What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

otto can't work [Solved]

5 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
My windows user 'otto' (no admin rights) is infected. After login there is a text or bitmap with some irritating text (fake police statement) and that's it, the user is blocked. Other users are ok.
Here is the OTL.Txt, the Extras.Txt did not appear:

OTL logfile created on: 09.01.2012 17:54:08 - Run 2
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Dokumente und Einstellungen\winter\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

3,00 Gb Total Physical Memory | 2,24 Gb Available Physical Memory | 74,77% Memory free
4,84 Gb Paging File | 4,05 Gb Available in Paging File | 83,59% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 39,06 Gb Total Space | 20,50 Gb Free Space | 52,47% Space Free | Partition Type: NTFS
Drive E: | 193,82 Gb Total Space | 12,22 Gb Free Space | 6,30% Space Free | Partition Type: NTFS

Computer Name: NB-XP-WINTER | User Name: winter | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Dokumente und Einstellungen\winter\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\CheckPoint\ZoneAlarm\vsmon.exe (Check Point Software Technologies LTD)
PRC - C:\Programme\CheckPoint\ZoneAlarm\zatray.exe (Check Point Software Technologies LTD)
PRC - C:\Programme\CheckPoint\ZAForceField\ISWSVC.exe (Check Point Software Technologies)
PRC - C:\Programme\CheckPoint\ZAForceField\ForceField.exe (Check Point Software Technologies)
PRC - C:\Programme\Nokia\Nokia Suite\NokiaSuite.exe (Nokia)
PRC - C:\Programme\PC Connectivity Solution\ServiceLayer.exe (Nokia)
PRC - C:\Programme\PC Connectivity Solution\Transports\NclUSBSrv.exe (Nokia)
PRC - C:\Programme\PC Connectivity Solution\Transports\NclMSBTSrv.exe (Nokia)
PRC - C:\Programme\PC Connectivity Solution\Transports\NclBCBTSrv.exe (Nokia)
PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Programme\VMware\VMware Player\hqtray.exe (VMware, Inc.)
PRC - C:\WINDOWS\system32\vmnetdhcp.exe (VMware, Inc.)
PRC - C:\WINDOWS\system32\vmnat.exe (VMware, Inc.)
PRC - C:\Programme\VMware\VMware Player\vmware-authd.exe (VMware, Inc.)
PRC - C:\Programme\Common Files\VMware\USB\vmware-usbarbitrator.exe (VMware, Inc.)
PRC - C:\Programme\ShrewSoft\VPN Client\iked.exe ()
PRC - C:\Programme\ShrewSoft\VPN Client\ipsecd.exe ()
PRC - C:\Programme\ThinkPad\Bluetooth Software\bin\btwdins.exe (Broadcom Corporation.)
PRC - C:\Programme\Intel\WiFi\bin\EvtEng.exe (Intel® Corporation)
PRC - C:\Programme\Intel\WiFi\bin\S24EvMon.exe (Intel® Corporation)
PRC - C:\Programme\Gemeinsame Dateien\Intel\WirelessCommon\RegSrvc.exe (Intel® Corporation)
PRC - C:\Programme\NTP\bin\ntpd.exe ()
PRC - C:\Programme\Lenovo\HOTKEY\TPONSCR.exe (Lenovo Group Limited)
PRC - C:\Programme\Lenovo\ZOOM\TpScrex.exe (Lenovo Group Limited)
PRC - C:\Programme\Lenovo\System Update\SUService.exe (Lenovo Group Limited)
PRC - C:\Programme\Lenovo\LenovoCare\LPMGR.EXE (Lenovo Group Limited)
PRC - C:\Programme\Lenovo\LenovoCare\LPMLCHK.EXE (Lenovo Group Limited)
PRC - C:\Programme\Lenovo\ATK Hotkey\LFKA.exe (Lenovo)
PRC - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
PRC - C:\WINDOWS\system32\acs.exe (Atheros)
PRC - C:\Programme\Lenovo\HOTKEY\LVOSDSVC.exe (Lenovo Group Limited)
PRC - C:\Programme\Lenovo\ATK Hotkey\LControl.exe (ATK0101)
PRC - C:\Programme\Lenovo\ATK Hotkey\LFKAS.exe ()
PRC - C:\Programme\Gemeinsame Dateien\Lenovo\Scheduler\scheduler_proxy.exe (Lenovo Group Limited)
PRC - C:\Programme\Gemeinsame Dateien\Lenovo\Scheduler\tvtsched.exe (Lenovo Group Limited)
PRC - C:\Programme\Lenovo\ATK Hotkey\GFNEXSrv.exe ()
PRC - C:\Programme\Gemeinsame Dateien\Lenovo\tvt_reg_monitor_svc.exe (Lenovo Group Limited)


========== Modules (No Company Name) ==========

MOD - C:\Programme\Nokia\Nokia Suite\ssoengine.dll ()
MOD - C:\Programme\Nokia\Nokia Suite\securestorage.dll ()
MOD - C:\Programme\Nokia\Nokia Suite\qjson.dll ()
MOD - C:\Programme\Nokia\Nokia Suite\phonon4.dll ()
MOD - C:\Programme\Nokia\Nokia Suite\QxtWeb.dll ()
MOD - C:\Programme\Nokia\Nokia Suite\QxtCore.dll ()
MOD - C:\Programme\Nokia\Nokia Suite\QtXmlPatterns4.dll ()
MOD - C:\Programme\Nokia\Nokia Suite\QtXml4.dll ()
MOD - C:\Programme\Nokia\Nokia Suite\QtWebKit4.dll ()
MOD - C:\Programme\Nokia\Nokia Suite\QtSql4.dll ()
MOD - C:\Programme\Nokia\Nokia Suite\QtScript4.dll ()
MOD - C:\Programme\Nokia\Nokia Suite\QtOpenGL4.dll ()
MOD - C:\Programme\Nokia\Nokia Suite\QtNetwork4.dll ()
MOD - C:\Programme\Nokia\Nokia Suite\QtMultimediaKit1.dll ()
MOD - C:\Programme\Nokia\Nokia Suite\QtGui4.dll ()
MOD - C:\Programme\Nokia\Nokia Suite\QtDeclarative4.dll ()
MOD - C:\Programme\Nokia\Nokia Suite\QtCore4.dll ()
MOD - C:\Programme\Nokia\Nokia Suite\sqldrivers\qsqlite4.dll ()
MOD - C:\Programme\Nokia\Nokia Suite\Imageformats\qjpeg4.dll ()
MOD - C:\Programme\Nokia\Nokia Suite\Imageformats\qico4.dll ()
MOD - C:\Programme\Nokia\Nokia Suite\Imageformats\qgif4.dll ()
MOD - C:\Programme\Nokia\Nokia Suite\OviShareLib.dll ()
MOD - C:\Programme\Nokia\Nokia Suite\NService.dll ()
MOD - C:\Programme\Nokia\Nokia Suite\Maps Service API.dll ()
MOD - C:\Programme\Nokia\Nokia Suite\CommonUpdateChecker.dll ()
MOD - C:\Programme\Nokia\Nokia Suite\mediaservice\dsengine.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\865390db0278ac64f667038656d9c25f\System.ServiceProcess.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\67bce2b25897e074ba865016315fbc89\System.Xml.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\6836a951700c2eb01a933212425cda4e\System.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\ca87ba84221991839abbe7d4bc9c6721\mscorlib.ni.dll ()
MOD - C:\Programme\Avira\AntiVir Desktop\sqlite3.dll ()
MOD - C:\Programme\VMware\VMware Player\libxml2.dll ()
MOD - C:\Programme\VMware\VMware Player\zlib1.dll ()
MOD - C:\Programme\ShrewSoft\VPN Client\iked.exe ()
MOD - C:\Programme\ShrewSoft\VPN Client\ipsecd.exe ()
MOD - C:\Programme\ShrewSoft\VPN Client\libdtp.dll ()
MOD - C:\Programme\ShrewSoft\VPN Client\libike.dll ()
MOD - C:\Programme\ShrewSoft\VPN Client\libvnet.dll ()
MOD - C:\Programme\ShrewSoft\VPN Client\libpfk.dll ()
MOD - C:\Programme\ShrewSoft\VPN Client\libvflt.dll ()
MOD - C:\Programme\ShrewSoft\VPN Client\libip.dll ()
MOD - C:\Programme\ShrewSoft\VPN Client\liblog.dll ()
MOD - C:\Programme\ShrewSoft\VPN Client\libidb.dll ()
MOD - C:\Programme\ShrewSoft\VPN Client\libith.dll ()
MOD - C:\WINDOWS\system32\nview.dll ()
MOD - C:\WINDOWS\system32\nvshell.dll ()
MOD - C:\WINDOWS\system32\msdmo.dll ()
MOD - C:\Programme\Lenovo\ATK Hotkey\LFKAS.exe ()
MOD - C:\Programme\Lenovo\ATK Hotkey\GFNEXSrv.exe ()


========== Win32 Services (SafeList) ==========

SRV - (VisualSVNServer) – File not found
SRV - (HidServ) – File not found
SRV - (vsmon) – C:\Programme\CheckPoint\ZoneAlarm\vsmon.exe (Check Point Software Technologies LTD)
SRV - (IswSvc) – C:\Programme\CheckPoint\ZAForceField\IswSvc.exe (Check Point Software Technologies)
SRV - (ServiceLayer) – C:\Programme\PC Connectivity Solution\ServiceLayer.exe (Nokia)
SRV - (AntiVirSchedulerService) – C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) – C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (VMnetDHCP) – C:\WINDOWS\system32\vmnetdhcp.exe (VMware, Inc.)
SRV - (VMware NAT Service) – C:\WINDOWS\system32\vmnat.exe (VMware, Inc.)
SRV - (VMAuthdService) – C:\Programme\VMware\VMware Player\vmware-authd.exe (VMware, Inc.)
SRV - (VMUSBArbService) – C:\Programme\Common Files\VMware\USB\vmware-usbarbitrator.exe (VMware, Inc.)
SRV - (iked) – C:\Programme\ShrewSoft\VPN Client\iked.exe ()
SRV - (ipsecd) – C:\Programme\ShrewSoft\VPN Client\ipsecd.exe ()
SRV - (dtpd) – C:\Programme\ShrewSoft\VPN Client\dtpd.exe ()
SRV - (ufad-ws60) – C:\Programme\VMware\VMware Player\vmware-ufad.exe (VMware, Inc.)
SRV - (btwdins) – C:\Programme\ThinkPad\Bluetooth Software\bin\btwdins.exe (Broadcom Corporation.)
SRV - (EvtEng) Intel® – C:\Programme\Intel\WiFi\bin\EvtEng.exe (Intel® Corporation)
SRV - (S24EventMonitor) Intel® – C:\Programme\Intel\WiFi\bin\S24EvMon.exe (Intel® Corporation)
SRV - (RegSrvc) Intel® – C:\Programme\Gemeinsame Dateien\Intel\WirelessCommon\RegSrvc.exe (Intel® Corporation)
SRV - (osppsvc) – C:\Programme\Gemeinsame Dateien\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation)
SRV - (ose) – C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (NTP) – C:\Programme\NTP\bin\ntpd.exe ()
SRV - (SUService) – C:\Programme\Lenovo\System Update\SUService.exe (Lenovo Group Limited)
SRV - (acs) – C:\WINDOWS\system32\acs.exe (Atheros)
SRV - (LFKAS) – C:\Programme\Lenovo\ATK Hotkey\LFKAS.exe ()
SRV - (TVT Scheduler) – C:\Programme\Gemeinsame Dateien\Lenovo\Scheduler\tvtsched.exe (Lenovo Group Limited)
SRV - (ATKGFNEXSrv) – C:\Programme\Lenovo\ATK Hotkey\GFNEXSrv.exe ()
SRV - (ThinkVantage Registry Monitor Service) – C:\Programme\Gemeinsame Dateien\Lenovo\tvt_reg_monitor_svc.exe (Lenovo Group Limited)
SRV - (OracleMTSRecoveryService) – C:\XEClient\BIN\omtsreco.exe (Oracle Corporation)
SRV - (IDriverT) – C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation)


========== Driver Services (SafeList) ==========

DRV - (avipbb) – C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (Vsdatant) – C:\WINDOWS\system32\vsdatant.sys (Check Point Software Technologies LTD)
DRV - (ISWKL) – C:\Programme\CheckPoint\ZAForceField\ISWKL.sys (Check Point Software Technologies)
DRV - (avgntflt) – C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (avkmgr) – C:\WINDOWS\system32\drivers\avkmgr.sys (Avira GmbH)
DRV - (UsbserFilt) – C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys (Nokia)
DRV - (upperdev) – C:\WINDOWS\system32\drivers\usbser_lowerflt.sys (Nokia)
DRV - (nmwcdc) – C:\WINDOWS\system32\drivers\ccdcmbo.sys (Nokia)
DRV - (nmwcd) – C:\WINDOWS\system32\drivers\ccdcmb.sys (Nokia)
DRV - (vmx86) – C:\WINDOWS\system32\drivers\vmx86.sys (VMware, Inc.)
DRV - (vmci) – C:\WINDOWS\system32\drivers\vmci.sys (VMware, Inc.)
DRV - (vmkbd) – C:\WINDOWS\system32\drivers\VMkbd.sys (VMware, Inc.)
DRV - (VMnetBridge) – C:\WINDOWS\system32\drivers\vmnetbridge.sys (VMware, Inc.)
DRV - (VMnetuserif) – C:\WINDOWS\system32\drivers\vmnetuserif.sys (VMware, Inc.)
DRV - (hcmon) – C:\WINDOWS\system32\drivers\hcmon.sys (VMware, Inc.)
DRV - (vmusb) – C:\WINDOWS\system32\drivers\vmusb.sys (VMware, Inc.)
DRV - (VMnetAdapter) – C:\WINDOWS\system32\drivers\vmnetadapter.sys (VMware, Inc.)
DRV - (pflt) – C:\WINDOWS\system32\drivers\vfilter.sys (Shrew Soft Inc)
DRV - (vstor2-ws60) – C:\Programme\VMware\VMware Player\vstor2-ws60.sys (VMware, Inc.)
DRV - (vnet) – C:\WINDOWS\system32\drivers\virtualnet.sys (Shrew Soft Inc)
DRV - (ssmdrv) – C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (BTKRNL) – C:\WINDOWS\system32\drivers\btkrnl.sys (Broadcom Corporation.)
DRV - (BTWUSB) – C:\WINDOWS\system32\drivers\btwusb.sys (Broadcom Corporation.)
DRV - (NETw5x32) Intel® – C:\WINDOWS\system32\drivers\NETw5x32.sys (Intel Corporation)
DRV - (Shockprf) – C:\WINDOWS\System32\DRIVERS\Apsx86.sys (Lenovo.)
DRV - (TPDIGIMN) – C:\WINDOWS\System32\DRIVERS\ApsHM86.sys (Lenovo.)
DRV - (s24trans) – C:\WINDOWS\system32\drivers\s24trans.sys (Intel Corporation)
DRV - (smihlp) SMI Helper Driver (smihlp) – C:\Programme\ThinkVantage Fingerprint Software\smihlp.sys (UPEK Inc.)
DRV - (lnvomdm2) – C:\WINDOWS\system32\drivers\lnvomdm2.sys (MCCI Corporation)
DRV - (lnvounic) Ericsson F3507g Mobile Broadband Minicard Network Adapter (WDM) – C:\WINDOWS\system32\drivers\lnvounic.sys (MCCI Corporation)
DRV - (lnvomdm) – C:\WINDOWS\system32\drivers\lnvomdm.sys (MCCI Corporation)
DRV - (lnvond5) Ericsson F3507g Mobile Broadband Minicard Network Adapter (NDIS) – C:\WINDOWS\system32\drivers\lnvond5.sys (MCCI Corporation)
DRV - (lnvocard) – C:\WINDOWS\system32\drivers\lnvocard.sys (MCCI Corporation)
DRV - (lnvobus) Ericsson F3507g Mobile Broadband Minicard Composite Device driver (WDM) – C:\WINDOWS\system32\drivers\lnvobus.sys (MCCI Corporation)
DRV - (lnvomdfl2) – C:\WINDOWS\system32\drivers\lnvomdfl2.sys (MCCI Corporation)
DRV - (lnvomdfl) – C:\WINDOWS\system32\drivers\lnvomdfl.sys (MCCI Corporation)
DRV - (lnvogps) – C:\WINDOWS\system32\drivers\lnvogps.sys (Ericsson AB)
DRV - (NVHDA) – C:\WINDOWS\system32\drivers\nvhda32.sys (NVIDIA Corporation)
DRV - (pccsmcfd) – C:\WINDOWS\system32\drivers\pccsmcfd.sys (Nokia)
DRV - (DCamUSBGene) – C:\WINDOWS\system32\drivers\USBSTK.sys ()
DRV - (Sony_EricssonWWSC) – C:\WINDOWS\system32\drivers\lnvoscard.sys (Sony Ericsson)
DRV - (CnxtHdAudService) – C:\WINDOWS\system32\drivers\CHDAU32.sys (Conexant Systems Inc.)
DRV - (lenovo.smi) – C:\WINDOWS\system32\drivers\smiif32.sys (Lenovo Group Limited)
DRV - (HSF_DPV) – C:\WINDOWS\system32\drivers\HSF_DPV.sys (Conexant Systems, Inc.)
DRV - (HSFHWAZL) – C:\WINDOWS\system32\drivers\HSFHWAZL.sys (Conexant Systems, Inc.)
DRV - (winachsf) – C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (rimmptsk) – C:\WINDOWS\system32\drivers\rimmptsk.sys (REDC)
DRV - (WSIMD) – C:\WINDOWS\system32\drivers\wsimd.sys (Atheros Communications, Inc.)
DRV - (RTLE8023xp) – C:\WINDOWS\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation )
DRV - (MTsensor) – C:\WINDOWS\system32\drivers\A0101X32.sys ()
DRV - (rismxdp) – C:\WINDOWS\system32\drivers\rixdptsk.sys (REDC)
DRV - (rimsptsk) – C:\WINDOWS\system32\drivers\rimsptsk.sys (REDC)
DRV - (ASMMAP) – C:\Programme\Lenovo\ATK Hotkey\ASMMAP.sys ()
DRV - (psadd) – C:\WINDOWS\system32\drivers\psadd.sys (Lenovo (United States) Inc.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@checkpoint.com/FFApi: C:\Programme\CheckPoint\ZAForceField\TrustChecker\bin\npFFApi.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Programme\CheckPoint\ZAForceField\TrustChecker [2011.11.26 17:43:48 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.01.08 18:51:24 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011.09.15 08:23:50 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 5.0\extensions\\Components: C:\Programme\Mozilla Thunderbird\components [2011.08.04 09:10:07 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 5.0\extensions\\Plugins: C:\Programme\Mozilla Thunderbird\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\[removed]: C:\Programme\Nokia\Nokia Suite\Connectors\Thunderbird Connector\ThunderbirdExtension_5.0 [2012.01.06 14:21:34 | 000,000,000 | —D | M]

[2011.06.30 17:41:16 | 000,000,000 | —D | M] (No name found) – C:\Dokumente und Einstellungen\winter\Anwendungsdaten\Mozilla\Extensions
[2011.11.18 13:00:50 | 000,000,000 | —D | M] (No name found) – C:\Programme\Mozilla Firefox\extensions
[2010.09.01 10:00:29 | 000,000,000 | —D | M] (Java Quick Starter) – C:\PROGRAMME\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2012.01.08 18:51:23 | 000,121,816 | —- | M] (Mozilla Foundation) – C:\Programme\mozilla firefox\components\browsercomps.dll
[2011.05.04 03:52:23 | 000,476,904 | —- | M] (Sun Microsystems, Inc.) – C:\Programme\mozilla firefox\plugins\npdeployJava1.dll
[2011.10.01 13:03:36 | 000,001,392 | —- | M] () – C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.10.01 13:03:36 | 000,002,252 | —- | M] () – C:\Programme\mozilla firefox\searchplugins\bing.xml
[2011.10.01 13:03:36 | 000,001,153 | —- | M] () – C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2011.10.01 13:03:36 | 000,006,805 | —- | M] () – C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.10.01 13:03:36 | 000,001,178 | —- | M] () – C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.10.01 13:03:36 | 000,001,105 | —- | M] () – C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml

O1 HOSTS File: ([2001.08.23 22:00:00 | 000,000,820 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (ZoneAlarm Security Engine Registrar) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Programme\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Programme\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O3 - HKCU\..\Toolbar\WebBrowser: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Programme\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [ISW] C:\Programme\CheckPoint\ZAForceField\ForceField.exe (Check Point Software Technologies)
O4 - HKLM..\Run: [LCONTROL] C:\Programme\Lenovo\ATK Hotkey\LCONTROL.exe (ATK0101)
O4 - HKLM..\Run: [LFKA] C:\Programme\Lenovo\ATK Hotkey\LFKA.exe (Lenovo)
O4 - HKLM..\Run: [LPMailChecker] C:\Programme\Lenovo\LenovoCare\LPMLCHK.EXE (Lenovo Group Limited)
O4 - HKLM..\Run: [LPManager] C:\Programme\Lenovo\LenovoCare\LPMGR.EXE (Lenovo Group Limited)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [PSQLLauncher] C:\Programme\ThinkVantage Fingerprint Software\launcher.exe (UPEK Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [TPHOTKEY] C:\Programme\Lenovo\HOTKEY\LVOSDSVC.exe (Lenovo Group Limited)
O4 - HKLM..\Run: [TVT Scheduler Proxy] C:\Programme\Gemeinsame Dateien\Lenovo\Scheduler\scheduler_proxy.exe (Lenovo Group Limited)
O4 - HKLM..\Run: [VMware hqtray] C:\Programme\VMware\VMware Player\hqtray.exe (VMware, Inc.)
O4 - HKLM..\Run: [ZoneAlarm] C:\Programme\CheckPoint\ZoneAlarm\zatray.exe (Check Point Software Technologies LTD)
O4 - HKCU..\Run: [] File not found
O4 - HKCU..\Run: [NokiaSuite.exe] C:\Programme\Nokia\Nokia Suite\NokiaSuite.exe (Nokia)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\WISO Mein Steuer-Sparbuch heute.lnk = C:\Programme\WISO\Steuersoftware 2011\mshaktuell.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: An OneNote s&enden; - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O8 - Extra context menu item: Nach Microsoft E&xcel; exportieren - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden; - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Verknüpfte &OneNote-Notizen; - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen; - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\ThinkPad\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\ThinkPad\Bluetooth Software\btsendto_ie.htm ()
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Programme\VMware\VMware Player\vsocklib.dll (VMware, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Programme\VMware\VMware Player\vsocklib.dll (VMware, Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = hq.kwsoft.de
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: GinaDLL - (vrlogon.dll) -C:\WINDOWS\System32\vrlogon.dll (UPEK Inc.)
O20 - Winlogon\Notify\psfus: DllName - (C:\Programme\ThinkVantage Fingerprint Software\psqlpwd.dll) - C:\Programme\ThinkVantage Fingerprint Software\psqlpwd.dll (UPEK Inc.)
O20 - Winlogon\Notify\tphotkey: DllName - (C:\Programme\Lenovo\HOTKEY\tphklock.dll) - C:\Programme\Lenovo\HOTKEY\tphklock.dll (Lenovo Group Limited)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.05.04 10:08:47 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: HidServ - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.VMnc - C:\WINDOWS\System32\vmnc.dll (VMware, Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012.01.09 17:50:27 | 000,584,192 | —- | C] (OldTimer Tools) – C:\Dokumente und Einstellungen\winter\Desktop\OTL.exe
[2012.01.09 08:38:03 | 000,016,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\spmsg.dll
[2012.01.06 14:26:27 | 000,000,000 | —D | C] – C:\Dokumente und Einstellungen\winter\Anwendungsdaten\Nokia Suite
[2012.01.06 14:26:26 | 000,000,000 | —D | C] – C:\Dokumente und Einstellungen\winter\Anwendungsdaten\Nokia
[2012.01.06 14:24:21 | 000,026,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\usbser.sys
[2012.01.06 14:23:57 | 000,016,928 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\spmsgXP_2k3.dll
[2012.01.06 14:23:15 | 000,000,000 | R–D | C] – C:\Dokumente und Einstellungen\winter\Eigene Dateien\Eigene Videos
[2012.01.06 14:23:11 | 000,000,000 | —D | C] – C:\Dokumente und Einstellungen\winter\Lokale Einstellungen\Anwendungsdaten\NokiaAccount
[2012.01.06 14:22:31 | 000,000,000 | —D | C] – C:\Dokumente und Einstellungen\winter\Lokale Einstellungen\Anwendungsdaten\Nokia
[2012.01.06 14:22:25 | 000,000,000 | —D | C] – C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Suite
[2012.01.06 14:22:21 | 000,000,000 | —D | C] – C:\Dokumente und Einstellungen\winter\Anwendungsdaten\PC Suite
[2012.01.06 14:21:46 | 000,000,000 | —D | C] – C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Nokia
[2012.01.06 14:21:23 | 000,000,000 | —D | C] – C:\Programme\Gemeinsame Dateien\Nokia
[2012.01.06 14:21:23 | 000,000,000 | —D | C] – C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Nokia
[2012.01.06 14:20:36 | 000,000,000 | —D | C] – C:\Programme\DIFX
[2012.01.06 14:20:35 | 000,018,816 | —- | C] (Nokia) – C:\WINDOWS\System32\drivers\pccsmcfd.sys
[2012.01.06 14:20:28 | 000,000,000 | —D | C] – C:\Programme\PC Connectivity Solution
[2012.01.06 14:20:18 | 000,008,192 | —- | C] (Nokia) – C:\WINDOWS\System32\drivers\usbser_lowerfltj.sys
[2012.01.06 14:20:17 | 000,023,168 | —- | C] (Nokia) – C:\WINDOWS\System32\drivers\ccdcmbo.sys
[2012.01.06 14:20:17 | 000,008,192 | —- | C] (Nokia) – C:\WINDOWS\System32\drivers\usbser_lowerflt.sys
[2012.01.06 14:20:16 | 001,461,992 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wdfcoinstaller01009.dll
[2012.01.06 14:20:16 | 000,605,696 | —- | C] (Nokia) – C:\WINDOWS\System32\nmwcdcocls.dll
[2012.01.06 14:20:16 | 000,123,904 | —- | C] (Nokia) – C:\WINDOWS\System32\ccdcmbwu.dll
[2012.01.06 14:20:16 | 000,018,176 | —- | C] (Nokia) – C:\WINDOWS\System32\drivers\ccdcmb.sys
[2012.01.06 14:20:01 | 000,075,264 | —- | C] (Nokia) – C:\WINDOWS\System32\nmwcdcls.dll
[2012.01.06 14:17:59 | 000,000,000 | —D | C] – C:\WINDOWS\System32\drivers\UMDF
[2012.01.06 14:17:59 | 000,000,000 | —D | C] – C:\WINDOWS\System32\LogFiles
[2012.01.06 14:16:35 | 000,000,000 | —D | C] – C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NokiaInstallerCache
[2012.01.06 14:16:35 | 000,000,000 | —D | C] – C:\Programme\Nokia
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012.01.09 17:53:33 | 000,192,822 | —- | M] () – C:\WINDOWS\System32\nvModes.001
[2012.01.09 17:53:16 | 000,195,099 | —- | M] () – C:\WINDOWS\System32\nvapps.xml
[2012.01.09 17:12:38 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Dokumente und Einstellungen\winter\Desktop\OTL.exe
[2012.01.09 16:00:00 | 000,000,324 | —- | M] () – C:\WINDOWS\tasks\SystemToolsDailyTest.job
[2012.01.09 15:36:13 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2012.01.09 08:41:33 | 000,417,440 | —- | M] () – C:\WINDOWS\System32\perfh007.dat
[2012.01.09 08:41:33 | 000,403,076 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2012.01.09 08:41:33 | 000,074,778 | —- | M] () – C:\WINDOWS\System32\perfc007.dat
[2012.01.09 08:41:33 | 000,062,014 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2012.01.09 08:38:37 | 000,001,355 | —- | M] () – C:\WINDOWS\imsins.BAK
[2012.01.09 08:35:26 | 000,192,822 | —- | M] () – C:\WINDOWS\System32\nvModes.dat
[2012.01.06 14:24:18 | 000,000,000 | -H– | M] () – C:\WINDOWS\System32\drivers\UMDF\Msft_User_WpdMtpDr_01_00_00.Wdf
[2012.01.06 14:24:09 | 000,000,000 | -H– | M] () – C:\WINDOWS\System32\drivers\Msft_Kernel_ccdcmb_01009.Wdf
[2012.01.06 14:24:08 | 000,000,000 | -H– | M] () – C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
[2012.01.06 14:18:08 | 000,000,000 | -H– | M] () – C:\WINDOWS\System32\drivers\UMDF\MsftWdf_user_01_00_00.Wdf
[2012.01.05 13:40:24 | 000,956,224 | —- | M] () – C:\Erdgeschoss.zip
[2012.01.05 13:40:05 | 000,555,706 | —- | M] () – C:\Erstes_OG.zip
[2012.01.05 13:22:57 | 001,466,368 | R— | M] () – C:\Dokumente und Einstellungen\All Users\Dokumente\ESBK.mbb
[2012.01.05 13:22:57 | 000,722,944 | R— | M] () – C:\Dokumente und Einstellungen\All Users\Dokumente\ESBK.mb
[2012.01.03 18:46:15 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011.12.21 00:00:00 | 000,000,512 | —- | M] () – C:\WINDOWS\tasks\PCDoctorBackgroundMonitorTask.job
[2011.12.15 09:36:37 | 000,228,000 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2011.12.12 19:36:42 | 000,134,856 | —- | M] (Avira GmbH) – C:\WINDOWS\System32\drivers\avipbb.sys
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012.01.06 14:24:18 | 000,000,000 | -H– | C] () – C:\WINDOWS\System32\drivers\UMDF\Msft_User_WpdMtpDr_01_00_00.Wdf
[2012.01.06 14:24:09 | 000,000,000 | -H– | C] () – C:\WINDOWS\System32\drivers\Msft_Kernel_ccdcmb_01009.Wdf
[2012.01.06 14:24:08 | 000,000,000 | -H– | C] () – C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
[2012.01.06 14:18:08 | 000,000,000 | -H– | C] () – C:\WINDOWS\System32\drivers\UMDF\MsftWdf_user_01_00_00.Wdf
[2012.01.05 13:41:42 | 000,956,224 | —- | C] () – C:\Erdgeschoss.zip
[2012.01.05 13:41:42 | 000,555,706 | —- | C] () – C:\Erstes_OG.zip
[2011.10.05 16:36:02 | 000,000,552 | —- | C] () – C:\WINDOWS\wiso.ini
[2011.10.01 18:39:28 | 000,000,022 | —- | C] () – C:\Dokumente und Einstellungen\winter\Lokale Einstellungen\Anwendungsdaten\kodakpcd.ini
[2011.09.07 08:19:12 | 000,048,892 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2011.06.22 13:58:10 | 000,000,139 | —- | C] () – C:\WINDOWS\ODBC.INI
[2010.12.08 11:16:26 | 000,000,000 | —- | C] () – C:\WINDOWS\nsreg.dat
[2010.05.04 13:49:48 | 000,077,824 | —- | C] () – C:\WINDOWS\System32\SynTPCoI.dll
[2010.05.04 11:05:44 | 000,192,822 | —- | C] () – C:\WINDOWS\System32\nvModes.dat
[2010.05.04 10:43:08 | 000,262,216 | —- | C] () – C:\WINDOWS\System32\IPTests.dll
[2010.05.04 10:43:06 | 000,651,264 | —- | C] () – C:\WINDOWS\System32\libeay32.dll
[2010.05.04 10:43:06 | 000,147,456 | —- | C] () – C:\WINDOWS\System32\ssleay32.dll
[2010.05.04 10:27:51 | 000,522,256 | R— | C] () – C:\WINDOWS\System32\drivers\USBSTK1.sys
[2010.05.04 10:27:51 | 000,145,424 | R— | C] () – C:\WINDOWS\System32\drivers\USBSTK2.sys
[2010.05.04 10:27:51 | 000,055,824 | R— | C] () – C:\WINDOWS\CamUnist.exe
[2010.05.04 10:27:51 | 000,025,616 | R— | C] () – C:\WINDOWS\System32\drivers\USBSTK3.sys
[2010.05.04 10:27:50 | 000,299,920 | R— | C] () – C:\WINDOWS\System32\drivers\USBSTK0.sys
[2010.05.04 10:27:50 | 000,173,584 | R— | C] () – C:\WINDOWS\System32\drivers\USBSTK.sys
[2010.05.04 10:22:27 | 000,061,440 | R— | C] () – C:\WINDOWS\System32\AABATT.dll
[2010.05.04 10:22:27 | 000,005,760 | —- | C] () – C:\WINDOWS\System32\drivers\A0101X32.sys
[2010.05.04 10:11:04 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2010.05.04 10:06:13 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2010.05.04 10:05:55 | 000,021,740 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2010.05.04 10:05:05 | 000,228,000 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010.02.25 17:45:58 | 002,860,384 | —- | C] () – C:\WINDOWS\System32\btwicons.dll
[2008.06.20 02:03:00 | 001,724,416 | —- | C] () – C:\WINDOWS\System32\nvwdmcpl.dll
[2008.06.20 02:03:00 | 001,657,376 | —- | C] () – C:\WINDOWS\System32\nwiz.exe
[2008.06.20 02:03:00 | 001,503,232 | —- | C] () – C:\WINDOWS\System32\nview.dll
[2008.06.20 02:03:00 | 001,346,080 | —- | C] () – C:\WINDOWS\System32\nvdspsch.exe
[2008.06.20 02:03:00 | 001,101,824 | —- | C] () – C:\WINDOWS\System32\nvwimg.dll
[2008.06.20 02:03:00 | 000,466,944 | —- | C] () – C:\WINDOWS\System32\nvshell.dll
[2008.06.20 02:03:00 | 000,449,056 | —- | C] () – C:\WINDOWS\System32\nvappbar.exe
[2008.06.20 02:03:00 | 000,432,672 | —- | C] () – C:\WINDOWS\System32\keystone.exe
[2008.04.14 07:06:26 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\Dcache.bin
[2008.01.04 14:13:58 | 000,073,728 | —- | C] () – C:\WINDOWS\System32\DEVMAN.DLL
[2006.12.31 06:57:08 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2001.11.14 11:56:00 | 001,802,240 | —- | C] () – C:\WINDOWS\System32\lcppn21.dll
[2001.08.23 22:00:00 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2001.08.23 22:00:00 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2001.08.23 22:00:00 | 000,417,440 | —- | C] () – C:\WINDOWS\System32\perfh007.dat
[2001.08.23 22:00:00 | 000,403,076 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2001.08.23 22:00:00 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2001.08.23 22:00:00 | 000,269,480 | —- | C] () – C:\WINDOWS\System32\perfi007.dat
[2001.08.23 22:00:00 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2001.08.23 22:00:00 | 000,074,778 | —- | C] () – C:\WINDOWS\System32\perfc007.dat
[2001.08.23 22:00:00 | 000,062,014 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2001.08.23 22:00:00 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2001.08.23 22:00:00 | 000,034,478 | —- | C] () – C:\WINDOWS\System32\perfd007.dat
[2001.08.23 22:00:00 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2001.08.23 22:00:00 | 000,004,463 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2001.08.23 22:00:00 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat

========== LOP Check ==========

[2011.10.05 16:35:59 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Buhl Data Service GmbH
[2011.11.26 17:43:02 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CheckPoint
[2010.09.15 12:08:35 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Ericsson
[2010.05.04 14:20:24 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Lenovo
[2012.01.06 14:21:23 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Nokia
[2012.01.06 14:16:35 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NokiaInstallerCache
[2012.01.06 14:22:25 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Suite
[2010.05.04 11:38:35 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PCDr
[2011.06.21 16:57:06 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Shrew Soft VPN
[2010.05.04 11:26:48 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\UIB
[2011.06.21 16:56:12 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\XPhone20
[2011.10.05 16:37:15 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\winter\Anwendungsdaten\Buhl Data Service
[2011.06.30 17:59:32 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\winter\Anwendungsdaten\CheckPoint
[2011.06.20 13:50:58 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\winter\Anwendungsdaten\Ericsson
[2011.06.20 10:32:38 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\winter\Anwendungsdaten\Lenovo
[2011.08.15 07:46:36 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\winter\Anwendungsdaten\LibreOffice
[2012.01.06 14:26:26 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\winter\Anwendungsdaten\Nokia
[2012.01.06 14:26:27 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\winter\Anwendungsdaten\Nokia Suite
[2012.01.06 14:25:09 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\winter\Anwendungsdaten\PC Suite
[2011.10.01 18:35:08 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\winter\Anwendungsdaten\Skinux
[2011.07.24 08:41:41 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\winter\Anwendungsdaten\Subversion
[2011.09.25 14:22:33 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\winter\Anwendungsdaten\Thunderbird
[2011.10.20 16:03:46 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\winter\Anwendungsdaten\XnView
[2011.12.21 00:00:00 | 000,000,512 | —- | M] () – C:\WINDOWS\Tasks\PCDoctorBackgroundMonitorTask.job
[2012.01.09 16:00:00 | 000,000,324 | —- | M] () – C:\WINDOWS\Tasks\SystemToolsDailyTest.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2011.06.03 15:13:44 | 000,001,024 | —- | M] () – C:\.rnd
[2010.05.04 10:08:47 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2010.05.04 10:03:41 | 000,000,211 | -HS- | M] () – C:\boot.ini
[2001.08.23 22:00:00 | 000,004,952 | RHS- | M] () – C:\bootfont.bin
[2009.08.26 14:49:24 | 001,048,576 | RH– | M] () – C:\BOXSTER.BIN
[2010.05.04 10:08:47 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2012.01.05 13:40:24 | 000,956,224 | —- | M] () – C:\Erdgeschoss.zip
[2012.01.05 13:40:05 | 000,555,706 | —- | M] () – C:\Erstes_OG.zip
[2010.12.07 16:00:29 | 000,000,000 | —- | M] () – C:\gp_0001.txt
[2010.05.04 10:08:47 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2010.05.04 10:08:47 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2008.04.13 21:13:04 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2008.04.13 23:01:56 | 000,251,712 | RHS- | M] () – C:\ntldr
[2012.01.09 15:36:07 | 2145,386,496 | -HS- | M] () – C:\pagefile.sys
[2010.07.23 19:47:01 | 000,197,652 | -H– | M] () – C:\treeinfo.wc

< %systemroot%\Fonts\*.com >

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2010.05.04 10:08:26 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2010.05.04 11:04:26 | 000,094,208 | —- | M] () – C:\WINDOWS\System32\config\default.sav
[2010.05.04 11:04:26 | 001,089,536 | —- | M] () – C:\WINDOWS\System32\config\software.sav
[2010.05.04 11:04:26 | 000,479,232 | —- | M] () – C:\WINDOWS\System32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2011.06.20 10:32:33 | 000,000,079 | —- | M] () – C:\Dokumente und Einstellungen\winter\Anwendungsdaten\Microsoft\Internet Explorer\Quick Launch\Desktop anzeigen.scf
[2011.06.20 10:32:33 | 000,000,064 | -HS- | M] () – C:\Dokumente und Einstellungen\winter\Anwendungsdaten\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2012.01.09 17:12:38 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Dokumente und Einstellungen\winter\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
"NoAutoUpdate" = 0
"AUOptions" = 3
"ScheduledInstallDay" = 0
"ScheduledInstallTime" = 11
"UseWUServer" = 1
"RescheduleWaitTimeEnabled" = 1
"RescheduleWaitTime" = 6
"DetectionFrequencyEnabled" = 1
"DetectionFrequency" = 11
"RebootWarningTimeoutEnabled" = 1
"RebootWarningTimeout" = 5
"RebootRelaunchTimeoutEnabled" = 1
"RebootRelaunchTimeout" = 65

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2012-01-09 07:41:53

< End of report >
Post #2
Could you please re-run the OTL scan and put a check mark beside "All Users" at the top of the window so we can get a look at Otto's profile

post the new log

thanks

also run the following:

  • Please download aswMBR.exe and save it to your desktop.
  • Double click aswMBR.exe to start the tool. (Vista/Windows 7 users - right click to run as administrator)
  • When asked if you want to download Avast's virus definitions please select Yes.
  • Click Scan

  • Upon completion of the scan, click Save log and save it to your desktop, and post that log in your next reply for review. Note - do NOT attempt any Fix yet.
  • You will also notice another file created on the desktop named MBR.dat. Right click that file and select Send To>Compressed (zipped) file. Attach that zipped file in your next reply as well.
Post #3
Thank you, CatByte.

Here is OTL.Txt from "all users":

OTL logfile created on: 10.01.2012 08:08:37 - Run 3
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Dokumente und Einstellungen\winter\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

3,00 Gb Total Physical Memory | 2,41 Gb Available Physical Memory | 80,21% Memory free
4,84 Gb Paging File | 4,07 Gb Available in Paging File | 84,15% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 39,06 Gb Total Space | 20,64 Gb Free Space | 52,83% Space Free | Partition Type: NTFS
Drive E: | 193,82 Gb Total Space | 12,22 Gb Free Space | 6,30% Space Free | Partition Type: NTFS

Computer Name: NB-XP-WINTER | User Name: winter | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Dokumente und Einstellungen\winter\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\CheckPoint\ZoneAlarm\vsmon.exe (Check Point Software Technologies LTD)
PRC - C:\Programme\CheckPoint\ZoneAlarm\zatray.exe (Check Point Software Technologies LTD)
PRC - C:\Programme\CheckPoint\ZAForceField\ISWSVC.exe (Check Point Software Technologies)
PRC - C:\Programme\CheckPoint\ZAForceField\ForceField.exe (Check Point Software Technologies)
PRC - C:\Programme\Nokia\Nokia Suite\NokiaSuite.exe (Nokia)
PRC - C:\Programme\PC Connectivity Solution\ServiceLayer.exe (Nokia)
PRC - C:\Programme\PC Connectivity Solution\Transports\NclUSBSrv.exe (Nokia)
PRC - C:\Programme\PC Connectivity Solution\Transports\NclMSBTSrv.exe (Nokia)
PRC - C:\Programme\PC Connectivity Solution\Transports\NclBCBTSrv.exe (Nokia)
PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Programme\VMware\VMware Player\hqtray.exe (VMware, Inc.)
PRC - C:\WINDOWS\system32\vmnetdhcp.exe (VMware, Inc.)
PRC - C:\WINDOWS\system32\vmnat.exe (VMware, Inc.)
PRC - C:\Programme\VMware\VMware Player\vmware-authd.exe (VMware, Inc.)
PRC - C:\Programme\Common Files\VMware\USB\vmware-usbarbitrator.exe (VMware, Inc.)
PRC - C:\Programme\ShrewSoft\VPN Client\iked.exe ()
PRC - C:\Programme\ShrewSoft\VPN Client\ipsecd.exe ()
PRC - C:\Programme\ThinkPad\Bluetooth Software\bin\btwdins.exe (Broadcom Corporation.)
PRC - C:\Programme\Intel\WiFi\bin\EvtEng.exe (Intel® Corporation)
PRC - C:\Programme\Intel\WiFi\bin\S24EvMon.exe (Intel® Corporation)
PRC - C:\Programme\Gemeinsame Dateien\Intel\WirelessCommon\RegSrvc.exe (Intel® Corporation)
PRC - C:\Programme\NTP\bin\ntpd.exe ()
PRC - C:\Programme\Lenovo\HOTKEY\TPONSCR.exe (Lenovo Group Limited)
PRC - C:\Programme\Lenovo\ZOOM\TpScrex.exe (Lenovo Group Limited)
PRC - C:\Programme\Lenovo\System Update\SUService.exe (Lenovo Group Limited)
PRC - C:\Programme\Lenovo\LenovoCare\LPMGR.EXE (Lenovo Group Limited)
PRC - C:\Programme\Lenovo\LenovoCare\LPMLCHK.EXE (Lenovo Group Limited)
PRC - C:\Programme\Lenovo\ATK Hotkey\LFKA.exe (Lenovo)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
PRC - C:\WINDOWS\system32\acs.exe (Atheros)
PRC - C:\Programme\Lenovo\HOTKEY\LVOSDSVC.exe (Lenovo Group Limited)
PRC - C:\Programme\Lenovo\ATK Hotkey\LControl.exe (ATK0101)
PRC - C:\Programme\Lenovo\ATK Hotkey\LFKAS.exe ()
PRC - C:\Programme\Gemeinsame Dateien\Lenovo\Scheduler\scheduler_proxy.exe (Lenovo Group Limited)
PRC - C:\Programme\Gemeinsame Dateien\Lenovo\Scheduler\tvtsched.exe (Lenovo Group Limited)
PRC - C:\Programme\Lenovo\ATK Hotkey\GFNEXSrv.exe ()
PRC - C:\Programme\Gemeinsame Dateien\Lenovo\tvt_reg_monitor_svc.exe (Lenovo Group Limited)


========== Modules (No Company Name) ==========

MOD - C:\Programme\Nokia\Nokia Suite\ssoengine.dll ()
MOD - C:\Programme\Nokia\Nokia Suite\securestorage.dll ()
MOD - C:\Programme\Nokia\Nokia Suite\qjson.dll ()
MOD - C:\Programme\Nokia\Nokia Suite\phonon4.dll ()
MOD - C:\Programme\Nokia\Nokia Suite\QxtWeb.dll ()
MOD - C:\Programme\Nokia\Nokia Suite\QxtCore.dll ()
MOD - C:\Programme\Nokia\Nokia Suite\QtXmlPatterns4.dll ()
MOD - C:\Programme\Nokia\Nokia Suite\QtXml4.dll ()
MOD - C:\Programme\Nokia\Nokia Suite\QtWebKit4.dll ()
MOD - C:\Programme\Nokia\Nokia Suite\QtSql4.dll ()
MOD - C:\Programme\Nokia\Nokia Suite\QtScript4.dll ()
MOD - C:\Programme\Nokia\Nokia Suite\QtOpenGL4.dll ()
MOD - C:\Programme\Nokia\Nokia Suite\QtNetwork4.dll ()
MOD - C:\Programme\Nokia\Nokia Suite\QtMultimediaKit1.dll ()
MOD - C:\Programme\Nokia\Nokia Suite\QtGui4.dll ()
MOD - C:\Programme\Nokia\Nokia Suite\QtDeclarative4.dll ()
MOD - C:\Programme\Nokia\Nokia Suite\QtCore4.dll ()
MOD - C:\Programme\Nokia\Nokia Suite\sqldrivers\qsqlite4.dll ()
MOD - C:\Programme\Nokia\Nokia Suite\Imageformats\qjpeg4.dll ()
MOD - C:\Programme\Nokia\Nokia Suite\Imageformats\qico4.dll ()
MOD - C:\Programme\Nokia\Nokia Suite\Imageformats\qgif4.dll ()
MOD - C:\Programme\Nokia\Nokia Suite\OviShareLib.dll ()
MOD - C:\Programme\Nokia\Nokia Suite\NService.dll ()
MOD - C:\Programme\Nokia\Nokia Suite\Maps Service API.dll ()
MOD - C:\Programme\Nokia\Nokia Suite\CommonUpdateChecker.dll ()
MOD - C:\Programme\Nokia\Nokia Suite\mediaservice\dsengine.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\865390db0278ac64f667038656d9c25f\System.ServiceProcess.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\67bce2b25897e074ba865016315fbc89\System.Xml.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\6836a951700c2eb01a933212425cda4e\System.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\ca87ba84221991839abbe7d4bc9c6721\mscorlib.ni.dll ()
MOD - C:\Programme\Avira\AntiVir Desktop\sqlite3.dll ()
MOD - C:\Programme\VMware\VMware Player\libxml2.dll ()
MOD - C:\Programme\VMware\VMware Player\zlib1.dll ()
MOD - C:\Programme\ShrewSoft\VPN Client\iked.exe ()
MOD - C:\Programme\ShrewSoft\VPN Client\ipsecd.exe ()
MOD - C:\Programme\ShrewSoft\VPN Client\libdtp.dll ()
MOD - C:\Programme\ShrewSoft\VPN Client\libike.dll ()
MOD - C:\Programme\ShrewSoft\VPN Client\libvnet.dll ()
MOD - C:\Programme\ShrewSoft\VPN Client\libpfk.dll ()
MOD - C:\Programme\ShrewSoft\VPN Client\libvflt.dll ()
MOD - C:\Programme\ShrewSoft\VPN Client\libip.dll ()
MOD - C:\Programme\ShrewSoft\VPN Client\liblog.dll ()
MOD - C:\Programme\ShrewSoft\VPN Client\libidb.dll ()
MOD - C:\Programme\ShrewSoft\VPN Client\libith.dll ()
MOD - C:\WINDOWS\system32\nview.dll ()
MOD - C:\WINDOWS\system32\nvshell.dll ()
MOD - C:\WINDOWS\system32\msdmo.dll ()
MOD - C:\Programme\PSPad editor\PSPadShell.dll ()
MOD - C:\Programme\Lenovo\ATK Hotkey\LFKAS.exe ()
MOD - C:\Programme\Lenovo\ATK Hotkey\GFNEXSrv.exe ()


========== Win32 Services (SafeList) ==========

SRV - (VisualSVNServer) – File not found
SRV - (HidServ) – File not found
SRV - (vsmon) – C:\Programme\CheckPoint\ZoneAlarm\vsmon.exe (Check Point Software Technologies LTD)
SRV - (IswSvc) – C:\Programme\CheckPoint\ZAForceField\IswSvc.exe (Check Point Software Technologies)
SRV - (ServiceLayer) – C:\Programme\PC Connectivity Solution\ServiceLayer.exe (Nokia)
SRV - (AntiVirSchedulerService) – C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) – C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (VMnetDHCP) – C:\WINDOWS\system32\vmnetdhcp.exe (VMware, Inc.)
SRV - (VMware NAT Service) – C:\WINDOWS\system32\vmnat.exe (VMware, Inc.)
SRV - (VMAuthdService) – C:\Programme\VMware\VMware Player\vmware-authd.exe (VMware, Inc.)
SRV - (VMUSBArbService) – C:\Programme\Common Files\VMware\USB\vmware-usbarbitrator.exe (VMware, Inc.)
SRV - (iked) – C:\Programme\ShrewSoft\VPN Client\iked.exe ()
SRV - (ipsecd) – C:\Programme\ShrewSoft\VPN Client\ipsecd.exe ()
SRV - (dtpd) – C:\Programme\ShrewSoft\VPN Client\dtpd.exe ()
SRV - (ufad-ws60) – C:\Programme\VMware\VMware Player\vmware-ufad.exe (VMware, Inc.)
SRV - (btwdins) – C:\Programme\ThinkPad\Bluetooth Software\bin\btwdins.exe (Broadcom Corporation.)
SRV - (EvtEng) Intel® – C:\Programme\Intel\WiFi\bin\EvtEng.exe (Intel® Corporation)
SRV - (S24EventMonitor) Intel® – C:\Programme\Intel\WiFi\bin\S24EvMon.exe (Intel® Corporation)
SRV - (RegSrvc) Intel® – C:\Programme\Gemeinsame Dateien\Intel\WirelessCommon\RegSrvc.exe (Intel® Corporation)
SRV - (osppsvc) – C:\Programme\Gemeinsame Dateien\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation)
SRV - (ose) – C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (NTP) – C:\Programme\NTP\bin\ntpd.exe ()
SRV - (SUService) – C:\Programme\Lenovo\System Update\SUService.exe (Lenovo Group Limited)
SRV - (acs) – C:\WINDOWS\system32\acs.exe (Atheros)
SRV - (LFKAS) – C:\Programme\Lenovo\ATK Hotkey\LFKAS.exe ()
SRV - (TVT Scheduler) – C:\Programme\Gemeinsame Dateien\Lenovo\Scheduler\tvtsched.exe (Lenovo Group Limited)
SRV - (ATKGFNEXSrv) – C:\Programme\Lenovo\ATK Hotkey\GFNEXSrv.exe ()
SRV - (ThinkVantage Registry Monitor Service) – C:\Programme\Gemeinsame Dateien\Lenovo\tvt_reg_monitor_svc.exe (Lenovo Group Limited)
SRV - (OracleMTSRecoveryService) – C:\XEClient\BIN\omtsreco.exe (Oracle Corporation)
SRV - (IDriverT) – C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation)


========== Driver Services (SafeList) ==========

DRV - (avipbb) – C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (Vsdatant) – C:\WINDOWS\system32\vsdatant.sys (Check Point Software Technologies LTD)
DRV - (ISWKL) – C:\Programme\CheckPoint\ZAForceField\ISWKL.sys (Check Point Software Technologies)
DRV - (avgntflt) – C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (avkmgr) – C:\WINDOWS\system32\drivers\avkmgr.sys (Avira GmbH)
DRV - (UsbserFilt) – C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys (Nokia)
DRV - (upperdev) – C:\WINDOWS\system32\drivers\usbser_lowerflt.sys (Nokia)
DRV - (nmwcdc) – C:\WINDOWS\system32\drivers\ccdcmbo.sys (Nokia)
DRV - (nmwcd) – C:\WINDOWS\system32\drivers\ccdcmb.sys (Nokia)
DRV - (vmx86) – C:\WINDOWS\system32\drivers\vmx86.sys (VMware, Inc.)
DRV - (vmci) – C:\WINDOWS\system32\drivers\vmci.sys (VMware, Inc.)
DRV - (vmkbd) – C:\WINDOWS\system32\drivers\VMkbd.sys (VMware, Inc.)
DRV - (VMnetBridge) – C:\WINDOWS\system32\drivers\vmnetbridge.sys (VMware, Inc.)
DRV - (VMnetuserif) – C:\WINDOWS\system32\drivers\vmnetuserif.sys (VMware, Inc.)
DRV - (hcmon) – C:\WINDOWS\system32\drivers\hcmon.sys (VMware, Inc.)
DRV - (vmusb) – C:\WINDOWS\system32\drivers\vmusb.sys (VMware, Inc.)
DRV - (VMnetAdapter) – C:\WINDOWS\system32\drivers\vmnetadapter.sys (VMware, Inc.)
DRV - (pflt) – C:\WINDOWS\system32\drivers\vfilter.sys (Shrew Soft Inc)
DRV - (vstor2-ws60) – C:\Programme\VMware\VMware Player\vstor2-ws60.sys (VMware, Inc.)
DRV - (vnet) – C:\WINDOWS\system32\drivers\virtualnet.sys (Shrew Soft Inc)
DRV - (ssmdrv) – C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (BTKRNL) – C:\WINDOWS\system32\drivers\btkrnl.sys (Broadcom Corporation.)
DRV - (BTWUSB) – C:\WINDOWS\system32\drivers\btwusb.sys (Broadcom Corporation.)
DRV - (NETw5x32) Intel® – C:\WINDOWS\system32\drivers\NETw5x32.sys (Intel Corporation)
DRV - (Shockprf) – C:\WINDOWS\System32\DRIVERS\Apsx86.sys (Lenovo.)
DRV - (TPDIGIMN) – C:\WINDOWS\System32\DRIVERS\ApsHM86.sys (Lenovo.)
DRV - (s24trans) – C:\WINDOWS\system32\drivers\s24trans.sys (Intel Corporation)
DRV - (smihlp) SMI Helper Driver (smihlp) – C:\Programme\ThinkVantage Fingerprint Software\smihlp.sys (UPEK Inc.)
DRV - (lnvomdm2) – C:\WINDOWS\system32\drivers\lnvomdm2.sys (MCCI Corporation)
DRV - (lnvounic) Ericsson F3507g Mobile Broadband Minicard Network Adapter (WDM) – C:\WINDOWS\system32\drivers\lnvounic.sys (MCCI Corporation)
DRV - (lnvomdm) – C:\WINDOWS\system32\drivers\lnvomdm.sys (MCCI Corporation)
DRV - (lnvond5) Ericsson F3507g Mobile Broadband Minicard Network Adapter (NDIS) – C:\WINDOWS\system32\drivers\lnvond5.sys (MCCI Corporation)
DRV - (lnvocard) – C:\WINDOWS\system32\drivers\lnvocard.sys (MCCI Corporation)
DRV - (lnvobus) Ericsson F3507g Mobile Broadband Minicard Composite Device driver (WDM) – C:\WINDOWS\system32\drivers\lnvobus.sys (MCCI Corporation)
DRV - (lnvomdfl2) – C:\WINDOWS\system32\drivers\lnvomdfl2.sys (MCCI Corporation)
DRV - (lnvomdfl) – C:\WINDOWS\system32\drivers\lnvomdfl.sys (MCCI Corporation)
DRV - (lnvogps) – C:\WINDOWS\system32\drivers\lnvogps.sys (Ericsson AB)
DRV - (NVHDA) – C:\WINDOWS\system32\drivers\nvhda32.sys (NVIDIA Corporation)
DRV - (pccsmcfd) – C:\WINDOWS\system32\drivers\pccsmcfd.sys (Nokia)
DRV - (DCamUSBGene) – C:\WINDOWS\system32\drivers\USBSTK.sys ()
DRV - (Sony_EricssonWWSC) – C:\WINDOWS\system32\drivers\lnvoscard.sys (Sony Ericsson)
DRV - (CnxtHdAudService) – C:\WINDOWS\system32\drivers\CHDAU32.sys (Conexant Systems Inc.)
DRV - (lenovo.smi) – C:\WINDOWS\system32\drivers\smiif32.sys (Lenovo Group Limited)
DRV - (HSF_DPV) – C:\WINDOWS\system32\drivers\HSF_DPV.sys (Conexant Systems, Inc.)
DRV - (HSFHWAZL) – C:\WINDOWS\system32\drivers\HSFHWAZL.sys (Conexant Systems, Inc.)
DRV - (winachsf) – C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (rimmptsk) – C:\WINDOWS\system32\drivers\rimmptsk.sys (REDC)
DRV - (WSIMD) – C:\WINDOWS\system32\drivers\wsimd.sys (Atheros Communications, Inc.)
DRV - (RTLE8023xp) – C:\WINDOWS\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation )
DRV - (MTsensor) – C:\WINDOWS\system32\drivers\A0101X32.sys ()
DRV - (rismxdp) – C:\WINDOWS\system32\drivers\rixdptsk.sys (REDC)
DRV - (rimsptsk) – C:\WINDOWS\system32\drivers\rimsptsk.sys (REDC)
DRV - (ASMMAP) – C:\Programme\Lenovo\ATK Hotkey\ASMMAP.sys ()
DRV - (psadd) – C:\WINDOWS\system32\drivers\psadd.sys (Lenovo (United States) Inc.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========



IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-2000478354-1275210071-1801674531-1009\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


IE - HKU\S-1-5-21-2000478354-1275210071-1801674531-1013\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@checkpoint.com/FFApi: C:\Programme\CheckPoint\ZAForceField\TrustChecker\bin\npFFApi.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Programme\CheckPoint\ZAForceField\TrustChecker [2011.11.26 17:43:48 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.01.08 18:51:24 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011.09.15 08:23:50 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 5.0\extensions\\Components: C:\Programme\Mozilla Thunderbird\components [2011.08.04 09:10:07 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 5.0\extensions\\Plugins: C:\Programme\Mozilla Thunderbird\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\[removed]: C:\Programme\Nokia\Nokia Suite\Connectors\Thunderbird Connector\ThunderbirdExtension_5.0 [2012.01.06 14:21:34 | 000,000,000 | —D | M]

[2011.06.30 17:41:16 | 000,000,000 | —D | M] (No name found) – C:\Dokumente und Einstellungen\winter\Anwendungsdaten\Mozilla\Extensions
[2011.11.18 13:00:50 | 000,000,000 | —D | M] (No name found) – C:\Programme\Mozilla Firefox\extensions
[2010.09.01 10:00:29 | 000,000,000 | —D | M] (Java Quick Starter) – C:\PROGRAMME\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2012.01.08 18:51:23 | 000,121,816 | —- | M] (Mozilla Foundation) – C:\Programme\mozilla firefox\components\browsercomps.dll
[2011.05.04 03:52:23 | 000,476,904 | —- | M] (Sun Microsystems, Inc.) – C:\Programme\mozilla firefox\plugins\npdeployJava1.dll
[2011.10.01 13:03:36 | 000,001,392 | —- | M] () – C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.10.01 13:03:36 | 000,002,252 | —- | M] () – C:\Programme\mozilla firefox\searchplugins\bing.xml
[2011.10.01 13:03:36 | 000,001,153 | —- | M] () – C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2011.10.01 13:03:36 | 000,006,805 | —- | M] () – C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.10.01 13:03:36 | 000,001,178 | —- | M] () – C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.10.01 13:03:36 | 000,001,105 | —- | M] () – C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml

O1 HOSTS File: ([2001.08.23 22:00:00 | 000,000,820 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (ZoneAlarm Security Engine Registrar) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Programme\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Programme\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O3 - HKU\S-1-5-21-2000478354-1275210071-1801674531-1009\..\Toolbar\WebBrowser: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Programme\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [ISW] C:\Programme\CheckPoint\ZAForceField\ForceField.exe (Check Point Software Technologies)
O4 - HKLM..\Run: [LCONTROL] C:\Programme\Lenovo\ATK Hotkey\LCONTROL.exe (ATK0101)
O4 - HKLM..\Run: [LFKA] C:\Programme\Lenovo\ATK Hotkey\LFKA.exe (Lenovo)
O4 - HKLM..\Run: [LPMailChecker] C:\Programme\Lenovo\LenovoCare\LPMLCHK.EXE (Lenovo Group Limited)
O4 - HKLM..\Run: [LPManager] C:\Programme\Lenovo\LenovoCare\LPMGR.EXE (Lenovo Group Limited)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [PSQLLauncher] C:\Programme\ThinkVantage Fingerprint Software\launcher.exe (UPEK Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [TPHOTKEY] C:\Programme\Lenovo\HOTKEY\LVOSDSVC.exe (Lenovo Group Limited)
O4 - HKLM..\Run: [TVT Scheduler Proxy] C:\Programme\Gemeinsame Dateien\Lenovo\Scheduler\scheduler_proxy.exe (Lenovo Group Limited)
O4 - HKLM..\Run: [VMware hqtray] C:\Programme\VMware\VMware Player\hqtray.exe (VMware, Inc.)
O4 - HKLM..\Run: [ZoneAlarm] C:\Programme\CheckPoint\ZoneAlarm\zatray.exe (Check Point Software Technologies LTD)
O4 - HKU\S-1-5-21-2000478354-1275210071-1801674531-1009..\Run: [] File not found
O4 - HKU\S-1-5-21-2000478354-1275210071-1801674531-1009..\Run: [NokiaSuite.exe] C:\Programme\Nokia\Nokia Suite\NokiaSuite.exe (Nokia)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\WISO Mein Steuer-Sparbuch heute.lnk = C:\Programme\WISO\Steuersoftware 2011\mshaktuell.exe ()
O4 - Startup: C:\Dokumente und Einstellungen\winter.KWSOFT\Startmenü\Programme\Autostart\XPhone 2.0.lnk = C:\WINDOWS\Installer\{6D36E55D-E2D6-4617-9DE6-AB1A012C8EE2}\XPhone.exe (InstallShield Software Corp.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-2000478354-1275210071-1801674531-1009\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-2000478354-1275210071-1801674531-1010\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-2000478354-1275210071-1801674531-1013\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: An OneNote s&enden; - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O8 - Extra context menu item: Nach Microsoft E&xcel; exportieren - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden; - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Verknüpfte &OneNote-Notizen; - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen; - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\ThinkPad\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\ThinkPad\Bluetooth Software\btsendto_ie.htm ()
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Programme\VMware\VMware Player\vsocklib.dll (VMware, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Programme\VMware\VMware Player\vsocklib.dll (VMware, Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = hq.kwsoft.de
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: GinaDLL - (vrlogon.dll) -C:\WINDOWS\System32\vrlogon.dll (UPEK Inc.)
O20 - Winlogon\Notify\psfus: DllName - (C:\Programme\ThinkVantage Fingerprint Software\psqlpwd.dll) - C:\Programme\ThinkVantage Fingerprint Software\psqlpwd.dll (UPEK Inc.)
O20 - Winlogon\Notify\tphotkey: DllName - (C:\Programme\Lenovo\HOTKEY\tphklock.dll) - C:\Programme\Lenovo\HOTKEY\tphklock.dll (Lenovo Group Limited)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.05.04 10:08:47 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: HidServ - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.VMnc - C:\WINDOWS\System32\vmnc.dll (VMware, Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012.01.09 17:50:27 | 000,584,192 | —- | C] (OldTimer Tools) – C:\Dokumente und Einstellungen\winter\Desktop\OTL.exe
[2012.01.09 08:38:03 | 000,016,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\spmsg.dll
[2012.01.06 14:26:27 | 000,000,000 | —D | C] – C:\Dokumente und Einstellungen\winter\Anwendungsdaten\Nokia Suite
[2012.01.06 14:26:26 | 000,000,000 | —D | C] – C:\Dokumente und Einstellungen\winter\Anwendungsdaten\Nokia
[2012.01.06 14:24:21 | 000,026,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\usbser.sys
[2012.01.06 14:23:57 | 000,016,928 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\spmsgXP_2k3.dll
[2012.01.06 14:23:15 | 000,000,000 | R–D | C] – C:\Dokumente und Einstellungen\winter\Eigene Dateien\Eigene Videos
[2012.01.06 14:23:11 | 000,000,000 | —D | C] – C:\Dokumente und Einstellungen\winter\Lokale Einstellungen\Anwendungsdaten\NokiaAccount
[2012.01.06 14:22:31 | 000,000,000 | —D | C] – C:\Dokumente und Einstellungen\winter\Lokale Einstellungen\Anwendungsdaten\Nokia
[2012.01.06 14:22:25 | 000,000,000 | —D | C] – C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Suite
[2012.01.06 14:22:21 | 000,000,000 | —D | C] – C:\Dokumente und Einstellungen\winter\Anwendungsdaten\PC Suite
[2012.01.06 14:21:46 | 000,000,000 | —D | C] – C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Nokia
[2012.01.06 14:21:23 | 000,000,000 | —D | C] – C:\Programme\Gemeinsame Dateien\Nokia
[2012.01.06 14:21:23 | 000,000,000 | —D | C] – C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Nokia
[2012.01.06 14:20:36 | 000,000,000 | —D | C] – C:\Programme\DIFX
[2012.01.06 14:20:35 | 000,018,816 | —- | C] (Nokia) – C:\WINDOWS\System32\drivers\pccsmcfd.sys
[2012.01.06 14:20:28 | 000,000,000 | —D | C] – C:\Programme\PC Connectivity Solution
[2012.01.06 14:20:18 | 000,008,192 | —- | C] (Nokia) – C:\WINDOWS\System32\drivers\usbser_lowerfltj.sys
[2012.01.06 14:20:17 | 000,023,168 | —- | C] (Nokia) – C:\WINDOWS\System32\drivers\ccdcmbo.sys
[2012.01.06 14:20:17 | 000,008,192 | —- | C] (Nokia) – C:\WINDOWS\System32\drivers\usbser_lowerflt.sys
[2012.01.06 14:20:16 | 001,461,992 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wdfcoinstaller01009.dll
[2012.01.06 14:20:16 | 000,605,696 | —- | C] (Nokia) – C:\WINDOWS\System32\nmwcdcocls.dll
[2012.01.06 14:20:16 | 000,123,904 | —- | C] (Nokia) – C:\WINDOWS\System32\ccdcmbwu.dll
[2012.01.06 14:20:16 | 000,018,176 | —- | C] (Nokia) – C:\WINDOWS\System32\drivers\ccdcmb.sys
[2012.01.06 14:20:01 | 000,075,264 | —- | C] (Nokia) – C:\WINDOWS\System32\nmwcdcls.dll
[2012.01.06 14:17:59 | 000,000,000 | —D | C] – C:\WINDOWS\System32\drivers\UMDF
[2012.01.06 14:17:59 | 000,000,000 | —D | C] – C:\WINDOWS\System32\LogFiles
[2012.01.06 14:16:35 | 000,000,000 | —D | C] – C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NokiaInstallerCache
[2012.01.06 14:16:35 | 000,000,000 | —D | C] – C:\Programme\Nokia
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012.01.10 07:54:07 | 000,192,822 | —- | M] () – C:\WINDOWS\System32\nvModes.001
[2012.01.10 07:54:00 | 000,195,099 | —- | M] () – C:\WINDOWS\System32\nvapps.xml
[2012.01.10 07:42:34 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2012.01.09 17:12:38 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Dokumente und Einstellungen\winter\Desktop\OTL.exe
[2012.01.09 16:00:00 | 000,000,324 | —- | M] () – C:\WINDOWS\tasks\SystemToolsDailyTest.job
[2012.01.09 08:41:33 | 000,417,440 | —- | M] () – C:\WINDOWS\System32\perfh007.dat
[2012.01.09 08:41:33 | 000,403,076 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2012.01.09 08:41:33 | 000,074,778 | —- | M] () – C:\WINDOWS\System32\perfc007.dat
[2012.01.09 08:41:33 | 000,062,014 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2012.01.09 08:38:37 | 000,001,355 | —- | M] () – C:\WINDOWS\imsins.BAK
[2012.01.09 08:35:26 | 000,192,822 | —- | M] () – C:\WINDOWS\System32\nvModes.dat
[2012.01.06 14:24:18 | 000,000,000 | -H– | M] () – C:\WINDOWS\System32\drivers\UMDF\Msft_User_WpdMtpDr_01_00_00.Wdf
[2012.01.06 14:24:09 | 000,000,000 | -H– | M] () – C:\WINDOWS\System32\drivers\Msft_Kernel_ccdcmb_01009.Wdf
[2012.01.06 14:24:08 | 000,000,000 | -H– | M] () – C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
[2012.01.06 14:18:08 | 000,000,000 | -H– | M] () – C:\WINDOWS\System32\drivers\UMDF\MsftWdf_user_01_00_00.Wdf
[2012.01.05 13:40:24 | 000,956,224 | —- | M] () – C:\Erdgeschoss.zip
[2012.01.05 13:40:05 | 000,555,706 | —- | M] () – C:\Erstes_OG.zip
[2012.01.05 13:22:57 | 001,466,368 | R— | M] () – C:\Dokumente und Einstellungen\All Users\Dokumente\ESBK.mbb
[2012.01.05 13:22:57 | 000,722,944 | R— | M] () – C:\Dokumente und Einstellungen\All Users\Dokumente\ESBK.mb
[2012.01.03 18:46:15 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011.12.21 00:00:00 | 000,000,512 | —- | M] () – C:\WINDOWS\tasks\PCDoctorBackgroundMonitorTask.job
[2011.12.15 09:36:37 | 000,228,000 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2011.12.12 19:36:42 | 000,134,856 | —- | M] (Avira GmbH) – C:\WINDOWS\System32\drivers\avipbb.sys
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012.01.06 14:24:18 | 000,000,000 | -H– | C] () – C:\WINDOWS\System32\drivers\UMDF\Msft_User_WpdMtpDr_01_00_00.Wdf
[2012.01.06 14:24:09 | 000,000,000 | -H– | C] () – C:\WINDOWS\System32\drivers\Msft_Kernel_ccdcmb_01009.Wdf
[2012.01.06 14:24:08 | 000,000,000 | -H– | C] () – C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
[2012.01.06 14:18:08 | 000,000,000 | -H– | C] () – C:\WINDOWS\System32\drivers\UMDF\MsftWdf_user_01_00_00.Wdf
[2012.01.05 13:41:42 | 000,956,224 | —- | C] () – C:\Erdgeschoss.zip
[2012.01.05 13:41:42 | 000,555,706 | —- | C] () – C:\Erstes_OG.zip
[2011.10.05 16:36:02 | 000,000,552 | —- | C] () – C:\WINDOWS\wiso.ini
[2011.10.01 18:39:28 | 000,000,022 | —- | C] () – C:\Dokumente und Einstellungen\winter\Lokale Einstellungen\Anwendungsdaten\kodakpcd.ini
[2011.09.07 08:19:12 | 000,048,892 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2011.06.22 13:58:10 | 000,000,139 | —- | C] () – C:\WINDOWS\ODBC.INI
[2010.12.08 11:16:26 | 000,000,000 | —- | C] () – C:\WINDOWS\nsreg.dat
[2010.05.04 13:49:48 | 000,077,824 | —- | C] () – C:\WINDOWS\System32\SynTPCoI.dll
[2010.05.04 11:05:44 | 000,192,822 | —- | C] () – C:\WINDOWS\System32\nvModes.dat
[2010.05.04 10:43:08 | 000,262,216 | —- | C] () – C:\WINDOWS\System32\IPTests.dll
[2010.05.04 10:43:06 | 000,651,264 | —- | C] () – C:\WINDOWS\System32\libeay32.dll
[2010.05.04 10:43:06 | 000,147,456 | —- | C] () – C:\WINDOWS\System32\ssleay32.dll
[2010.05.04 10:27:51 | 000,522,256 | R— | C] () – C:\WINDOWS\System32\drivers\USBSTK1.sys
[2010.05.04 10:27:51 | 000,145,424 | R— | C] () – C:\WINDOWS\System32\drivers\USBSTK2.sys
[2010.05.04 10:27:51 | 000,055,824 | R— | C] () – C:\WINDOWS\CamUnist.exe
[2010.05.04 10:27:51 | 000,025,616 | R— | C] () – C:\WINDOWS\System32\drivers\USBSTK3.sys
[2010.05.04 10:27:50 | 000,299,920 | R— | C] () – C:\WINDOWS\System32\drivers\USBSTK0.sys
[2010.05.04 10:27:50 | 000,173,584 | R— | C] () – C:\WINDOWS\System32\drivers\USBSTK.sys
[2010.05.04 10:22:27 | 000,061,440 | R— | C] () – C:\WINDOWS\System32\AABATT.dll
[2010.05.04 10:22:27 | 000,005,760 | —- | C] () – C:\WINDOWS\System32\drivers\A0101X32.sys
[2010.05.04 10:11:04 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2010.05.04 10:06:13 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2010.05.04 10:05:55 | 000,021,740 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2010.05.04 10:05:05 | 000,228,000 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010.02.25 17:45:58 | 002,860,384 | —- | C] () – C:\WINDOWS\System32\btwicons.dll
[2008.06.20 02:03:00 | 001,724,416 | —- | C] () – C:\WINDOWS\System32\nvwdmcpl.dll
[2008.06.20 02:03:00 | 001,657,376 | —- | C] () – C:\WINDOWS\System32\nwiz.exe
[2008.06.20 02:03:00 | 001,503,232 | —- | C] () – C:\WINDOWS\System32\nview.dll
[2008.06.20 02:03:00 | 001,346,080 | —- | C] () – C:\WINDOWS\System32\nvdspsch.exe
[2008.06.20 02:03:00 | 001,101,824 | —- | C] () – C:\WINDOWS\System32\nvwimg.dll
[2008.06.20 02:03:00 | 000,466,944 | —- | C] () – C:\WINDOWS\System32\nvshell.dll
[2008.06.20 02:03:00 | 000,449,056 | —- | C] () – C:\WINDOWS\System32\nvappbar.exe
[2008.06.20 02:03:00 | 000,432,672 | —- | C] () – C:\WINDOWS\System32\keystone.exe
[2008.04.14 07:06:26 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\Dcache.bin
[2008.01.04 14:13:58 | 000,073,728 | —- | C] () – C:\WINDOWS\System32\DEVMAN.DLL
[2006.12.31 06:57:08 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2001.11.14 11:56:00 | 001,802,240 | —- | C] () – C:\WINDOWS\System32\lcppn21.dll
[2001.08.23 22:00:00 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2001.08.23 22:00:00 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2001.08.23 22:00:00 | 000,417,440 | —- | C] () – C:\WINDOWS\System32\perfh007.dat
[2001.08.23 22:00:00 | 000,403,076 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2001.08.23 22:00:00 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2001.08.23 22:00:00 | 000,269,480 | —- | C] () – C:\WINDOWS\System32\perfi007.dat
[2001.08.23 22:00:00 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2001.08.23 22:00:00 | 000,074,778 | —- | C] () – C:\WINDOWS\System32\perfc007.dat
[2001.08.23 22:00:00 | 000,062,014 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2001.08.23 22:00:00 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2001.08.23 22:00:00 | 000,034,478 | —- | C] () – C:\WINDOWS\System32\perfd007.dat
[2001.08.23 22:00:00 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2001.08.23 22:00:00 | 000,004,463 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2001.08.23 22:00:00 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat

========== LOP Check ==========

[2011.06.20 16:12:20 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Lenovo
[2011.10.05 16:35:59 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Buhl Data Service GmbH
[2011.11.26 17:43:02 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CheckPoint
[2010.09.15 12:08:35 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Ericsson
[2010.05.04 14:20:24 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Lenovo
[2012.01.06 14:21:23 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Nokia
[2012.01.06 14:16:35 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NokiaInstallerCache
[2012.01.06 14:22:25 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Suite
[2010.05.04 11:38:35 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PCDr
[2011.06.21 16:57:06 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Shrew Soft VPN
[2010.05.04 11:26:48 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\UIB
[2011.06.21 16:56:12 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\XPhone20
[2012.01.09 15:37:35 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\hugo\Anwendungsdaten\CheckPoint
[2012.01.09 18:36:15 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\hugo\Anwendungsdaten\Ericsson
[2012.01.09 15:38:18 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\hugo\Anwendungsdaten\Lenovo
[2012.01.09 18:39:51 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\hugo\Anwendungsdaten\PC Suite
[2011.06.21 09:04:10 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\install\Anwendungsdaten\Lenovo
[2011.06.21 17:01:51 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\install\Anwendungsdaten\LibreOffice
[2011.06.21 14:37:58 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\install\Anwendungsdaten\XnView
[2011.06.22 09:29:22 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\install\Anwendungsdaten\XPhone20
[2011.11.20 15:40:20 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\otto\Anwendungsdaten\Amazon
[2011.06.30 18:07:32 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\otto\Anwendungsdaten\CheckPoint
[2011.06.30 18:09:37 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\otto\Anwendungsdaten\Ericsson
[2011.06.30 18:07:53 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\otto\Anwendungsdaten\Lenovo
[2012.01.06 14:30:18 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\otto\Anwendungsdaten\PC Suite
[2012.01.05 13:02:16 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\otto\Anwendungsdaten\Skinux
[2011.10.05 16:37:15 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\winter\Anwendungsdaten\Buhl Data Service
[2011.06.30 17:59:32 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\winter\Anwendungsdaten\CheckPoint
[2011.06.20 13:50:58 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\winter\Anwendungsdaten\Ericsson
[2011.06.20 10:32:38 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\winter\Anwendungsdaten\Lenovo
[2011.08.15 07:46:36 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\winter\Anwendungsdaten\LibreOffice
[2012.01.06 14:26:26 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\winter\Anwendungsdaten\Nokia
[2012.01.06 14:26:27 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\winter\Anwendungsdaten\Nokia Suite
[2012.01.06 14:25:09 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\winter\Anwendungsdaten\PC Suite
[2011.10.01 18:35:08 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\winter\Anwendungsdaten\Skinux
[2011.07.24 08:41:41 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\winter\Anwendungsdaten\Subversion
[2011.09.25 14:22:33 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\winter\Anwendungsdaten\Thunderbird
[2011.10.20 16:03:46 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\winter\Anwendungsdaten\XnView
[2011.07.01 07:33:22 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\winter.KWSOFT\Anwendungsdaten\CheckPoint
[2011.11.21 12:28:38 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\winter.KWSOFT\Anwendungsdaten\Ericsson
[2011.06.22 11:04:03 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\winter.KWSOFT\Anwendungsdaten\Lenovo
[2011.07.01 08:12:10 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\winter.KWSOFT\Anwendungsdaten\LibreOffice
[2012.01.09 17:51:12 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\winter.KWSOFT\Anwendungsdaten\PC Suite
[2011.07.31 14:46:15 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\winter.KWSOFT\Anwendungsdaten\Subversion
[2011.06.22 11:08:57 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\winter.KWSOFT\Anwendungsdaten\Thunderbird
[2011.11.23 11:52:05 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\winter.KWSOFT\Anwendungsdaten\XPhone20
[2011.12.21 00:00:00 | 000,000,512 | —- | M] () – C:\WINDOWS\Tasks\PCDoctorBackgroundMonitorTask.job
[2012.01.09 16:00:00 | 000,000,324 | —- | M] () – C:\WINDOWS\Tasks\SystemToolsDailyTest.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2011.06.03 15:13:44 | 000,001,024 | —- | M] () – C:\.rnd
[2010.05.04 10:08:47 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2010.05.04 10:03:41 | 000,000,211 | -HS- | M] () – C:\boot.ini
[2001.08.23 22:00:00 | 000,004,952 | RHS- | M] () – C:\bootfont.bin
[2009.08.26 14:49:24 | 001,048,576 | RH– | M] () – C:\BOXSTER.BIN
[2010.05.04 10:08:47 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2012.01.05 13:40:24 | 000,956,224 | —- | M] () – C:\Erdgeschoss.zip
[2012.01.05 13:40:05 | 000,555,706 | —- | M] () – C:\Erstes_OG.zip
[2010.12.07 16:00:29 | 000,000,000 | —- | M] () – C:\gp_0001.txt
[2010.05.04 10:08:47 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2010.05.04 10:08:47 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2008.04.13 21:13:04 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2008.04.13 23:01:56 | 000,251,712 | RHS- | M] () – C:\ntldr
[2012.01.10 07:42:29 | 2145,386,496 | -HS- | M] () – C:\pagefile.sys
[2010.07.23 19:47:01 | 000,197,652 | -H– | M] () – C:\treeinfo.wc

< %systemroot%\Fonts\*.com >

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2010.05.04 10:08:26 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2010.05.04 11:04:26 | 000,094,208 | —- | M] () – C:\WINDOWS\System32\config\default.sav
[2010.05.04 11:04:26 | 001,089,536 | —- | M] () – C:\WINDOWS\System32\config\software.sav
[2010.05.04 11:04:26 | 000,479,232 | —- | M] () – C:\WINDOWS\System32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2011.06.20 10:32:33 | 000,000,079 | —- | M] () – C:\Dokumente und Einstellungen\winter\Anwendungsdaten\Microsoft\Internet Explorer\Quick Launch\Desktop anzeigen.scf
[2011.06.20 10:32:33 | 000,000,064 | -HS- | M] () – C:\Dokumente und Einstellungen\winter\Anwendungsdaten\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2012.01.09 17:12:38 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Dokumente und Einstellungen\winter\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
"NoAutoUpdate" = 0
"AUOptions" = 3
"ScheduledInstallDay" = 0
"ScheduledInstallTime" = 11
"UseWUServer" = 1
"RescheduleWaitTimeEnabled" = 1
"RescheduleWaitTime" = 6
"DetectionFrequencyEnabled" = 1
"DetectionFrequency" = 11
"RebootWarningTimeoutEnabled" = 1
"RebootWarningTimeout" = 5
"RebootRelaunchTimeoutEnabled" = 1
"RebootRelaunchTimeout" = 65

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2012-01-09 07:41:53

< End of report >

And here is aswMBR.txt:

aswMBR version 0.9.9.1297 Copyright© 2011 AVAST Software
Run date: 2012-01-10 08:18:03
—————————–
08:18:03.657 OS Version: Windows 5.1.2600 Service Pack 3
08:18:03.657 Number of processors: 2 586 0xF0D
08:18:03.657 ComputerName: NB-XP-WINTER UserName: winter
08:18:04.032 Initialize success
08:19:43.518 AVAST engine defs: 12010901
08:20:05.596 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
08:20:05.596 Disk 0 Vendor: HITACHI_HTS542525K9SA00 BBFZC3HP Size: 238475MB BusType: 3
08:20:05.596 Disk 0 MBR read successfully
08:20:05.596 Disk 0 MBR scan
08:20:05.658 Disk 0 Windows XP default MBR code
08:20:05.658 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 39997 MB offset 63
08:20:05.674 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 198474 MB offset 81915435
08:20:05.690 Disk 0 scanning sectors +488392065
08:20:05.768 Disk 0 scanning C:\WINDOWS\system32\drivers
08:20:16.690 Service scanning
08:20:18.096 Modules scanning
08:20:26.190 Disk 0 trace - called modules:
08:20:26.190
08:20:26.612 AVAST engine scan C:\WINDOWS
08:20:33.424 AVAST engine scan C:\WINDOWS\system32
08:22:21.847 AVAST engine scan C:\WINDOWS\system32\drivers
08:22:36.222 AVAST engine scan C:\Dokumente und Einstellungen\winter
08:25:11.348 AVAST engine scan C:\Dokumente und Einstellungen\All Users
08:26:09.724 Scan finished successfully
08:27:23.834 Disk 0 MBR has been saved successfully to "C:\Dokumente und Einstellungen\hugo\Eigene Dateien\Downloads\MBR.dat"
08:27:23.850 The log file has been saved successfully to "C:\Dokumente und Einstellungen\hugo\Eigene Dateien\Downloads\aswMBR.txt"


Attached you will find the zipped MBR.dat

Attachments:

Post #4
Hi,

Please do the following:


Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
Post #5
Thank you, CatByte, I appreciate your help.

Here comes log.txt from ComboFix: There was a system restart during the ComboFix run, I assume this was expected.

ComboFix 12-01-10.02 - winter 11.01.2012 7:38.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.49.1031.18.3071.2322 [GMT 1:00]
ausgeführt von:: c:\dokumente und einstellungen\winter\Desktop\ComboFix.exe
FW: ZoneAlarm Free Firewall *Enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\dokumente und einstellungen\winter.KWSOFT\WINDOWS
c:\windows\m
c:\windows\m\ini\serie_m.ini
c:\windows\pkunzip.pif
c:\windows\pkzip.pif
.
.
((((((((((((((((((((((((((((((((((((((( Treiber/Dienste )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
——-\Legacy_NPF
.
.
((((((((((((((((((((((( Dateien erstellt von 2011-12-11 bis 2012-01-11 ))))))))))))))))))))))))))))))
.
.
2012-01-09 16:51 . 2012-01-09 16:51 ——– d—–w- c:\dokumente und einstellungen\winter.KWSOFT\Anwendungsdaten\PC Suite
2012-01-09 14:37 . 2012-01-11 06:28 ——– d—–w- c:\dokumente und einstellungen\hugo
2012-01-08 19:51 . 2012-01-08 19:51 ——– d-sh–w- c:\dokumente und einstellungen\otto\PrivacIE
2012-01-08 17:51 . 2012-01-08 17:51 548864 —-a-w- c:\programme\Mozilla Firefox\msvcp80.dll
2012-01-08 17:51 . 2012-01-08 17:51 479232 —-a-w- c:\programme\Mozilla Firefox\msvcm80.dll
2012-01-08 17:51 . 2012-01-08 17:51 43992 —-a-w- c:\programme\Mozilla Firefox\mozutils.dll
2012-01-08 17:51 . 2012-01-08 17:51 626688 —-a-w- c:\programme\Mozilla Firefox\msvcr80.dll
2012-01-06 13:30 . 2012-01-06 13:30 ——– d—–w- c:\dokumente und einstellungen\otto\Anwendungsdaten\PC Suite
2012-01-06 13:26 . 2012-01-06 13:26 ——– d—–w- c:\dokumente und einstellungen\winter\Anwendungsdaten\Nokia Suite
2012-01-06 13:26 . 2012-01-06 13:26 ——– d—–w- c:\dokumente und einstellungen\winter\Anwendungsdaten\Nokia
2012-01-06 13:24 . 2008-04-13 23:15 26112 -c–a-w- c:\windows\system32\dllcache\usbser.sys
2012-01-06 13:24 . 2008-04-13 23:15 26112 —-a-w- c:\windows\system32\drivers\usbser.sys
2012-01-06 13:23 . 2008-11-07 17:55 16928 ——w- c:\windows\system32\spmsgXP_2k3.dll
2012-01-06 13:22 . 2012-01-06 13:22 ——– d—–w- c:\dokumente und einstellungen\winter\Lokale Einstellungen\Anwendungsdaten\Nokia
2012-01-06 13:22 . 2012-01-06 13:22 ——– d—–w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\PC Suite
2012-01-06 13:22 . 2012-01-06 13:25 ——– d—–w- c:\dokumente und einstellungen\winter\Anwendungsdaten\PC Suite
2012-01-06 13:21 . 2012-01-06 13:21 ——– d—–w- c:\programme\Gemeinsame Dateien\Nokia
2012-01-06 13:21 . 2012-01-06 13:21 ——– d—–w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Nokia
2012-01-06 13:20 . 2012-01-06 13:20 ——– d—–w- c:\programme\DIFX
2012-01-06 13:20 . 2008-08-26 09:26 18816 —-a-w- c:\windows\system32\drivers\pccsmcfd.sys
2012-01-06 13:20 . 2012-01-06 13:20 ——– d—–w- c:\programme\PC Connectivity Solution
2012-01-06 13:20 . 2011-08-17 11:56 8192 —-a-w- c:\windows\system32\drivers\usbser_lowerfltj.sys
2012-01-06 13:20 . 2011-08-17 11:56 8192 —-a-w- c:\windows\system32\drivers\usbser_lowerflt.sys
2012-01-06 13:20 . 2011-08-17 11:56 23168 —-a-w- c:\windows\system32\drivers\ccdcmbo.sys
2012-01-06 13:20 . 2011-08-17 11:57 123904 —-a-w- c:\windows\system32\ccdcmbwu.dll
2012-01-06 13:20 . 2011-08-17 11:57 605696 —-a-w- c:\windows\system32\nmwcdcocls.dll
2012-01-06 13:20 . 2011-08-17 11:56 18176 —-a-w- c:\windows\system32\drivers\ccdcmb.sys
2012-01-06 13:20 . 2011-05-18 09:09 1461992 —-a-w- c:\windows\system32\wdfcoinstaller01009.dll
2012-01-06 13:20 . 2011-08-17 11:57 75264 —-a-w- c:\windows\system32\nmwcdcls.dll
2012-01-06 13:17 . 2012-01-06 13:24 ——– d—–w- c:\windows\system32\drivers\UMDF
2012-01-06 13:17 . 2012-01-06 13:17 ——– d—–w- c:\windows\system32\LogFiles
2012-01-06 13:16 . 2012-01-06 13:21 ——– d—–w- c:\programme\Nokia
2012-01-05 12:02 . 2012-01-05 12:02 ——– d—–w- c:\dokumente und einstellungen\otto\Anwendungsdaten\KodakCredentialStore
2012-01-05 12:02 . 2012-01-05 12:02 ——– d—–w- c:\dokumente und einstellungen\otto\Lokale Einstellungen\Anwendungsdaten\KodakGallery
2012-01-05 12:02 . 2012-01-05 12:02 ——– d—–w- c:\dokumente und einstellungen\otto\Anwendungsdaten\Skinux
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-01-05 12:40 . 2012-01-05 12:41 956224 —-a-w- C:\Erdgeschoss.zip
2012-01-05 12:40 . 2012-01-05 12:41 555706 —-a-w- C:\Erstes_OG.zip
2011-12-12 18:36 . 2011-10-22 11:32 134856 —-a-w- c:\windows\system32\drivers\avipbb.sys
2011-11-28 06:57 . 2011-06-30 17:13 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-11-23 14:40 . 2008-04-14 05:23 1859712 —-a-w- c:\windows\system32\win32k.sys
2011-11-04 19:13 . 2008-04-14 05:52 916992 —-a-w- c:\windows\system32\wininet.dll
2011-11-04 19:13 . 2008-04-14 05:53 1469440 —-a-w- c:\windows\system32\inetcpl.cpl
2011-11-04 19:13 . 2008-04-14 05:52 43520 —-a-w- c:\windows\system32\licmgr10.dll
2011-11-04 11:23 . 2008-04-14 05:25 385024 —-a-w- c:\windows\system32\html.iec
2011-11-01 16:07 . 2008-04-14 05:52 1288704 —-a-w- c:\windows\system32\ole32.dll
2011-10-28 05:31 . 2008-04-14 05:52 33280 —-a-w- c:\windows\system32\csrsrv.dll
2011-10-26 10:49 . 2008-04-14 07:30 2029568 —-a-w- c:\windows\system32\ntkrnlpa.exe
2011-10-26 10:49 . 2008-04-14 05:29 2151424 —-a-w- c:\windows\system32\ntoskrnl.exe
2011-10-18 11:13 . 2008-04-14 05:52 186880 —-a-w- c:\windows\system32\encdec.dll
2012-01-08 17:51 . 2011-09-15 07:26 121816 —-a-w- c:\programme\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NokiaSuite.exe"="c:\programme\Nokia\Nokia Suite\NokiaSuite.exe" [2011-11-01 1053056]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LCONTROL"="c:\programme\Lenovo\ATK Hotkey\LCONTROL.exe" [2008-03-19 77824]
"LFKA"="c:\programme\Lenovo\ATK Hotkey\LFKA.exe" [2008-04-15 315392]
"TPHOTKEY"="c:\programme\Lenovo\HOTKEY\LVOSDSVC.exe" [2008-03-24 64368]
"TpShocks"="TpShocks.exe" [2009-12-11 337256]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-15 13594624]
"nwiz"="nwiz.exe" [2008-12-15 1657376]
"PSQLLauncher"="c:\programme\ThinkVantage Fingerprint Software\launcher.exe" [2009-12-01 55048]
"TVT Scheduler Proxy"="c:\programme\Gemeinsame Dateien\Lenovo\Scheduler\scheduler_proxy.exe" [2008-03-04 487424]
"SynTPLpr"="c:\programme\Synaptics\SynTP\SynTPLpr.exe" [2008-04-10 122880]
"SynTPEnh"="c:\programme\Synaptics\SynTP\SynTPEnh.exe" [2008-04-10 524288]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-15 86016]
"LPManager"="c:\progra~1\Lenovo\LENOVO~1\LPMGR.exe" [2008-06-09 165208]
"LPMailChecker"="c:\progra~1\Lenovo\LENOVO~1\LPMLCHK.exe" [2008-06-09 124248]
"EZEJMNAP"="c:\progra~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe" [2009-12-01 256576]
"VMware hqtray"="c:\programme\VMware\VMware Player\hqtray.exe" [2011-03-25 64112]
"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2011-08-31 40368]
"Adobe ARM"="c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-29 937920]
"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2011-04-08 254696]
"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2011-10-11 258512]
"ISW"="c:\programme\CheckPoint\ZAForceField\ForceField.exe" [2011-11-03 738944]
"ZoneAlarm"="c:\programme\CheckPoint\ZoneAlarm\zatray.exe" [2011-11-09 73360]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\dokumente und einstellungen\winter.KWSOFT\Startmenü\Programme\Autostart\
XPhone 2.0.lnk - c:\windows\Installer\{6D36E55D-E2D6-4617-9DE6-AB1A012C8EE2}\XPhone.exe [2011-6-21 45056]
.
c:\dokumente und einstellungen\otto\Startmenü\Programme\Autostart\
0.9285615972777693.exe.lnk - c:\windows\system32\rundll32.exe [2008-4-14 33792]
.
c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\
WISO Mein Steuer-Sparbuch heute.lnk - c:\programme\WISO\Steuersoftware 2011\mshaktuell.exe [2011-10-5 1302640]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
2009-12-01 11:41 100104 —-a-w- c:\programme\ThinkVantage Fingerprint Software\psqlpwd.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]
2009-05-21 18:48 34080 —-a-w- c:\programme\Lenovo\HOTKEY\tphklock.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli c:\programme\ThinkVantage Fingerprint Software\psqlpwd.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\VisualSVN Server\\bin\\VisualSVNServer.exe"=
"c:\\Programme\\VMware\\VMware Player\\vmware-authd.exe"=
"c:\\Programme\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Windows-Remoteverwaltung
.
R0 TPDIGIMN;TPDIGIMN;c:\windows\system32\drivers\ApsHM86.sys [09.10.2009 11:10 20520]
R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [22.10.2011 12:32 36000]
R1 lenovo.smi;Lenovo System Interface Driver;c:\windows\system32\drivers\smiif32.sys [04.05.2010 14:17 13480]
R2 AntiVirSchedulerService;Avira Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [22.10.2011 12:32 86224]
R2 iked;ShrewSoft IKE Daemon;c:\programme\ShrewSoft\VPN Client\iked.exe -service –> c:\programme\ShrewSoft\VPN Client\iked.exe -service [?]
R2 ipsecd;ShrewSoft IPSEC Daemon;c:\programme\ShrewSoft\VPN Client\ipsecd.exe -service –> c:\programme\ShrewSoft\VPN Client\ipsecd.exe -service [?]
R2 ISWKL;ZoneAlarm Toolbar ISWKL;c:\programme\CheckPoint\ZAForceField\ISWKL.sys [03.11.2011 15:44 27016]
R2 IswSvc;ZoneAlarm Toolbar IswSvc;c:\programme\CheckPoint\ZAForceField\ISWSVC.exe [03.11.2011 15:44 497280]
R2 LFKAS;Service of LFKA;c:\programme\Lenovo\ATK Hotkey\LFKAS.exe [04.05.2010 10:22 208896]
R2 NTP;Network Time Protocol Daemon;c:\programme\NTP\bin\ntpd.exe -U 3 -M -g -c "c:\programme\NTP\etc\ntp.conf" –> c:\programme\NTP\bin\ntpd.exe -U 3 -M -g -c c:\programme\NTP\etc\ntp.conf [?]
R2 smihlp;SMI Helper Driver (smihlp);c:\programme\ThinkVantage Fingerprint Software\smihlp.sys [13.03.2009 12:47 12560]
R2 vmci;VMware vmci;c:\windows\system32\drivers\vmci.sys [25.03.2011 22:27 70768]
R2 VMUSBArbService;VMware USB Arbitration Service;c:\programme\Common Files\VMware\USB\vmware-usbarbitrator.exe [25.03.2011 21:27 539248]
R3 DCamUSBGene;Integrated Camera;c:\windows\system32\drivers\USBSTK.sys [04.05.2010 10:27 173584]
R3 lnvobus;Ericsson F3507g Mobile Broadband Minicard Composite Device driver (WDM);c:\windows\system32\drivers\lnvobus.sys [04.05.2010 13:50 282880]
R3 lnvocard;Ericsson F3507g Mobile Broadband Minicard Device Management;c:\windows\system32\drivers\lnvocard.sys [04.05.2010 13:51 356480]
R3 lnvogps;Ericsson F3507g Mobile Broadband Minicard GPS Port;c:\windows\system32\drivers\lnvogps.sys [04.05.2010 13:51 77864]
R3 lnvomdfl;Ericsson F3507g Mobile Broadband Minicard Modem Filter;c:\windows\system32\drivers\lnvomdfl.sys [04.05.2010 13:50 15104]
R3 lnvomdfl2;Ericsson F3507g Mobile Broadband Minicard Data Modem Filter;c:\windows\system32\drivers\lnvomdfl2.sys [04.05.2010 13:50 15104]
R3 lnvomdm;Ericsson F3507g Mobile Broadband Minicard Modem Driver;c:\windows\system32\drivers\lnvomdm.sys [04.05.2010 13:50 365056]
R3 lnvomdm2;Ericsson F3507g Mobile Broadband Minicard Data Modem;c:\windows\system32\drivers\lnvomdm2.sys [04.05.2010 13:50 408960]
R3 lnvounic;Ericsson F3507g Mobile Broadband Minicard Network Adapter (WDM);c:\windows\system32\drivers\lnvounic.sys [04.05.2010 13:51 375424]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32.sys [20.06.2008 02:03 41376]
R3 pflt;Shrew Soft Miniport Filter;c:\windows\system32\drivers\vfilter.sys [12.12.2010 21:40 24192]
R3 Sony_EricssonWWSC;Ericsson F3507g Mobile Broadband Minicard PC SC Port;c:\windows\system32\drivers\lnvoscard.sys [04.05.2010 13:51 24232]
S2 VisualSVNServer;VisualSVN Server;c:\programme\VisualSVN Server\bin\VisualSVNServer.exe [29.11.2010 18:02 23840]
S3 lnvond5;Ericsson F3507g Mobile Broadband Minicard Network Adapter (NDIS);c:\windows\system32\drivers\lnvond5.sys [04.05.2010 13:51 25984]
S3 osppsvc;Office Software Protection Platform;c:\programme\Gemeinsame Dateien\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [09.01.2010 20:37 4640000]
S3 vnet;Shrew Soft Virtual Adapter;c:\windows\system32\drivers\virtualnet.sys [22.07.2010 04:33 11904]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [14.04.2008 06:53 14336]
S4 dtpd;ShrewSoft DNS Proxy Daemon;c:\programme\ShrewSoft\VPN Client\dtpd.exe -service –> c:\programme\ShrewSoft\VPN Client\dtpd.exe -service [?]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM REG_MULTI_SZ WINRM
.
Inhalt des "geplante Tasks" Ordners
.
.
——- Zusätzlicher Suchlauf ——-
.
IE: An OneNote s&enden - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
LSP: c:\programme\VMware\VMware Player\vsocklib.dll
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\dokumente und einstellungen\winter\Anwendungsdaten\Mozilla\Firefox\Profiles\urhlj6ys.default\
.
.
——- Dateityp-Verknüpfung ——-
.
txtfile="c:\programme\PSPad editor\PSPad.exe" "%1"
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
AddRemove-Nmap - c:\programme\Nmap\uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-01-11 07:47
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse…
.
Scanne versteckte Autostarteinträge…
.
Scanne versteckte Dateien…
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
——————— Durch laufende Prozesse gestartete DLLs ———————
.
- - - - - - - > 'winlogon.exe'(1804)
c:\windows\system32\vrlogon.dll
c:\programme\ThinkVantage Fingerprint Software\psqlpwd.dll
c:\programme\ThinkVantage Fingerprint Software\homefus2.dll
c:\programme\ThinkVantage Fingerprint Software\infql2.dll
c:\programme\ThinkVantage Fingerprint Software\homepass.dll
c:\programme\ThinkVantage Fingerprint Software\bio.dll
c:\programme\ThinkVantage Fingerprint Software\qlbase.dll
c:\programme\ThinkVantage Fingerprint Software\ps2css.dll
c:\programme\Lenovo\HOTKEY\tphklock.dll
c:\programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
.
- - - - - - - > 'lsass.exe'(1860)
c:\programme\ThinkVantage Fingerprint Software\psqlpwd.dll
c:\programme\ThinkVantage Fingerprint Software\homefus2.dll
c:\programme\ThinkVantage Fingerprint Software\infql2.dll
c:\programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
c:\programme\ThinkVantage Fingerprint Software\qlbase.dll
.
- - - - - - - > 'explorer.exe'(4804)
c:\programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
c:\windows\system32\nview.dll
c:\windows\system32\NVWRSDE.DLL
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\btncopy.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Weitere laufende Prozesse ————————
.
c:\windows\system32\ibmpmsvc.exe
c:\programme\Intel\WiFi\bin\S24EvMon.exe
c:\programme\Lenovo\ATK Hotkey\GFNEXSrv.exe
c:\windows\System32\SCardSvr.exe
c:\windows\system32\acs.exe
c:\programme\Avira\AntiVir Desktop\avguard.exe
c:\programme\Intel\WiFi\bin\EvtEng.exe
c:\programme\ShrewSoft\VPN Client\iked.exe
c:\programme\ShrewSoft\VPN Client\ipsecd.exe
c:\programme\Java\jre6\bin\jqs.exe
c:\programme\NTP\bin\ntpd.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\system32\nvsvc32.exe
c:\programme\Gemeinsame Dateien\Intel\WirelessCommon\RegSrvc.exe
c:\programme\Lenovo\System Update\SUService.exe
c:\programme\Gemeinsame Dateien\Lenovo\tvt_reg_monitor_svc.exe
c:\programme\Avira\AntiVir Desktop\avshadow.exe
c:\programme\Gemeinsame Dateien\Lenovo\Scheduler\tvtsched.exe
c:\programme\VMware\VMware Player\vmware-authd.exe
c:\windows\system32\vmnat.exe
c:\windows\system32\vmnetdhcp.exe
c:\windows\system32\TpShocks.exe
c:\programme\Lenovo\HOTKEY\TPONSCR.exe
c:\programme\Lenovo\Zoom\TpScrex.exe
c:\programme\ThinkPad\Bluetooth Software\bin\btwdins.exe
c:\programme\PC Connectivity Solution\ServiceLayer.exe
c:\programme\PC Connectivity Solution\Transports\NclUSBSrv.exe
c:\programme\PC Connectivity Solution\Transports\NclMSBTSrv.exe
c:\programme\PC Connectivity Solution\Transports\NclBCBTSrv.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-01-11 07:51:27 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2012-01-11 06:51
.
Vor Suchlauf: 10 Verzeichnis(se), 23.034.281.984 Bytes frei
Nach Suchlauf: 12 Verzeichnis(se), 24.268.787.712 Bytes frei
.
WindowsXP-KB310994-SP2-Pro-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - 1574E58B6689808B80995BAD0B6C0A0A
Post #6
Hi,

Please do the following:

Please download Malwarebytes' Anti-Malware
  • Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected. <– very important
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.



NEXT


Go here to run an online scanner from ESET.
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activeX control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
  • Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
  • Click Scan
  • Wait for the scan to finish
  • When the scan completes, press the LIST OF THREATS FOUND button
  • Press EXPORT TO TEXT FILE , name the file ESETSCAN and save it to your desktop
  • Include the contents of this report in your next reply.
  • Press the BACK button.
  • Press Finish
Post #7
Now all the users are blocked. What happend was: I downloaded MBAM, installed and followed your instructions (I was logged on as a user with admin rights). When I pressed the "Scan"-Button, the system was blocked and remaind so. I waited for an hour or so, but nothing happend. I turned off the computer and started again, windows still came up, I could login (later I tried: login is still possible with all defined users), the desktop came up. Soon after that the system got blocked and remained so. No reaction to mouse or keyboard. Any idea?
Post #8
try booting into safe mode,

run rkill first to disable to bad process


To Enter Safemode
  • Go to Start> Shut off your Computer> Restart
  • As the computer starts to boot-up, Tap the F8 KEY repeatedly,
  • this will bring up a menu.
  • Use the Up and Down Arrow Keys to scroll up to Safemode
  • Then press the Enter Key on your Keyboard
  • go into your usual account


Please download and run the following tool to help allow other programs to run. (courtesy of BleepingComputer.com)
There are 4 different versions. If one of them won't run then download and try to run the other one.
Vista and Win7 users need to right click and choose Run as Admin
You only need to get one of them to run, not all of them.

Link 1
Link 2
Link 3
Link 4



Note:

You will likely see a message from this rogue telling you the file is infected. Ignore the message. Leave the message OPEN, do not close the message. Run rkill repeatedly until it's able to do it's job. This may take a few tries. You'll be able to tell rkill has done it's job when your desktop (explorer.exe) cycles off and then on again.

At this point, you should now be able to run the tools.
Post #9
Hi CatByte, I'm sorry to have to tell you that I brought the laptop to the slaughterer. He will get me the contents of the hard disk and then build up the operation system from scratch. Again, I'm sorry for interrupting this here so crude, but I felt I have not the patience to go on. Thanks again, Fred
Post #10
that's OK, sometimes a reformat is the only sure way to eradicate an infection and at least you have a nice fresh install to build from again. Good luck

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI