Falsche Weiterleitung im Browser

O15 - Trusted Zone: *.antimalwareguard.com (HKLM)
O15 - Trusted Zone: *.gomyhit.com (HKLM)

Die 2 sachen bitte mit HJT fixen...
Dann mit dem Ccleaner alle Temp daten bereinigen und alle regit fehler beheben
Danach mit Malwarebytes nochmal einen schnell scan mcahen und log posten

...o.k., habe ich gemacht, Log ist hier:

Malwarebytes' Anti-Malware 1.41
Datenbank Version: 3174
Windows 5.1.2600 Service Pack 3

15.11.2009 15:34:10
mbam-log-2009-11-15 (15-34-10).txt

Scan-Methode: Quick-Scan
Durchsuchte Objekte: 113593
Laufzeit: 11 minute(s), 39 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)



Gruß
Beggo

Wie läuft der rechner jetzt ?

... muss erst mal ne weile testen, da die sonderbare Weiterleitung immer sporadisch auftrat.
ALLERDINGS kann ich jetzt die Systemwiederherstellung nicht mehr aktivieren (WTF), habe schon verschiedenes probiert.
Gruß
Beggo

... muss erst mal ne weile testen, da die sonderbare Weiterleitung immer sporadisch auftrat.
ALLERDINGS kann ich jetzt die Systemwiederherstellung nicht mehr aktivieren (WTF), habe schon verschiedenes probiert.
Gruß
Beggo

... die Registerkarte zum Aktivieren ist verschwunden.
Über Dienste starten, kommt die Fehlermeldung Nr.5 : Zugriff verweigert.
Habe die SWH sogar probiert neu zu installieren, aber keinen Erfolg gehabt.

LOG
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:20:12, on 16.11.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16876)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Avira\AntiVir Desktop\sched.exe
c:\programme\a-squared free\a2service.exe
C:\Programme\Avira\AntiVir Desktop\avguard.exe
C:\Programme\FRITZ!DSL\IGDCTRL.EXE
C:\Programme\avmwlanstick\WlanNetService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\TUProgSt.exe
C:\Programme\RealVNC\VNC4\WinVNC4.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\avmwlanstick\wlangui.exe
C:\Programme\Avira\AntiVir Desktop\avgnt.exe
C:\Programme\BOINC\boinctray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\BOINC\boinc.exe
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\BOINC\projects\setiathome.berkeley.edu\AK_v8_win_SSE_P3.exe
C:\Programme\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [AVMWlanClient] C:\Programme\avmwlanstick\wlangui.exe
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [boinctray] "C:\Programme\BOINC\boinctray.exe"
O4 - HKLM\..\Run: [boincmgr] "C:\Programme\BOINC\boincmgr.exe" /a /s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {15B782AF-55D8-11D1-B477-006097098764} (Macromedia Authorware Web Player Control) - http://learn.bbwonline.de/wd04bg/awlm/awswax.cab
O16 - DPF: {162247AF-26A7-44FC-A93A-69506EA244F3} (HWTest.HWTestControl) - http://maxdomeservice.1und1.de/de/systemcheck/HWTest.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1158865244230
O16 - DPF: {DF6504AC-3EFE-4287-B259-FB299B069C95} (WEBDE Fotoalbum Upload Control) - https://img.web.de/v/mail/activex/fa_os_mms/upload_1132.cab
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - c:\programme\a-squared free\a2service.exe
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe
O23 - Service: AVM IGD CTRL Service - AVM Berlin - C:\Programme\FRITZ!DSL\IGDCTRL.EXE
O23 - Service: AVM WLAN Connection Service - AVM Berlin - C:\Programme\avmwlanstick\WlanNetService.exe
O23 - Service: AVM FRITZ!web Routing Service (de_serv) - AVM Berlin - C:\Programme\Gemeinsame Dateien\AVM\de_serv.exe
O23 - Service: TuneUp Drive Defrag-Dienst (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Programme\RealVNC\VNC4\WinVNC4.exe

--
End of file - 5182 bytes


Gruß
Beggo

Alle Programme>Zubehör>Systemprogramme>Systemwiederherstellung

ist da garnichsmehr  ???




bis du als Admin eingeloggt ?

Kurz unter die Arme greif 

• Lade Random's System Information Tool (RSIT) herunter,
• speichere es auf Deinem Desktop.
• Starte mit Doppelklick die RSIT.exe.
• Klicke auf Continue, um die Nutzungsbedingungen zu akzeptieren.
• Der Scan startet automatisch, RSIT checkt nun einige wichtige System-Bereiche und produziert Logfiles als Analyse-Grundlage.
• Wenn der Scan beendet ist, werden zwei Logfiles erstellt und in Deinem Editor geöffnet.
• Bitte poste den Inhalt von C:\rsit\log.txt und C:\rsit\info.txt

• alle anderen Scanner gegen Viren, Spyware, usw. deaktiviert sein,
  
• keine Verbindung zu einem Netzwerk/Internet bestehen (WLAN nicht vergessen),
  
• nichts am Rechner getan werden,
  
• nach jedem Scan der Rechner neu gestartet werden.

• Gehe hierhin, scrolle runter und downloade RootRepeal.zip.
  
• Entpacke die Datei auf Deinen Desktop.
  
• Doppelklicke die RootRepeal.exe, um den Scanner zu starten.
  
• Klicke auf den Reiter Report und dann auf den Button Scan.
  
• Mache einen Haken bei den folgenden Elementen und klicke Ok.

• Im Anschluss wirst Du gefragt, welche Laufwerke gescannt werden sollen.
• Wähle C:\ und klicke wieder Ok.
• Der Suchlauf beginnt automatisch, es wird eine Weile dauern, bitte Geduld.
• Wenn der Suchlauf beendet ist, klicke auf Save Report.
  
• Speichere das Logfile als RootRepeal.txt auf dem Desktop.
  
• Kopiere den Inhalt hier in den Thread.

Hey,
ja bin als Admin angemeldet.
Nein da ist nix mehr, wenn ichs anklicke kommt die Meldung: Systemwiederherstellung kann nicht sichern, starten sie den Rechner neu. Habe schon vieles probiert.


@HJT-Larusso
ist ein Haufen Zeug:

Die Logs sind so lange, dass sie die maximale Länge übersteigen, splitte sie deshalb...



RSIT

Logfile of random's system information tool 1.06 (written by random/random)
Run by Admin at 2009-11-16 19:38:01
Microsoft Windows XP Professional Service Pack 3
System drive C: has 18 GB (46%) free of 39 GB
Total RAM: 511 MB (57% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:38:15, on 16.11.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16876)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Avira\AntiVir Desktop\sched.exe
c:\programme\a-squared free\a2service.exe
C:\Programme\Avira\AntiVir Desktop\avguard.exe
C:\Programme\FRITZ!DSL\IGDCTRL.EXE
C:\Programme\avmwlanstick\WlanNetService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\TUProgSt.exe
C:\Programme\RealVNC\VNC4\WinVNC4.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Avira\AntiVir Desktop\avgnt.exe
C:\Programme\BOINC\boinctray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\avmwlanstick\WLanGUI.exe
C:\Dokumente und Einstellungen\Admin\Desktop\RSIT.exe
C:\Programme\Trend Micro\HijackThis\Admin.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [AVMWlanClient] C:\Programme\avmwlanstick\wlangui.exe
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [boinctray] "C:\Programme\BOINC\boinctray.exe"
O4 - HKLM\..\Run: [boincmgr] "C:\Programme\BOINC\boincmgr.exe" /a /s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {15B782AF-55D8-11D1-B477-006097098764} (Macromedia Authorware Web Player Control) - http://learn.bbwonline.de/wd04bg/awlm/awswax.cab
O16 - DPF: {162247AF-26A7-44FC-A93A-69506EA244F3} (HWTest.HWTestControl) - http://maxdomeservice.1und1.de/de/systemcheck/HWTest.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1158865244230
O16 - DPF: {DF6504AC-3EFE-4287-B259-FB299B069C95} (WEBDE Fotoalbum Upload Control) - https://img.web.de/v/mail/activex/fa_os_mms/upload_1132.cab
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - c:\programme\a-squared free\a2service.exe
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe
O23 - Service: AVM IGD CTRL Service - AVM Berlin - C:\Programme\FRITZ!DSL\IGDCTRL.EXE
O23 - Service: AVM WLAN Connection Service - AVM Berlin - C:\Programme\avmwlanstick\WlanNetService.exe
O23 - Service: AVM FRITZ!web Routing Service (de_serv) - AVM Berlin - C:\Programme\Gemeinsame Dateien\AVM\de_serv.exe
O23 - Service: TuneUp Drive Defrag-Dienst (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Programme\RealVNC\VNC4\WinVNC4.exe

--
End of file - 5084 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\1-Klick-Wartung.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-12-18 59032]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Programme\Java\jre6\bin\jp2ssv.dll [2009-07-25 41760]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"AVMWlanClient"=C:\Programme\avmwlanstick\wlangui.exe [2007-12-20 1748992]
"avgnt"=C:\Programme\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153]
"boinctray"=C:\Programme\BOINC\boinctray.exe [2009-10-28 58112]
"boincmgr"=C:\Programme\BOINC\boincmgr.exe [2009-10-28 4793088]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ALDI Foto Service]
C:\Programme\ALDI Sued Foto Service\ALDI_Foto_Service\FotoSuite.exe [2007-01-26 1167360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ALDI_SUED_FotoSuite_Download]
C:\Programme\ALDI Sued Foto Service\ALDI_Foto_Service\FotoSuite.exe [2007-01-26 1167360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
C:\PROGRA~1\GEMEIN~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Programme\Messenger\msmsgs.exe [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Programme\QuickTime\qttask.exe -atboottime []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
C:\Programme\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe [2006-03-30 313472]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"mnmsrvc"=3
"ERSvc"=2
"Messenger"=2
"gusvc"=2

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Programme\RealVNC\VNC4\winvnc4.exe"="C:\Programme\RealVNC\VNC4\winvnc4.exe:*:Enabled:winvnc4"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Programme\Mozilla Firefox\firefox.exe"="C:\Programme\Mozilla Firefox\firefox.exe:*:Enabled:Firefox"
"C:\WINDOWS\system32\ftp.exe"="C:\WINDOWS\system32\ftp.exe:*:Enabled:Programm zur Dateiübertragung"
"C:\Programme\Gemeinsame Dateien\Ahead\Nero Web\SetupX.exe"="C:\Programme\Gemeinsame Dateien\Ahead\Nero Web\SetupX.exe:*:Disabled:Nero ProductSetup"
"C:\Program Files\WS_FTP\WS_FTP95.exe"="C:\Program Files\WS_FTP\WS_FTP95.exe:*:Disabled:WS_FTP 95"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

 

======List of files/folders created in the last 3 months======

2009-11-16 19:38:01 ----D---- C:\rsit
2009-11-16 19:30:06 ----D---- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\WEB.DE
2009-11-15 18:27:48 ----D---- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Ahead
2009-11-15 16:09:51 ----D---- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\WinRAR
2009-11-15 11:17:05 ----D---- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Malwarebytes
2009-11-15 11:16:50 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
2009-11-15 11:16:49 ----D---- C:\Programme\Malwarebytes' Anti-Malware
2009-11-15 09:40:41 ----D---- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\QuickScan
2009-11-15 09:36:31 ----D---- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Mozilla
2009-11-14 15:33:17 ----A---- C:\WINDOWS\system32\TUKernel.exe
2009-11-14 15:21:18 ----A---- C:\WINDOWS\system32\uxtuneup.dll
2009-11-14 15:21:16 ----A---- C:\WINDOWS\system32\TuneUpDefragService.exe
2009-11-13 20:31:01 ----HDC---- C:\WINDOWS\$NtUninstallKB969947$
2009-11-07 07:06:12 ----HDC---- C:\WINDOWS\$NtUninstallKB958869$
2009-11-06 19:22:22 ----D---- C:\~ErdUserProfile.$$$
2009-11-06 16:55:46 ----D---- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\TuneUp Software
2009-11-05 21:05:56 ----D---- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\TrueCrypt
2009-11-05 21:01:47 ----D---- C:\Programme\TrueCrypt
2009-11-05 19:54:17 ----A---- C:\WINDOWS\system32\ntoskrnl.exe
2009-11-05 19:54:17 ----A---- C:\WINDOWS\system32\ntkrnlpa.exe
2009-11-05 18:47:10 ----N---- C:\WINDOWS\UNNeroBurnRights.exe
2009-11-05 18:46:05 ----D---- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Macromedia
2009-11-05 18:46:05 ----D---- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Adobe
2009-11-04 17:37:31 ----D---- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Opera
2009-11-04 17:25:21 ----D---- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Sun
2009-11-04 17:19:05 ----D---- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Identities
2009-11-04 17:18:27 ----SD---- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Microsoft
2009-11-04 17:18:27 ----ASH---- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\desktop.ini
2009-10-31 15:45:23 ----D---- C:\Programme\BOINC
2009-10-31 15:45:23 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\BOINC
2009-10-24 08:29:30 ----D---- C:\Programme\Trend Micro
2009-10-20 19:05:14 ----HDC---- C:\WINDOWS\$NtUninstallKB969059$
2009-10-20 19:04:56 ----HDC---- C:\WINDOWS\$NtUninstallKB974112$
2009-10-20 19:04:39 ----HDC---- C:\WINDOWS\$NtUninstallKB975025$
2009-10-20 19:02:44 ----HDC---- C:\WINDOWS\$NtUninstallKB974571$
2009-10-20 19:01:14 ----HDC---- C:\WINDOWS\$NtUninstallKB975467$
2009-10-20 18:06:43 ----A---- C:\WINDOWS\system32\TUProgSt.exe
2009-10-20 18:04:56 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software
2009-10-20 18:04:50 ----D---- C:\Programme\TuneUp Utilities 2009
2009-10-20 18:02:57 ----SHD---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{55A29068-F2CE-456C-9148-C869879E2357}
2009-10-15 19:39:22 ----HDC---- C:\WINDOWS\$NtUninstallKB973525$
2009-10-14 19:10:37 ----D---- C:\Programme\Avira
2009-10-14 19:10:37 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avira
2009-10-12 07:15:29 ----HD---- C:\divx
2009-10-08 19:45:25 ----N---- C:\WINDOWS\system32\vxblock.dll
2009-10-08 19:45:25 ----N---- C:\WINDOWS\system32\pxwave.dll
2009-10-08 19:45:25 ----N---- C:\WINDOWS\system32\pxsfs.dll
2009-10-08 19:45:25 ----N---- C:\WINDOWS\system32\pxmas.dll
2009-10-08 19:45:25 ----N---- C:\WINDOWS\system32\pxinsi64.exe
2009-10-08 19:45:25 ----N---- C:\WINDOWS\system32\pxinsa64.exe
2009-10-08 19:45:25 ----N---- C:\WINDOWS\system32\pxhpinst.exe
2009-10-08 19:45:25 ----N---- C:\WINDOWS\system32\pxdrv.dll
2009-10-08 19:45:25 ----N---- C:\WINDOWS\system32\pxcpyi64.exe
2009-10-08 19:45:25 ----N---- C:\WINDOWS\system32\pxcpya64.exe
2009-10-08 19:45:25 ----N---- C:\WINDOWS\system32\pxafs.dll
2009-10-08 19:45:23 ----N---- C:\WINDOWS\system32\px.dll
2009-10-08 19:43:49 ----D---- C:\Programme\Gemeinsame Dateien\DivX Shared
2009-09-25 17:41:26 ----A---- C:\WINDOWS\system32\divx_xx16.dll
2009-09-25 17:41:26 ----A---- C:\WINDOWS\system32\divx_xx11.dll
2009-09-25 17:41:26 ----A---- C:\WINDOWS\system32\divx_xx0c.dll
2009-09-25 17:41:26 ----A---- C:\WINDOWS\system32\divx_xx0a.dll
2009-09-25 17:41:26 ----A---- C:\WINDOWS\system32\divx_xx07.dll
2009-09-25 17:41:26 ----A---- C:\WINDOWS\system32\DivX.dll
2009-09-21 18:35:57 ----D---- C:\WINDOWS\A5W_DATA
2009-09-21 18:35:57 ----A---- C:\WINDOWS\A5W.INI
2009-09-21 18:35:52 ----A---- C:\WINDOWS\AWSHKWV.INI
2009-09-18 20:15:18 ----D---- C:\Programme\eSpeak
2009-09-11 15:17:01 ----N---- C:\WINDOWS\system32\SET121.tmp
2009-09-11 15:17:01 ----A---- C:\WINDOWS\system32\SET236.tmp
2009-09-09 06:37:50 ----HDC---- C:\WINDOWS\$NtUninstallKB968816_WM9$
2009-09-09 06:37:37 ----HDC---- C:\WINDOWS\$NtUninstallKB956844$
2009-09-09 06:37:16 ----HDC---- C:\WINDOWS\$NtUninstallKB971961$
2009-09-04 22:03:28 ----A---- C:\WINDOWS\system32\SET24A.tmp
2009-09-04 22:03:28 ----A---- C:\WINDOWS\system32\SET134.tmp
2009-09-02 12:46:30 ----HD---- C:\a9ae923d36940228a57e
2009-09-02 11:46:13 ----A---- C:\WINDOWS\system32\javaws.exe
2009-09-02 11:46:13 ----A---- C:\WINDOWS\system32\javaw.exe
2009-09-02 11:46:13 ----A---- C:\WINDOWS\system32\java.exe
2009-08-29 08:24:57 ----A---- C:\WINDOWS\system32\SET24F.tmp
2009-08-29 08:24:57 ----A---- C:\WINDOWS\system32\SET24E.tmp
2009-08-29 08:24:56 ----A---- C:\WINDOWS\system32\SET251.tmp
2009-08-29 08:24:56 ----A---- C:\WINDOWS\system32\SET250.tmp
2009-08-29 08:24:55 ----A---- C:\WINDOWS\system32\SET257.tmp
2009-08-29 08:24:53 ----A---- C:\WINDOWS\system32\SET259.tmp
2009-08-29 08:24:53 ----A---- C:\WINDOWS\system32\SET258.tmp
2009-08-29 08:24:51 ----A---- C:\WINDOWS\system32\SET260.tmp
2009-08-29 08:24:51 ----A---- C:\WINDOWS\system32\SET25D.tmp
2009-08-29 08:24:48 ----A---- C:\WINDOWS\system32\SET267.tmp
2009-08-29 08:24:48 ----A---- C:\WINDOWS\system32\SET262.tmp
2009-08-29 08:24:47 ----A---- C:\WINDOWS\system32\SET26B.tmp

======List of files/folders modified in the last 3 months======

2009-11-16 19:36:03 ----D---- C:\TEMP
2009-11-16 19:34:26 ----D---- C:\Programme\Mozilla Firefox
2009-11-16 19:33:29 ----D---- C:\!Downloads
2009-11-16 19:02:05 ----D---- C:\WINDOWS\system32\CatRoot2
2009-11-16 09:31:02 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-11-16 09:26:13 ----SHD---- C:\Config.Msi
2009-11-16 09:26:13 ----RSD---- C:\WINDOWS\assembly
2009-11-16 09:26:12 ----SHD---- C:\WINDOWS\Installer
2009-11-16 09:26:12 ----D---- C:\Programme
2009-11-16 07:49:04 ----D---- C:\WINDOWS\Prefetch
2009-11-16 07:39:38 ----A---- C:\WINDOWS\NeroDigital.ini
2009-11-15 19:00:23 ----D---- C:\WINDOWS
2009-11-15 18:57:12 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-11-15 18:57:06 ----D---- C:\WINDOWS\Temp
2009-11-15 18:57:06 ----D---- C:\WINDOWS\system32\Restore
2009-11-15 18:41:46 ----D---- C:\WINDOWS\system32
2009-11-15 18:41:43 ----D---- C:\WINDOWS\security
2009-11-15 18:41:37 ----D---- C:\WINDOWS\system32\drivers
2009-11-15 11:20:34 ----SHD---- C:\System Volume Information
2009-11-15 11:08:08 ----D---- C:\WINDOWS\Debug
2009-11-15 10:54:56 ----SH---- C:\boot.ini
2009-11-15 07:11:34 ----D---- C:\Programme\a-squared Free
2009-11-14 15:21:22 ----SD---- C:\WINDOWS\Tasks
2009-11-13 20:31:20 ----HD---- C:\WINDOWS\inf
2009-11-13 20:26:04 ----HD---- C:\WINDOWS\$hf_mig$
2009-11-07 09:06:31 ----A---- C:\WINDOWS\CSTBox.INI
2009-11-07 07:06:15 ----D---- C:\WINDOWS\WinSxS
2009-11-07 07:05:55 ----D---- C:\WINDOWS\system32\CatRoot
2009-11-05 20:48:53 ----D---- C:\WINDOWS\Help
2009-11-05 19:22:51 ----SHD---- C:\RECYCLER
2009-11-05 18:59:37 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-11-05 09:36:22 ----A---- C:\WINDOWS\system32\MRT.exe
2009-11-04 17:18:26 ----D---- C:\Dokumente und Einstellungen
2009-10-31 08:44:11 ----D---- C:\WINDOWS\system32\config
2009-10-30 19:58:25 ----D---- C:\Programme\DivX
2009-10-30 06:25:07 ----D---- C:\Programme\Opera
2009-10-20 19:14:22 ----D---- C:\WINDOWS\Microsoft.NET
2009-10-20 19:03:48 ----D---- C:\WINDOWS\system32\de-de
2009-10-20 19:03:47 ----D---- C:\Programme\Internet Explorer
2009-10-20 19:03:25 ----D---- C:\WINDOWS\ie7updates
2009-10-14 19:08:16 ----D---- C:\Programme\Gemeinsame Dateien\Microsoft Shared
2009-10-08 19:43:49 ----D---- C:\Programme\Gemeinsame Dateien
2009-09-25 17:56:30 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-09-21 18:35:07 ----D---- C:\WINDOWS\system32\Macromed
2009-09-21 18:21:32 ----D---- C:\WINDOWS\system
2009-09-19 13:29:07 ----D---- C:\WINDOWS\system32\NtmsData
2009-09-11 15:17:01 ----A---- C:\WINDOWS\system32\msv1_0.dll
2009-09-04 22:03:28 ----A---- C:\WINDOWS\system32\msasn1.dll
2009-09-02 12:48:31 ----D---- C:\WINDOWS\system32\XPSViewer
2009-09-02 12:48:24 ----D---- C:\WINDOWS\system32\en-us
2009-09-02 12:48:12 ----RSD---- C:\WINDOWS\Fonts
2009-09-02 12:43:30 ----D---- C:\Programme\Outlook Express
2009-09-02 12:05:24 ----D---- C:\WINDOWS\SxsCaPendDel
2009-09-02 11:46:10 ----D---- C:\Programme\Java
2009-08-26 09:00:21 ----A---- C:\WINDOWS\system32\strmdll.dll

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 avgio;avgio; \??\C:\Programme\Avira\AntiVir Desktop\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2009-03-30 96104]
R1 P3;Intel PentiumIII-Prozessortreiber; C:\WINDOWS\System32\DRIVERS\p3.sys [2008-04-14 46848]
R1 truecrypt;truecrypt; C:\WINDOWS\System32\drivers\truecrypt.sys [2009-11-05 223432]
R1 WS2IFSL;Windows Socket 2.0 Non-IFS-Dienstanbieter-Unterstützungsumgebung; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-08-18 12032]
R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2009-07-28 55656]
R3 ati2mtag;ati2mtag; C:\WINDOWS\System32\DRIVERS\ati2mtag.sys [2004-08-03 701952]
R3 FWLANUSB;AVM FRITZ!WLAN; C:\WINDOWS\System32\DRIVERS\fwlanusb.sys [2007-12-20 265088]
R3 HidUsb;Microsoft HID Class-Treiber; C:\WINDOWS\System32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 mouhid;Maus-HID-Treiber; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-08-18 12288]
R3 pcouffin;VSO Software pcouffin; C:\WINDOWS\System32\Drivers\pcouffin.sys [2008-05-15 47360]
R3 usbehci;Miniporttreiber für erweiterten Microsoft USB 2.0-Hostcontroller; C:\WINDOWS\System32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Microsoft USB-Standardhubtreiber; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbprint;Microsoft USB-Druckerklasse; C:\WINDOWS\System32\DRIVERS\usbprint.sys [2008-04-13 25856]
R3 usbuhci;Miniporttreiber für universellen Microsoft USB-Hostcontroller; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 VIAudio;VIA AC'97 Audiocontroller (WDM); C:\WINDOWS\system32\drivers\ac97via.sys [2002-08-28 84480]
S3 ati2mtaa;ati2mtaa; C:\WINDOWS\system32\DRIVERS\ati2mtaa.sys [2004-08-03 327168]
S3 atimtag;atimtag; C:\WINDOWS\System32\DRIVERS\atimtag.sys []
S3 avmeject;AVM Eject; C:\WINDOWS\system32\drivers\avmeject.sys [2007-12-20 4352]
S3 CrystalSysInfo;CrystalSysInfo; \??\C:\Programme\MediaCoder\SysInfo.sys []
S3 es1371;Creative AudioPCI (ES1371,ES1373) (WDM); C:\WINDOWS\system32\drivers\es1371mp.sys [2001-08-17 40704]
S3 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2009-05-11 28520]
S3 usbscan;USB-Scannertreiber; C:\WINDOWS\System32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;USB-Massenspeichertreiber; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WDMWANMP;NDIS WAN miniport; C:\WINDOWS\System32\DRIVERS\wdmwanmp.sys [2002-03-21 26067]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 a2free;a-squared Free Service; c:\programme\a-squared free\a2service.exe [2009-09-26 1858144]
R2 AntiVirSchedulerService;Avira AntiVir Planer; C:\Programme\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]
R2 AntiVirService;Avira AntiVir Guard; C:\Programme\Avira\AntiVir Desktop\avguard.exe [2009-07-21 185089]
R2 AVM IGD CTRL Service;AVM IGD CTRL Service; C:\Programme\FRITZ!DSL\IGDCTRL.EXE [2005-11-21 81920]
R2 AVM WLAN Connection Service;AVM WLAN Connection Service; C:\Programme\avmwlanstick\WlanNetService.exe [2007-12-20 364544]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service; C:\WINDOWS\System32\TUProgSt.exe [2009-11-14 604488]
R2 UxTuneUp;TuneUp Designerweiterung; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
R2 WinVNC4;VNC Server Version 4; C:\Programme\RealVNC\VNC4\WinVNC4.exe [2006-05-12 439248]
S3 aspnet_state;ASP.NET-Zustandsdienst; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 de_serv;AVM FRITZ!web Routing Service; C:\Programme\Gemeinsame Dateien\AVM\de_serv.exe [2005-11-21 315392]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 ose;Office Source Engine; C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 TuneUp.Defrag;TuneUp Drive Defrag-Dienst; C:\WINDOWS\System32\TuneUpDefragService.exe [2009-11-14 361288]
S3 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\System32\wdfmgr.exe [2006-10-18 8704]
S4 NetTcpPortSharing;Net.Tcp-Portfreigabedienst; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
S4 NMIndexingService;NMIndexingService; C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe []

-----------------EOF-----------------

info.txt logfile of random's system information tool 1.06 2009-11-16 19:38:20

======Uninstall list======

-->C:\Programme\DivX\DivXConverterUninstall.exe /CONVERTER
-->C:\Programme\Gemeinsame Dateien\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
-->C:\Programme\Nero\Nero 7\nero\uninstall\UNNERO.exe /UNINSTALL
-->C:\WINDOWS\UNNeroBackItUp.exe /UNINSTALL
-->C:\WINDOWS\UNNeroMediaHome.exe /UNINSTALL
-->C:\WINDOWS\UNNeroShowTime.exe /UNINSTALL
-->C:\WINDOWS\UNNeroVision.exe /UNINSTALL
-->C:\WINDOWS\UNRecode.exe /UNINSTALL
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
7-Zip 4.57-->"C:\Programme\7-Zip\Uninstall.exe"
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Flash Player 9 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe -uninstallDelete
Adobe Reader 7.0.9 - Deutsch-->MsiExec.exe /I{AC76BA86-7AD7-1031-7B44-A70900000002}
Adobe Shockwave Player-->C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log
Aldi Süd Fotoservice-->"C:\Programme\Aldi Sued Fotoservice\unins000.exe"
ALDI Sued Foto Service-->C:\Programme\ALDI Sued Foto Service\ALDI_Foto_Service\instslct.exe /p
ArcSoft PhotoStudio 5-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{03F1CC67-5BD8-4C36-8394-76311B2AE69A}\setup.exe" -l0x7  -uninst
a-squared Free 2.0-->"C:\Programme\a-squared Free\unins000.exe"
AudioCon-->C:\Programme\Basement Softworks\AudioCon\Uninstall.exe
Avira AntiVir Personal - Free Antivirus-->C:\Programme\Avira\AntiVir Desktop\setup.exe /REMOVE
AVM FRITZ!Box Dokumentation-->C:\Programme\FRITZ!Box\install.exe -d
AVM FRITZ!DSL-->C:\WINDOWS\IsUn0407.exe -fC:\Programme\FRITZ!DSL\WebUnins.isu -cC:\Programme\FRITZ!DSL\Webunins.dll
AVM FRITZ!WLAN-->C:\Programme\avmwlanstick\instwcli.exe -d1
BOINC-->MsiExec.exe /I{76B830B5-AFE2-498E-8A0E-0BB64B5EC87E}
Canon CanoScan Toolbox 4.1-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{BCE46757-7674-4416-BEDB-68205A60409E}\setup.exe" -l0x7
Canon PIXMA iP3000-->C:\WINDOWS\System32\CNMCP61.exe "-PRINTERNAMECanon PIXMA iP3000" "-HELPERDLLC:\BJPrinter\CNMWINDOWS\Canon PIXMA iP3000 Installer\Inst2\cnmis.dll" "-RCDLLC:\BJPrinter\CNMWINDOWS\Canon PIXMA iP3000 Installer\Inst2\cnmi0407.dll"
Cartes du Ciel-->"C:\Programme\Ciel\Uninstall.exe" "C:\Programme\Ciel\install.log"
CCleaner-->"C:\Programme\CCleaner\uninst.exe"
CopyToDVD 4-->"C:\Programme\VSO\unins000.exe"
DivX Codec-->C:\Programme\DivX\DivXCodecUninstall.exe /CODEC
DivX Converter-->C:\Programme\DivX\DivXConverterUninstall.exe /CONVERTER
DivX Player-->C:\Programme\DivX\DivXPlayerUninstall.exe /PLAYER
DivX Plus DirectShow Filters-->C:\Programme\DivX\DivXDSFiltersUninstall.exe /DSFILTERS
DivX Web Player-->C:\Programme\DivX\DivXWebPlayerUninstall.exe /PLUGIN
Energiewelten-->C:\WINDOWS\unin0407.exe -fc:\programme\Energiewelten\DeIsL1.isu  -cc:\programme\Energiewelten\_ISREG32.DLL
eSpeak version 1.41.01-->"C:\Programme\eSpeak\unins000.exe"
foobar2000 v0.9.5.1-->"C:\Programme\foobar2000\uninstall.exe"
Google Earth-->MsiExec.exe /I{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}
HijackThis 2.0.2-->"C:\Programme\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall  /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
Hotfix für Windows Internet Explorer 7 (KB947864)-->"C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe"
J2SE Runtime Environment 5.0 Update 10-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150100}
J2SE Runtime Environment 5.0 Update 11-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150110}
J2SE Runtime Environment 5.0 Update 6-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150060}
J2SE Runtime Environment 5.0 Update 9-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150090}
Java(TM) 6 Update 15-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216010FF}
Java(TM) 6 Update 3-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}
Java(TM) 6 Update 5-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
Malwarebytes' Anti-Malware-->"C:\Programme\Malwarebytes' Anti-Malware\unins000.exe"
MediaCoder 0.6.2-->C:\Programme\MediaCoder\uninst.exe
Microsoft .NET Framework 2.0 Service Pack 1 Language Pack - DEU-->MsiExec.exe /I{9309DD7E-EBFE-3C95-8B47-30D3A012F606}
Microsoft .NET Framework 2.0 Service Pack 2-->MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
Microsoft .NET Framework 3.0 Service Pack 1 Language Pack - DEU-->MsiExec.exe /I{A1071AEB-B0EF-3F5F-BC84-83A270EBE496}
Microsoft .NET Framework 3.0 Service Pack 2-->MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}
Microsoft .NET Framework 3.5 Language Pack - DEU-->c:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack - deu\setup.exe
Microsoft .NET Framework 3.5 Language Pack - deu-->MsiExec.exe /I{1545207E-C6F3-31D7-9918-BDBB65075FBF}
Microsoft .NET Framework 3.5 SP1-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office Professional Edition 2003-->MsiExec.exe /I{90110407-6000-11D3-8CFE-0150048383C9}
Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
MSXML 4.0 SP2 (KB927978)-->MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 6.0 Parser (KB933579)-->MsiExec.exe /I{0A869A65-8C94-4F7C-A5C7-972D3C8CED9E}
Nero 7 Ultra Edition-->MsiExec.exe /I{5241FB1B-9CF5-448C-3BFD-1AE58B061031}
Nero BurnRights-->C:\WINDOWS\UNNeroBurnRights.exe /UNINSTALL
neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
OmniPage SE-->MsiExec.exe /I{6249C22D-E6A8-407B-BA8B-40298848ED94}
Opera 10.01-->MsiExec.exe /X{4B296228-DF7C-43EA-8DED-76027355B219}
Physik Klasse 5-10-->MsiExec.exe /I{9877FA05-D6A3-464C-882D-DBE5A301D6D0}
PowerDVD-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\setup.exe"  -uninstall
QuickTime-->MsiExec.exe /I{F07B861C-72B9-40A4-8B1A-AAED4C06A7E8}
ratDVD 0.78.1444-->C:\Programme\ratDVD\uninst.exe
RealPlayer-->C:\Programme\Gemeinsame Dateien\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
RedShift 6 Kompakt-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{92B8D056-3B61-40E8-97B4-062BEAFFD7AB}\Setup.EXE" -l0x7
S500/S600 USB Driver-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{514DF7BB-D192-417C-BB60-58BF1FD34253}\Setup.exe"  anything
Sicherheitsupdate für Windows Internet Explorer 7 (KB938127)-->"C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 7 (KB939653)-->"C:\WINDOWS\ie7updates\KB939653-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 7 (KB942615)-->"C:\WINDOWS\ie7updates\KB942615-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 7 (KB944533)-->"C:\WINDOWS\ie7updates\KB944533-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 7 (KB950759)-->"C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 7 (KB953838)-->"C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 7 (KB956390)-->"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 7 (KB958215)-->"C:\WINDOWS\ie7updates\KB958215-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 7 (KB960714)-->"C:\WINDOWS\ie7updates\KB960714-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 7 (KB961260)-->"C:\WINDOWS\ie7updates\KB961260-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 7 (KB963027)-->"C:\WINDOWS\ie7updates\KB963027-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 7 (KB969897)-->"C:\WINDOWS\ie7updates\KB969897-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 7 (KB972260)-->"C:\WINDOWS\ie7updates\KB972260-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Media Player (KB968816)-->"C:\WINDOWS\$NtUninstallKB968816_WM9$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB913433)-->C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB913433.inf
Sicherheitsupdate für Windows XP (KB956844)-->"C:\WINDOWS\$NtUninstallKB956844$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB958869)-->"C:\WINDOWS\$NtUninstallKB958869$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB969059)-->"C:\WINDOWS\$NtUninstallKB969059$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB969947)-->"C:\WINDOWS\$NtUninstallKB969947$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB971961)-->"C:\WINDOWS\$NtUninstallKB971961$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB974112)-->"C:\WINDOWS\$NtUninstallKB974112$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB974571)-->"C:\WINDOWS\$NtUninstallKB974571$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB975467)-->"C:\WINDOWS\$NtUninstallKB975467$\spuninst\spuninst.exe"
Tom Clancy's Splinter Cell-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{A174402A-2EE6-4B86-A930-7BC85A9933BD}\setup.exe" -l0x7
TrueCrypt-->"C:\Programme\TrueCrypt\TrueCrypt Setup.exe" /u
TuneUp Utilities 2009-->MsiExec.exe /I{55A29068-F2CE-456C-9148-C869879E2357}
Umwelt: Technik Arbeitsblätter 1-->C:\WINDOWS\IsUn0407.exe -f"c:\Klett Werkstatt\Technik\Umwelt Technik Arbeitsblätter 1\Unins001.isu"
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
VC80CRTRedist - 8.0.50727.4053-->MsiExec.exe /I{5EE7D259-D137-4438-9A5F-42F432EC0421}
VideoLAN VLC media player 0.8.6f-->C:\Programme\VideoLAN\VLC\uninstall.exe
VNC Free Edition 4.1.2-->"C:\Programme\RealVNC\VNC4\unins000.exe"
WEB.DE Club SmartFax-->C:\Programme\WEB.DE\WEB.DE Club SmartFax\uninst.exe
Windows Imaging Component-->"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
Windows Media Format Runtime-->"C:\Programme\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Player 10-->"C:\Programme\Windows Media Player\Setup_wm.exe" /Uninstall
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
WinRAR-->C:\Programme\WinRAR\uninstall.exe
XML Paper Specification Shared Components Language Pack 1.0-->"C:\WINDOWS\$NtUninstallXPSEPSCLP$\spuninst\spuninst.exe"
Xvid 1.1.3 final uninstall-->"C:\Programme\Xvid\unins000.exe"

 

=====HijackThis Backups=====

O15 - Trusted Zone: *.gomyhit.com (HKLM) [2009-11-15]
O15 - Trusted Zone: *.antimalwareguard.com (HKLM) [2009-11-15]

======Hosts File======

127.0.0.1   www.007guard.com
127.0.0.1   007guard.com
127.0.0.1   008i.com
127.0.0.1   www.008k.com
127.0.0.1   008k.com
127.0.0.1   www.00hq.com
127.0.0.1   00hq.com
127.0.0.1   010402.com
127.0.0.1   www.032439.com
127.0.0.1   032439.com

======Security center information======

AV: Avira AntiVir PersonalEdition Classic
AV: AntiVir Desktop (disabled)
AV: Avira AntiVir PersonalEdition Classic
AV: Avira AntiVir PersonalEdition Classic

======System event log======

Computer Name: ROCKET
Event Code: 7036
Message: Dienst "Telefonie" befindet sich jetzt im Status "Ausgeführt".

Record Number: 648
Source Name: Service Control Manager
Time Written: 20091026171330.000000+060
Event Type: Informationen
User:

Computer Name: ROCKET
Event Code: 7036
Message: Dienst "IMAPI-CD-Brenn-COM-Dienste" befindet sich jetzt im Status "Beendet".

Record Number: 647
Source Name: Service Control Manager
Time Written: 20091026171330.000000+060
Event Type: Informationen
User:

Computer Name: ROCKET
Event Code: 7036
Message: Dienst "Gatewaydienst auf Anwendungsebene" befindet sich jetzt im Status "Ausgeführt".

Record Number: 646
Source Name: Service Control Manager
Time Written: 20091026171329.000000+060
Event Type: Informationen
User:

Computer Name: ROCKET
Event Code: 7035
Message: Der Steuerbefehl "starten" wurde erfolgreich an den Dienst "Gatewaydienst auf Anwendungsebene" gesendet.

Record Number: 645
Source Name: Service Control Manager
Time Written: 20091026171329.000000+060
Event Type: Informationen
User: NT-AUTORITÄT\SYSTEM

Computer Name: ROCKET
Event Code: 7036
Message: Dienst "NLA (Network Location Awareness)" befindet sich jetzt im Status "Ausgeführt".

Record Number: 644
Source Name: Service Control Manager
Time Written: 20091026171323.000000+060
Event Type: Informationen
User:

=====Application event log=====

Computer Name: ROCKET
Event Code: 1000
Message: Die Leistungsindikatoren für den Dienst aspnet_state (ASP.NET-Zustandsdienst) wurden geladen.
Die Daten enthalten die dem Dienst zugeordneten neuen Indexwerte.

Record Number: 5
Source Name: LoadPerf
Time Written: 20091020201229.000000+120
Event Type: Informationen
User:

Computer Name: ROCKET
Event Code: 1001
Message: Die Leistungsindikatoren für den Dienst aspnet_state (ASP.NET-Zustandsdienst) wurden entfernt. Die Daten
enthalten die neuen Werte der Registrierungseinträge Last Counter
und Last Help.

Record Number: 4
Source Name: LoadPerf
Time Written: 20091020201228.000000+120
Event Type: Informationen
User:

Computer Name: ROCKET
Event Code: 1001
Message: Die Leistungsindikatoren für den Dienst ASP.NET_2.0.50727 (ASP.NET_2.0.50727) wurden entfernt. Die Daten
enthalten die neuen Werte der Registrierungseinträge Last Counter
und Last Help.

Record Number: 3
Source Name: LoadPerf
Time Written: 20091020201220.000000+120
Event Type: Informationen
User:

Computer Name: ROCKET
Event Code: 1017
Message: ASP.NET (Version 2.0.50727.0) registrieren (internes Flag: 0x00000406)

Record Number: 2
Source Name: ASP.NET 2.0.50727.0
Time Written: 20091020201218.000000+120
Event Type: Informationen
User:

Computer Name: ROCKET
Event Code: 1025
Message: Produkt: Microsoft .NET Framework 2.0 Service Pack 2. Die Datei c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll wird von folgendem Prozess verwendet: jqs, Kennung 524.

Record Number: 1
Source Name: MsiInstaller
Time Written: 20091020201026.000000+120
Event Type: Informationen
User: ROCKET\Mr. C

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"NUMBER_OF_PROCESSORS"=1
"OS"=Windows_NT
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Programme\QuickTime\QTSystem\;C:\Programme\Gemeinsame Dateien\DivX Shared\
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 8 Stepping 6, GenuineIntel
"PROCESSOR_LEVEL"=6
"PROCESSOR_REVISION"=0806
"TEMP"=C:\TEMP
"TMP"=C:\TEMP
"windir"=%SystemRoot%
"CLASSPATH"=.;C:\Programme\Java\jre1.5.0_06\lib\ext\QTJava.zip
"QTJAVA"=C:\Programme\Java\jre1.5.0_06\lib\ext\QTJava.zip

-----------------EOF-----------------
 

ROOTREPEAL (c) AD, 2007-2009
==================================================
Scan Start Time:      2009/11/16 19:53
Program Version:      Version 1.3.5.0
Windows Version:      Windows XP SP3
==================================================

Drivers
-------------------
Name: ac97via.sys
Image Path: C:\WINDOWS\system32\drivers\ac97via.sys
Address: 0xF7BE2000   Size: 84480   File Visible: -   Signed: -
Status: -

Name: ACPI.sys
Image Path: ACPI.sys
Address: 0xF84E6000   Size: 188800   File Visible: -   Signed: -
Status: -

Name: ACPI_HAL
Image Path: \Driver\ACPI_HAL
Address: 0x804D7000   Size: 2331136   File Visible: -   Signed: -
Status: -

Name: afd.sys
Image Path: C:\WINDOWS\System32\drivers\afd.sys
Address: 0xF18A8000   Size: 138496   File Visible: -   Signed: -
Status: -

Name: atapi.sys
Image Path: atapi.sys
Address: 0xF8478000   Size: 96512   File Visible: -   Signed: -
Status: -

Name: ati2cqag.dll
Image Path: C:\WINDOWS\System32\ati2cqag.dll
Address: 0xBFA0C000   Size: 229376   File Visible: -   Signed: -
Status: -

Name: ati2dvag.dll
Image Path: C:\WINDOWS\System32\ati2dvag.dll
Address: 0xBF9D6000   Size: 221184   File Visible: -   Signed: -
Status: -

Name: ati2mtag.sys
Image Path: C:\WINDOWS\System32\DRIVERS\ati2mtag.sys
Address: 0xF7C52000   Size: 815104   File Visible: -   Signed: -
Status: -

Name: ati3d1ag.dll
Image Path: C:\WINDOWS\System32\ati3d1ag.dll
Address: 0xBFA44000   Size: 872448   File Visible: -   Signed: -
Status: -

Name: ATMFD.DLL
Image Path: C:\WINDOWS\System32\ATMFD.DLL
Address: 0xBFFA0000   Size: 286720   File Visible: -   Signed: -
Status: -

Name: audstub.sys
Image Path: C:\WINDOWS\System32\DRIVERS\audstub.sys
Address: 0xF8C86000   Size: 3072   File Visible: -   Signed: -
Status: -

Name: avgio.sys
Image Path: C:\Programme\Avira\AntiVir Desktop\avgio.sys
Address: 0xF8A7C000   Size: 6144   File Visible: -   Signed: -
Status: -

Name: avgntflt.sys
Image Path: C:\WINDOWS\system32\DRIVERS\avgntflt.sys
Address: 0xF1562000   Size: 81920   File Visible: -   Signed: -
Status: -

Name: avipbb.sys
Image Path: C:\WINDOWS\system32\DRIVERS\avipbb.sys
Address: 0xF16CE000   Size: 114688   File Visible: -   Signed: -
Status: -

Name: Beep.SYS
Image Path: C:\WINDOWS\System32\Drivers\Beep.SYS
Address: 0xF8A74000   Size: 4224   File Visible: -   Signed: -
Status: -

Name: BOOTVID.dll
Image Path: C:\WINDOWS\system32\BOOTVID.dll
Address: 0xF8946000   Size: 12288   File Visible: -   Signed: -
Status: -

Name: Cdfs.SYS
Image Path: C:\WINDOWS\System32\Drivers\Cdfs.SYS
Address: 0xF86D6000   Size: 63744   File Visible: -   Signed: -
Status: -

Name: cdrom.sys
Image Path: C:\WINDOWS\System32\DRIVERS\cdrom.sys
Address: 0xF7D79000   Size: 62976   File Visible: -   Signed: -
Status: -

Name: CLASSPNP.SYS
Image Path: C:\WINDOWS\System32\DRIVERS\CLASSPNP.SYS
Address: 0xF8576000   Size: 53248   File Visible: -   Signed: -
Status: -

Name: disk.sys
Image Path: disk.sys
Address: 0xF8566000   Size: 36352   File Visible: -   Signed: -
Status: -

Name: dmio.sys
Image Path: dmio.sys
Address: 0xF8490000   Size: 154112   File Visible: -   Signed: -
Status: -

Name: dmload.sys
Image Path: dmload.sys
Address: 0xF8A3C000   Size: 5888   File Visible: -   Signed: -
Status: -

Name: drmk.sys
Image Path: C:\WINDOWS\system32\drivers\drmk.sys
Address: 0xF7D49000   Size: 61440   File Visible: -   Signed: -
Status: -

Name: dump_atapi.sys
Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys
Address: 0xF16B6000   Size: 98304   File Visible: No   Signed: -
Status: -

Name: dump_WMILIB.SYS
Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS
Address: 0xF8A7E000   Size: 8192   File Visible: No   Signed: -
Status: -

Name: Dxapi.sys
Image Path: C:\WINDOWS\System32\drivers\Dxapi.sys
Address: 0xF7B01000   Size: 12288   File Visible: -   Signed: -
Status: -

Name: dxg.sys
Image Path: C:\WINDOWS\System32\drivers\dxg.sys
Address: 0xBF9C4000   Size: 73728   File Visible: -   Signed: -
Status: -

Name: dxgthk.sys
Image Path: C:\WINDOWS\System32\drivers\dxgthk.sys
Address: 0xF8BCF000   Size: 4096   File Visible: -   Signed: -
Status: -

Name: Fastfat.SYS
Image Path: C:\WINDOWS\System32\Drivers\Fastfat.SYS
Address: 0xF12BE000   Size: 143744   File Visible: -   Signed: -
Status: -

Name: fdc.sys
Image Path: C:\WINDOWS\System32\DRIVERS\fdc.sys
Address: 0xF88A6000   Size: 27392   File Visible: -   Signed: -
Status: -

Name: Fips.SYS
Image Path: C:\WINDOWS\System32\Drivers\Fips.SYS
Address: 0xF8696000   Size: 44672   File Visible: -   Signed: -
Status: -

Name: flpydisk.sys
Image Path: C:\WINDOWS\System32\DRIVERS\flpydisk.sys
Address: 0xF88D6000   Size: 20480   File Visible: -   Signed: -
Status: -

Name: fltmgr.sys
Image Path: fltmgr.sys
Address: 0xF8458000   Size: 129792   File Visible: -   Signed: -
Status: -

Name: Fs_Rec.SYS
Image Path: C:\WINDOWS\System32\Drivers\Fs_Rec.SYS
Address: 0xF8A64000   Size: 7936   File Visible: -   Signed: -
Status: -

Name: ftdisk.sys
Image Path: ftdisk.sys
Address: 0xF84B6000   Size: 126336   File Visible: -   Signed: -
Status: -

Name: fwlanusb.sys
Image Path: C:\WINDOWS\System32\DRIVERS\fwlanusb.sys
Address: 0xF197E000   Size: 265088   File Visible: -   Signed: -
Status: -

Name: gameenum.sys
Image Path: C:\WINDOWS\System32\DRIVERS\gameenum.sys
Address: 0xF829A000   Size: 10624   File Visible: -   Signed: -
Status: -

Name: hal.dll
Image Path: C:\WINDOWS\system32\hal.dll
Address: 0x80711000   Size: 81152   File Visible: -   Signed: -
Status: -

Name: HIDCLASS.SYS
Image Path: C:\WINDOWS\System32\DRIVERS\HIDCLASS.SYS
Address: 0xF8676000   Size: 36864   File Visible: -   Signed: -
Status: -

Name: HIDPARSE.SYS
Image Path: C:\WINDOWS\System32\DRIVERS\HIDPARSE.SYS
Address: 0xF88F6000   Size: 28672   File Visible: -   Signed: -
Status: -

Name: hidusb.sys
Image Path: C:\WINDOWS\System32\DRIVERS\hidusb.sys
Address: 0xF8282000   Size: 10368   File Visible: -   Signed: -
Status: -

Name: i8042prt.sys
Image Path: C:\WINDOWS\System32\DRIVERS\i8042prt.sys
Address: 0xF7D29000   Size: 52992   File Visible: -   Signed: -
Status: -

Name: imapi.sys
Image Path: C:\WINDOWS\System32\DRIVERS\imapi.sys
Address: 0xF7D59000   Size: 42112   File Visible: -   Signed: -
Status: -

Name: ipnat.sys
Image Path: C:\WINDOWS\System32\DRIVERS\ipnat.sys
Address: 0xF17B2000   Size: 152832   File Visible: -   Signed: -
Status: -

Name: ipsec.sys
Image Path: C:\WINDOWS\System32\DRIVERS\ipsec.sys
Address: 0xF194B000   Size: 75264   File Visible: -   Signed: -
Status: -

Name: isapnp.sys
Image Path: isapnp.sys
Address: 0xF8536000   Size: 37632   File Visible: -   Signed: -
Status: -

Name: kbdclass.sys
Image Path: C:\WINDOWS\System32\DRIVERS\kbdclass.sys
Address: 0xF88AE000   Size: 25216   File Visible: -   Signed: -
Status: -

Name: KDCOM.DLL
Image Path: C:\WINDOWS\system32\KDCOM.DLL
Address: 0xF8A36000   Size: 8192   File Visible: -   Signed: -
Status: -

Name: kmixer.sys
Image Path: C:\WINDOWS\system32\drivers\kmixer.sys
Address: 0xF0879000   Size: 172416   File Visible: -   Signed: -
Status: -

Name: ks.sys
Image Path: C:\WINDOWS\System32\DRIVERS\ks.sys
Address: 0xF7C1B000   Size: 143360   File Visible: -   Signed: -
Status: -

Name: KSecDD.sys
Image Path: KSecDD.sys
Address: 0xF842F000   Size: 92928   File Visible: -   Signed: -
Status: -

 

Name: mnmdd.SYS
Image Path: C:\WINDOWS\System32\Drivers\mnmdd.SYS
Address: 0xF8A76000   Size: 4224   File Visible: -   Signed: -
Status: -

Name: mouclass.sys
Image Path: C:\WINDOWS\System32\DRIVERS\mouclass.sys
Address: 0xF88CE000   Size: 23552   File Visible: -   Signed: -
Status: -

Name: mouhid.sys
Image Path: C:\WINDOWS\System32\DRIVERS\mouhid.sys
Address: 0xF89C2000   Size: 12288   File Visible: -   Signed: -
Status: -

Name: MountMgr.sys
Image Path: MountMgr.sys
Address: 0xF8546000   Size: 42368   File Visible: -   Signed: -
Status: -

Name: mrxsmb.sys
Image Path: C:\WINDOWS\System32\DRIVERS\mrxsmb.sys
Address: 0xF17D8000   Size: 455296   File Visible: -   Signed: -
Status: -

Name: Msfs.SYS
Image Path: C:\WINDOWS\System32\Drivers\Msfs.SYS
Address: 0xF890E000   Size: 19072   File Visible: -   Signed: -
Status: -

Name: msgpc.sys
Image Path: C:\WINDOWS\System32\DRIVERS\msgpc.sys
Address: 0xF85F6000   Size: 35072   File Visible: -   Signed: -
Status: -

Name: mssmbios.sys
Image Path: C:\WINDOWS\System32\DRIVERS\mssmbios.sys
Address: 0xF8A1E000   Size: 15488   File Visible: -   Signed: -
Status: -

Name: Mup.sys
Image Path: Mup.sys
Address: 0xF82CA000   Size: 105344   File Visible: -   Signed: -
Status: -

Name: NDIS.sys
Image Path: NDIS.sys
Address: 0xF8375000   Size: 182656   File Visible: -   Signed: -
Status: -

Name: ndistapi.sys
Image Path: C:\WINDOWS\System32\DRIVERS\ndistapi.sys
Address: 0xF8A02000   Size: 10112   File Visible: -   Signed: -
Status: -

Name: ndiswan.sys
Image Path: C:\WINDOWS\System32\DRIVERS\ndiswan.sys
Address: 0xF7B93000   Size: 91520   File Visible: -   Signed: -
Status: -

Name: NDProxy.SYS
Image Path: C:\WINDOWS\System32\Drivers\NDProxy.SYS
Address: 0xF8626000   Size: 40576   File Visible: -   Signed: -
Status: -

Name: netbios.sys
Image Path: C:\WINDOWS\System32\DRIVERS\netbios.sys
Address: 0xF8686000   Size: 34688   File Visible: -   Signed: -
Status: -

Name: netbt.sys
Image Path: C:\WINDOWS\System32\DRIVERS\netbt.sys
Address: 0xF18CA000   Size: 162816   File Visible: -   Signed: -
Status: -

Name: Npfs.SYS
Image Path: C:\WINDOWS\System32\Drivers\Npfs.SYS
Address: 0xF8916000   Size: 30848   File Visible: -   Signed: -
Status: -

Name: Ntfs.sys
Image Path: Ntfs.sys
Address: 0xF83A2000   Size: 574976   File Visible: -   Signed: -
Status: -

Name: Null.SYS
Image Path: C:\WINDOWS\System32\Drivers\Null.SYS
Address: 0xF8B78000   Size: 2944   File Visible: -   Signed: -
Status: -

Name: p3.sys
Image Path: C:\WINDOWS\System32\DRIVERS\p3.sys
Address: 0xF7D89000   Size: 46848   File Visible: -   Signed: -
Status: -

Name: parport.sys
Image Path: C:\WINDOWS\System32\DRIVERS\parport.sys
Address: 0xF7BAA000   Size: 80384   File Visible: -   Signed: -
Status: -

Name: PartMgr.sys
Image Path: PartMgr.sys
Address: 0xF87BE000   Size: 19712   File Visible: -   Signed: -
Status: -

Name: ParVdm.SYS
Image Path: C:\WINDOWS\System32\Drivers\ParVdm.SYS
Address: 0xF8A72000   Size: 7040   File Visible: -   Signed: -
Status: -

Name: pci.sys
Image Path: pci.sys
Address: 0xF84D5000   Size: 68224   File Visible: -   Signed: -
Status: -

Name: PCIIDEX.SYS
Image Path: C:\WINDOWS\System32\DRIVERS\PCIIDEX.SYS
Address: 0xF87B6000   Size: 28672   File Visible: -   Signed: -
Status: -

Name: pcouffin.sys
Image Path: C:\WINDOWS\System32\Drivers\pcouffin.sys
Address: 0xF8606000   Size: 47360   File Visible: -   Signed: -
Status: -

Name: PnpManager
Image Path: \Driver\PnpManager
Address: 0x804D7000   Size: 2331136   File Visible: -   Signed: -
Status: -

Name: portcls.sys
Image Path: C:\WINDOWS\system32\drivers\portcls.sys
Address: 0xF7BBE000   Size: 147456   File Visible: -   Signed: -
Status: -

Name: psched.sys
Image Path: C:\WINDOWS\System32\DRIVERS\psched.sys
Address: 0xF7B82000   Size: 69120   File Visible: -   Signed: -
Status: -

Name: ptilink.sys
Image Path: C:\WINDOWS\System32\DRIVERS\ptilink.sys
Address: 0xF88BE000   Size: 17792   File Visible: -   Signed: -
Status: -

Name: PxHelp20.sys
Image Path: PxHelp20.sys
Address: 0xF8586000   Size: 35712   File Visible: -   Signed: -
Status: -

Name: rasacd.sys
Image Path: C:\WINDOWS\System32\DRIVERS\rasacd.sys
Address: 0xF89C6000   Size: 8832   File Visible: -   Signed: -
Status: -

Name: rasl2tp.sys
Image Path: C:\WINDOWS\System32\DRIVERS\rasl2tp.sys
Address: 0xF7D19000   Size: 51328   File Visible: -   Signed: -
Status: -

Name: raspppoe.sys
Image Path: C:\WINDOWS\System32\DRIVERS\raspppoe.sys
Address: 0xF85D6000   Size: 41472   File Visible: -   Signed: -
Status: -

Name: raspptp.sys
Image Path: C:\WINDOWS\System32\DRIVERS\raspptp.sys
Address: 0xF85E6000   Size: 48384   File Visible: -   Signed: -
Status: -

Name: raspti.sys
Image Path: C:\WINDOWS\System32\DRIVERS\raspti.sys
Address: 0xF88C6000   Size: 16512   File Visible: -   Signed: -
Status: -

Name: RAW
Image Path: \FileSystem\RAW
Address: 0x804D7000   Size: 2331136   File Visible: -   Signed: -
Status: -

Name: rdbss.sys
Image Path: C:\WINDOWS\System32\DRIVERS\rdbss.sys
Address: 0xF1848000   Size: 175744   File Visible: -   Signed: -
Status: -

Name: RDPCDD.sys
Image Path: C:\WINDOWS\System32\DRIVERS\RDPCDD.sys
Address: 0xF8A78000   Size: 4224   File Visible: -   Signed: -
Status: -

Name: rdpdr.sys
Image Path: C:\WINDOWS\System32\DRIVERS\rdpdr.sys
Address: 0xF7B0D000   Size: 196224   File Visible: -   Signed: -
Status: -

Name: redbook.sys
Image Path: C:\WINDOWS\System32\DRIVERS\redbook.sys
Address: 0xF7D69000   Size: 57728   File Visible: -   Signed: -
Status: -

Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xF0D66000   Size: 49152   File Visible: No   Signed: -
Status: -

Name: serenum.sys
Image Path: C:\WINDOWS\System32\DRIVERS\serenum.sys
Address: 0xF89FE000   Size: 15744   File Visible: -   Signed: -
Status: -

Name: serial.sys
Image Path: C:\WINDOWS\System32\DRIVERS\serial.sys
Address: 0xF7D39000   Size: 65536   File Visible: -   Signed: -
Status: -

Name: sr.sys
Image Path: sr.sys
Address: 0xF8446000   Size: 73472   File Visible: -   Signed: -
Status: -

Name: srv.sys
Image Path: C:\WINDOWS\System32\DRIVERS\srv.sys
Address: 0xF0DEE000   Size: 333952   File Visible: -   Signed: -
Status: -

Name: swenum.sys
Image Path: C:\WINDOWS\System32\DRIVERS\swenum.sys
Address: 0xF8A60000   Size: 4352   File Visible: -   Signed: -
Status: -

Name: sysaudio.sys
Image Path: C:\WINDOWS\system32\drivers\sysaudio.sys
Address: 0xF16FA000   Size: 60800   File Visible: -   Signed: -
Status: -

Name: tcpip.sys
Image Path: C:\WINDOWS\System32\DRIVERS\tcpip.sys
Address: 0xF18F2000   Size: 361600   File Visible: -   Signed: -
Status: -

Name: TDI.SYS
Image Path: C:\WINDOWS\System32\DRIVERS\TDI.SYS
Address: 0xF88B6000   Size: 20480   File Visible: -   Signed: -
Status: -

Name: termdd.sys
Image Path: C:\WINDOWS\System32\DRIVERS\termdd.sys
Address: 0xF8616000   Size: 40704   File Visible: -   Signed: -
Status: -

Name: truecrypt.sys
Image Path: C:\WINDOWS\System32\drivers\truecrypt.sys
Address: 0xF1873000   Size: 215808   File Visible: -   Signed: -
Status: -

Name: TUKERNEL.EXE
Image Path: C:\WINDOWS\system32\TUKERNEL.EXE
Address: 0x804D7000   Size: 2331136   File Visible: -   Signed: -
Status: -

Name: update.sys
Image Path: C:\WINDOWS\System32\DRIVERS\update.sys
Address: 0xF7A87000   Size: 384768   File Visible: -   Signed: -
Status: -

Name: USBD.SYS
Image Path: C:\WINDOWS\System32\DRIVERS\USBD.SYS
Address: 0xF8A62000   Size: 8192   File Visible: -   Signed: -
Status: -

Name: usbehci.sys
Image Path: C:\WINDOWS\System32\DRIVERS\usbehci.sys
Address: 0xF889E000   Size: 30208   File Visible: -   Signed: -
Status: -

Name: usbhub.sys
Image Path: C:\WINDOWS\System32\DRIVERS\usbhub.sys
Address: 0xF8656000   Size: 59520   File Visible: -   Signed: -
Status: -

Name: USBPORT.SYS
Image Path: C:\WINDOWS\System32\DRIVERS\USBPORT.SYS
Address: 0xF7BF7000   Size: 147456   File Visible: -   Signed: -
Status: -

Name: usbprint.sys
Image Path: C:\WINDOWS\System32\DRIVERS\usbprint.sys
Address: 0xF88FE000   Size: 25856   File Visible: -   Signed: -
Status: -

Name: usbuhci.sys
Image Path: C:\WINDOWS\System32\DRIVERS\usbuhci.sys
Address: 0xF8896000   Size: 20608   File Visible: -   Signed: -
Status: -

Name: vga.sys
Image Path: C:\WINDOWS\System32\drivers\vga.sys
Address: 0xF8906000   Size: 20992   File Visible: -   Signed: -
Status: -

Name: viaagp.sys
Image Path: viaagp.sys
Address: 0xF8596000   Size: 42240   File Visible: -   Signed: -
Status: -

Name: viaide.sys
Image Path: viaide.sys
Address: 0xF8A3A000   Size: 5376   File Visible: -   Signed: -
Status: -

Name: VIDEOPRT.SYS
Image Path: C:\WINDOWS\System32\DRIVERS\VIDEOPRT.SYS
Address: 0xF7C3E000   Size: 81920   File Visible: -   Signed: -
Status: -

Name: VolSnap.sys
Image Path: VolSnap.sys
Address: 0xF8556000   Size: 53760   File Visible: -   Signed: -
Status: -

Name: wanarp.sys
Image Path: C:\WINDOWS\System32\DRIVERS\wanarp.sys
Address: 0xF86A6000   Size: 34560   File Visible: -   Signed: -
Status: -

Name: watchdog.sys
Image Path: C:\WINDOWS\System32\watchdog.sys
Address: 0xF891E000   Size: 20480   File Visible: -   Signed: -
Status: -

Name: wdmaud.sys
Image Path: C:\WINDOWS\system32\drivers\wdmaud.sys
Address: 0xF11E1000   Size: 83072   File Visible: -   Signed: -
Status: -

Name: WDMCAPI.sys
Image Path: WDMCAPI.sys
Address: 0xF82E4000   Size: 590592   File Visible: -   Signed: -
Status: -

Name: Win32k
Image Path: \Driver\Win32k
Address: 0xBF800000   Size: 1851392   File Visible: -   Signed: -
Status: -

Name: win32k.sys
Image Path: C:\WINDOWS\System32\win32k.sys
Address: 0xBF800000   Size: 1851392   File Visible: -   Signed: -
Status: -

Name: WMILIB.SYS
Image Path: C:\WINDOWS\System32\DRIVERS\WMILIB.SYS
Address: 0xF8A38000   Size: 8192   File Visible: -   Signed: -
Status: -

Name: WMIxWDM
Image Path: \Driver\WMIxWDM
Address: 0x804D7000   Size: 2331136   File Visible: -   Signed: -
Status: -

Name: ws2ifsl.sys
Image Path: C:\WINDOWS\System32\drivers\ws2ifsl.sys
Address: 0xF89CA000   Size: 12032   File Visible: -   Signed: -
Status: -