7g0ittv.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2010.03.03 22:50:01 | 000,000,000 | ---D | M] (DVDVideoSoft Toolbar) -- C:\Users\Leena\AppData\Roaming\mozilla\Firefox\Profiles\j7g0ittv.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}
[2010.10.03 23:15:08 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\mozilla\Firefox\Profiles\j7g0ittv.default\extensions\bejeweledblitz3cheat@thecybershadow.net
[2010.06.09 11:51:43 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\mozilla\Firefox\Profiles\j7g0ittv.default\extensions\sparweltgutscheinewl@sparwelt.de
[2010.03.24 15:13:02 | 000,000,917 | ---- | M] () -- C:\Users\Leena\AppData\Roaming\Mozilla\FireFox\Profiles\j7g0ittv.default\searchplugins\conduit.xml
[2010.01.18 02:15:14 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2009.07.14 21:31:23 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2010.06.09 17:17:31 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.06.09 17:17:31 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.06.09 17:17:31 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.06.09 17:17:31 | 000,000,986 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.06.09 17:17:31 | 000,000,801 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml

O1 HOSTS File: ([2009.10.17 23:15:37 | 000,000,935 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O1 - Hosts: 127.0.0.1 im.adtech.de
O1 - Hosts: 127.0.0.1 adserver.adtech.de
O1 - Hosts: 127.0.0.1 adtech.de
O1 - Hosts: 127.0.0.1 atwola.com
O1 - Hosts: 127.0.0.1 adserver.71i.de
O1 - Hosts: 127.0.0.1 adicqserver.71i.de
O1 - Hosts: 127.0.0.1 71i.de
O2 - BHO: (XTTBPos00 Class) - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\Programme\ICQToolbar\toolbaru.dll (ICQ Inc.)
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Winload Toolbar) - {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Programme\Winload\tbWinl.dll (Conduit Ltd.)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - No CLSID value found.
O2 - BHO: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.)
O2 - BHO: (DVDVideoSoft Toolbar) - {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - C:\Programme\DVDVideoSoft\tbDVDV.dll (Conduit Ltd.)
O2 - BHO: (HP Smart BHO Class) - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Programme\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O3 - HKLM\..\Toolbar: (Winload Toolbar) - {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Programme\Winload\tbWinl.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (DVDVideoSoft Toolbar) - {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - C:\Programme\DVDVideoSoft\tbDVDV.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-2001224967-2248691082-3800531272-1000\..\Toolbar\WebBrowser: (Winload Toolbar) - {40C3CC16-7269-4B32-9531-17F2950FB06F} - C:\Programme\Winload\tbWinl.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-2001224967-2248691082-3800531272-1000\..\Toolbar\WebBrowser: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKU\S-1-5-21-2001224967-2248691082-3800531272-1000\..\Toolbar\WebBrowser: (DVDVideoSoftTB Toolbar) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - C:\Programme\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-2001224967-2248691082-3800531272-1000\..\Toolbar\WebBrowser: (DVDVideoSoft Toolbar) - {E9911EC6-1BCC-40B0-9993-E0EEA7F6953F} - C:\Programme\DVDVideoSoft\tbDVDV.dll (Conduit Ltd.)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Programme\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [HP Health Check Scheduler] c:\Programme\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe (Hewlett-Packard)
O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [Realtime Audio Engine] C:\Windows\System32\mmrtkrnl.exe (AlcaTech)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [SysTrayApp] C:\Programme\IDT\WDM\sttray.exe (IDT, Inc.)
O4 - HKLM..\Run: [UCam_Menu] C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe ()
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-2001224967-2248691082-3800531272-1000..\Run: [cbssreg] C:\Users\Leena\AppData\Local\Temp\dgmlk.exe ()
O4 - HKU\S-1-5-21-2001224967-2248691082-3800531272-1000..\Run: [iihihhaudio] c:\users\leena\appdata\local\temp\yabbax.DLL (foobar2000.org)
O4 - HKU\S-1-5-21-2001224967-2248691082-3800531272-1000..\Run: [ISUSPM Startup] C:\Programme\Common Files\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation)
O4 - HKU\S-1-5-21-2001224967-2248691082-3800531272-1000..\Run: [urspnksys] c:\users\leena\appdata\local\temp\efcawu.DLL (foobar2000.org)
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideFastUserSwitching = 0
O7 - HKU\S-1-5-21-2001224967-2248691082-3800531272-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLogoff = 0
O7 - HKU\S-1-5-21-2001224967-2248691082-3800531272-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoClose = 0
O7 - HKU\S-1-5-21-2001224967-2248691082-3800531272-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutorun = 0
O7 - HKU\S-1-5-21-2001224967-2248691082-3800531272-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableLockWorkstation = 0
O7 - HKU\S-1-5-21-2001224967-2248691082-3800531272-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableChangePassword = 0
O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: HP Intelligente Auswahl - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Programme\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKU\.DEFAULT\..Trusted Ranges: Range1 ([http] in Local intranet)
O15 - HKU\S-1-5-18\..Trusted Ranges: Range1 ([http] in Local intranet)
O15 - HKU\S-1-5-21-2001224967-2248691082-3800531272-1000\..Trusted Ranges: Range1 ([http] in Local intranet)
O16 - DPF: {588031A3-94BF-4CDD-86D0-939F6F93910F} https://fixit.support.microsoft.com/ActiveX/FixItClient.CAB (FixItClient Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} hxxp://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab (Oberon Flash Game Host)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKU\S-1-5-21-2001224967-2248691082-3800531272-1000 Winlogon: Shell - (C:\Users\Leena\AppData\Roaming\hotfix.exe) - C:\Users\Leena\AppData\Roaming\hotfix.exe ()
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{874150bf-244a-11df-8cbc-002186648db0}\Shell - "" = AutoRun
O33 - MountPoints2\{874150bf-244a-11df-8cbc-002186648db0}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -- File not found
O33 - MountPoints2\{b0a7e944-188f-11df-a5a8-002186648db0}\Shell\AutoRun\command - "" = G:\Get_Started_for_Win.exe -- File not found
O33 - MountPoints2\{b1d1f47c-f691-11dd-9100-002186648db0}\Shell\AutoRun\command - "" = G:\setupSNK.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found
NetSvcs: ezSharedSvc - C:\Windows\System32\ezsvc7.dll (EasyBits Sofware AS)

SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS - File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS - File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

ActiveX: {03F998B2-0E00-11D3-A498-00104B6EB52E} - Viewpoint Media Player
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
ActiveX: {166B1BCA-3F9C-11CF-8075-444553540000} - Macromedia Shockwave Director 10.1
ActiveX: {1B00725B-C455-4DE6-BFB6-AD540AD427CD} - Viewpoint Media Player
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Windows Media Player 5.2
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Macromedia Shockwave Director 10.1
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2A5D676E-780C-5F24-ED77-B71D2653F34C} - Java (Sun)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {2F6EFCE6-10DF-49F9-9E64-9AE3775B2588} - Microsoft .NET Framework 1.1 Security Update (KB2416447)
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3codecp - C:\Windows\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.voxacm160 - C:\Windows\System32\vct3216.acm (Voxware, Inc.)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: VIDC.CFHD - C:\Windows\System32\cfhd.dll (CineForm Inc.)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)
Drivers32: VIDC.FMVC - C:\Windows\System32\fmcodec.DLL (Fox Magic Software)
Drivers32: VIDC.WMV3 - C:\Windows\System32\wmv9vcm.dll (Microsoft Corporation)
Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.)

CREATERESTOREPOINT
Error creating restore point.

========== Files/Folders - Created Within 30 Days ==========

[2010.11.02 09:47:25 | 000,000,000 | ---D | C] -- C:\Users\Leena\AppData\Roaming\Malwarebytes
[2010.11.02 09:47:15 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010.11.02 09:47:11 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010.11.02 09:47:11 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2010.11.02 09:47:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010.11.02 00:59:47 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2010.11.01 22:48:12 | 000,000,000 | -H-D | C] -- C:\Users\Public\Documents\Windows
[2010.11.01 22:48:04 | 000,000,000 | -H-D | C] -- C:\Users\Public\Documents\Server
[2010.11.01 09:56:18 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee
[2010.10.14 00:18:00 | 008,147,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmploc.DLL
[2010.10.14 00:17:30 | 000,017,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\netevent.dll
[2010.10.14 00:17:18 | 000,157,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\t2embed.dll
[2010.10.14 00:17:15 | 000,954,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc40.dll
[2010.10.14 00:17:14 | 000,954,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc40u.dll
[2010.10.14 00:17:12 | 002,037,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2010.10.14 00:17:09 | 000,248,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msshsq.dll
[2010.10.14 00:17:08 | 000,866,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmpmde.dll
[2010.10.14 00:17:00 | 000,467,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2010.10.14 00:16:58 | 000,380,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll
[2010.10.14 00:16:56 | 001,383,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2010.10.14 00:16:56 | 000,671,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll
[2010.10.14 00:16:56 | 000,389,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2010.10.14 00:16:56 | 000,389,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll
[2010.10.14 00:16:56 | 000,230,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieaksie.dll
[2010.10.14 00:16:56 | 000,193,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2010.10.14 00:16:56 | 000,078,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieencode.dll
[2010.10.14 00:16:56 | 000,028,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2007.02.12 19:10:44 | 002,682,880 | ---- | C] (Microsoft Corporation) -- C:\ProgramData\VCREDI~3.EXE
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010.11.02 11:38:24 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010.11.02 11:38:24 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010.11.02 11:19:53 | 000,702,300 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2010.11.02 11:19:53 | 000,648,106 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010.11.02 11:19:53 | 000,157,832 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2010.11.02 11:19:53 | 000,129,330 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010.11.02 10:12:38 | 000,133,632 | ---- | M] () -- C:\Users\Leena\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.11.02 09:47:17 | 000,000,820 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.11.02 09:40:50 | 000,000,269 | ---- | M] () -- C:\Users\Public\Documents\hpqp.ini
[2010.11.02 09:37:14 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.11.02 09:36:58 | 3218,952,192 | -HS- | M] () -- C:\hiberfil.sys
[2010.11.02 09:36:08 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2010.11.02 00:59:47 | 260,315,277 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2010.11.02 00:57:31 | 000,000,006 | ---- | M] () -- C:\Users\Leena\AppData\Roaming\completescan
[2010.11.02 00:51:37 | 000,000,194 | ---- | M] () -- C:\Users\Leena\AppData\Roaming\dkfjasdfshd.bat
[2010.11.02 00:51:36 | 000,572,416 | ---- | M] () -- C:\Users\Leena\AppData\Roaming\hotfix.exe
[2010.11.01 23:36:30 | 000,000,006 | ---- | M] () -- C:\Users\Leena\AppData\Roaming\start
[2010.11.01 22:50:04 | 000,000,010 | ---- | M] () -- C:\Users\Leena\AppData\Roaming\install
[2010.11.01 20:43:49 | 000,000,418 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{BB7779DA-C7FE-4FF3-A991-4726E13E476B}.job
[2010.10.31 10:06:36 | 000,006,944 | ---- | M] () -- C:\Users\Leena\AppData\Local\d3d9caps.dat
[2010.10.30 15:52:04 | 005,086,563 | ---- | M] () -- C:\Users\Leena\Desktop\carribean show letzte.MP3
[2010.10.29 23:45:38 | 000,009,600 | ---- | M] () -- C:\Users\Leena\Desktop\holy 2011.veg
[2010.10.29 13:49:14 | 000,021,800 | ---- | M] () -- C:\Users\Leena\Desktop\carribean show2.veg
[2010.10.29 13:48:24 | 010,674,158 | ---- | M] () -- C:\Users\Leena\Desktop\carribean show2.mp3
[2010.10.29 00:12:47 | 000,025,088 | ---- | M] () -- C:\Users\Leena\Documents\filme youtube.doc
[2010.10.28 22:31:22 | 000,021,032 | ---- | M] () -- C:\Users\Leena\Desktop\carribean show2.veg.bak
[2010.10.21 15:59:26 | 000,150,168 | ---- | M] () -- C:\Users\Leena\Desktop\holy best of.veg
[2010.10.21 15:57:14 | 000,000,038 | ---- | M] () -- C:\Users\Leena\Desktop\holy best of.avi.sfl
[2010.10.21 00:18:14 | 000,150,240 | ---- | M] () -- C:\Users\Leena\Desktop\holy best of.veg.bak
[2010.10.20 23:56:56 | 000,413,280 | ---- | M] () -- C:\Users\Leena\Desktop\holy train video.avi.sfk
[2010.10.20 14:59:15 | 000,050,008 | -H-- | M] () -- C:\Users\Leena\Documents\mxfilerelatedcache.mxc2
[2010.10.19 10:41:44 | 000,222,080 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe
[2010.10.14 13:58:08 | 000,552,184 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2010.10.12 16:19:03 | 000,020,760 | ---- | M] () -- C:\Users\Leena\Desktop\carribean show.veg
[2010.10.12 16:16:08 | 007,052,123 | ---- | M] () -- C:\Users\Leena\Desktop\carribean show.mp3
[2010.10.09 11:09:49 | 000,016,632 | ---- | M] () -- C:\Users\Leena\Desktop\carribean show.veg.bak
[2010.10.05 20:40:22 | 000,007,688 | ---- | M] () -- C:\Users\Leena\Desktop\holy show.veg
[2010.10.05 20:39:56 | 000,000,034 | ---- | M] () -- C:\Users\Leena\Desktop\holy show.avi.sfl
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010.11.02 09:47:17 | 000,000,820 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.11.02 00:59:05 | 260,315,277 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2010.11.01 23:06:45 | 000,000,006 | ---- | C] () -- C:\Users\Leena\AppData\Roaming\start
[2010.11.01 23:05:54 | 000,000,006 | ---- | C] () -- C:\Users\Leena\AppData\Roaming\completescan
[2010.11.01 22:50:04 | 000,000,010 | ---- | C] () -- C:\Users\Leena\AppData\Roaming\install
[2010.11.01 22:48:22 | 000,000,194 | ---- | C] () -- C:\Users\Leena\AppData\Roaming\dkfjasdfshd.bat
[2010.11.01 22:48:21 | 000,572,416 | ---- | C] () -- C:\Users\Leena\AppData\Roaming\hotfix.exe
[2010.10.30 15:51:35 | 005,086,563 | ---- | C] () -- C:\Users\Leena\Desktop\carribean show letzte.MP3
[2010.10.29 23:45:38 | 000,009,600 | ---- | C] () -- C:\Users\Leena\Desktop\holy 2011.veg
[2010.10.29 07:40:59 | 010,674,158 | ---- | C] () -- C:\Users\Leena\Desktop\carribean show2.mp3
[2010.10.29 00:12:46 | 000,025,088 | ---- | C] () -- C:\Users\Leena\Documents\filme youtube.doc
[2010.10.28 22:31:22 | 000,021,800 | ---- | C] () -- C:\Users\Leena\Desktop\carribean show2.veg
[2010.10.28 22:31:22 | 000,021,032 | ---- | C] () -- C:\Users\Leena\Desktop\carribean show2.veg.bak
[2010.10.21 15:57:14 | 000,000,038 | ---- | C] () -- C:\Users\Leena\Desktop\holy best of.avi.sfl
[2010.10.20 22:41:31 | 000,413,280 | ---- | C] () -- C:\Users\Leena\Desktop\holy train video.avi.sfk
[2010.10.20 21:57:39 | 000,150,240 | ---- | C] () -- C:\Users\Leena\Desktop\holy best of.veg.bak
[2010.10.20 21:57:39 | 000,150,168 | ---- | C] () -- C:\Users\Leena\Desktop\holy best of.veg
[2010.10.09 08:57:50 | 007,052,123 | ---- | C] () -- C:\Users\Leena\Desktop\carribean show.mp3
[2010.10.08 22:57:24 | 000,020,760 | ---- | C] () -- C:\Users\Leena\Desktop\carribean show.veg
[2010.10.08 22:57:24 | 000,016,632 | ---- | C] () -- C:\Users\Leena\Desktop\carribean show.veg.bak
[2010.10.05 20:40:22 | 000,007,688 | ---- | C] () -- C:\Users\Leena\Desktop\holy show.veg
[2010.10.05 20:39:56 | 000,000,034 | ---- | C] () -- C:\Users\Leena\Desktop\holy show.avi.sfl
[2010.08.22 21:50:07 | 000,003,140 | -HS- | C] () -- C:\Windows\System32\KGyGaAvL.sys
[2009.11.16 17:33:38 | 000,053,299 | ---- | C] () -- C:\Windows\System32\pthreadVC.dll
[2009.09.23 13:04:09 | 000,001,209 | ---- | C] () -- C:\ProgramData\hpzinstall.log
[2009.08.23 23:14:45 | 000,000,268 | ---- | C] () -- C:\Windows\_delis43.ini
[2009.06.07 12:27:20 | 000,073,728 | ---- | C] () -- C:\Windows\System32\vbzlib1.dll
[2009.05.15 22:16:45 | 000,210,944 | ---- | C] () -- C:\Windows\System32\MSVCRT10.DLL
[2008.10.04 00:03:30 | 000,000,000 | ---- | C] () -- C:\Users\Leena\AppData\Local\FnF4.txt
[2008.10.01 11:24:23 | 000,000,090 | ---- | C] () -- C:\Windows\wincmd.ini
[2008.08.27 11:58:37 | 000,049,152 | ---- | C] () -- C:\Windows\System32\mgxasio2.dll
[2008.08.13 12:29:58 | 000,000,049 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2008.08.12 18:45:03 | 000,001,631 | ---- | C] () -- C:\Windows\cdplayer.ini
[2008.08.12 13:40:11 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI
[2008.08.12 12:13:58 | 000,120,200 | ---- | C] () -- C:\Windows\System32\DLLDEV32i.dll
[2008.08.12 11:46:23 | 000,006,944 | ---- | C] () -- C:\Users\Leena\AppData\Local\d3d9caps.dat
[2008.08.12 11:42:02 | 000,000,052 | ---- | C] () -- C:\Windows\videodeLuxe.INI
[2008.08.12 11:38:35 | 000,010,240 | ---- | C] () -- C:\Windows\System32\vidx16.dll
[2008.08.12 11:38:15 | 000,019,968 | ---- | C] () -- C:\Windows\System32\cpuinf32.dll
[2008.08.12 11:31:04 | 000,007,119 | ---- | C] () -- C:\Windows\mgxoschk.ini
[2008.08.11 22:56:45 | 000,000,093 | ---- | C] () -- C:\Users\Leena\AppData\Local\fusioncache.dat
[2008.08.11 22:24:30 | 000,000,000 | ---- | C] () -- C:\Users\Leena\AppData\Roaming\wklnhst.dat
[2008.08.11 16:23:56 | 000,133,632 | ---- | C] () -- C:\Users\Leena\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.08.11 14:44:21 | 000,000,000 | ---- | C] () -- C:\Users\Leena\AppData\Local\QSwitch.txt
[2008.08.11 14:44:21 | 000,000,000 | ---- | C] () -- C:\Users\Leena\AppData\Local\DSwitch.txt
[2008.08.11 14:44:21 | 000,000,000 | ---- | C] () -- C:\Users\Leena\AppData\Local\AtStart.txt
[2008.07.23 06:53:56 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2008.05.08 23:14:22 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 11:25:26 | 000,557,568 | ---- | C] () -- C:\Windows\System32\hpotscl1.dll
[2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2005.05.20 00:56:26 | 000,491,520 | ---- | C] () -- C:\Windows\System32\mp3lib.dll
[2004.08.14 01:49:20 | 000,000,388 | ---- | C] () -- C:\Programme\file_id.diz
[2004.08.14 01:44:52 | 000,000,078 | -H-- | C] () -- C:\Programme\descript.ion
[2001.11.14 11:56:00 | 001,802,240 | ---- | C] () -- C:\Windows\System32\lcppn21.dll

========== LOP Check ==========

[2010.04.24 11:14:27 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\Acoustica
[2009.11.08 23:05:30 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\AlcaTech
[2009.09.09 21:03:11 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\ICQ
[2008.08.15 16:51:51 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\ICQ Toolbar
[2008.08.12 14:08:39 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\LogoMaker
[2010.01.06 23:35:55 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\Mael
[2010.05.10 22:39:49 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\MAGIX
[2009.10.30 13:31:30 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\PlayFirst
[2010.05.19 23:50:12 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\Publish Providers
[2008.08.13 13:01:41 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\RadioRipper
[2009.09.09 18:22:48 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\Sony
[2010.08.02 12:38:10 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\SparweltGutschein
[2008.08.11 20:04:10 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\Steinberg
[2008.08.11 22:24:34 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\Template
[2009.12.08 22:22:51 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\uTorrent
[2008.08.12 12:55:37 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\WildTangent
[2010.11.02 11:13:23 | 000,032,538 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2010.11.01 20:43:49 | 000,000,418 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{BB7779DA-C7FE-4FF3-A991-4726E13E476B}.job

========== Purity Check ==========

========== Custom Scans ==========

< %ALLUSERSPROFILE%\Application Data\*. >

< %ALLUSERSPROFILE%\Application Data\*.exe /s >

< %APPDATA%\*. >
[2010.04.24 11:14:27 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\Acoustica
[2009.09.04 19:21:43 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\Adobe
[2008.09.03 12:59:19 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\Ahead
[2009.11.08 23:05:30 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\AlcaTech
[2010.04.19 23:18:01 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\Apple Computer
[2008.08.11 14:44:17 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\ATI
[2009.03.30 18:54:07 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\AVS4YOU
[2010.08.22 21:57:42 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\Corel
[2009.04.22 15:21:23 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\CyberLink
[2008.12.10 00:30:18 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\DivX
[2009.05.15 22:01:45 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\Download Manager
[2010.06.09 22:40:49 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\dvdcss
[2008.08.11 14:44:53 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\Hewlett-Packard
[2009.09.23 13:41:29 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\HP
[2009.09.09 21:03:11 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\ICQ
[2008.08.15 16:51:51 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\ICQ Toolbar
[2008.08.11 14:43:08 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\Identities
[2008.08.12 14:08:39 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\LogoMaker
[2009.10.21 22:25:54 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\Macromedia
[2010.01.06 23:35:55 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\Mael
[2010.05.10 22:39:49 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\MAGIX
[2010.11.02 09:47:25 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\Malwarebytes
[2006.11.02 13:37:34 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\Media Center Programs
[2010.06.09 11:51:51 | 000,000,000 | --SD | M] -- C:\Users\Leena\AppData\Roaming\Microsoft
[2008.08.11 19:03:07 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\Mozilla
[2008.08.27 20:55:10 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\NeroDCTemplates
[2009.10.30 13:31:30 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\PlayFirst
[2010.05.19 23:50:12 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\Publish Providers
[2008.08.13 13:01:41 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\RadioRipper
[2008.12.15 01:38:16 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\Real
[2010.09.30 22:41:04 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\Skype
[2010.09.30 22:11:45 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\skypePM
[2009.09.09 18:22:48 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\Sony
[2010.08.02 12:38:10 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\SparweltGutschein
[2008.08.11 20:04:10 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\Steinberg
[2008.08.11 14:43:56 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\Symantec
[2008.08.11 22:24:34 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\Template
[2010.04.16 21:30:15 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\U3
[2009.12.08 22:22:51 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\uTorrent
[2010.11.01 23:42:07 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\vlc
[2008.08.12 12:55:37 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\WildTangent
[2008.08.13 13:08:34 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\Winamp
[2009.02.09 11:24:17 | 000,000,000 | ---D | M] -- C:\Users\Leena\AppData\Roaming\WinRAR

< %APPDATA%\*.exe /s >
[2010.11.02 00:51:36 | 000,572,416 | ---- | M] () -- C:\Users\Leena\AppData\Roaming\hotfix.exe
[2010.06.09 11:51:51 | 000,005,550 | R--- | M] () -- C:\Users\Leena\AppData\Roaming\Microsoft\Installer\{5943B7F7-678B-477E-9AEE-6E4C6962322B}\_6FEFF9B68218417F98F549.exe
[2008.08.13 12:26:06 | 000,045,495 | ---- | M] (AOL LLC) -- C:\Users\Leena\AppData\Roaming\Mozilla\Firefox\Profiles\j7g0ittv.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\uninstall.exe
[2007.10.23 08:27:20 | 000,110,592 | ---- | M] () -- C:\Users\Leena\AppData\Roaming\U3\temp\cleanup.exe
[2008.05.02 09:41:48 | 003,493,888 | -H-- | M] (SanDisk Corporation) -- C:\Users\Leena\AppData\Roaming\U3\temp\Launchpad Removal.exe

< %SYSTEMDRIVE%\*.exe >

< MD5 for: AGP440.SYS >
[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\drivers\AGP440.sys
[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys
[2006.11.02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys

< MD5 for: ATAPI.SYS >
[2008.06.13 13:27:27 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=0D83C87A801A3DFCD1BF73893FE7518C -- C:\Windows\System32\drivers\atapi.sys
[2008.06.13 13:27:27 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=0D83C87A801A3DFCD1BF73893FE7518C -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_4c9c5a00\atapi.sys
[2008.06.13 13:27:27 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=0D83C87A801A3DFCD1BF73893FE7518C -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18034_none_dd1bb97e219e87cb\atapi.sys
[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\SoftwareDistribution\Download\cd2b15b1a90e884578188440a1660b12\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sy s
[2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006.11.02 10:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2008.06.13 13:27:27 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=96DC4E1A9F90CCD489950A8935425C59 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.22134_none_dda556493abc2795\atapi.sys

< MD5 for: CNGAUDIT.DLL >
[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll

< MD5 for: EVENTLOG.DLL >
[2007.01.12 21:30:08 | 000,007,216 | ---- | M] () MD5=C2A279A458A06DE2C83D842AA042B5A8 -- C:\Programme\CyberLink\PowerDirector\EventLog.dll

< MD5 for: EXPLORER.EXE >
[2008.10.29 07:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2008.10.29 07:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\explorer.exe
[2008.10.29 07:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2008.10.30 04:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\SoftwareDistribution\Download\cd2b15b1a90e884578188440a1660b12\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[2008.10.28 03:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2008.01.21 03:24:24 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe

< MD5 for: IASTORV.SYS >
[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\drivers\iaStorV.sys
[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006.11.02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys

< MD5 for: NETLOGON.DLL >
[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\SoftwareDistribution\Download\cd2b15b1a90e884578188440a1660b12\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll
[2008.01.21 03:24:05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\System32\netlogon.dll
[2008.01.21 03:24:05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll

< MD5 for: NVSTOR.SYS >
[2006.11.02 10:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\drivers\nvstor.sys
[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys

< MD5 for: SCECLI.DLL >
[2008.01.21 03:24:50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\System32\scecli.dll
[2008.01.21 03:24:50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\SoftwareDistribution\Download\cd2b15b1a90e884578188440a1660b12\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll

< MD5 for: USER32.DLL >
[2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\SoftwareDistribution\Download\cd2b15b1a90e884578188440a1660b12\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll
[2008.01.21 03:24:21 | 000,627,200 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll
[2008.01.21 03:24:21 | 000,627,200 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll

< MD5 for: USERINIT.EXE >
[2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe

< MD5 for: WINLOGON.EXE >
[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\SoftwareDistribution\Download\cd2b15b1a90e884578188440a1660b12\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2008.01.21 03:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\System32\winlogon.exe
[2008.01.21 03:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe

< MD5 for: WS2IFSL.SYS >
[2008.01.21 03:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2008.01.21 03:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2008.01.21 04:14:18 | 016,846,848 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2008.01.21 04:14:08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2008.01.21 04:14:18 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006.11.02 11:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006.11.02 11:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2008.05.08 23:14:36 | 000,372,736 | ---- | M] (Advanced Micro Devices, Inc.) Unable to obtain MD5 -- C:\Windows\System32\ATIDEMGX.dll
[2009.10.11 04:17:27 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) Unable to obtain MD5 -- C:\Windows\System32\deploytk.dll
[2010.09.08 18:23:42 | 000,193,024 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\iepeers.dll
[2008.01.21 03:24:42 | 000,242,744 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\rsaenh.dll
[2008.01.21 03:24:38 | 000,225,792 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\SLC.dll
[1 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ]

========== Alternate Data Streams ==========

@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:888AFB86

< End of report >

und die extras.txt:OTL EXTRAS Logfile:

Code:

OTL Extras logfile created on: 02.11.2010 11:57:29 - Run 2

OTL by OldTimer - Version 3.2.17.2     Folder = C:\Users\Leena\Downloads

Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation

Internet Explorer (Version = 7.0.6001.18000)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 58,00% Memory free

6,00 Gb Paging File | 5,00 Gb Available in Paging File | 78,00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 224,04 Gb Total Space | 39,02 Gb Free Space | 17,42% Space Free | Partition Type: NTFS

Drive D: | 232,88 Gb Total Space | 82,87 Gb Free Space | 35,59% Space Free | Partition Type: NTFS

Drive E: | 8,84 Gb Total Space | 1,63 Gb Free Space | 18,43% Space Free | Partition Type: NTFS

 

Computer Name: LEENA-PC | User Name: Leena | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)

.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

.js [@ = JSFile] -- C:\Program Files\Macromedia\Dreamweaver MX 2004\Dreamweaver.exe File not found

 

[HKEY_USERS\S-1-5-21-2001224967-2248691082-3800531272-1000\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 
 ========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

jsfile [open] -- "C:\Program Files\Macromedia\Dreamweaver MX 2004\Dreamweaver.exe" "%1" File not found

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()

Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)

Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft)

Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft)

Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

"UacDisableNotify" = 0

"InternetSettingsDisableNotify" = 0

"AutoUpdateDisableNotify" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

"DisableMonitoring" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

"DisableMonitoring" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

"DisableMonitoring" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

"VistaSp1" = Reg Error: Unknown registry data type -- File not found

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 
 ========== Authorized Applications List ==========

 

 
 ========== Vista Active Open Ports Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{0690E82C-72E5-4435-BE23-D9FBE08C4602}" = lport=2869 | protocol=6 | dir=in | app=system | 

"{0B0A7A4A-8DAC-4DEE-9E0C-5BB7F030A176}" = rport=138 | protocol=17 | dir=out | app=system | 

"{12E793C8-6887-4387-8D9A-1956A567106A}" = lport=137 | protocol=17 | dir=in | app=system | 

"{2B7A7F5E-4433-46F9-839B-EA7DEBE6C67D}" = lport=53 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 

"{2E0EBF18-1FA2-47B1-9044-FD6AA913660B}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 

"{3FA2A927-26C3-45CF-9636-B212AF5E041A}" = lport=68 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 

"{464F213B-23FD-47CA-A709-34FA11A21AA9}" = rport=139 | protocol=6 | dir=out | app=system | 

"{46656814-CC08-4BAE-960D-3223F6C0EBEA}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{5C24D01A-3158-4CEA-8148-CD72CBBDFF3F}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{61CC93AF-A1CE-44CD-8263-58DF587677A6}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{6C410AD2-6193-454A-84A7-08A14A369815}" = lport=138 | protocol=17 | dir=in | app=system | 

"{825128FE-B2A8-4831-9A7A-09505A9D5EDF}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{85000413-DC4E-476F-8C82-02005803137E}" = lport=547 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 

"{86009710-45A6-484E-8F8C-065323854E01}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{86AFC324-B75E-4CED-A3E0-449F70F502AB}" = lport=445 | protocol=6 | dir=in | app=system | 

"{86F9F02F-9DC3-4E23-BDF6-77D3803358D6}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 

"{93AFF6C4-7149-491A-A96A-5220A9CCDBC6}" = lport=2869 | protocol=6 | dir=in | app=system | 

"{A4AC75A4-53BC-4C7A-809E-F867D3AB3CBA}" = lport=67 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 

"{A7900926-95BC-4F09-B8BF-702504DE53C6}" = lport=139 | protocol=6 | dir=in | app=system | 

"{C56C6BEF-01C5-42D2-A6D8-C8469037ADA8}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 

"{C902F382-5D91-458A-A54F-8ECCE64949B0}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{D2718806-9A8A-46C7-8881-46DC87E43DFF}" = rport=445 | protocol=6 | dir=out | app=system | 

"{DB323275-F7E2-4B24-815F-64372936C74B}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | 

"{E2FAAC88-CD02-44DA-8944-0FF322829705}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | 

"{E7E29313-3CA2-4037-997A-9CFC2C4527E7}" = rport=2869 | protocol=6 | dir=out | app=system | 

"{EA0A63A9-5A5D-44BC-8E64-2B1E4B5CC920}" = rport=137 | protocol=17 | dir=out | app=system | 

"{F8C2C574-D99D-430F-A375-48383F42C869}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 

"{FD31AF11-97C2-44C1-858A-03AB419880D2}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 

 
 ========== Vista Active Application Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{120BA139-3590-4F82-BEC6-B1F3575C5B12}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 

"{1633467E-BCC0-4FA2-AE5D-02B08F8BEAB6}" = protocol=58 | dir=in | name=@hnetcfg.dll,-148 | 

"{16E3A47E-375E-43E9-BE6D-2762DCF1C57A}" = dir=in | app=c:\program files\hp\quickplay\qpservice.exe | 

"{179ADA75-39A7-4F92-82E3-D0E0A7D9669E}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 

"{21DE3AFE-6643-4D5A-8FDA-5D946F320FE0}" = dir=out | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 

"{220AB53D-4A06-4A22-ABDF-8E9AEBA78E50}" = protocol=17 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe | 

"{2D533AC2-D4E0-4D04-9FAD-4E22E8B373F9}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 

"{2ED8CC7E-A7DD-46B7-9457-B274F60E6E0E}" = protocol=6 | dir=in | app=c:\program files\winamp remote\bin\orbir.exe | 

"{37EE4D01-AFDC-4DA7-A294-C280731B6E1C}" = protocol=6 | dir=in | app=c:\program files\winamp remote\bin\orb.exe | 

"{3CBED01A-65E0-4AD9-8CDA-A5989AFAEC84}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 

"{4195F7A7-E32A-41A2-B62F-ACE256EB86AA}" = dir=in | app=c:\program files\cyberlink\powerdirector\pdr.exe | 

"{58CED9B1-C51C-48E5-972B-5A61277AB352}" = protocol=6 | dir=in | app=c:\program files\winamp remote\bin\orbstreamerclient.exe | 

"{628FD7D7-FEB3-46A8-9492-4FFC71BE483F}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 

"{64AF032E-C7F1-4A3A-A761-846271B0F22B}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 

"{761BCB60-3D4B-4F1F-B0E7-18885C178448}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 

"{775F2E47-62A2-4521-BCBA-936AC82D8670}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 

"{7A8431CC-65F1-4B7A-B91C-C2B2F7439885}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{7FF2EC2C-BA52-40A2-8A09-B12F57473EAE}" = protocol=17 | dir=in | app=c:\program files\winamp remote\bin\orbir.exe | 

"{8F62C64B-409F-469E-B34E-A69209236C5C}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe | 

"{A05299AB-6809-4F9F-8DD2-8FBB1168EB1C}" = protocol=6 | dir=in | app=c:\program files\winamp remote\bin\orbtray.exe | 

"{AEA67CF8-64B0-4478-9992-1D87726A30CB}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 

"{B9FCA400-EB9F-4F32-B4D9-BA1FC7834404}" = protocol=17 | dir=in | app=c:\program files\winamp remote\bin\orbtray.exe | 

"{BDDB83BD-F195-48F3-BBD0-0743E94BE9E6}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe | 

"{C1883AA0-0674-4BBE-A38E-AAAAC4DECEC8}" = dir=in | app=c:\program files\msn messenger\msnmsgr.exe | 

"{C9516439-5E5A-4CE2-81A5-C9C075766596}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 

"{CFABCFD2-7500-41C5-A0AA-7C72FAA4FF60}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe | 

"{D8CA07DD-B6A6-490B-B6CB-E90407EA8B2D}" = protocol=17 | dir=in | app=c:\program files\winamp remote\bin\orbstreamerclient.exe | 

"{DA7862F4-55EB-4F3B-9664-24ED03662A92}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe | 

"{DE37F91C-2B78-4EA5-9A40-90852CC76678}" = dir=in | app=c:\program files\hp\quickplay\qp.exe | 

"{DF8986D1-8419-4A41-9E61-BEB4361E19CF}" = dir=in | app=c:\program files\msn messenger\livecall.exe | 

"{E353A2A7-F401-46E3-BAF1-DB8AB583B7DA}" = protocol=17 | dir=in | app=c:\program files\winamp remote\bin\orb.exe | 

"{E55A920E-BDAE-478A-BDFF-6FA88C3205F0}" = protocol=6 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe | 

"{FA0A1A68-8951-4637-8FDB-0DC6D614ECE5}" = dir=in | app=c:\program files\cyberlink\powerdirector express\pdx.exe | 

"TCP Query User{399297BE-BCA6-411B-95E4-211E1F2A8E6E}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 

"TCP Query User{41E59271-3466-4B03-A862-8DF3C383F7C7}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe | 

"TCP Query User{477BA1F9-AD8E-4B43-A83D-62523B0DFBCC}C:\program files\sopcast\sopcast.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\sopcast.exe | 

"TCP Query User{53DFF381-73A3-469D-BF64-42922B1C111A}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe | 

"TCP Query User{5458406A-2DA8-47C5-80EF-A8E3E995B3A2}C:\program files\icq6\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6\icq.exe | 

"TCP Query User{8721F86C-A43F-4536-99E3-0698A6BE59D3}C:\program files\icq6\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6\icq.exe | 

"TCP Query User{C276ECA4-8727-47C8-B644-90E7F8785D8D}C:\program files\sopcast\adv\sopadver.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe | 

"TCP Query User{D2ECDB50-0A0C-4C03-82ED-2F4F97550D54}C:\users\leena\desktop\utorrent.exe" = protocol=6 | dir=in | app=c:\users\leena\desktop\utorrent.exe | 

"UDP Query User{02E856C1-A98C-4A25-AD33-D1B7C7530D53}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 

"UDP Query User{1CB20E66-747E-42A9-89F7-620865465C45}C:\program files\sopcast\adv\sopadver.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe | 

"UDP Query User{49FEEE7A-9368-4267-A31C-A0E80B976F15}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe | 

"UDP Query User{5AFF48B7-C688-40C5-98D1-9472BBBCBF94}C:\program files\icq6\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6\icq.exe | 

"UDP Query User{8EEF283C-B961-43D5-A340-5D91F9202A6B}C:\program files\sopcast\sopcast.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\sopcast.exe | 

"UDP Query User{990DFE01-3B1E-4F9A-86BC-A3AA6B8F8597}C:\users\leena\desktop\utorrent.exe" = protocol=17 | dir=in | app=c:\users\leena\desktop\utorrent.exe | 

"UDP Query User{9F02AE2F-DC44-4994-910A-4CBD562F980C}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe | 

"UDP Query User{B94C4480-537A-481C-8985-D047CE4EF43B}C:\program files\icq6\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6\icq.exe | 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148

"{01B10898-0693-5E45-8C0B-CB4B0C2CB5C9}" = CCC Help Spanish

"{01E71682-7A62-31B6-2E19-82C4C2C410C3}" = CCC Help Korean

"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam

"{03D1988F-469F-4843-8E6E-E5FE9D17889D}" = HP Integrated Module with Bluetooth wireless technology 6.0.1.6200

"{05BB2EC5-6BEF-4DDC-9E75-BEE7B161157A}" = Macromedia Dreamweaver MX 2004

"{05F5ADF7-B9BF-E5AC-FDA4-C412C150763F}" = Catalyst Control Center Localization Greek

"{082702D5-5DD8-4600-BCE5-48B15174687F}" = HP Doc Viewer

"{0892BA56-B55A-EA45-74A7-C728BEFCEE4A}" = Catalyst Control Center Localization Norwegian

"{0A35B15C-9CCD-4C0C-BD5B-34ABF8C95813}_is1" = ICQ 6.5 Build #1042 Banner Remover 1.3

"{0A5825FD-0FB7-4e45-9037-858D463F2943}" = BPDSoftware

"{0BCE001B-D952-7242-1378-6B3188B7CDB6}" = Catalyst Control Center Localization Swedish

"{0CB9668D-F979-4F31-B8B8-67FE90F929F8}" = Bonjour

"{0F7C2E47-089E-4d23-B9F7-39BE00100776}" = Toolbox

"{111CE1DA-F2B6-B449-8BDC-BFA807EEF343}" = Catalyst Control Center Localization Thai

"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter

"{1550A772-F3DF-9DCA-70E4-5BA5FEDBDDEE}" = CCC Help Norwegian

"{18669FF9-C8FE-407a-9F70-E674896B1DB4}" = GPBaseService

"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate

"{190B4E60-FE37-4B8C-A661-172997347A90}" = Sony Media Manager 2.2

"{195F2C6C-A343-4b10-B1A4-3F00AB9E9DD9}" = Fax

"{1B835521-00CB-B242-2072-DA41AE7E9F11}" = CCC Help Turkish

"{1BDC9633-895B-4842-BCB6-8FA1EC2A3C5A}" = Adobe Shockwave Player

"{1CDFA6DE-FD15-4821-AB48-2832D6FA1031}" = Nero 7 Premium

"{1F7F3E8C-956E-445C-BECE-4947D164A0BF}" = Sony Vegas 7.0

"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite

"{228C6B46-64E2-404E-898A-EF0830603EF4}" = HPNetworkAssistant

"{246771C5-5589-C809-90A3-95D380CAEB0C}" = CCC Help Dutch

"{254C37AA-6B72-4300-84F6-98A82419187E}" = Hewlett-Packard Active Check for Health Check

"{26604C7E-A313-4D12-867F-7C6E7820BE4C}" = JMicron JMB38X Flash Media Controller

"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 17

"{279DB581-239C-4E13-97F8-0F48E40BE75C}" = Windows Live Messenger

"{2951A232-69BA-4925-BB9A-CEEB72B18B4F}" = BPDSoftware_Ini

"{2ACA4FB1-A1DB-BACF-05D8-9F654ED1F6F9}" = CCC Help Danish

"{30DAA715-5032-40F9-A0AE-95C9AEBB3E3F}" = HP QuickTouch 1.00 D2

"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java(TM) 6 Update 5

"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7

"{335901DF-7FC7-76E9-AEFB-3BD15D5C1B8E}" = Catalyst Control Center Localization German

"{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons 6.40 D3

"{36FDBE6E-6684-462b-AE98-9A39A1B200CC}" = HPProductAssistant

"{37F36B08-76D1-58D0-0B62-C873B3F1E04A}" = Catalyst Control Center Graphics Full Existing

"{398E8625-6F3A-4C54-B54C-28F0ABB89774}" = BPD_HPSU

"{39D0E034-1042-4905-BECB-5502909FCB7C}" = Microsoft Works

"{3AC54383-31D1-4907-961B-B12CBB1D0AE8}" = MobileMe Control Panel

"{3D9892BB-A751-4E48-ADC8-E4289956CE1D}" = QuickTime

"{3FA93E4C-CB3B-4B25-B091-9DB0FCC56A74}" = Catalyst Control Center - Branding

"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker

"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go

"{415B2719-AD3A-4944-B404-C472DB6085B3}" = Cisco EAP-FAST Module

"{43519E32-0AC9-ACBF-0AC9-000CEDEBCAFB}" = CCC Help Russian

"{440EE84D-A37A-E283-D538-0A4E94AC6243}" = Catalyst Control Center Localization Dutch

"{456B2B42-C082-8B6F-923C-2C8920ECF559}" = Catalyst Control Center Localization Czech

"{45D707E9-F3C4-11D9-A373-0050BAE317E1}" = HP QuickPlay 3.7

"{48382386-BA53-3B91-668C-DE3F4969C00C}" = ccc-core-static

"{49521D72-2856-C7B9-F54E-26B116606B0D}" = Catalyst Control Center Localization Hungarian

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{50C5DCCD-C82F-3D45-AAC8-1E094717FF9B}" = CCC Help Czech

"{5109C064-813E-4e87-B0DE-C8AF7B5BC02B}" = SmartWebPrintingOC

"{51E5C397-0AA0-48DD-9CB6-7259AFFDFB0A}" = HP Easy Setup - Frontend

"{52A69E11-7CEB-4a7d-9607-68BA4F39A89B}" = DeviceDiscovery

"{54F98E59-AC27-F6D6-8DF3-29E38BB1AFF9}" = Catalyst Control Center Localization Korean

"{572F2A62-70CD-4429-8758-6D4D6DC696E1}" = 4500_Help

"{57921C23-454B-1B45-6C32-B1A8BFC76875}" = Catalyst Control Center Localization French

"{582287DA-0806-4AC0-BF19-C15E3A466034}" = LightScribe System Software  1.12.33.2

"{582D2A53-F426-4C5E-A2E6-43C1AB36B907}" = Safari

"{5943B7F7-678B-477E-9AEE-6E4C6962322B}" = Sparwelt.de Gutschein Alarm

"{5ACE69F0-A3E8-44eb-88C1-0A841E700180}" = TrayApp

"{5BB4D7C1-52F2-4BFD-9E40-0D419E2E3021}" = bpd_scan

"{5C9B4046-4B37-3595-7BAF-1FFF58F2BA88}" = Catalyst Control Center Core Implementation

"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053

"{60DE4033-9503-48D1-A483-7846BD217CA9}" = ICQ6.5

"{61C2601F-D1F4-6CC3-858B-80A54A1C1360}" = CCC Help Greek

"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites

"{6697D99E-E550-4498-B793-4A8DD8A1821F}" = ProductContext

"{669C7BD8-DAA2-49B6-966C-F1E2AAE6B17E}" = Cisco PEAP Module

"{669D4A35-146B-4314-89F1-1AC3D7B88367}" = Hewlett-Packard Asset Agent for Health Check

"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder

"{679EC478-3FF9-4987-B2FF-C2C2B27532A2}" = DocProc

"{687FEF8A-8597-40b4-832C-297EA3F35817}" = BufferChm

"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update

"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin

"{6E25BE3B-8E16-3A78-2BA7-1482A2D4743F}" = CCC Help English

"{6F26A541-E756-4C24-A36B-EFD3C6217EAF}" = CCC Help German

"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder

"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable

"{7491471D-DA69-6E11-623D-F3BCAF65F922}" = CCC Help Italian

"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

"{789EC9D6-5A0D-3CCA-957D-D0523BDE1638}" = ATI Catalyst Install Manager

"{7AB3A249-FB81-416B-917A-A2A10E74C503}" = iTunes

"{7B3F0113-E63C-4D6D-AF19-111A3165CCA2}" = Text-To-Speech-Runtime

"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec

"{7F82D79D-81EF-DC6C-69FF-A45C282B1986}" = CCC Help Swedish

"{80533B67-C407-485D-8B5D-63BB8ED9D878}" = Scan

"{81ACE059-6894-21DE-E3AB-E8D6AF38B5C4}" = Catalyst Control Center Localization Portuguese

"{83770D14-21B9-44B3-8689-F7B523F94560}" = Cisco LEAP Module

"{8572742E-08EA-FCEF-458A-4CE90851E804}" = Catalyst Control Center Localization Russian

"{85991ED2-010C-4930-96FA-52F43C2CE98A}" = Apple Mobile Device Support

"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder

"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169, 8168, 8101E and 8102E Ethernet Network Card Driver for Windows Vista

"{8AB6D950-AF93-4FBB-9599-A7F09BD1EE6E}" = Music-DVD on CD and DVD

"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player

"{8D8ABD26-50FA-2D1B-2B3D-72DEF1E800D0}" = ccc-utility

"{8F0CFF10-034C-EE7E-3B2D-8C7F117BB3A6}" = Catalyst Control Center Localization Finnish

"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003

"{9075DF27-7C34-D2D5-4E66-970E0E99E320}" = Catalyst Control Center Graphics Light

"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)

"{9858B284-0ACC-3EB1-BBF7-B0D1A5D0C2FD}" = CCC Help Japanese

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9A85A260-CC99-8DA9-0D03-60C12BE82189}" = CCC Help Polish

"{9D6C29FF-850B-9425-7B34-B21526874121}" = Catalyst Control Center Graphics Previews Vista

"{9E2CCD5E-1990-4EF2-9B61-32F0BBACC29B}" = HP Active Support Library

"{9EBF6795-816C-06EB-BF29-06317FD5A730}" = Catalyst Control Center Localization Chinese Standard

"{9F2D3FB4-895E-A9F2-5B3A-118EDCE4E409}" = CCC Help Chinese Traditional

"{A0B9F8DF-C949-45ed-9808-7DC5C0C19C81}" = Status

"{A2F6EEA0-DBCD-2389-BA8D-9A16DB60FAD8}" = Catalyst Control Center Graphics Full New

"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable

"{A5AB9D5E-52E2-440e-A3ED-9512E253C81A}" = SolutionCenter

"{A5CE7175-080D-49AC-B5A3-E7E3502428F5}" = HP Wireless Assistant

"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder

"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter

"{AB5737DB-03C3-1526-F31E-D45A588D8459}" = Catalyst Control Center Localization Japanese

"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder

"{AC76BA86-7AD7-1031-7B44-A81200000003}" = Adobe Reader 8.1.2 - Deutsch

"{ADBFC909-D682-10E2-43C6-790F25FA3296}" = CCC Help Finnish

"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder

"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter

"{B16DA0F8-26BC-4FFC-9363-1D9F3E6C3E21}" = HP Customer Experience Enhancements

"{B2D328BE-45AD-4D92-96F9-2151490A203E}" = Apple Application Support

"{B5DA1D7B-9494-A847-F185-EE4B8C48D905}" = CCC Help Hungarian

"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player

"{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = PowerProducer

"{B8169E45-8E23-430B-91D1-EC64540C8ED0}" = HP User Guides 0103

"{B8DBED1E-8BC3-4d08-B94A-F9D7D88E9BBF}" = HPSSupply

"{BD2CC796-A584-9399-098A-2C2F291ABD1A}" = Catalyst Control Center Localization Spanish

"{C05A2E05-73A2-2672-7B82-59F3932AF6AD}" = CCC Help Thai

"{C1C9D5E7-761D-817F-DBF2-1E77E20121BB}" = CCC Help Portuguese

"{C39B346D-1E0D-CB23-CAC5-78CD5CBB495A}" = Catalyst Control Center Localization Italian

"{C3A32068-8AB1-4327-BB16-BED9C6219DC7}" = Atheros Driver Installation Program

"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint

"{C5E794F3-2EAC-CA94-79ED-1E3E3267F40B}" = CCC Help Chinese Standard

"{C69405BB-27AF-4940-B3DA-04910B4DFD23}_is1" = aTube Catcher 1.0

"{C7340571-7773-4A8C-9EBC-4E4243B38C76}" = Microsoft XML Parser

"{C8FD5BC1-92EF-4C15-92A9-F9AC7F61985F}" = HP Update

"{C9690E1F-06A0-559B-37D2-B573DA95CA54}" = Catalyst Control Center Localization Danish

"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector

"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1

"{CB71A20E-B1B4-4562-81FA-33E1DBD0342F}" = ProtectSmart Hard Drive Protection

"{CCB9B81A-167F-4832-B305-D2A0430840B3}" = WebReg

"{CD0773D5-C18E-495c-B39B-21A96415EDD5}" = HP Officejet J4500 Series

"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1

"{CF217146-C889-3CB8-1490-07DA0DDB1318}" = CCC Help French

"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2

"{D142FE39-3386-4d82-9AD3-36D4A92AC3C2}" = DocMgr

"{D2E0F0CC-6BE0-490b-B08B-9267083E34C9}" = MarketResearch

"{D68147A7-E42F-DA4B-209A-38CCC53702EC}" = Catalyst Control Center Localization Chinese Traditional

"{D99A8E3A-AE5A-4692-8B19-6F16D454E240}" = Destination Component

"{E09B48B5-E141-427A-AB0C-D3605127224A}" = Microsoft SQL Server Desktop Engine (SONY_MEDIAMGR)

"{E333CA5F-00ED-4EEF-90E5-6A33A8FE969F}" = HP Help and Support

"{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}" = IDT Audio

"{E728E952-DD4F-4BCD-A5C8-40FBFEFF91FE}" = OpenOffice.org Installer 1.0

"{EDE721EC-870A-11D8-9D75-000129760D75}" = PowerDirector Express

"{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}" = 32 Bit HP CIO Components Installer

"{f32502b5-5b64-4882-bf61-77f23edcac4f}" = HP Total Care Advisor

"{F7D7E6EA-2B25-ABB1-0F4A-F39764C2D15B}" = Skins

"{FAF0230B-8A11-8052-AFC9-5DB998020FD5}" = Catalyst Control Center Localization Polish

"{FC7C3B82-C7CB-125A-23FE-EE268799F5E3}" = Catalyst Control Center Localization Turkish

"{FDEC11CC-4BD6-4a8c-A398-3CCD8E43EACA}" = J4500

"Acoustica Effects Pack" = Acoustica Effects Pack

"Acoustica Mixcraft 5" = Acoustica Mixcraft 5

"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites

"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin

"Adobe Photoshop 7.0" = Adobe Photoshop 7.0

"Adobe Type Manager 4.0" = Adobe Type Manager 4.0

"ALDI Foto Service D" = ALDI Foto Service

"aTube Catcher" = aTube Catcher

"Audiograbber" = Audiograbber 1.83 SE 

"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus

"CD goes MP3 v3.5 Essential3.5" = CD goes MP3 v3.5 Essential

"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters

"DVD Shrink DE_is1" = DVD Shrink 3.2 deutsch

"DVDVideoSoft Toolbar" = DVDVideoSoft Toolbar

"DVDVideoSoftTB Toolbar" = DVDVideoSoftTB Toolbar

"Firebird SQL Server D" = Firebird SQL Server - MAGIX Edition

"FMCODEC" = FM Screen Capture Codec (Remove Only)

"Free Video to iPhone Converter_is1" = Free Video to iPhone Converter version 2.3

"Free Video to iPod Converter_is1" = Free Video to iPod Converter version 3.4

"Free YouTube Download_is1" = Free YouTube Download 2.3

"Free YouTube to iPod Converter_is1" = Free YouTube to iPod Converter version 3.3

"Free YouTube to Mp3 Converter_is1" = Free YouTube to Mp3 Converter version 3.1

"GreenBox_is1" = GreenBox 1.0

"HP Document Manager" = HP Document Manager 1.0

"HP Imaging Device Functions" = HP Imaging Device Functions 10.0

"HP Smart Web Printing" = HP Smart Web Printing

"HP Solution Center & Imaging Support Tools" = HP Solution Center 10.0

"HPExtendedCapabilities" = HP Customer Participation Program 10.0

"HPOCR" = OCR Software by I.R.I.S. 10.0

"ICQToolbar" = ICQ Toolbar

"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam

"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector

"MAGIX 3D Maker D" = MAGIX 3D Maker (embeded)

"MAGIX Foto Manager 2007 D" = MAGIX Foto Manager 2007 4.2.0.42 (D)

"MAGIX Foto Manager 8 D" = MAGIX Foto Manager 8 6.0.1.457 (D)

"MAGIX Fotobuch" = MAGIX Fotobuch 3.6

"MAGIX Fotos auf CD & DVD 6.5 D" = MAGIX Fotos auf CD & DVD 6.5 6.5.1.5 (D)

"MAGIX Music Maker Hip Hop Edition 2 D" = MAGIX Music Maker Hip Hop Edition 2 4.0.0.10 (D)

"MAGIX Music Maker Techno Edition 2 D" = MAGIX Music Maker Techno Edition 2 4.0.0.10 (D)

"MAGIX Music Manager 2007 D" = MAGIX Music Manager 2007 8.2.0.54 (D)

"MAGIX Online Druck Service D" = MAGIX Online Druck Service 2.3.2.0 (D)

"MAGIX PC Visit D" = MAGIX PC Visit

"MAGIX Screenshare D" = MAGIX Screenshare

"MAGIX Speed burnR D" = MAGIX Speed burnR

"MAGIX Xtreme Foto Designer 6 D" = MAGIX Xtreme Foto Designer 6 6.0.27.0 (D)

"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware

"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1

"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1

"Mozilla Firefox (3.0.19)" = Mozilla Firefox (3.0.19)

"myMP3 4.0" = myMP3 4.0

"RealPlayer 6.0" = RealPlayer

"Shop for HP Supplies" = Shop for HP Supplies

"SlingMedia.QPSlingPlayer_is1" = QuickPlay SlingPlayer 0.4.6

"SopCast" = SopCast 3.2.4

"SynTPDeinstKey" = Synaptics Pointing Device Driver

"TKKG12" = TKKG12

"Uninstall_is1" = Uninstall 1.0.0.1

"ViewpointMediaPlayer" = Viewpoint Media Player

"Virtual DJ Home Edition - Atomix Productions" = Virtual DJ Home Edition - Atomix Productions

"VLC media player" = VLC media player 1.0.3

"WildTangent hp Master Uninstall" = My HP Games

"Winamp" = Winamp

"Winamp Toolbar for Firefox" = Winamp Toolbar for Firefox

"Winload Toolbar" = Winload Toolbar

"WinPcapInst" = WinPcap 4.1.1

"WinRAR archiver" = WinRAR

"WMV9_VCM" = Microsoft Windows Media Video 9 VCM

 
 ========== HKEY_USERS Uninstall List ==========

 

[HKEY_USERS\S-1-5-21-2001224967-2248691082-3800531272-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"RadioRipper" = RadioRipper 1.1d BETA5

 
 ========== Last 10 Event Log Errors ==========

 

[ Application Events ]

Error - 15.11.2009 01:04:10 | Computer Name = Leena-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 15.11.2009 06:39:49 | Computer Name = Leena-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 16.11.2009 16:03:51 | Computer Name = Leena-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 16.11.2009 20:25:57 | Computer Name = Leena-PC | Source = Application Hang | ID = 1002

Description = Programm firefox.exe, Version 1.9.0.3576 arbeitet nicht mehr mit Windows

 zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen

 für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem

 zu suchen.  Prozess-ID: 664  Anfangszeit: 01ca67155d97cdab  Zeitpunkt der Beendigung:

 108

 

Error - 19.11.2009 08:47:12 | Computer Name = Leena-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 20.11.2009 03:51:59 | Computer Name = Leena-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 20.11.2009 07:22:48 | Computer Name = Leena-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 20.11.2009 08:53:15 | Computer Name = Leena-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 21.11.2009 10:24:07 | Computer Name = Leena-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 22.11.2009 04:52:31 | Computer Name = Leena-PC | Source = WinMgmt | ID = 10

Description = 

 

[ System Events ]

Error - 01.11.2010 23:04:16 | Computer Name = Leena-PC | Source = VDS Dynamic Provider | ID = 16908298

Description = 

 

Error - 02.11.2010 04:36:07 | Computer Name = Leena-PC | Source = Service Control Manager | ID = 7043

Description = 

 

Error - 02.11.2010 04:38:13 | Computer Name = Leena-PC | Source = HTTP | ID = 15016

Description = 

 

Error - 02.11.2010 04:38:39 | Computer Name = Leena-PC | Source = Service Control Manager | ID = 7000

Description = 

 

Error - 02.11.2010 04:39:47 | Computer Name = Leena-PC | Source = Service Control Manager | ID = 7022

Description = 

 

Error - 02.11.2010 04:53:42 | Computer Name = Leena-PC | Source = Service Control Manager | ID = 7032

Description = 

 

Error - 02.11.2010 04:53:42 | Computer Name = Leena-PC | Source = Service Control Manager | ID = 7032

Description = 

 

Error - 02.11.2010 05:47:08 | Computer Name = Leena-PC | Source = VDS Dynamic Provider | ID = 16908298

Description = 

 

Error - 02.11.2010 06:15:25 | Computer Name = Leena-PC | Source = Service Control Manager | ID = 7032

Description = 

 

Error - 02.11.2010 07:11:24 | Computer Name = Leena-PC | Source = VDS Dynamic Provider | ID = 16908298

Description = 

 

 

< End of report >

--- --- ---

• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.

:OTL
PRC - C:\Users\Leena\AppData\Local\Temp\dgmlk.exe ()
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - No CLSID value found
O4 - HKU\S-1-5-21-2001224967-2248691082-3800531272-1000..\Run: [cbssreg] C:\Users\Leena\AppData\Local\Temp\dgmlk.exe ()
O4 - HKU\S-1-5-21-2001224967-2248691082-3800531272-1000..\Run: [iihihhaudio] c:\users\leena\appdata\local\temp\yabbax.DLL (foobar2000.org)
O4 - HKU\S-1-5-21-2001224967-2248691082-3800531272-1000..\Run: [urspnksys] c:\users\leena\appdata\local\temp\efcawu.DLL (foobar2000.org)
O20 - HKU\S-1-5-21-2001224967-2248691082-3800531272-1000 Winlogon: Shell - (C:\Users\Leena\AppData\Roaming\hotfix.exe) - C:\Users\Leena\AppData\Roaming\hotfix.exe
()
[2010.11.01 22:48:04 | 000,000,000 | -H-D | C] -- C:\Users\Public\Documents\Server
[2010.11.01 22:48:12 | 000,000,000 | -H-D | C] -- C:\Users\Public\Documents\Windows
[2010.11.02 00:51:37 | 000,000,194 | ---- | M] () -- C:\Users\Leena\AppData\Roaming\dkfjasdfshd.bat
[2010.11.02 00:51:36 | 000,572,416 | ---- | M] () -- C:\Users\Leena\AppData\Roaming\hotfix.exe
:FILES
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument dieses posten

öffne "mein computer" c: dort _OTL rechtsklick auf moved files. wähle zu movedfiles.rar oder zip hinzufügen.
archiv zu uns hochladen.
http://www.trojaner-board.de/54791-a...ner-board.html

All processes killed
========== OTL ==========
No active process named dgmlk.exe was found!
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7E853D72-626A-48EC-A868-BA8D5E23E045}\ not found.
Registry value HKEY_USERS\S-1-5-21-2001224967-2248691082-3800531272-1000\Software\Microsoft\Windows\CurrentVersion\Run\\cbssreg deleted successfully.
C:\Users\Leena\AppData\Local\Temp\dgmlk.exe moved successfully.
Registry value HKEY_USERS\S-1-5-21-2001224967-2248691082-3800531272-1000\Software\Microsoft\Windows\CurrentVersion\Run\\iihihhaudio deleted successfully.
c:\users\leena\appdata\local\temp\yabbax.DLL moved successfully.
Registry value HKEY_USERS\S-1-5-21-2001224967-2248691082-3800531272-1000\Software\Microsoft\Windows\CurrentVersion\Run\\urspnksys deleted successfully.
c:\users\leena\appdata\local\temp\efcawu.DLL moved successfully.
Registry value HKEY_USERS\S-1-5-21-2001224967-2248691082-3800531272-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:C:\Users\Leena\AppData\Roaming\hotfix.exe deleted successfully.
C:\Users\Leena\AppData\Roaming\hotfix.exe moved successfully.
C:\Users\Public\Documents\Server folder moved successfully.
C:\Users\Public\Documents\Windows folder moved successfully.
C:\Users\Leena\AppData\Roaming\dkfjasdfshd.bat moved successfully.
File C:\Users\Leena\AppData\Roaming\hotfix.exe not found.
========== FILES ==========
========== COMMANDS ==========

[EMPTYFLASH]

User: All Users

User: Default

User: Default User

User: Leena
->Flash cache emptied: 157557 bytes

User: Public

Total Flash Files Cleaned = 0,00 mb

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Leena
->Temp folder emptied: 14894993954 bytes
->Temporary Internet Files folder emptied: 99692322 bytes
->Java cache emptied: 90429968 bytes
->FireFox cache emptied: 48657341 bytes
->Apple Safari cache emptied: 367616 bytes
->Flash cache emptied: 0 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 1386496 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 378397227 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 1890441 bytes
%systemroot%\system32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 25500382 bytes
RecycleBin emptied: 3777862236 bytes

Total Files Cleaned = 18.424,00 mb

OTL by OldTimer - Version 3.2.17.2 log created on 11022010_123504

Files\Folders moved on Reboot...
C:\Users\Leena\AppData\Local\Temp\ehmsas.txt moved successfully.
File\Folder C:\Windows\temp\hsperfdata_LEENA-PC$\4992 not found!
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8OEL51QA\allemarken[1].htm moved successfully.

Registry entries deleted on Reboot...

18 gb temp files, na da hast ja jetzt ordendlich speicher gewonnen.
wir haben nachher aber noch einiges zu updaten, dein pc weist ne menge sicherheitslücken auf.
bitte erstelle und poste ein combofix log.
Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Combofix Logfile:

Code:

ComboFix 10-11-01.05 - Leena 02.11.2010  13:01:07.1.2 - x86

Microsoft® Windows Vista™ Home Premium   6.0.6001.1.1252.49.1031.18.3069.1765 [GMT 1:00]

ausgeführt von:: c:\users\Leena\Downloads\ComboFix.exe

.
 

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.
 

c:\programdata\VCREDI~3.EXE

c:\users\Leena\AppData\Local\Temp\efcawu.dll

c:\users\Leena\AppData\Local\Temp\yabbax.dll

c:\users\Leena\AppData\Roaming\completescan

c:\users\Leena\AppData\Roaming\install

c:\users\Leena\AppData\Roaming\Microsoft\Windows\Templates\memory.tmp

c:\users\Public\Documents\Server\admin.txt

c:\users\Public\Documents\Server\server.dat

c:\windows\pi.exe

c:\windows\system32\vbzlib1.dll
 

.

(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))

.
 

-------\Service_usnjsvc
 
 

(((((((((((((((((((((((   Dateien erstellt von 2010-10-02 bis 2010-11-02  ))))))))))))))))))))))))))))))

.
 

2010-11-02 12:11 . 2010-11-02 12:11        --------        d-----w-        c:\users\Default\AppData\Local\temp

2010-11-02 11:35 . 2010-11-02 11:48        --------        d-----w-        C:\_OTL

2010-11-02 11:09 . 2010-11-02 11:09        55296        ---ha-w-        c:\windows\system32\ciphlder.dll

2010-11-02 11:09 . 2010-11-02 11:09        --------        d-----w-        c:\windows\Sun

2010-11-02 08:47 . 2010-11-02 08:47        --------        d-----w-        c:\users\Leena\AppData\Roaming\Malwarebytes

2010-11-02 08:47 . 2010-04-29 11:19        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys

2010-11-02 08:47 . 2010-11-02 08:47        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

2010-11-02 08:47 . 2010-11-02 08:47        --------        d-----w-        c:\programdata\Malwarebytes

2010-11-02 08:47 . 2010-04-29 11:19        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys

2010-11-01 08:56 . 2010-11-01 08:56        --------        d-----w-        c:\programdata\McAfee

2010-10-29 17:14 . 2010-10-07 23:21        6146896        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{02C53A9F-8B15-486B-800F-F48D1C37DC73}\mpengine.dll

2010-10-13 23:18 . 2010-09-10 16:35        168960        ----a-w-        c:\program files\Windows Media Player\wmplayer.exe

2010-10-13 23:18 . 2010-09-10 16:37        8147456        ----a-w-        c:\windows\system32\wmploc.DLL
 

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-10-19 09:41 . 2009-10-03 08:16        222080        ------w-        c:\windows\system32\MpSigStub.exe

2010-08-17 13:32 . 2010-09-15 09:17        126464        ----a-w-        c:\windows\system32\spoolsv.exe

2009-09-25 16:41 . 2009-09-25 16:41        1044480        ----a-w-        c:\program files\mozilla firefox\plugins\libdivx.dll

2009-09-25 16:41 . 2009-09-25 16:41        200704        ----a-w-        c:\program files\mozilla firefox\plugins\ssldivx.dll

.
 

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4
 

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}"= "c:\program files\DVDVideoSoft\tbDVDV.dll" [2010-03-09 2355224]

"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files\DVDVideoSoftTB\tbDVDV.dll" [2010-03-25 2355296]

"{40c3cc16-7269-4b32-9531-17f2950fb06f}"= "c:\program files\Winload\tbWinl.dll" [2010-03-17 2355224]
 

[HKEY_CLASSES_ROOT\clsid\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}]
 

[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
 

[HKEY_CLASSES_ROOT\clsid\{40c3cc16-7269-4b32-9531-17f2950fb06f}]
 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{40c3cc16-7269-4b32-9531-17f2950fb06f}]

2010-03-17 13:45        2355224        ----a-w-        c:\program files\Winload\tbWinl.dll
 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]

2010-03-25 11:31        2355296        ----a-w-        c:\program files\DVDVideoSoftTB\tbDVDV.dll
 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}]

2010-03-09 09:06        2355224        ----a-w-        c:\program files\DVDVideoSoft\tbDVDV.dll
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}"= "c:\program files\DVDVideoSoft\tbDVDV.dll" [2010-03-09 2355224]

"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files\DVDVideoSoftTB\tbDVDV.dll" [2010-03-25 2355296]

"{40c3cc16-7269-4b32-9531-17f2950fb06f}"= "c:\program files\Winload\tbWinl.dll" [2010-03-17 2355224]
 

[HKEY_CLASSES_ROOT\clsid\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}]
 

[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
 

[HKEY_CLASSES_ROOT\clsid\{40c3cc16-7269-4b32-9531-17f2950fb06f}]
 

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{40C3CC16-7269-4B32-9531-17F2950FB06F}"= "c:\program files\Winload\tbWinl.dll" [2010-03-17 2355224]

"{872B5B88-9DB5-4310-BDD0-AC189557E5F5}"= "c:\program files\DVDVideoSoftTB\tbDVDV.dll" [2010-03-25 2355296]

"{E9911EC6-1BCC-40B0-9993-E0EEA7F6953F}"= "c:\program files\DVDVideoSoft\tbDVDV.dll" [2010-03-09 2355224]
 

[HKEY_CLASSES_ROOT\clsid\{40c3cc16-7269-4b32-9531-17f2950fb06f}]
 

[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
 

[HKEY_CLASSES_ROOT\clsid\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}]
 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]

"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-02-26 2289664]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]

"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-06-16 221184]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-01-18 1033512]

"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2008-04-15 442433]

"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2007-12-24 222504]

"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2008-05-14 468264]

"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]

"QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-03-14 202032]

"OnScreenDisplay"="c:\program files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe" [2007-11-01 554288]

"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-04-15 70912]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-14 49152]

"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-11-20 488752]

"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]

"WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-08-03 36352]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]

"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]

"Realtime Audio Engine"="mmrtkrnl.exe" [2008-12-02 70144]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-18 421888]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-06-15 141624]

"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-06-16 81920]
 

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-7-18 110592]

BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-1-16 727592]

Dienst-Manager.lnk - c:\program files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2002-12-17 74308]
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

"HideFastUserSwitching"= 0 (0x0)
 

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{93f261fc-7dce-4268-9edb-4c94f8afb899}"= "mscoree.dll" [2009-11-08 297808]
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"mixer3"=wdmaud.drv
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

@="Service"
 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001
 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001
 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001
 

R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\MAGIX\Common\Database\bin\fbserver.exe [2005-11-17 1527900]

R3 UPnPService;UPnPService;c:\program files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe [2006-12-14 544768]

S1 ATMhelpr;ATMhelpr; [x]

S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_9a642328\aestsrv.exe [2008-02-12 73728]

S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]

S2 ezSharedSvc;Easybits Shared Services for Windows;c:\windows\system32\svchost.exe [2008-01-21 21504]

S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [2008-03-18 19456]

S2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [2009-06-01 222968]

S2 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2009-11-16 50704]

S2 Recovery Service for Windows;Recovery Service for Windows;c:\windows\SMINST\BLService.exe [2008-03-26 341328]

S3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2008-04-03 193840]

S3 enecir;ENE CIR Receiver;c:\windows\system32\DRIVERS\enecir.sys [2008-01-24 52736]

S3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [2008-04-11 84240]
 
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

bthsvcs        REG_MULTI_SZ           BthServ

HPZ12        REG_MULTI_SZ           Pml Driver HPZ12 Net Driver HPZ12

hpdevmgmt        REG_MULTI_SZ           hpqcxs08 hpqddsvc
 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs

ezSharedSvc
 

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

2008-02-26 12:06        451872        ----a-w-        c:\program files\Common Files\LightScribe\LSRunOnce.exe

.

Inhalt des "geplante Tasks" Ordners
 

2010-11-01 c:\windows\Tasks\User_Feed_Synchronization-{BB7779DA-C7FE-4FF3-A991-4726E13E476B}.job

- c:\windows\system32\msfeedssync.exe [2008-01-21 02:24]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2319825

mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=83&bd=Pavilion&pf=cnnb

uInternet Settings,ProxyOverride = *.local

IE: Bild an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

IE: Seite an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

FF - ProfilePath - c:\users\Leena\AppData\Roaming\Mozilla\Firefox\Profiles\j7g0ittv.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2319825&SearchSource=3&q={searchTerms}

FF - prefs.js: browser.startup.homepage - hxxp://www.t-online.de/

FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2319825&q=

FF - component: c:\users\Leena\AppData\Roaming\Mozilla\Firefox\Profiles\j7g0ittv.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\components\FFExternalAlert.dll

FF - component: c:\users\Leena\AppData\Roaming\Mozilla\Firefox\Profiles\j7g0ittv.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\components\RadioWMPCore.dll

FF - component: c:\users\Leena\AppData\Roaming\Mozilla\Firefox\Profiles\j7g0ittv.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\components\FFExternalAlert.dll

FF - component: c:\users\Leena\AppData\Roaming\Mozilla\Firefox\Profiles\j7g0ittv.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\components\RadioWMPCore.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll

FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

.
 

**************************************************************************
 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2010-11-02 13:17

Windows 6.0.6001 Service Pack 1 NTFS
 

Scanne versteckte Prozesse... 
 

Scanne versteckte Autostarteinträge... 
 

Scanne versteckte Dateien... 
 

Scan erfolgreich abgeschlossen

versteckte Dateien: 0
 

**************************************************************************
 

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.1 by Gmer, hxxp://www.gmer.net

Windows 6.0.6001 Disk: WDC_WD2500BEVS-60UST0 rev.01.01A01 -> \Device\Ide\IdeDeviceP1T0L0-1
 

device: opened successfully

user: MBR read successfully

called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys hpdskflt.sys hal.dll >>UNKNOWN [0x86D65446]<< 

_asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x86d6b504]; MOV EAX, [0x86d6b580]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX;  }

1 ntkrnlpa!IofCallDriver[0x822C605F] -> \Device\Harddisk0\DR0[0x86085030]

3 CLASSPNP[0x807A8745] -> ntkrnlpa!IofCallDriver[0x822C605F] -> [0x860783A0]

5 hpdskflt[0x8B5E7F05] -> ntkrnlpa!IofCallDriver[0x822C605F] -> [0x8604CBA0]

\Driver\atapi[0x86D55F38] -> IRP_MJ_CREATE -> 0x86D65446

kernel: MBR read successfully

_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [BP+0x0], CH; JL 0x2e; JNZ 0x3a;  }

detected hooks:

\Driver\atapi DriverStartIo -> 0x86D65292

user != kernel MBR !!! 

Warning: possible TDL4 rootkit infection !

TDL4 rootkit infection detected ! Use: "mbr.exe -f" to fix.
 

Filesystem trace:

called modules: ntkrnlpa.exe hal.dll fltmgr.sys avgntflt.sys luafv.sys fileinfo.sys Ntfs.sys 

1 ntkrnlpa!IofCallDriver[0x822C605F] -> [0x86090690]

3 fltmgr[0x8AD6CBA1] -> ntkrnlpa!IofCallDriver[0x822C605F] -> [0x86DB1020]

5 ntkrnlpa[0x82456712] -> ntkrnlpa!IofCallDriver[0x822C605F] -> [0x86090690]

7 fltmgr[0x8AD6CBA1] -> ntkrnlpa!IofCallDriver[0x822C605F] -> [0x86DB1020]
 

Registry trace:

called modules: ntkrnlpa.exe hal.dll avipbb.sys 
 

**************************************************************************

.

--------------------- Gesperrte Registrierungsschluessel ---------------------
 

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
 

- - - - - - - > 'Explorer.exe'(3744)

c:\windows\system32\btmmhook.dll

c:\program files\Common Files\Ahead\Lib\NeroSearchBar.dll

c:\program files\Common Files\Ahead\Lib\MFC71U.DLL

c:\program files\Common Files\Ahead\Lib\BCGCBPRO800u.dll

c:\windows\system32\btncopy.dll

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\windows\system32\Ati2evxx.exe

c:\windows\System32\DriverStore\FileRepository\stwrt.inf_9a642328\STacSV.exe

c:\windows\system32\Ati2evxx.exe

c:\windows\system32\WLANExt.exe

c:\program files\Avira\AntiVir Desktop\avguard.exe

c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe

c:\program files\Common Files\LightScribe\LSSrvc.exe

c:\program files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe

c:\program files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe

c:\program files\HP\QuickPlay\Kernel\TV\QPSched.exe

c:\program files\CyberLink\Shared Files\RichVideo.exe

c:\windows\system32\conime.exe

c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

c:\program files\Windows Media Player\wmpnscfg.exe

c:\windows\System32\mmrtkrnl.exe

c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe

c:\program files\Windows Media Player\wmpnetwk.exe

c:\windows\ehome\ehmsas.exe

c:\program files\Hewlett-Packard\Shared\HpqToaster.exe

c:\program files\Hewlett-Packard\HP Health Check\hphc_service.exe

c:\program files\WIDCOMM\Bluetooth Software\BtStackServer.exe

c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

c:\program files\iPod\bin\iPodService.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2010-11-02  13:28:58 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2010-11-02 12:28
 

Vor Suchlauf: 14 Verzeichnis(se), 60.839.964.672 Bytes frei

Nach Suchlauf: 19 Verzeichnis(se), 60.022.214.656 Bytes frei
 

- - End Of File - - 6B0B5C2EAB6FFA355B65B1006B669107

--- --- ---

downloade mbr.exe direkt auf c:
http://www2.gmer.net/mbr/mbr.exe
es könnte eine fehlermeldung geben, dort auf "fortsetzen" klicken. dann gehe auf start, ausführen, schreibe
cmd.exe
drücke strg+shift (großschreibung) enter
bestätige die nachfrage.
tippe nun folgendes ein:
C:\mbr.exe -f
enter
dein pc wird evtl. neu starten. auf c: sollte sich ein mbr.log befinden, dessen inhalt posten.

wenn ich die datei öffne als adminstrator öffnet sich kurz ein feld das schwarz ist mit schrift und ist sofort wieder zu. etwas anderes passiert nicht.

du sollst nicht die datei öffnen.
du sollst die datei laden und dann auf start ausführen, dort cmd.exe
strg+schift+enter gleichzeitig drücken, nachfrage bestätigen und dann eingeben
C:\mbr.exe -f

und dann enter.
das programm arbeitet dann.

wenn ich auf start gehe habe ich kein ausführe. nur die normale ansicht meiner programme, ein suchfeld und rechts meine ordner und systemsteuerung

ja in das suchfeld eintippen.

wenni ch das getan habe öffnet sich ein fenster wie im alten dos modus und ich kann hinter c:\Users\Leena>
etwas eingeben. wenn ich dort mbr.exe -f eingebe soll ich das programm bestätigen, danach tut sich nichts neues mehr